Hash :
2f26b48f
Author :
Date :
2025-04-02T13:59:17
Mac pkg: Fix issues that prevent notarization - Explicitly sign all binaries included in the package. - Enable the hardened runtime.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189
#!/bin/sh
set -u
set -e
trap onexit INT
trap onexit TERM
trap onexit EXIT
TMPDIR=
onexit()
{
if [ ! "$TMPDIR" = "" ]; then
rm -rf $TMPDIR
fi
}
safedirmove ()
{
if [ "$1" = "$2" ]; then
return 0
fi
if [ "$1" = "" -o ! -d "$1" ]; then
echo safedirmove: source dir $1 is not valid
return 1
fi
if [ "$2" = "" -o -e "$2" ]; then
echo safedirmove: dest dir $2 is not valid
return 1
fi
if [ "$3" = "" -o -e "$3" ]; then
echo safedirmove: tmp dir $3 is not valid
return 1
fi
mkdir -p $3
mv $1/* $3/
rmdir $1
mkdir -p $2
mv $3/* $2/
rmdir $3
return 0
}
usage()
{
echo "$0 [-lipo [path to lipo]]"
exit 1
}
PKGNAME=@PKGNAME@
VERSION=@VERSION@
BUILD=@BUILD@
SRCDIR=@CMAKE_CURRENT_SOURCE_DIR@
BUILDDIRSECONDARY=@SECONDARY_BUILD@
WITH_JAVA=@WITH_JAVA@
MACOS_APP_CERT_NAME="@MACOS_APP_CERT_NAME@"
MACOS_INST_CERT_NAME="@MACOS_INST_CERT_NAME@"
LIPO=lipo
PREFIX=@CMAKE_INSTALL_PREFIX@
BINDIR=@CMAKE_INSTALL_FULL_BINDIR@
DOCDIR=@CMAKE_INSTALL_FULL_DOCDIR@
LIBDIR=@CMAKE_INSTALL_FULL_LIBDIR@
LIBJPEG_DSO_NAME=libjpeg.@SO_MAJOR_VERSION@.@SO_AGE@.@SO_MINOR_VERSION@.dylib
TURBOJPEG_DSO_NAME=libturbojpeg.@TURBOJPEG_SO_VERSION@.dylib
while [ $# -gt 0 ]; do
case $1 in
-h*)
usage 0
;;
-lipo)
if [ $# -gt 1 ]; then
if [[ ! "$2" =~ -.* ]]; then
LIPO=$2; shift
fi
fi
;;
esac
shift
done
if [ -f $PKGNAME-$VERSION.dmg ]; then
rm -f $PKGNAME-$VERSION.dmg
fi
umask 022
TMPDIR=`mktemp -d /tmp/$PKGNAME-build.XXXXXX`
PKGROOT=$TMPDIR/pkg/Package_Root
mkdir -p $PKGROOT
DESTDIR=$PKGROOT @CMAKE_MAKE_PROGRAM@ install
if [ "$PREFIX" = "@CMAKE_INSTALL_DEFAULT_PREFIX@" -a "$DOCDIR" = "@CMAKE_INSTALL_DEFAULT_PREFIX@/doc" ]; then
mkdir -p $PKGROOT/Library/Documentation
safedirmove $PKGROOT$DOCDIR $PKGROOT/Library/Documentation/$PKGNAME $TMPDIR/__tmpdoc
ln -fs /Library/Documentation/$PKGNAME $PKGROOT$DOCDIR
fi
install_secondarybuild()
{
BUILDDIR=$1
if [ ! -d $BUILDDIR ]; then
echo ERROR: Secondary build directory $BUILDDIR does not exist
exit 1
fi
if [ ! -f $BUILDDIR/Makefile -a ! -f $BUILDDIR/build.ninja ]; then
echo ERROR: Secondary build directory $BUILDDIR is not configured
exit 1
fi
mkdir -p $TMPDIR/dist.secondary
pushd $BUILDDIR
DESTDIR=$TMPDIR/dist.secondary @CMAKE_MAKE_PROGRAM@ install
popd
for file in $LIBJPEG_DSO_NAME libjpeg.a $TURBOJPEG_DSO_NAME libturbojpeg.a; do
$LIPO -create \
$PKGROOT/$LIBDIR/$file \
$TMPDIR/dist.secondary/$LIBDIR/$file \
-output $PKGROOT/$LIBDIR/$file
done
for file in cjpeg djpeg jpegtran tjbench rdjpgcom wrjpgcom; do
$LIPO -create \
$PKGROOT/$BINDIR/$file \
$TMPDIR/dist.secondary/$BINDIR/$file \
-output $PKGROOT/$BINDIR/$file
done
}
if [ "$BUILDDIRSECONDARY" != "" ]; then
install_secondarybuild $BUILDDIRSECONDARY
fi
install_name_tool -id $LIBDIR/$LIBJPEG_DSO_NAME $PKGROOT/$LIBDIR/$LIBJPEG_DSO_NAME
install_name_tool -id $LIBDIR/$TURBOJPEG_DSO_NAME $PKGROOT/$LIBDIR/$TURBOJPEG_DSO_NAME
if [ "$PREFIX" = "@CMAKE_INSTALL_DEFAULT_PREFIX@" -a "$LIBDIR" = "@CMAKE_INSTALL_DEFAULT_PREFIX@/lib" ]; then
if [ ! -h $PKGROOT/$PREFIX/lib64 ]; then
ln -fs lib $PKGROOT/$PREFIX/lib64
fi
fi
mkdir -p $TMPDIR/pkg
if [ "$MACOS_APP_CERT_NAME" != "" ]; then
for file in $LIBJPEG_DSO_NAME $TURBOJPEG_DSO_NAME; do
codesign -s "$MACOS_APP_CERT_NAME" --options=runtime \
--timestamp $PKGROOT/$LIBDIR/$file
codesign --verify --strict -v $PKGROOT/$LIBDIR/$file
done
for file in cjpeg djpeg jpegtran tjbench rdjpgcom wrjpgcom; do
codesign -s "$MACOS_APP_CERT_NAME" --options=runtime \
--timestamp $PKGROOT/$BINDIR/$file
codesign --verify --strict -v $PKGROOT/$BINDIR/$file
done
fi
install -m 755 pkgscripts/uninstall $PKGROOT/$BINDIR/
find $PKGROOT -type f | while read file; do xattr -c $file; done
cp $SRCDIR/release/License.rtf pkgscripts/Welcome.rtf $SRCDIR/release/ReadMe.txt $TMPDIR/pkg/
mkdir $TMPDIR/dmg
pkgbuild --root $PKGROOT --version $VERSION.$BUILD --identifier @PKGID@ \
$TMPDIR/pkg/$PKGNAME.pkg
SUFFIX=
if [ "$MACOS_INST_CERT_NAME" != "" ]; then
SUFFIX=-unsigned
fi
productbuild --distribution pkgscripts/Distribution.xml \
--package-path $TMPDIR/pkg/ --resources $TMPDIR/pkg/ \
$TMPDIR/dmg/$PKGNAME$SUFFIX.pkg
if [ "$MACOS_INST_CERT_NAME" != "" ]; then
productsign --sign "$MACOS_INST_CERT_NAME" --timestamp \
$TMPDIR/dmg/$PKGNAME$SUFFIX.pkg $TMPDIR/dmg/$PKGNAME.pkg
rm -r $TMPDIR/dmg/$PKGNAME$SUFFIX.pkg
pkgutil --check-signature $TMPDIR/dmg/$PKGNAME.pkg
fi
hdiutil create -fs HFS+ -volname $PKGNAME-$VERSION \
-srcfolder "$TMPDIR/dmg" $TMPDIR/$PKGNAME-$VERSION.dmg
if [ "$MACOS_APP_CERT_NAME" != "" ]; then
codesign -s "$MACOS_APP_CERT_NAME" --timestamp $TMPDIR/$PKGNAME-$VERSION.dmg
codesign -vv $TMPDIR/$PKGNAME-$VERSION.dmg
fi
cp $TMPDIR/$PKGNAME-$VERSION.dmg .
exit