make_osx

#!/bin/bash

build_dir=$(dirname "$0")
test -n "$build_dir" -a -d "$build_dir" || (echo "Cannot determine build dir. FIXME!" && exit 1)

. "$build_dir"/../base.sh # functions we use below

OSX_COMPAT=""
DARWIN_VER=$(uname -r | cut -f 1 -d .)
if ((DARWIN_VER < 17)); then
    fail "Minimum OSX High Sierra is required to build"
fi

function DoCodeSignMaybe { # ARGS: infoName fileOrDirName codesignIdentity
    infoName="$1"
    file="$2"
    identity="$3"
    deep=""
    if [ -z "$identity" ]; then
        # we are ok with them not passing anything; master script calls us unconditionally even if no identity is specified
        return
    fi
    if [ -d "$file" ]; then
        deep="--deep"
    fi
    if [ -z "$infoName" ] || [ -z "$file" ] || [ -z "$identity" ] || [ ! -e "$file" ]; then
        fail "Argument error to internal function DoCodeSignMaybe()"
    fi
    preserve_arg="--preserve-metadata=requirements,entitlements"
    hardened_arg=""
    hardened_info=""
    if ((DARWIN_VER >= 18)); then
      # On Mojave or above, we codesign with the "hardened runtime" which
      # is required for notarization.
      # See: https://github.com/pyinstaller/pyinstaller/issues/4629
      preserve_arg=""
      hardened_arg="--entitlements=${build_dir}/entitlements.plist -o runtime"
      hardened_info=" (Hardened Runtime)"
    fi
    info "Code signing ${infoName}${hardened_info}..."
    codesign -f -v $deep -s "$identity" $preserve_arg $hardened_arg "$file" || fail "Could not code sign ${infoName}"
}

cd $build_dir/../..

VERSION=`git_describe_filtered`

# Paramterize
BUILDDIR=/tmp/electron-cash-build
LIBSECP_COMMIT="69ccf0d2f758b1a4df9cde8222459381e08fc1dc"
# Compute major.minor Python version from above using Bash array magic
MAJ_MIN=(${PYTHON_VERSION//./ })
MAJ_MIN=${MAJ_MIN[0]}.${MAJ_MIN[1]}

which xcodebuild > /dev/null 2>&1 || fail "Please install Xcode and xcode command line tools to continue"

# Code Signing: See https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html
APP_SIGN=""
if [ -n "$1" ]; then
    # Test the identity is valid for signing by doing this hack. There is no other way to do this.
    cp -f /bin/ls ./CODESIGN_TEST
    codesign -s "$1" --dryrun -f ./CODESIGN_TEST > /dev/null 2>&1
    res=$?
    rm -f ./CODESIGN_TEST
    if ((res)); then
        fail "Code signing identity \"$1\" appears to be invalid."
    fi
    unset res
    APP_SIGN="$1"
    info "Code signing enabled using identity \"$APP_SIGN\""
else
    warn "Code signing DISABLED. Specify a valid macOS Developer identity installed on the system as the first argument to this script to enable signing."
fi

have_brew=`which brew`
have_macports=`which port`
if [ -n "$have_brew" ]; then
    info "Ensuring build prerequisites are installed via brew"
    for a in autoconf automake coreutils gettext libtool openssl@1.1 readline sqlite3 xz zlib swig ; do
        brew list $a > /dev/null 2>&1
        if [ "$?" != "0" ]; then
            info "Installing $a"
            brew install "$a" || fail "Could not install $a"
        else
            info "$a found"
        fi
    done
elif [ -n "$have_macports" ]; then
    have_port_swig_python=`port installed | grep swig-python`
    if [ -z "$have_port_swig_python" ]; then
        fail "Please install swig-python: sudo port install swig-python"
    fi
else
    fail "This script requires either brew or MacPorts. Please install either of these package managers and re-run this script."
fi

have_swig=`which swig`
if [ -z "$have_swig" ]; then
    warn "Please install 'swig' to run this script:"
    info "If using brew: brew install swig"
    info "If using MacPorts: sudo port install swig-python"
    info "Lastly, ensure 'swig' is in your PATH"
    fail "'swig' not found in path, cannot proceed"
fi

info "Installing Python $PYTHON_VERSION"  # NB: $PYTHON_VERSION comes from ../base.sh
export PATH=~/.pyenv/bin:~/.pyenv/versions/${PYTHON_VERSION}/bin:~/.pyenv/shims:~/Library/Python/${MAJ_MIN}/bin:"$PATH"
if [ -d "~/.pyenv" ]; then
  pyenv update
else
  curl -L https://raw.githubusercontent.com/pyenv/pyenv-installer/master/bin/pyenv-installer | bash > /dev/null 2>&1
fi
if ~/.pyenv/bin/pyenv versions | grep -q "$PYTHON_VERSION"; then
    warn "Python $PYTHON_VERSION already exists in pyenv!"
    warn "We will proceed to use this version but you really should start with a fresh, clean version of Python by removing ~/.pyenv altogether."
else
    # Pre-download the tarball and verify its hash
    mkdir -p ~/.pyenv/cache
    download_if_not_exist ~/.pyenv/cache/Python-$PYTHON_VERSION.tar.xz "https://www.python.org/ftp/python/$PYTHON_VERSION/Python-$PYTHON_VERSION.tar.xz"
    verify_hash ~/.pyenv/cache/Python-$PYTHON_VERSION.tar.xz $PYTHON_SRC_TARBALL_HASH
fi
# The below just switches to this python version if already installed..
# or does a build-install from the file in ~/.pyenv/cache if not installed
PYTHON_CONFIGURE_OPTS="--enable-framework" pyenv install -s $PYTHON_VERSION && \
    pyenv global $PYTHON_VERSION && pyenv rehash || \
    fail "Unable to use Python $PYTHON_VERSION"

# We use a hashed requirements file for even the build tools to prevent
# dependency attacks even in the build process
info "Installing pip, dmgbuild, requests, and other build tools we need..."
# Ensure we have wheel because otherwise we get warnings about not having it (even though below installs it again)
python3 -m pip install --user --upgrade wheel || fail "Failed to install wheel"
python3 -m pip install -I --user -r contrib/deterministic-build/requirements-pip.txt \
    || fail "Could not install pip"
python3 -m pip install -I --user -r contrib/osx/requirements-osx-build.txt \
    || fail "Could not install osx build requirements"

# Create the build directory in /tmp
rm  -rf $BUILDDIR > /dev/null 2>&1
mkdir -p $BUILDDIR

info "Building PyInstaller."
PYINSTALLER_REPO="https://github.com/pyinstaller/pyinstaller.git"
PYINSTALLER_COMMIT="90256f93ed943daf6de53c7dd39710a415f705cb"
# ^ tag "v6.4.0"
#PYINSTALLER_COMMIT="e20e74c03768d432d48665b8ef1e02511b16e4be"
# ^ tag "4.3"
# TODO test newer versions of pyinstaller for build-reproducibility.
#      we are using this version for now due to change in code-signing behavior
#      (https://github.com/pyinstaller/pyinstaller/pull/5581)
(
    if [ -f "$BUILDDIR/pyinstaller/PyInstaller/bootloader/Darwin-64bit/runw" ]; then
        info "pyinstaller already built, skipping"
        exit 0
    fi
    pushd "${build_dir}"
    EC_COMMIT_HASH=$(git rev-parse HEAD)
    pushd "$BUILDDIR"
    rm -rf pyinstaller
    mkdir pyinstaller
    cd pyinstaller
    # Shallow clone
    git init
    git remote add origin $PYINSTALLER_REPO
    git fetch --depth 1 origin $PYINSTALLER_COMMIT
    git checkout -b pinned "${PYINSTALLER_COMMIT}^{commit}"
    rm -fv PyInstaller/bootloader/Darwin-*/run* || true
    # add reproducible randomness. this ensures we build a different bootloader for each commit.
    # if we built the same one for all releases, that might also get anti-virus false positives
    echo "extern const char * const electron_cash_tag;" >> ./bootloader/src/pyi_main.c
    echo "const char * const electron_cash_tag = \"tagged by Electron-Cash@$EC_COMMIT_HASH\";" >> ./bootloader/src/pyi_main.c
    pushd bootloader
    # compile bootloader
    python3 ./waf all CFLAGS="-static"
    popd
    # sanity check bootloader is there:
    [[ -e "PyInstaller/bootloader/Darwin-64bit/runw" ]] || fail "Could not find runw in target dir!"
    rm pyinstaller.py  # workaround for https://github.com/pyinstaller/pyinstaller/pull/6701
    popd # $BUILDDIR
    popd # $build_dir
) || fail "PyInstaller build failed"

info "Installing PyInstaller"
# Use the one we just built above
python3 -m pip install --user --upgrade --no-warn-script-location "$BUILDDIR/pyinstaller" \
    && pyenv rehash || fail "Could not install PyInstaller"

info "Using these versions for building $PACKAGE:"  # NB: PACKAGE var comes from ../base.sh
sw_vers
python3 --version
echo -n "Pyinstaller "
pyinstaller --version

rm -rf ./dist

info "Making locale..."
python3 ./contrib/make_locale || fail "Failed to make locale..."

info "Downloading libusb..."
curl -L https://github.com/cculianu/Electron-Cash-Build-Tools/releases/download/v1.0/libusb-1.0.21.el_capitan.bottle.tar.gz | \
    tar xz --directory $BUILDDIR || fail "Could not download libusb"
verify_hash $BUILDDIR/libusb/1.0.21/lib/libusb-1.0.dylib d147e7382dfa676d93e8b17d160d50f68e4b01f58f3647c90a8899a7a0519ca3  # this exits on failure
cp -fp $BUILDDIR/libusb/1.0.21/lib/libusb-1.0.dylib contrib/osx || fail "Could not copy libusb"

# Build ZBar
contrib/make_zbar && mv -vf electroncash/libzbar.0.dylib contrib/osx/. || fail "Could not build ZBar"

info "Building libsecp256k1"
pushd contrib/secp256k1 || fail "Could not chdir to contrib/secp256k1"
git checkout "$LIBSECP_COMMIT^{commit}" || fail "Could not check out secp256k1 $LIBSECP_COMMIT"
git clean -f -x -q
./autogen.sh || fail "Could not run autogen for secp256k1"
./configure \
    --enable-module-recovery \
    --enable-experimental \
    --enable-module-ecdh \
    --disable-jni \
    --with-bignum=no \
    --enable-module-schnorr \
    --disable-tests \
    --disable-static \
    --enable-shared || fail "Could not configure for secp256k1"
make -j4 || fail "Could not build secp256k1"
popd
cp -fp contrib/secp256k1/.libs/libsecp256k1.0.dylib contrib/osx || fail "Could not copy secp256k1 binary to its destination"

info "Building integrated Tor"
contrib/make_zlib && contrib/make_libevent && contrib/make_openssl && contrib/make_tor || fail "Could not build Tor"


info "Installing requirements..."
python3 -m pip install -r ./contrib/deterministic-build/requirements.txt --user || fail "Could not install requirements"
python3 -m pip install -r ./contrib/deterministic-build/requirements-binaries.txt --user || fail "Could not install binary requirements"

info "Installing hardware wallet requirements..."
python3 -m pip install -r ./contrib/deterministic-build/requirements-hw.txt --user || \
fail "Could not install hardware wallet requirements"

info "Building $PACKAGE..."
python3 setup.py install --user > /dev/null || fail "Could not build $PACKAGE"

info "Building binary"
ELECTRONCASH_VERSION=$VERSION pyinstaller --clean --noconfirm contrib/osx/osx.spec || fail "Could not build binary"

info "Adding bitcoincash & cashacct URI types to Info.plist"
# NB: Make sure there are no trailing spaces after the '\' characters here
plutil -insert 'CFBundleURLTypes' \
	-xml \
'<array> '\
'<dict> '\
'  <key>CFBundleURLName</key> '\
'  <string>bitcoincash</string> '\
'  <key>CFBundleURLSchemes</key> '\
'    <array><string>bitcoincash</string></array> '\
'</dict> '\
'<dict> '\
'  <key>CFBundleURLName</key> '\
'  <string>CashAccount</string> '\
'  <key>CFBundleURLSchemes</key> '\
'    <array><string>cashacct</string></array> '\
'</dict> '\
'</array>' \
	-- dist/$PACKAGE.app/Contents/Info.plist \
	|| fail "Could not add keys to Info.plist. Make sure the program 'plutil' exists and is installed."

plutil -insert 'NSCameraUsageDescription' \
       -string 'Electron Cash would like to access the camera to scan for QR codes' \
	-- dist/$PACKAGE.app/Contents/Info.plist \
	|| fail "Could not add keys to Info.plist. Make sure the program 'plutil' exists and is installed."

plutil -insert 'LSMinimumSystemVersion' \
       -string '10.14.0' \
	-- dist/$PACKAGE.app/Contents/Info.plist \
	|| fail "Could not add keys to Info.plist. Make sure the program 'plutil' exists and is installed."

FORCE_MOJAVE_DARK=1  # Set to 1 to try and add the Info.plist key to force mojave dark mode support.
                     # On PyQt 5.14.1, it doesn't work, but on 5.15.2 it does.
if ((DARWIN_VER >= 18 && FORCE_MOJAVE_DARK)); then
    # Add a key to Info.plist key to support Mojave dark mode
    info "Adding Mojave dark mode support to Info.plist"
    plutil -insert 'NSRequiresAquaSystemAppearance' -bool NO -- dist/"$PACKAGE".app/Contents/Info.plist \
      || fail "Could not set Info.plist NSRequiresAquaSystemAppearance"
fi

# Sign the Tor binary separately
DoCodeSignMaybe "tor binary" "dist/${PACKAGE}.app/Contents/Frameworks/electroncash/tor/bin/tor" "$APP_SIGN"
# Finally, codesign the whole thing
DoCodeSignMaybe ".app bundle" "dist/${PACKAGE}.app" "$APP_SIGN"

info "Creating .DMG"
dmgbuild -D PACKAGE=$PACKAGE -s contrib/osx/dmgbuild.spec "" "dist/${PACKAGE}-${VERSION}-macosx${OSX_COMPAT}.dmg" || fail "Could not create .DMG"

DoCodeSignMaybe ".DMG" "dist/${PACKAGE}-${VERSION}-macosx${OSX_COMPAT}.dmg" "$APP_SIGN" # If APP_SIGN is empty will be a noop

if [ -z "$APP_SIGN" ]; then
    warn "App was built successfully but was not code signed. Users may get security warnings from macOS."
    warn "Specify a valid code signing identity as the first argument to this script to enable code signing."
fi

rm -fr $BUILDDIR