mirror of
https://github.com/wownero/wowlet.git
synced 2026-10-17 07:11:29 +02:00
build: macos codesigning
This commit is contained in:
tobtoht
@@ -7,3 +7,9 @@
|
||||
[submodule "external/feather-docs"]
|
||||
path = external/feather-docs
|
||||
url = https://github.com/feather-wallet/feather-docs.git
|
||||
[submodule "external/feather-sigs"]
|
||||
path = external/feather-sigs
|
||||
url = https://github.com/feather-wallet/feather-sigs.git
|
||||
[submodule "external/feather-codesigning"]
|
||||
path = external/feather-codesigning
|
||||
url = https://github.com/feather-wallet/feather-codesigning.git
|
||||
|
||||
+1
-1
@@ -64,7 +64,7 @@ if(STATIC)
|
||||
endif()
|
||||
|
||||
include(CMakePackageConfigHelpers)
|
||||
include(VersionFeather)
|
||||
configure_file("cmake/config-feather.h.cmake" "${CMAKE_CURRENT_SOURCE_DIR}/src/config-feather.h")
|
||||
|
||||
#### Dependencies ####
|
||||
# Monero
|
||||
|
||||
@@ -1,14 +1,11 @@
|
||||
build:
|
||||
@./contrib/guix/guix-build
|
||||
|
||||
codesign:
|
||||
@./contrib/guix/guix-codesign
|
||||
|
||||
attest:
|
||||
@./contrib/guix/guix-attest
|
||||
|
||||
verify:
|
||||
@./contrib/guix/guix-attest
|
||||
@./contrib/guix/guix-verify
|
||||
|
||||
clean:
|
||||
@./contrib/guix/guix-clean
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
set(QRC_LIST)
|
||||
|
||||
if (TOR_DIR)
|
||||
FILE(GLOB TOR_FILES LIST_DIRECTORIES false ${TOR_DIR}/*)
|
||||
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
# SPDX-License-Identifier: BSD-3-Clause
|
||||
# SPDX-FileCopyrightText: 2020-2023 The Monero Project
|
||||
|
||||
find_package(Git QUIET)
|
||||
|
||||
# Sets FEATHER_COMMIT to the first 9 chars of the current commit hash.
|
||||
|
||||
if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/githash.txt")
|
||||
# This file added in source archives where the .git folder has been removed to optimize for space.
|
||||
file(READ "githash.txt" COMMIT)
|
||||
string(SUBSTRING ${COMMIT} 0 9 COMMIT)
|
||||
message(STATUS "You are currently on commit ${COMMIT}")
|
||||
set(FEATHER_COMMIT "${COMMIT}")
|
||||
else()
|
||||
execute_process(COMMAND "${GIT_EXECUTABLE}" rev-parse --short=9 HEAD RESULT_VARIABLE RET OUTPUT_VARIABLE COMMIT OUTPUT_STRIP_TRAILING_WHITESPACE)
|
||||
|
||||
if(RET)
|
||||
message(WARNING "Cannot determine current commit. Make sure that you are building either from a Git working tree or from a source archive.")
|
||||
set(FEATHER_COMMIT "unknown")
|
||||
else()
|
||||
string(SUBSTRING ${COMMIT} 0 9 COMMIT)
|
||||
message(STATUS "You are currently on commit ${COMMIT}")
|
||||
set(FEATHER_COMMIT "${COMMIT}")
|
||||
endif()
|
||||
endif()
|
||||
|
||||
configure_file("cmake/config-feather.h.cmake" "${CMAKE_CURRENT_SOURCE_DIR}/src/config-feather.h")
|
||||
@@ -2,7 +2,6 @@
|
||||
#define FEATHER_VERSION_H
|
||||
|
||||
#define FEATHER_VERSION "@PROJECT_VERSION@"
|
||||
#define FEATHER_COMMIT "@FEATHER_COMMIT@"
|
||||
|
||||
#define TOR_VERSION "@TOR_VERSION@"
|
||||
|
||||
|
||||
@@ -118,7 +118,7 @@ env GUIX_SIGS_REPO=<path/to/feather-sigs> SIGNER=<gpg-key-fingerprint>=<gh_usern
|
||||
See `./contrib/guix/guix-attest --help` for more information on the various ways
|
||||
`guix-attest` can be invoked.
|
||||
|
||||
For a step-by-step walkthrough, see: https://paste.debian.net/plainh/2457c02c. Make sure to replace the version number
|
||||
For a step-by-step walkthrough, see: https://paste.debian.net/plainh/dfecbbcc. Make sure to replace the version number
|
||||
with the version you want to build.
|
||||
|
||||
## Verifying build output attestations
|
||||
|
||||
+21
-91
@@ -39,50 +39,29 @@ cmd_usage() {
|
||||
cat <<EOF
|
||||
Synopsis:
|
||||
|
||||
env GUIX_SIGS_REPO=<path/to/feather-sigs> \\
|
||||
SIGNER=GPG_KEY_NAME[=SIGNER_NAME] \\
|
||||
env SIGNER=GPG_KEY_NAME[=SIGNER_NAME] \\
|
||||
[ NO_SIGN=1 ]
|
||||
./contrib/guix/guix-attest
|
||||
|
||||
Example w/o overriding signing name:
|
||||
|
||||
env GUIX_SIGS_REPO=/home/user/feather-sigs \\
|
||||
SIGNER=achow101 \\
|
||||
env SIGNER=achow101 \\
|
||||
./contrib/guix/guix-attest
|
||||
|
||||
Example overriding signing name:
|
||||
|
||||
env GUIX_SIGS_REPO=/home/user/feather-sigs \\
|
||||
SIGNER=0x96AB007F1A7ED999=dongcarl \\
|
||||
env SIGNER=0x96AB007F1A7ED999=dongcarl \\
|
||||
./contrib/guix/guix-attest
|
||||
|
||||
Example w/o signing, just creating SHA256SUMS:
|
||||
|
||||
env GUIX_SIGS_REPO=/home/user/feather-sigs \\
|
||||
SIGNER=achow101 \\
|
||||
env SIGNER=achow101 \\
|
||||
NO_SIGN=1 \\
|
||||
./contrib/guix/guix-attest
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
if [ -z "${GUIX_SIGS_REPO}" ]; then
|
||||
echo "[HINT] Fork and clone the feather-sigs repo, if you haven't already:"
|
||||
echo "https://github.com/feather-wallet/feather-sigs"
|
||||
echo ""
|
||||
|
||||
printf "Enter path to 'feather-sigs' repo: "
|
||||
read -r repo
|
||||
|
||||
if [ ! -d "${repo}" ]; then
|
||||
echo "ERR: directory does not exist"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
export GUIX_SIGS_REPO="$repo"
|
||||
wizard=1
|
||||
fi
|
||||
|
||||
if [ -z "${SIGNER}" ]; then
|
||||
printf "Enter your GitHub username: "
|
||||
read -r signer
|
||||
@@ -108,28 +87,10 @@ fi
|
||||
if [ -n "$wizard" ]; then
|
||||
echo ""
|
||||
echo "Next time, invoke this command as:"
|
||||
echo "env GUIX_SIGS_REPO=${GUIX_SIGS_REPO} SIGNER=${SIGNER} make attest"
|
||||
echo "env SIGNER=${SIGNER} make attest"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
################
|
||||
# GUIX_SIGS_REPO should exist as a directory
|
||||
################
|
||||
|
||||
if [ ! -d "$GUIX_SIGS_REPO" ]; then
|
||||
cat << EOF
|
||||
ERR: The specified GUIX_SIGS_REPO is not an existent directory:
|
||||
|
||||
'$GUIX_SIGS_REPO'
|
||||
|
||||
Hint: Please clone the feather-sigs repository and point to it with the
|
||||
GUIX_SIGS_REPO environment variable.
|
||||
|
||||
EOF
|
||||
cmd_usage
|
||||
exit 1
|
||||
fi
|
||||
|
||||
################
|
||||
# The key specified in SIGNER should be usable
|
||||
################
|
||||
@@ -154,19 +115,15 @@ shopt -s nullglob
|
||||
sha256sum_fragments=( "$LOGDIR_BASE"/*/SHA256SUMS.part ) # This expands to an array of directories...
|
||||
shopt -u nullglob
|
||||
|
||||
noncodesigned_fragments=()
|
||||
codesigned_fragments=()
|
||||
fragments=()
|
||||
|
||||
if (( ${#sha256sum_fragments[@]} )); then
|
||||
echo "Found build output SHA256SUMS fragments:"
|
||||
for logdir in "${sha256sum_fragments[@]}"; do
|
||||
echo " '$logdir'"
|
||||
case "$logdir" in
|
||||
"$LOGDIR_BASE"/*-codesigned/SHA256SUMS.part)
|
||||
codesigned_fragments+=("$logdir")
|
||||
;;
|
||||
*)
|
||||
noncodesigned_fragments+=("$logdir")
|
||||
fragments+=("$logdir")
|
||||
;;
|
||||
esac
|
||||
done
|
||||
@@ -223,67 +180,40 @@ basenameify_SHA256SUMS() {
|
||||
sed -E 's@(^[[:xdigit:]]{64}[[:space:]]+).+/([^/]+$)@\1\2@'
|
||||
}
|
||||
|
||||
outsigdir="$GUIX_SIGS_REPO/$VERSION/$signer_name"
|
||||
outsigdir="external/feather-sigs/$VERSION/$signer_name"
|
||||
mkdir -p "$outsigdir"
|
||||
(
|
||||
cd "$outsigdir"
|
||||
|
||||
temp_noncodesigned="$(mktemp)"
|
||||
trap 'rm -rf -- "$temp_noncodesigned"' EXIT
|
||||
temp_file="$(mktemp)"
|
||||
trap 'rm -rf -- "$temp_file"' EXIT
|
||||
|
||||
if (( ${#noncodesigned_fragments[@]} )); then
|
||||
cat "${noncodesigned_fragments[@]}" \
|
||||
if (( ${#fragments[@]} )); then
|
||||
cat "${fragments[@]}" \
|
||||
| sort -u \
|
||||
| basenameify_SHA256SUMS \
|
||||
| sort -k2 \
|
||||
> "$temp_noncodesigned"
|
||||
if [ -e noncodesigned.SHA256SUMS ]; then
|
||||
# The SHA256SUMS already exists, make sure it's exactly what we
|
||||
# expect, error out if not
|
||||
if diff -u noncodesigned.SHA256SUMS "$temp_noncodesigned"; then
|
||||
echo "A noncodesigned.SHA256SUMS file already exists for '${VERSION}' and is up-to-date."
|
||||
else
|
||||
shasum_already_exists noncodesigned.SHA256SUMS
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
mv "$temp_noncodesigned" noncodesigned.SHA256SUMS
|
||||
fi
|
||||
else
|
||||
echo "ERR: No noncodesigned outputs found for '${VERSION}', exiting..."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
temp_all="$(mktemp)"
|
||||
trap 'rm -rf -- "$temp_all"' EXIT
|
||||
|
||||
if (( ${#codesigned_fragments[@]} )); then
|
||||
# Note: all.SHA256SUMS attests to all of $sha256sum_fragments, but is
|
||||
# not needed if there are no $codesigned_fragments
|
||||
cat "${sha256sum_fragments[@]}" \
|
||||
| sort -u \
|
||||
| basenameify_SHA256SUMS \
|
||||
| sort -k2 \
|
||||
> "$temp_all"
|
||||
> "$temp_file"
|
||||
if [ -e all.SHA256SUMS ]; then
|
||||
# The SHA256SUMS already exists, make sure it's exactly what we
|
||||
# expect, error out if not
|
||||
if diff -u all.SHA256SUMS "$temp_all"; then
|
||||
echo "An all.SHA256SUMS file already exists for '${VERSION}' and is up-to-date."
|
||||
if diff -u all.SHA256SUMS "$temp_file"; then
|
||||
echo "A SHA256SUMS file already exists for '${VERSION}' and is up-to-date."
|
||||
else
|
||||
shasum_already_exists all.SHA256SUMS
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
mv "$temp_all" all.SHA256SUMS
|
||||
mv "$temp_file" all.SHA256SUMS
|
||||
fi
|
||||
else
|
||||
# It is fine to have the codesigned outputs be missing (perhaps the
|
||||
# detached codesigs have not been published yet), just print a log
|
||||
# message instead of erroring out
|
||||
echo "INFO: No codesigned outputs found for '${VERSION}', skipping..."
|
||||
echo "ERR: No outputs found for '${VERSION}', exiting..."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
temp_all="$(mktemp)"
|
||||
trap 'rm -rf -- "$temp_all"' EXIT
|
||||
|
||||
if [ -z "$NO_SIGN" ]; then
|
||||
echo "Signing SHA256SUMS to produce SHA256SUMS.asc"
|
||||
for i in *.SHA256SUMS; do
|
||||
|
||||
@@ -446,6 +446,7 @@ EOF
|
||||
${ADDITIONAL_GUIX_COMMON_FLAGS} ${ADDITIONAL_GUIX_ENVIRONMENT_FLAGS} \
|
||||
-- env HOST="$HOST" \
|
||||
DISTNAME="$DISTNAME" \
|
||||
RELEASE="$RELEASE" \
|
||||
JOBS="$JOBS" \
|
||||
COMMIT_TIMESTAMP="${COMMIT_TIMESTAMP:?unable to determine value}" \
|
||||
${V:+V=1} \
|
||||
|
||||
@@ -1,341 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
export LC_ALL=C
|
||||
set -e -o pipefail
|
||||
|
||||
# Source the common prelude, which:
|
||||
# 1. Checks if we're at the top directory of the Feather Wallet repository
|
||||
# 2. Defines a few common functions and variables
|
||||
#
|
||||
# shellcheck source=libexec/prelude.bash
|
||||
source "$(dirname "${BASH_SOURCE[0]}")/libexec/prelude.bash"
|
||||
|
||||
|
||||
###################
|
||||
## SANITY CHECKS ##
|
||||
###################
|
||||
|
||||
################
|
||||
# Required non-builtin commands should be invocable
|
||||
################
|
||||
|
||||
check_tools cat mkdir git guix
|
||||
|
||||
################
|
||||
# Required env vars should be non-empty
|
||||
################
|
||||
|
||||
cmd_usage() {
|
||||
cat <<EOF
|
||||
Synopsis:
|
||||
|
||||
env GUIX_SIGS_REPO=<path/to/feather-sigs> \\
|
||||
./contrib/guix/guix-codesign
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
if [ -z "$GUIX_SIGS_REPO" ]; then
|
||||
echo "[HINT] Fork and clone the feather-sigs repo:"
|
||||
echo "https://github.com/feather-wallet/feather-sigs"
|
||||
echo ""
|
||||
|
||||
printf "Enter path to 'feather-sigs' repo: "
|
||||
read -r GUIX_SIGS_REPO
|
||||
|
||||
if [ ! -d "${GUIX_SIGS_REPO}" ]; then
|
||||
echo "Directory does not exist"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "Next time, invoke this command as:"
|
||||
echo "env GUIX_SIGS_REPO=${GUIX_SIGS_REPO} make codesign"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
################
|
||||
# GUIX_BUILD_OPTIONS should be empty
|
||||
################
|
||||
#
|
||||
# GUIX_BUILD_OPTIONS is an environment variable recognized by guix commands that
|
||||
# can perform builds. This seems like what we want instead of
|
||||
# ADDITIONAL_GUIX_COMMON_FLAGS, but the value of GUIX_BUILD_OPTIONS is actually
|
||||
# _appended_ to normal command-line options. Meaning that they will take
|
||||
# precedence over the command-specific ADDITIONAL_GUIX_<CMD>_FLAGS.
|
||||
#
|
||||
# This seems like a poor user experience. Thus we check for GUIX_BUILD_OPTIONS's
|
||||
# existence here and direct users of this script to use our (more flexible)
|
||||
# custom environment variables.
|
||||
if [ -n "$GUIX_BUILD_OPTIONS" ]; then
|
||||
cat << EOF
|
||||
Error: Environment variable GUIX_BUILD_OPTIONS is not empty:
|
||||
'$GUIX_BUILD_OPTIONS'
|
||||
|
||||
Unfortunately this script is incompatible with GUIX_BUILD_OPTIONS, please unset
|
||||
GUIX_BUILD_OPTIONS and use ADDITIONAL_GUIX_COMMON_FLAGS to set build options
|
||||
across guix commands or ADDITIONAL_GUIX_<CMD>_FLAGS to set build options for a
|
||||
specific guix command.
|
||||
|
||||
See contrib/guix/README.md for more details.
|
||||
EOF
|
||||
exit 1
|
||||
fi
|
||||
|
||||
################
|
||||
# The codesignature git worktree should not be dirty
|
||||
################
|
||||
|
||||
if ! git -C "$GUIX_SIGS_REPO" diff-index --quiet HEAD -- && [ -z "$FORCE_DIRTY_WORKTREE" ]; then
|
||||
cat << EOF
|
||||
ERR: The FEATHER SIGS git worktree is dirty, which may lead to broken builds.
|
||||
|
||||
Aborting...
|
||||
|
||||
Hint: To make your git worktree clean, You may want to:
|
||||
1. Commit your changes,
|
||||
2. Stash your changes, or
|
||||
3. Set the 'FORCE_DIRTY_WORKTREE' environment variable if you insist on
|
||||
using a dirty worktree
|
||||
EOF
|
||||
exit 1
|
||||
fi
|
||||
|
||||
################
|
||||
# Build directories should not exist
|
||||
################
|
||||
|
||||
# Default to building for all supported HOSTs (overridable by environment)
|
||||
export HOSTS="${HOSTS:-x86_64-w64-mingw32 x86_64-w64-mingw32.installer}"
|
||||
|
||||
# Usage: distsrc_for_host HOST
|
||||
#
|
||||
# HOST: The current platform triple we're building for
|
||||
#
|
||||
distsrc_for_host() {
|
||||
echo "${DISTSRC_BASE}/build/distsrc-${VERSION}-${1}-codesigned"
|
||||
}
|
||||
|
||||
# Accumulate a list of build directories that already exist...
|
||||
hosts_distsrc_exists=""
|
||||
for host in $HOSTS; do
|
||||
if [ -e "$(distsrc_for_host "$host")" ]; then
|
||||
hosts_distsrc_exists+=" ${host}"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$hosts_distsrc_exists" ]; then
|
||||
# ...so that we can print them out nicely in an error message
|
||||
cat << EOF
|
||||
ERR: Build directories for this commit already exist for the following platform
|
||||
triples you're attempting to build, probably because of previous builds.
|
||||
Please remove, or otherwise deal with them prior to starting another build.
|
||||
|
||||
Aborting...
|
||||
|
||||
Hint: To blow everything away, you may want to use:
|
||||
|
||||
$ ./contrib/guix/guix-clean
|
||||
|
||||
Specifically, this will remove all files without an entry in the index,
|
||||
excluding the SDK directory, the depends download cache, the depends built
|
||||
packages cache, the garbage collector roots for Guix environments, and the
|
||||
output directory.
|
||||
EOF
|
||||
for host in $hosts_distsrc_exists; do
|
||||
echo " ${host} '$(distsrc_for_host "$host")'"
|
||||
done
|
||||
exit 1
|
||||
else
|
||||
mkdir -p "$DISTSRC_BASE"
|
||||
fi
|
||||
|
||||
|
||||
################
|
||||
# Unsigned files SHOULD exist
|
||||
################
|
||||
|
||||
# Usage: outdir_for_host HOST SUFFIX
|
||||
#
|
||||
# HOST: The current platform triple we're building for
|
||||
#
|
||||
outdir_for_host() {
|
||||
echo "${OUTDIR_BASE}/${1}${2:+-${2}}"
|
||||
}
|
||||
|
||||
# Usage: logdir_for_host HOST SUFFIX
|
||||
#
|
||||
# HOST: The current platform triple we're building for
|
||||
#
|
||||
logdir_for_host() {
|
||||
echo "${LOGDIR_BASE}/${1}${2:+-${2}}"
|
||||
}
|
||||
|
||||
unsigned_file_for_host() {
|
||||
case "$1" in
|
||||
*mingw32.installer)
|
||||
echo "$(outdir_for_host "$1")/FeatherWalletSetup-${VERSION}-unsigned.exe"
|
||||
;;
|
||||
*mingw32*)
|
||||
echo "$(outdir_for_host "$1")/${DISTNAME}-unsigned.exe"
|
||||
;;
|
||||
*)
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Accumulate a list of build directories that already exist...
|
||||
hosts_file_tarball_missing=""
|
||||
for host in $HOSTS; do
|
||||
if [ ! -e "$(unsigned_file_for_host "$host")" ]; then
|
||||
hosts_file_tarball_missing+=" ${host}"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -n "$hosts_file_tarball_missing" ]; then
|
||||
# ...so that we can print them out nicely in an error message
|
||||
cat << EOF
|
||||
ERR: Unsigned files do not exist
|
||||
...
|
||||
|
||||
EOF
|
||||
for host in $hosts_file_tarball_missing; do
|
||||
echo " ${host} '$(unsigned_file_for_host "$host")'"
|
||||
done
|
||||
exit 1
|
||||
fi
|
||||
|
||||
################
|
||||
# Check that we can connect to the guix-daemon
|
||||
################
|
||||
|
||||
cat << EOF
|
||||
Checking that we can connect to the guix-daemon...
|
||||
|
||||
Hint: If this hangs, you may want to try turning your guix-daemon off and on
|
||||
again.
|
||||
|
||||
EOF
|
||||
if ! guix gc --list-failures > /dev/null; then
|
||||
cat << EOF
|
||||
|
||||
ERR: Failed to connect to the guix-daemon, please ensure that one is running and
|
||||
reachable.
|
||||
EOF
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Developer note: we could use `guix repl` for this check and run:
|
||||
#
|
||||
# (import (guix store)) (close-connection (open-connection))
|
||||
#
|
||||
# However, the internal API is likely to change more than the CLI invocation
|
||||
|
||||
|
||||
#########
|
||||
# SETUP #
|
||||
#########
|
||||
|
||||
# Determine the maximum number of jobs to run simultaneously (overridable by
|
||||
# environment)
|
||||
JOBS="${JOBS:-$(nproc)}"
|
||||
|
||||
# Determine the reference time used for determinism (overridable by environment)
|
||||
SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(git -c log.showSignature=false log --format=%at -1)}"
|
||||
|
||||
# Make sure an output directory exists for our builds
|
||||
OUTDIR_BASE="${OUTDIR_BASE:-${VERSION_BASE}/output}"
|
||||
mkdir -p "$OUTDIR_BASE"
|
||||
|
||||
# Usage: profiledir_for_host HOST SUFFIX
|
||||
#
|
||||
# HOST: The current platform triple we're building for
|
||||
#
|
||||
profiledir_for_host() {
|
||||
echo "${PROFILES_BASE}/${1}${2:+-${2}}"
|
||||
}
|
||||
|
||||
#########
|
||||
# BUILD #
|
||||
#########
|
||||
|
||||
# Function to be called when codesigning for host ${1} and the user interrupts
|
||||
# the codesign
|
||||
int_trap() {
|
||||
cat << EOF
|
||||
** INT received while codesigning ${1}, you may want to clean up the relevant
|
||||
work directories (e.g. distsrc-*) before recodesigning
|
||||
|
||||
Hint: To blow everything away, you may want to use:
|
||||
|
||||
$ ./contrib/guix/guix-clean
|
||||
|
||||
Specifically, this will remove all files without an entry in the index,
|
||||
excluding the SDK directory, the depends download cache, the depends built
|
||||
packages cache, the garbage collector roots for Guix environments, and the
|
||||
output directory.
|
||||
EOF
|
||||
}
|
||||
|
||||
# shellcheck disable=SC2153
|
||||
for host in $HOSTS; do
|
||||
|
||||
# Display proper warning when the user interrupts the build
|
||||
trap 'int_trap ${host}' INT
|
||||
|
||||
(
|
||||
# Required for 'contrib/guix/manifest.scm' to output the right manifest
|
||||
# for the particular $HOST we're building for
|
||||
export HOST="$host"
|
||||
|
||||
# shellcheck disable=SC2030
|
||||
cat << EOF
|
||||
INFO: Codesigning ${VERSION:?not set} for platform triple ${HOST:?not set}:
|
||||
...using reference timestamp: ${SOURCE_DATE_EPOCH:?not set}
|
||||
...from worktree directory: '${PWD}'
|
||||
...bind-mounted in container to: '/feather'
|
||||
...in build directory: '$(distsrc_for_host "$HOST")'
|
||||
...bind-mounted in container to: '$(DISTSRC_BASE=/distsrc-base && distsrc_for_host "$HOST")'
|
||||
...outputting in: '$(outdir_for_host "$HOST" codesigned)'
|
||||
...bind-mounted in container to: '$(OUTDIR_BASE=/outdir-base && outdir_for_host "$HOST" codesigned)'
|
||||
...using detached signatures in: '${GUIX_SIGS_REPO:?not set}'
|
||||
...bind-mounted in container to: '/detached-sigs'
|
||||
EOF
|
||||
|
||||
# shellcheck disable=SC2086,SC2031
|
||||
time-machine shell --manifest="${PWD}/contrib/guix/manifest.scm" \
|
||||
--container \
|
||||
--pure \
|
||||
--no-cwd \
|
||||
--share="$PWD"=/feather \
|
||||
--share="$DISTSRC_BASE"=/distsrc-base \
|
||||
--share="$OUTDIR_BASE"=/outdir-base \
|
||||
--share="$LOGDIR_BASE"=/logdir-base \
|
||||
--share="$GUIX_SIGS_REPO"=/guix-sigs \
|
||||
--expose="$(git rev-parse --git-common-dir)" \
|
||||
--expose="$(git -C "$GUIX_SIGS_REPO" rev-parse --git-common-dir)" \
|
||||
${SOURCES_PATH:+--share="$SOURCES_PATH"} \
|
||||
--cores="$JOBS" \
|
||||
--keep-failed \
|
||||
--fallback \
|
||||
--link-profile \
|
||||
--user="user" \
|
||||
--root="$(profiledir_for_host "${HOST}" codesigned)" \
|
||||
${SUBSTITUTE_URLS:+--substitute-urls="$SUBSTITUTE_URLS"} \
|
||||
${ADDITIONAL_GUIX_COMMON_FLAGS} ${ADDITIONAL_GUIX_ENVIRONMENT_FLAGS} \
|
||||
-- env HOST="$host" \
|
||||
DISTNAME="$DISTNAME" \
|
||||
VERSION="$VERSION" \
|
||||
JOBS="$JOBS" \
|
||||
SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:?unable to determine value}" \
|
||||
${V:+V=1} \
|
||||
${SOURCES_PATH:+SOURCES_PATH="$SOURCES_PATH"} \
|
||||
DISTSRC="$(DISTSRC_BASE=/distsrc-base && distsrc_for_host "$HOST")" \
|
||||
OUTDIR="$(OUTDIR_BASE=/outdir-base && outdir_for_host "$HOST" codesigned)" \
|
||||
LOGDIR="$(LOGDIR_BASE=/logdir-base && logdir_for_host "$HOST" codesigned)" \
|
||||
GUIX_SIGS_REPO=/guix-sigs \
|
||||
UNSIGNED_FILE="$(OUTDIR_BASE=/outdir-base && unsigned_file_for_host "$HOST")" \
|
||||
bash -c "cd /feather && bash contrib/guix/libexec/codesign.sh"
|
||||
)
|
||||
|
||||
done
|
||||
@@ -35,6 +35,7 @@ cat << EOF
|
||||
Required environment variables as seen inside the container:
|
||||
DIST_ARCHIVE_BASE: ${DIST_ARCHIVE_BASE:?not set}
|
||||
DISTNAME: ${DISTNAME:?not set}
|
||||
RELEASE: ${RELEASE:?not set}
|
||||
HOST: ${HOST:?not set}
|
||||
COMMIT_TIMESTAMP: ${COMMIT_TIMESTAMP:?not set}
|
||||
JOBS: ${JOBS:?not set}
|
||||
@@ -44,8 +45,11 @@ Required environment variables as seen inside the container:
|
||||
OPTIONS: ${OPTIONS}
|
||||
EOF
|
||||
|
||||
mkdir -p ${DISTSRC}
|
||||
ln -s "${DISTSRC}" /distsrc
|
||||
|
||||
ACTUAL_OUTDIR="${OUTDIR}"
|
||||
OUTDIR="${DISTSRC}/output"
|
||||
OUTDIR="/distsrc/output"
|
||||
|
||||
# Use a fixed timestamp for depends builds so hashes match across commits that don't make changes to the build system
|
||||
export SOURCE_DATE_EPOCH=1397818193
|
||||
@@ -274,9 +278,8 @@ export USE_DEVICE_TREZOR_MANDATORY=1
|
||||
|
||||
# Make $HOST-specific native binaries from depends available in $PATH
|
||||
export PATH="${BASEPREFIX}/${HOST}/native/bin:${PATH}"
|
||||
mkdir -p "$DISTSRC"
|
||||
(
|
||||
cd "$DISTSRC"
|
||||
cd "/distsrc"
|
||||
|
||||
# Extract the source tarball
|
||||
tar --strip-components=1 -xf "${GIT_ARCHIVE}"
|
||||
@@ -284,7 +287,7 @@ mkdir -p "$DISTSRC"
|
||||
# Setup the directory where our Bitcoin Core build for HOST will be
|
||||
# installed. This directory will also later serve as the input for our
|
||||
# binary tarballs.
|
||||
INSTALLPATH="${DISTSRC}/installed"
|
||||
INSTALLPATH="/distsrc/installed"
|
||||
mkdir -p "${INSTALLPATH}"
|
||||
|
||||
|
||||
@@ -314,6 +317,9 @@ mkdir -p "$DISTSRC"
|
||||
*gnueabihf)
|
||||
CMAKEVARS+=" -DNO_AES=On" # Raspberry Pi
|
||||
;;
|
||||
*darwin*)
|
||||
CMAKEVARS+=" -DTOR_DIR=Off -DTOR_VERSION=Off"
|
||||
;;
|
||||
esac
|
||||
|
||||
# Configure this DISTSRC for $HOST
|
||||
@@ -401,9 +407,21 @@ mkdir -p "$DISTSRC"
|
||||
case "$HOST" in
|
||||
*darwin*)
|
||||
mv "feather.app" "Feather.app"
|
||||
mkdir -p Feather.app/Contents/bin
|
||||
cp -a /feather/contrib/depends/${HOST}/Tor/libevent-2.1.7.dylib Feather.app/Contents/bin
|
||||
cp -a /feather/contrib/depends/${HOST}/Tor/tor Feather.app/Contents/bin
|
||||
;;
|
||||
esac
|
||||
|
||||
# Code-signing
|
||||
if [ "$RELEASE" -ne 0 ]; then
|
||||
case "$HOST" in
|
||||
*darwin*)
|
||||
signapple apply Feather.app "/distsrc/external/feather-codesigning/signatures/${HOST}/Feather.app"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# Finally, deterministically produce {non-,}debug binary tarballs ready
|
||||
# for release
|
||||
case "$HOST" in
|
||||
|
||||
@@ -1,115 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Copyright (c) 2021-2022 The Bitcoin Core developers
|
||||
# Copyright (c) 2024-2024 The Monero Project
|
||||
# Distributed under the MIT software license, see the accompanying
|
||||
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
||||
export LC_ALL=C
|
||||
set -e -o pipefail
|
||||
export TZ=UTC
|
||||
|
||||
# Although Guix _does_ set umask when building its own packages (in our case,
|
||||
# this is all packages in manifest.scm), it does not set it for `guix
|
||||
# shell`. It does make sense for at least `guix shell --container`
|
||||
# to set umask, so if that change gets merged upstream and we bump the
|
||||
# time-machine to a commit which includes the aforementioned change, we can
|
||||
# remove this line.
|
||||
#
|
||||
# This line should be placed before any commands which creates files.
|
||||
umask 0022
|
||||
|
||||
if [ -n "$V" ]; then
|
||||
# Print both unexpanded (-v) and expanded (-x) forms of commands as they are
|
||||
# read from this file.
|
||||
set -vx
|
||||
# Set VERBOSE for CMake-based builds
|
||||
export VERBOSE="$V"
|
||||
fi
|
||||
|
||||
# Check that required environment variables are set
|
||||
cat << EOF
|
||||
Required environment variables as seen inside the container:
|
||||
UNSIGNED_FILE: ${UNSIGNED_FILE:?not set}
|
||||
GUIX_SIGS_REPO: ${GUIX_SIGS_REPO:?not set}
|
||||
DISTNAME: ${DISTNAME:?not set}
|
||||
VERSION: ${VERSION:?not set}
|
||||
HOST: ${HOST:?not set}
|
||||
SOURCE_DATE_EPOCH: ${SOURCE_DATE_EPOCH:?not set}
|
||||
DISTSRC: ${DISTSRC:?not set}
|
||||
OUTDIR: ${OUTDIR:?not set}
|
||||
LOGDIR: ${LOGDIR:?not set}
|
||||
EOF
|
||||
|
||||
ACTUAL_OUTDIR="${OUTDIR}"
|
||||
OUTDIR="${DISTSRC}/output"
|
||||
|
||||
git_head_version() {
|
||||
local recent_tag
|
||||
if recent_tag="$(git -C "$1" describe --exact-match HEAD 2> /dev/null)"; then
|
||||
echo "${recent_tag#v}"
|
||||
else
|
||||
git -C "$1" rev-parse --short=12 HEAD
|
||||
fi
|
||||
}
|
||||
|
||||
mkdir -p "$OUTDIR"
|
||||
|
||||
mkdir -p "$DISTSRC"
|
||||
(
|
||||
cd "$DISTSRC"
|
||||
|
||||
case "$HOST" in
|
||||
*mingw32*)
|
||||
infile_base="$(basename "$UNSIGNED_FILE")"
|
||||
outfile_base="${infile_base/-unsigned}"
|
||||
|
||||
# Codesigned *-unsigned.exe and output to OUTDIR
|
||||
osslsigncode attach-signature \
|
||||
-in "$UNSIGNED_FILE" \
|
||||
-out "${OUTDIR}/$outfile_base" \
|
||||
-CAfile "$GUIX_ENVIRONMENT/etc/ssl/certs/ca-certificates.crt" \
|
||||
-sigin /guix-sigs/codesignatures/"${VERSION}"/"$outfile_base".pem
|
||||
;;
|
||||
*)
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
) # $DISTSRC
|
||||
|
||||
|
||||
(
|
||||
cd "$OUTDIR"
|
||||
|
||||
case "$HOST" in
|
||||
*mingw32.installer)
|
||||
find . -print0 \
|
||||
| xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
|
||||
find . \
|
||||
| sort \
|
||||
| zip -X@ "${OUTDIR}/${DISTNAME}-win-installer.zip" \
|
||||
|| ( rm -f "${OUTDIR}/${DISTNAME}-win-installer.zip" && exit 1 )
|
||||
;;
|
||||
*mingw32*)
|
||||
find . -print0 \
|
||||
| xargs -0r touch --no-dereference --date="@${SOURCE_DATE_EPOCH}"
|
||||
find . \
|
||||
| sort \
|
||||
| zip -X@ "${OUTDIR}/${DISTNAME}-win.zip" \
|
||||
|| ( rm -f "${OUTDIR}/${DISTNAME}-win.zip" && exit 1 )
|
||||
;;
|
||||
esac
|
||||
)
|
||||
|
||||
rm -rf "$ACTUAL_OUTDIR"
|
||||
mv --no-target-directory "$OUTDIR" "$ACTUAL_OUTDIR" \
|
||||
|| ( rm -rf "$ACTUAL_OUTDIR" && exit 1 )
|
||||
|
||||
(
|
||||
cd /outdir-base
|
||||
mkdir -p "$LOGDIR"/codesigned
|
||||
{
|
||||
find "$ACTUAL_OUTDIR" -type f
|
||||
} | xargs realpath --relative-base="$PWD" \
|
||||
| xargs sha256sum \
|
||||
| sort -k2 \
|
||||
| sponge "$LOGDIR"/SHA256SUMS.part
|
||||
)
|
||||
@@ -67,6 +67,7 @@ time-machine() {
|
||||
|
||||
VERSION="${FORCE_VERSION:-$(git_head_version)}"
|
||||
DISTNAME="${DISTNAME:-feather-${VERSION}}"
|
||||
RELEASE="$(is_release)"
|
||||
|
||||
VERSION_BASE_DIR="${VERSION_BASE_DIR:-${PWD}}"
|
||||
version_base_prefix="${VERSION_BASE_DIR}/guix/guix-build-"
|
||||
|
||||
@@ -7,8 +7,20 @@ git_root() {
|
||||
git_head_version() {
|
||||
local recent_tag
|
||||
if recent_tag="$(git describe --exact-match HEAD 2> /dev/null)"; then
|
||||
echo "${recent_tag#v}"
|
||||
echo "${recent_tag%-rc}"
|
||||
else
|
||||
git rev-parse --short=12 HEAD
|
||||
fi
|
||||
}
|
||||
|
||||
is_release() {
|
||||
local recent_tag
|
||||
if recent_tag="$(git describe --exact-match HEAD 2> /dev/null)"; then
|
||||
if [[ "$recent_tag" == *"-rc" ]]; then
|
||||
echo -n "0"
|
||||
fi
|
||||
echo -n "1"
|
||||
else
|
||||
echo -n "0"
|
||||
fi
|
||||
}
|
||||
|
||||
+1
Submodule external/feather-codesigning added at 9dc358787e
+1
Submodule external/feather-sigs added at 91aef404e5
@@ -1,4 +1,4 @@
|
||||
Feather <feather_version> (<feather_git_head>)
|
||||
Feather <feather_version>
|
||||
|
||||
Copyright (c) 2020-<current_year>, The Monero Project
|
||||
|
||||
|
||||
@@ -21,7 +21,6 @@ AboutDialog::AboutDialog(QWidget *parent)
|
||||
auto about = Utils::fileOpenQRC(":assets/about.txt");
|
||||
auto about_text = Utils::barrayToString(about);
|
||||
about_text = about_text.replace("<feather_version>", FEATHER_VERSION);
|
||||
about_text = about_text.replace("<feather_git_head>", FEATHER_COMMIT);
|
||||
about_text = about_text.replace("<current_year>", QString::number(QDate::currentDate().year()));
|
||||
ui->copyrightText->setPlainText(about_text);
|
||||
|
||||
|
||||
@@ -48,7 +48,7 @@ void DebugInfoDialog::updateInfo() {
|
||||
else
|
||||
torStatus = "Unknown";
|
||||
|
||||
ui->label_featherVersion->setText(QString("%1-%2").arg(FEATHER_VERSION, FEATHER_COMMIT));
|
||||
ui->label_featherVersion->setText(QString("%1").arg(FEATHER_VERSION));
|
||||
|
||||
ui->label_walletHeight->setText(QString::number(m_wallet->blockChainHeight()));
|
||||
ui->label_daemonHeight->setText(QString::number(m_wallet->daemonBlockChainHeight()));
|
||||
|
||||
+1
-1
@@ -49,7 +49,7 @@ void signal_handler(int signum) {
|
||||
if (conf()->get(Config::writeStackTraceToDisk).toBool()) {
|
||||
QString crashLogPath{Config::defaultConfigDir().path() + "/crash_report.txt"};
|
||||
std::ofstream out(crashLogPath.toStdString());
|
||||
out << QString("Version: %1-%2\n").arg(FEATHER_VERSION, FEATHER_COMMIT).toStdString();
|
||||
out << QString("Version: %1\n").arg(FEATHER_VERSION).toStdString();
|
||||
out << QString("OS: %1\n").arg(QSysInfo::prettyProductName()).toStdString();
|
||||
out << keyStream.str();
|
||||
out.close();
|
||||
|
||||
Reference in New Issue
Block a user