Skip to content

Commit 6c4e3e1

Browse files
csasarakcsasarak
authored
Fix Mac ARM release process (#1428)
* Reapply "Add Mac arm64 executable (#1426)" (#1429) This reverts commit 36e62bb. * Zip up the right archive. * Try adding an entitlement. * Explicitly install xz. * try entitlements. * Move entitlements arg. * Fix condition * wip * Only use entitlements for arm64. * Use correct equality. * Restore full conditional. * Fix conditional
1 parent c43e2e3 commit 6c4e3e1

File tree

6 files changed

+77
-23
lines changed

6 files changed

+77
-23
lines changed

‎.github/entitlements.plist

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.disable-library-validation</key>
6+
<true/>
7+
</dict>
8+
</plist>

‎.github/workflows/build-all.yml

+37-17
Original file line numberDiff line numberDiff line change
@@ -19,16 +19,17 @@ jobs:
1919

2020
strategy:
2121
matrix:
22-
os: ['windows-latest', 'ubuntu-latest', 'macos-12']
22+
os: ['windows-latest', 'ubuntu-latest', 'macos-12', 'macos-latest']
2323
include:
2424
- os: ubuntu-latest
2525
os-name: Linux
2626
container: fossa/haskell-static-alpine:ghc-9.4.8
2727
project-file: cabal.project.ci.linux
2828
ghc: '9.4.8'
2929

30+
# macos-latest pointed at macos-12 this before it was changed to ARM.
3031
- os: macos-12
31-
os-name: macOS
32+
os-name: macOS-intel
3233
project-file: cabal.project.ci.macos
3334
ghc: '9.4.8'
3435

@@ -37,6 +38,11 @@ jobs:
3738
project-file: cabal.project.ci.windows
3839
ghc: '9.4.8'
3940

41+
- os: macos-latest
42+
os-name: macOS-arm64
43+
project-file: cabal.project.ci.macos
44+
ghc: '9.4.8'
45+
4046
steps:
4147

4248
- uses: actions/checkout@v4
@@ -134,22 +140,22 @@ jobs:
134140
name: Cache cabal store
135141
with:
136142
path: ${{ steps.setup-haskell.outputs.cabal-store || '~/.local/state/cabal' }}
137-
key: ${{ runner.os }}-${{ matrix.ghc }}-cabal-cache-${{ steps.compute-cache-key.outputs.cabal-cache-key }}
143+
key: ${{ matrix.os-name }}-${{ matrix.ghc }}-cabal-cache-${{ steps.compute-cache-key.outputs.cabal-cache-key }}
138144
restore-keys: |
139-
${{ runner.os }}-${{ matrix.ghc }}-cabal-cache-
140-
${{ runner.os }}-${{ matrix.ghc }}-
141-
${{ runner.os }}-
145+
${{ matrix.os-name }}-${{ matrix.ghc }}-cabal-cache-
146+
${{ matrix.os-name }}-${{ matrix.ghc }}-
147+
${{ matrix.os-name }}-
142148
143149
- uses: actions/cache@v4
144150
name: Cache dist-newstyle
145151
with:
146152
path: ${{ github.workspace }}/dist-newstyle
147-
key: ${{ runner.os }}-${{ env.GHC_VERSION }}-dist-newstyle-${{ github.sha }}
153+
key: ${{ matrix.os-name }}-${{ env.GHC_VERSION }}-dist-newstyle-${{ github.sha }}
148154
restore-keys: |
149-
${{ runner.os }}-${{ env.GHC_VERSION }}-dist-newstyle-${{ env.parent_commit }}
150-
${{ runner.os }}-${{ env.GHC_VERSION }}-dist-newstyle-
151-
${{ runner.os }}-${{ env.GHC_VERSION }}-
152-
${{ runner.os }}-
155+
${{ matrix.os-name }}-${{ env.GHC_VERSION }}-dist-newstyle-${{ env.parent_commit }}
156+
${{ matrix.os-name }}-${{ env.GHC_VERSION }}-dist-newstyle-
157+
${{ matrix.os-name }}-${{ env.GHC_VERSION }}-
158+
${{ matrix.os-name }}-
153159
154160
- name: Update vendored binaries
155161
run: |
@@ -224,6 +230,7 @@ jobs:
224230
APPLE_NOTARIZATION_DEV_PASS: ${{ secrets.APPLE_NOTARIZATION_DEV_PASS }}
225231
APPLE_NOTARIZATION_DEV_ID: ${{ secrets.APPLE_NOTARIZATION_DEV_ID }}
226232
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
233+
OS_NAME: ${{ matrix.os-name }}
227234
run: |
228235
# create variables
229236
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
@@ -241,10 +248,18 @@ jobs:
241248
security import $CERTIFICATE_PATH -P "$MACOS_BUILD_CERT_P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
242249
security list-keychain -d user -s $KEYCHAIN_PATH
243250
251+
244252
chmod +x release/*
245253
# '--options runtime' enables the hardened runtime: https://developer.apple.com/documentation/security/hardened_runtime
254+
# On Apple Silicon there doesn't seem to be a default liblzma, and the one installed via homebrew is rejected.
255+
# The entitlement line will relax that check.
246256
# The hardened runtime is required for notarization.
247-
codesign --options runtime -s 'FOSSA, Inc.' release/fossa
257+
if [ "$OS_NAME" = "macOS-arm64" ] ; then
258+
codesign --entitlements .github/entitlements.plist --options runtime -s 'FOSSA, Inc.' release/fossa
259+
else
260+
# Intel does not need the entitlement to run liblzma, which is included in the base system.
261+
codesign --options runtime -s 'FOSSA, Inc.' release/fossa
262+
fi
248263
codesign --options runtime -s 'FOSSA, Inc.' release/diagnose
249264
codesign --options runtime -s 'FOSSA, Inc.' release/millhone
250265
@@ -260,7 +275,7 @@ jobs:
260275
261276
- uses: actions/upload-artifact@v4
262277
with:
263-
name: ${{ runner.os }}-binaries
278+
name: ${{ matrix.os-name }}-binaries
264279
path: release
265280

266281
create-release:
@@ -367,10 +382,14 @@ jobs:
367382
gzip "$LINUX_DIAGNOSE_TAR_PATH"
368383
gzip "$LINUX_MILLHONE_TAR_PATH"
369384
370-
chmod +x macOS-binaries/*
371-
zip -j release/fossa_${{ steps.get-version.outputs.VERSION }}_darwin_amd64.zip macOS-binaries/fossa
372-
zip -j release/diagnose_${{ steps.get-version.outputs.VERSION }}_darwin_amd64.zip macOS-binaries/diagnose
373-
zip -j release/millhone_${{ steps.get-version.outputs.VERSION }}_darwin_amd64.zip macOS-binaries/millhone
385+
chmod +x macOS-intel-binaries/*
386+
zip -j release/fossa_${{ steps.get-version.outputs.VERSION }}_darwin_amd64.zip macOS-intel-binaries/fossa
387+
zip -j release/diagnose_${{ steps.get-version.outputs.VERSION }}_darwin_amd64.zip macOS-intel-binaries/diagnose
388+
zip -j release/millhone_${{ steps.get-version.outputs.VERSION }}_darwin_amd64.zip macOS-intel-binaries/millhone
389+
chmod +x macOS-arm64-binaries/*
390+
zip -j release/fossa_${{ steps.get-version.outputs.VERSION }}_darwin_arm64.zip macOS-arm64-binaries/fossa
391+
zip -j release/diagnose_${{ steps.get-version.outputs.VERSION }}_darwin_arm64.zip macOS-arm64-binaries/diagnose
392+
zip -j release/millhone_${{ steps.get-version.outputs.VERSION }}_darwin_arm64.zip macOS-arm64-binaries/millhone
374393
375394
chmod +x Windows-binaries/*
376395
zip -j release/fossa_${{ steps.get-version.outputs.VERSION }}_windows_amd64.zip Windows-binaries/fossa.exe
@@ -384,6 +403,7 @@ jobs:
384403
sha256sum --binary "fossa_${{ steps.get-version.outputs.VERSION }}_linux_amd64.zip" > "fossa_${{ steps.get-version.outputs.VERSION }}_linux_amd64.zip.sha256"
385404
sha256sum --binary "fossa_${{ steps.get-version.outputs.VERSION }}_linux_amd64.tar.gz" > "fossa_${{ steps.get-version.outputs.VERSION }}_linux_amd64.tar.gz.sha256"
386405
sha256sum --binary "fossa_${{ steps.get-version.outputs.VERSION }}_darwin_amd64.zip" > "fossa_${{ steps.get-version.outputs.VERSION }}_darwin_amd64.zip.sha256"
406+
sha256sum --binary "fossa_${{ steps.get-version.outputs.VERSION }}_darwin_arm64.zip" > "fossa_${{ steps.get-version.outputs.VERSION }}_darwin_arm64.zip.sha256"
387407
sha256sum --binary "fossa_${{ steps.get-version.outputs.VERSION }}_windows_amd64.zip" > "fossa_${{ steps.get-version.outputs.VERSION }}_windows_amd64.zip.sha256"
388408
389409
echo "Sanity-checking the checksums."

‎.github/workflows/install-script-test.yml

+22
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,28 @@ jobs:
5555
fossa --version
5656
brew uninstall fossa
5757
58+
# These are run separately from the Matrix above because:
59+
# 1. There is no Mac ARM fossa v1.
60+
# 2. Earlier versions of cli v3 did not have ARM releases.
61+
test-macos-arm:
62+
runs-on: "macos-latest"
63+
steps:
64+
- uses: actions/checkout@v4
65+
- name: install latest script can install a specific version
66+
shell: bash
67+
run: |
68+
# 3.9.19 is the first version with native Mac ARM builds.
69+
./install-latest.sh -b . v3.9.19
70+
./fossa --version | grep -q "3.9.19"
71+
rm fossa
72+
73+
- name: install latest script performs installation
74+
shell: bash
75+
run: |
76+
./install-latest.sh -b .
77+
./fossa --version
78+
rm fossa
79+
5880
test-windows:
5981
runs-on: "windows-latest"
6082
steps:

‎Changelog.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# FOSSA CLI Changelog
22

3-
## Unreleased
3+
## v3.9.19
4+
- Release a Mac arm64 binary. ([#1426](https://github.com/fossas/fossa-cli/pull/1426))
45
- Updated the license to CPAL, an OSI-approved license similar to MPL ([#1431](https://github.com/fossas/fossa-cli/pull/1431)).
56

67
## v3.9.18

‎install-latest.sh

+4-3
Original file line numberDiff line numberDiff line change
@@ -393,9 +393,10 @@ get_binary_name() {
393393
name=${PROJECT_NAME}_${VERSION}_${OS}_${ARCH}
394394
case ${PLATFORM} in
395395
darwin/arm64)
396-
log_info "Platform ${PLATFORM} (m1 silicon) detected, using compatible darwin/amd64 binary instead."
397-
name=${PROJECT_NAME}_${VERSION}_${OS}_amd64
398-
;;
396+
if version_less_than "$VERSION" "3.9.19"; then
397+
log_info "Platform ${PLATFORM} (m1 silicon) detected and requested version < 3.9.19, using compatible darwin/amd64 binary instead."
398+
name=${PROJECT_NAME}_${VERSION}_${OS}_amd64
399+
fi ;;
399400
esac
400401
echo "$name"
401402
}

‎vendor_download.sh

+4-2
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,17 @@ THEMIS_ASSET_POSTFIX=""
3535
LERNIE_ASSET_POSTFIX=""
3636
case "$(uname -s)" in
3737
Darwin)
38-
ASSET_POSTFIX="darwin"
39-
THEMIS_ASSET_POSTFIX="darwin-amd64"
4038
case "$(uname -m)" in
4139
arm64)
40+
ASSET_POSTFIX="darwin-arm64"
4241
LERNIE_ASSET_POSTFIX="aarch64-macos"
42+
THEMIS_ASSET_POSTFIX="darwin-arm64"
4343
;;
4444

4545
*)
46+
ASSET_POSTFIX="darwin-amd64"
4647
LERNIE_ASSET_POSTFIX="x86_64-macos"
48+
THEMIS_ASSET_POSTFIX="darwin-amd64"
4749
;;
4850
esac
4951
;;

0 commit comments

Comments
 (0)