Merge pull request #4601 from zen-browser/macos-signing-fix

2026-01-07 22:03:24 +00:00 · 2025-01-29 15:25:49 -08:00
parent 010f9acb54 6e5a56bed5
commit aec9ef390c
19 changed files with 4966 additions and 318 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,6 +54,18 @@ jobs:
          echo "GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}"
          echo "GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}"

+  buildid:
+    name: Generate build ID
+    runs-on: ubuntu-latest
+    outputs:
+      buildids: ${{ steps.get.outputs.bid }}
+    steps:
+      - id: get
+        shell: bash -xe {0}
+        run: |
+          bdat=`date +"%Y%m%d%I%M%S"`
+          echo "bid=${bdat}" >> $GITHUB_OUTPUT
+
  start-self-host:
    runs-on: ubuntu-latest
    needs: debug-inputs
@@ -294,7 +306,7 @@ jobs:
  windows-step-1:
    name: Windows build step 1 (PGO build)
    uses: ./.github/workflows/windows-release-build.yml
-    needs: [build-data]
+    needs: [build-data, buildid]
    permissions:
      contents: write
    secrets: inherit
@@ -303,6 +315,7 @@ jobs:
      generate-gpo: true
      profile-data-path-archive: zen-windows-profile-data-and-jarlog.zip
      release-branch: ${{ inputs.update_branch }}
+      MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}

  windows-step-2:
    name: Windows build step 2 (Generate profile data)
@@ -322,11 +335,12 @@ jobs:
    permissions:
      contents: write
    secrets: inherit
-    needs: [build-data, windows-step-2, start-self-host]
+    needs: [build-data, windows-step-2, start-self-host, buildid]
    with:
      build-version: ${{ needs.build-data.outputs.version }}
      generate-gpo: false
      release-branch: ${{ inputs.update_branch }}
+      MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}

  linux:
    name: Linux build
@@ -334,10 +348,11 @@ jobs:
    permissions:
      contents: write
    secrets: inherit
-    needs: [build-data, start-self-host]
+    needs: [build-data, start-self-host, buildid]
    with:
      build-version: ${{ needs.build-data.outputs.version }}
      release-branch: ${{ inputs.update_branch }}
+      MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}

  mac:
    name: macOS build
@@ -345,7 +360,19 @@ jobs:
    permissions:
      contents: write
    secrets: inherit
-    needs: [build-data]
+    needs: [build-data, buildid]
+    with:
+      build-version: ${{ needs.build-data.outputs.version }}
+      release-branch: ${{ inputs.update_branch }}
+      MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
+
+  mac-uni:
+    name: macOS build (Universal)
+    uses: ./.github/workflows/macos-universal-release-build.yml
+    permissions:
+      contents: write
+    secrets: inherit
+    needs: [build-data, mac]
    with:
      build-version: ${{ needs.build-data.outputs.version }}
      release-branch: ${{ inputs.update_branch }}
@@ -453,7 +480,7 @@ jobs:
    if: ${{ inputs.create_release || inputs.update_branch == 'twilight' }}
    permissions: write-all
    name: Release
-    needs: [build-data, linux, windows-step-3, check-release, mac, appimage, source, lint, stop-self-hosted]
+    needs: [build-data, linux, windows-step-3, check-release, mac-uni, appimage, source, lint, stop-self-hosted]
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.update_branch == 'release' && 'Deploy-Release' || 'Deploy-Twilight' }}
@@ -503,8 +530,7 @@ jobs:
            cp -a ../windows_update_manifest_arm64/.  updates/
          fi

-          cp -a ../macos_update_manifest_aarch64/.  updates/
-          cp -a ../macos_update_manifest_x86_64/.  updates/
+          cp -a ../macos_update_manifest/.  updates/

      - name: Commit
        uses: stefanzweifel/git-auto-commit-action@v5
@@ -533,12 +559,10 @@ jobs:
            linux-aarch64.mar
            windows.mar
            windows-arm64.mar
-            macos-x86_64.mar
-            macos-aarch64.mar
+            macos.mar
            zen.installer.exe
            zen.installer-arm64.exe
-            zen.macos-x86_64.dmg
-            zen.macos-aarch64.dmg
+            zen.macos-universal.dmg
          automatic_release_tag: 'twilight'
          title: 'Twilight build - ${{ needs.build-data.outputs.version }} (${{ needs.build-data.outputs.build_date }} at ${{ needs.build-data.outputs.build_time }})'
          draft: false
@@ -569,8 +593,7 @@ jobs:
            linux-aarch64.mar
            .github/workflows/object/windows-x64-signed-x86_64/windows.mar
            .github/workflows/object/windows-x64-signed-arm64/windows-arm64.mar
-            macos-x86_64.mar
-            macos-aarch64.mar
+            macos.mar
            .github/workflows/object/windows-x64-signed-x86_64/zen.installer.exe
            .github/workflows/object/windows-x64-signed-arm64/zen.installer-arm64.exe
            zen.macos-x86_64.dmg
--- a/.github/workflows/linux-release-build.yml
+++ b/.github/workflows/linux-release-build.yml
@@ -11,6 +11,10 @@ on:
        description: 'The branch to build'
        required: true
        type: string
+      MOZ_BUILD_DATE:
+        type: string
+        required: true
+        default: ""

 jobs:
  build-linux:
@@ -130,6 +134,9 @@ jobs:
        continue-on-error: true
        run: |
          export SURFER_PLATFORM="linux"
+          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
+            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
+          fi
          bash .github/workflows/src/release-build.sh

      - name: Package
--- a/.github/workflows/macos-release-build.yml
+++ b/.github/workflows/macos-release-build.yml
@@ -11,6 +11,10 @@ on:
        description: 'The branch to build'
        required: true
        type: string
+      MOZ_BUILD_DATE:
+        type: string
+        required: true
+        default: ""

 jobs:
  mac-build:
@@ -118,72 +122,47 @@ jobs:
          ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
        run: |
          export SURFER_PLATFORM="darwin"
+          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
+            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
+          fi
          bash .github/workflows/src/release-build.sh

-      - name: Import APPLE DEVELOPER ID CERTIFICATE for .app
-        uses: Apple-Actions/import-codesign-certs@v3
-        with:
-          p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}
-          p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}
-
-      - name: Import provisioning profile for .app
-        run: |
-          echo "${{ secrets.macOS_PROVISIONING_PROFILE }}" | base64 --decode > ./engine/Zen_Browser.provisionprofile
-          ls -la
-
      - name: Package
        env:
          SURFER_COMPAT: ${{ matrix.arch }}
          ZEN_GA_DISABLE_PGO: true
-          MACOS_APPLE_ACCOUNT_ID: ${{ secrets.macOS_AppleAccountId }}
-          MACOS_APPLE_DEVELOPER_ID_TEAM_ID: ${{ secrets.macOS_AppleDeveloperIdTeamId }}
-          MACOS_APPLE_DEVELOPER_ID_PASSWORD: ${{ secrets.macOS_AppleDeveloperIdPassword }}
        run: |
          export SURFER_PLATFORM="darwin"
-          export MACOS_APPLE_DEVELOPER_ID="${{ secrets.macOS_AppleDeveloperId }}"
          export ZEN_RELEASE=1
          pnpm package

      - name: Rename artifacts
        run: |
-          mv ./dist/output.mar macos-${{ matrix.arch }}.mar
-
-      - name: Remove sensitive information
-        run: |
-          rm -f ./engine/Zen_Browser.provisionprofile
-
-      - name: Sign .dmg
-        run: |
+          echo "Tarballing DMG"
          set -ex
-          hdiutil convert ./dist/*.dmg -format UDZO -imagekey zlib-level=9 -o zen.macos-${{ matrix.arch }}.dmg
-          xattr -cr zen.macos-${{ matrix.arch }}.dmg
-          codesign -s "${{ secrets.macOS_AppleDeveloperId }}" zen.macos-${{ matrix.arch }}.dmg
-          xcrun notarytool submit "zen.macos-${{ matrix.arch }}.dmg" \
-            --apple-id "${{ secrets.macOS_AppleAccountId }}" \
-            --team-id "${{ secrets.macOS_AppleDeveloperIdTeamId }}" \
-            --password "${{ secrets.macOS_AppleDeveloperIdPassword }}" \
-            --no-s3-acceleration \
-            --verbose \
-            --wait
-          xcrun stapler staple "zen.macos-${{ matrix.arch }}.dmg"
+          mv ./dist/*.dmg ./zen-${{ matrix.arch }}-apple-darwin-dist.dmg
+          mv ./engine/obj-${{ matrix.arch }}-apple-darwin/dist/host/bin/mar ./zen-macos-host-mar
+          mv ./engine/obj-${{ matrix.arch }}-apple-darwin/dist/bin/platform.ini ./platform.ini

-      - name: Upload build artifact
+      - name: Upload dist dmg
        uses: actions/upload-artifact@v4
        with:
-          retention-days: 5
-          name: zen.macos-${{ matrix.arch }}.dmg
-          path: ./zen.macos-${{ matrix.arch }}.dmg
+          retention-days: 1
+          name: zen-${{ matrix.arch }}-apple-darwin-dist.dmg
+          path: ./zen-${{ matrix.arch }}-apple-darwin-dist.dmg

-      - name: Upload build artifact (.mar)
+      - name: Upload host mar
        uses: actions/upload-artifact@v4
+        if: matrix.arch == 'aarch64'
        with:
-          retention-days: 5
-          name: macos-${{ matrix.arch }}.mar
-          path: ./macos-${{ matrix.arch }}.mar
+          retention-days: 1
+          name: zen-macos-host-mar
+          path: ./zen-macos-host-mar

-      - name: Upload build artifact (update manifests)
+      - name: Upload platform.ini
        uses: actions/upload-artifact@v4
+        if: matrix.arch == 'x86_64'
        with:
-          retention-days: 5
-          name: macos_update_manifest_${{ matrix.arch }}
-          path: ./dist/update
+          retention-days: 1
+          name: platform.ini
+          path: ./platform.ini
--- a/.github/workflows/macos-universal-release-build.yml
+++ b/.github/workflows/macos-universal-release-build.yml
@@ -0,0 +1,271 @@
+name: macOS Release Build
+
+on:
+  workflow_call:
+    inputs:
+      build-version:
+        description: 'The version to build'
+        required: true
+        type: string
+      release-branch:
+        description: 'The branch to build'
+        required: true
+        type: string
+
+jobs:
+  mac-build:
+    name: Unify macOS (Universal)
+    runs-on: 'macos-14'
+
+    strategy:
+      fail-fast: false
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          token: ${{ secrets.DEPLOY_KEY }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        # note: This will use the version defined in '.python-version' by default
+
+      - name: Setup Git
+        run: |
+          git config --global user.email "mauro-balades@users.noreply.github.com"
+          git config --global user.name "mauro-balades"
+
+      - name: Install system dependencies
+        run: |
+          brew update
+          brew install cairo sccache gnu-tar mercurial
+          sudo pip install setuptools
+
+          brew uninstall --ignore-dependencies python3.12 -f
+
+          export PATH="$(python3 -m site --user-base)/bin":$PATH
+          python3 -m pip install --user mercurial
+
+          rm '/usr/local/bin/2to3-3.11' '/usr/local/bin/2to3-3.12' '/usr/local/bin/2to3'
+          rm '/usr/local/bin/idle3.11' '/usr/local/bin/idle3.12' '/usr/local/bin/idle3'
+          rm '/usr/local/bin/pydoc3.11' '/usr/local/bin/pydoc3.12' '/usr/local/bin/pydoc3'
+          rm '/usr/local/bin/python3.11' '/usr/local/bin/python3.12' '/usr/local/bin/python3'
+          rm '/usr/local/bin/python3.11-config' '/usr/local/bin/python3.12-config' '/usr/local/bin/python3-config'
+
+          brew install watchman
+
+          cargo install apple-codesign
+
+      - name: Force usage of gnu-tar
+        run: |
+          echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.bash_profile
+          echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.zsh
+          source ~/.bash_profile
+
+      - name: Setup pnpm
+        run: npm install -g pnpm
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - name: Install dependencies
+        run: |
+          pnpm install
+
+      - name: Load surfer CI setup
+        run: pnpm surfer ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
+
+      - name: Download Firefox source and dependencies
+        run: pnpm surfer download
+
+      - name: Bootstrap
+        run: |
+          cd engine
+          export SURFER_PLATFORM="darwin"
+          export PATH="$(python3 -m site --user-base)/bin":$PATH
+          ./mach --no-interactive bootstrap --application-choice browser --no-system-changes
+          cd ..
+
+      - name: Import
+        run: pnpm surfer import
+
+      - name: Populate mozconfig
+        env:
+          SURFER_MOZCONFIG_ONLY: true
+        run: |
+              pnpm build
+              cd engine
+              ./mach configure
+
+      - name: Download x86_64 DMG from artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: zen-x86_64-apple-darwin-dist.dmg
+
+      - name: Download aarch64 DMG from artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: zen-aarch64-apple-darwin-dist.dmg
+
+      - name: Remove any existing .app folders
+        run: |
+          set -x
+          cd engine
+          rm -rf "./obj-x86_64-apple-darwin/" || true
+          rm -rf "./obj-aarch64-apple-darwin/" || true
+
+      - name: Extract .app from dmg
+        run: |
+          set -ex
+          cd engine
+          echo "Extracting x86_64 .app from dmg"
+          mkdir -p ./obj-x86_64-apple-darwin/dist
+          mkdir -p ./obj-aarch64-apple-darwin/dist
+          ./mach python -m mozbuild.action.unpack_dmg \
+            ../zen-x86_64-apple-darwin-dist.dmg \
+            ./obj-x86_64-apple-darwin/dist
+          echo "Extracting aarch64 .app from dmg"
+          ./mach python -m mozbuild.action.unpack_dmg \
+            ../zen-aarch64-apple-darwin-dist.dmg \
+            ./obj-aarch64-apple-darwin/dist
+
+      - name: Find first .app folder name
+        run: |
+          cd engine/obj-x86_64-apple-darwin/dist
+          export APP_NAME=$(basename "$(find . -maxdepth 1 -name "Zen *.app" -type d | head -n 1)" .app)
+          echo "APP_NAME=$APP_NAME" >> $GITHUB_ENV
+          echo "APP_NAME=$APP_NAME"
+
+      - name: List .app folders
+        run: |
+          ls engine/
+          echo "--------------------"
+          cd engine/obj-x86_64-apple-darwin/dist
+          find . -maxdepth 1 -name "*.app" -type d
+          cd ../..
+
+      - name: create .p12 for codesign 🖊️
+        run: |
+          cd engine
+          echo "${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}" > cert.txt
+          base64 --decode -i cert.txt -o zenCert.p12
+          echo "${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}" > zenpCertPassword.passwd
+
+      - name: Remove certificate sensitive information
+        run: |
+          rm engine/cert.txt || true
+
+      - name: Import provisioning profile for .app
+        run: |
+          echo "${{ secrets.macOS_PROVISIONING_PROFILE }}" | base64 --decode > ./engine/Zen_Browser.provisionprofile
+          ls -la
+
+      - name: Unify architectures
+        run: |
+          cd engine
+          ./mach python "./toolkit/mozapps/installer/unify.py" "./obj-x86_64-apple-darwin/dist/${{ env.APP_NAME }}.app" "./obj-aarch64-apple-darwin/dist/${{ env.APP_NAME }}.app"
+          echo "Merged aaarch64 into x86_64!"
+
+      - name: Import APPLE DEVELOPER ID CERTIFICATE for .app
+        uses: Apple-Actions/import-codesign-certs@v3
+        with:
+          p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}
+          p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}
+
+      - name: Copy provisioning profile for .app (embedded in .app)
+        run: |
+          cd engine
+          echo "Copying provisioning profile for .app on both architectures (${{ env.APP_NAME }})"
+          cp ./Zen_Browser.provisionprofile "./embedded.provisionprofile"
+
+
+      - name: Sign .app
+        run: |
+          cd engine
+          # TODO: Change it to "production" once we figure out the issue with the webauth
+          ./mach macos-sign -v -r -c "release" -e "production-without-restricted" -a "./obj-x86_64-apple-darwin/dist/${{ env.APP_NAME }}.app" --rcodesign-p12-file zenCert.p12 --rcodesign-p12-password-file zenpCertPassword.passwd
+
+      - name: Create DMG
+        run: |
+          cd engine
+          ./mach python -m mozbuild.action.make_dmg \
+            --volume-name "${{ env.APP_NAME }}" \
+            --background ./browser/branding/${{ inputs.release-branch }}/background.png \
+            --icon ./browser/branding/${{ inputs.release-branch }}/firefox.icns \
+            --dsstore ./browser/branding/${{ inputs.release-branch }}/dsstore \
+            ./obj-x86_64-apple-darwin/dist/ ../zen-macOS-universal-temp.dmg
+
+      - name: Remove sensitive information
+        run: |
+          rm -f ./engine/Zen_Browser.provisionprofile
+
+      - name: Sign .dmg
+        run: |
+          set -ex
+          hdiutil convert zen-macOS-universal-temp.dmg -format UDZO -imagekey zlib-level=9 -o zen.macos-universal.dmg
+          codesign -s "${{ secrets.macOS_AppleDeveloperId }}" zen.macos-universal.dmg
+          xcrun notarytool submit "zen.macos-universal.dmg" \
+            --apple-id "${{ secrets.macOS_AppleAccountId }}" \
+            --team-id "${{ secrets.macOS_AppleDeveloperIdTeamId }}" \
+            --password "${{ secrets.macOS_AppleDeveloperIdPassword }}" \
+            --no-s3-acceleration \
+            --wait
+          xcrun stapler staple "zen.macos-universal.dmg"
+
+      - name: Download host mar
+        uses: actions/download-artifact@v4
+        with:
+          name: zen-macos-host-mar
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 5
+          name: zen.macos-universal.dmg
+          path: ./zen.macos-universal.dmg
+
+      - name: Download platform.ini
+        uses: actions/download-artifact@v4
+        with:
+          name: platform.ini
+
+      - name: Package for mar
+        env:
+          JUST_MAR: true
+        run: |
+          # we don't need it anymore
+          set -ex
+          rm -rf ./engine/obj-aarch64-apple-darwin
+          mkdir -p ./engine/obj-x86_64-apple-darwin/dist/bin
+          mv ./platform.ini ./engine/obj-x86_64-apple-darwin/dist/bin/platform.ini
+          export SURFER_PLATFORM="darwin"
+          export ZEN_RELEASE=1
+          # full path to zen-macos-host-mar
+          export MAR=$(pwd)/zen-macos-host-mar
+          chmod +x $MAR
+          echo "MAR=$MAR"
+          pnpm package --verbose
+          mv ./dist/output.mar ./macos.mar
+
+      - name: Upload build artifact (.mar)
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 5
+          name: macos.mar
+          path: ./macos.mar
+
+      - name: Upload build artifact (update manifests)
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 5
+          name: macos_update_manifest
+          path: ./dist/update
--- a/.github/workflows/windows-release-build.yml
+++ b/.github/workflows/windows-release-build.yml
@@ -18,6 +18,10 @@ on:
        description: 'The branch to build'
        required: true
        type: string
+      MOZ_BUILD_DATE:
+        type: string
+        required: true
+        default: ""

 jobs:
  windows-build:
@@ -216,6 +220,9 @@ jobs:
          if test ${{ inputs.generate-gpo }} = true; then
            export ZEN_GA_GENERATE_PROFILE=1
          fi
+          if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
+            export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
+          fi
          bash .github/workflows/src/release-build.sh

      - name: Package