mirror of
https://github.com/zen-browser/desktop.git
synced 2026-02-06 03:47:20 +00:00
Refactor macOS build workflow and remove deprecated entitlements files
This commit is contained in:
mr. M
13
.github/workflows/build.yml
vendored
13
.github/workflows/build.yml
vendored
@@ -350,6 +350,17 @@ jobs:
|
||||
build-version: ${{ needs.build-data.outputs.version }}
|
||||
release-branch: ${{ inputs.update_branch }}
|
||||
|
||||
mac-uni:
|
||||
name: macOS build (Universal)
|
||||
uses: ./.github/workflows/macos-universal-release-build.yml
|
||||
permissions:
|
||||
contents: write
|
||||
secrets: inherit
|
||||
needs: [build-data]
|
||||
with:
|
||||
build-version: ${{ needs.build-data.outputs.version }}
|
||||
release-branch: ${{ inputs.update_branch }}
|
||||
|
||||
appimage:
|
||||
name: AppImage build - Linux ${{ matrix.arch }}
|
||||
permissions:
|
||||
@@ -453,7 +464,7 @@ jobs:
|
||||
if: ${{ inputs.create_release || inputs.update_branch == 'twilight' }}
|
||||
permissions: write-all
|
||||
name: Release
|
||||
needs: [build-data, linux, windows-step-3, check-release, mac, appimage, source, lint, stop-self-hosted]
|
||||
needs: [build-data, linux, windows-step-3, check-release, mac-uni, appimage, source, lint, stop-self-hosted]
|
||||
runs-on: ubuntu-latest
|
||||
environment:
|
||||
name: ${{ inputs.update_branch == 'release' && 'Deploy-Release' || 'Deploy-Twilight' }}
|
||||
|
||||
42
.github/workflows/macos-release-build.yml
vendored
42
.github/workflows/macos-release-build.yml
vendored
@@ -120,27 +120,12 @@ jobs:
|
||||
export SURFER_PLATFORM="darwin"
|
||||
bash .github/workflows/src/release-build.sh
|
||||
|
||||
- name: Import APPLE DEVELOPER ID CERTIFICATE for .app
|
||||
uses: Apple-Actions/import-codesign-certs@v3
|
||||
with:
|
||||
p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}
|
||||
p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}
|
||||
|
||||
- name: Import provisioning profile for .app
|
||||
run: |
|
||||
echo "${{ secrets.macOS_PROVISIONING_PROFILE }}" | base64 --decode > ./engine/Zen_Browser.provisionprofile
|
||||
ls -la
|
||||
|
||||
- name: Package
|
||||
env:
|
||||
SURFER_COMPAT: ${{ matrix.arch }}
|
||||
ZEN_GA_DISABLE_PGO: true
|
||||
MACOS_APPLE_ACCOUNT_ID: ${{ secrets.macOS_AppleAccountId }}
|
||||
MACOS_APPLE_DEVELOPER_ID_TEAM_ID: ${{ secrets.macOS_AppleDeveloperIdTeamId }}
|
||||
MACOS_APPLE_DEVELOPER_ID_PASSWORD: ${{ secrets.macOS_AppleDeveloperIdPassword }}
|
||||
run: |
|
||||
export SURFER_PLATFORM="darwin"
|
||||
export MACOS_APPLE_DEVELOPER_ID="${{ secrets.macOS_AppleDeveloperId }}"
|
||||
export ZEN_RELEASE=1
|
||||
pnpm package
|
||||
|
||||
@@ -148,31 +133,12 @@ jobs:
|
||||
run: |
|
||||
mv ./dist/output.mar macos-${{ matrix.arch }}.mar
|
||||
|
||||
- name: Remove sensitive information
|
||||
run: |
|
||||
rm -f ./engine/Zen_Browser.provisionprofile
|
||||
|
||||
- name: Sign .dmg
|
||||
run: |
|
||||
set -ex
|
||||
hdiutil convert ./dist/*.dmg -format UDZO -imagekey zlib-level=9 -o zen.macos-${{ matrix.arch }}.dmg
|
||||
xattr -cr zen.macos-${{ matrix.arch }}.dmg
|
||||
codesign -s "${{ secrets.macOS_AppleDeveloperId }}" zen.macos-${{ matrix.arch }}.dmg
|
||||
xcrun notarytool submit "zen.macos-${{ matrix.arch }}.dmg" \
|
||||
--apple-id "${{ secrets.macOS_AppleAccountId }}" \
|
||||
--team-id "${{ secrets.macOS_AppleDeveloperIdTeamId }}" \
|
||||
--password "${{ secrets.macOS_AppleDeveloperIdPassword }}" \
|
||||
--no-s3-acceleration \
|
||||
--verbose \
|
||||
--wait
|
||||
xcrun stapler staple "zen.macos-${{ matrix.arch }}.dmg"
|
||||
|
||||
- name: Upload build artifact
|
||||
- name: Upload dist app folder
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
retention-days: 5
|
||||
name: zen.macos-${{ matrix.arch }}.dmg
|
||||
path: ./zen.macos-${{ matrix.arch }}.dmg
|
||||
retention-days: 1
|
||||
name: obj-${{ matrix.arch }}-apple-darwin
|
||||
path: ./engine/obj-${{ matrix.arch }}-apple-darwin
|
||||
|
||||
- name: Upload build artifact (.mar)
|
||||
uses: actions/upload-artifact@v4
|
||||
|
||||
201
.github/workflows/macos-universal-release-build.yml
vendored
Normal file
201
.github/workflows/macos-universal-release-build.yml
vendored
Normal file
@@ -0,0 +1,201 @@
|
||||
name: macOS Release Build
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
build-version:
|
||||
description: 'The version to build'
|
||||
required: true
|
||||
type: string
|
||||
release-branch:
|
||||
description: 'The branch to build'
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
mac-build:
|
||||
name: Unify macOS (Universal)
|
||||
runs-on: 'macos-14'
|
||||
|
||||
strategy:
|
||||
fail-fast: false
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
submodules: recursive
|
||||
token: ${{ secrets.DEPLOY_KEY }}
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version-file: '.nvmrc'
|
||||
|
||||
- name: Setup Python
|
||||
uses: actions/setup-python@v5
|
||||
# note: This will use the version defined in '.python-version' by default
|
||||
|
||||
- name: Setup Git
|
||||
run: |
|
||||
git config --global user.email "mauro-balades@users.noreply.github.com"
|
||||
git config --global user.name "mauro-balades"
|
||||
|
||||
- name: Install system dependencies
|
||||
run: |
|
||||
brew update
|
||||
brew install cairo sccache gnu-tar mercurial
|
||||
sudo pip install setuptools
|
||||
|
||||
brew uninstall --ignore-dependencies python3.12 -f
|
||||
|
||||
export PATH="$(python3 -m site --user-base)/bin":$PATH
|
||||
python3 -m pip install --user mercurial
|
||||
|
||||
rm '/usr/local/bin/2to3-3.11' '/usr/local/bin/2to3-3.12' '/usr/local/bin/2to3'
|
||||
rm '/usr/local/bin/idle3.11' '/usr/local/bin/idle3.12' '/usr/local/bin/idle3'
|
||||
rm '/usr/local/bin/pydoc3.11' '/usr/local/bin/pydoc3.12' '/usr/local/bin/pydoc3'
|
||||
rm '/usr/local/bin/python3.11' '/usr/local/bin/python3.12' '/usr/local/bin/python3'
|
||||
rm '/usr/local/bin/python3.11-config' '/usr/local/bin/python3.12-config' '/usr/local/bin/python3-config'
|
||||
|
||||
brew install watchman
|
||||
|
||||
cargo install apple-codesign
|
||||
|
||||
- name: Force usage of gnu-tar
|
||||
run: |
|
||||
echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.bash_profile
|
||||
echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.zsh
|
||||
source ~/.bash_profile
|
||||
|
||||
- name: Setup pnpm
|
||||
run: npm install -g pnpm
|
||||
|
||||
- name: Get pnpm store directory
|
||||
id: pnpm-cache
|
||||
shell: bash
|
||||
run: |
|
||||
echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
pnpm install
|
||||
|
||||
- name: Load surfer CI setup
|
||||
run: pnpm surfer ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }}
|
||||
|
||||
- name: Download Firefox source and dependencies
|
||||
run: pnpm surfer download
|
||||
|
||||
- name: Download x86_64 app folder from artifacts
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: obj-x86_64-apple-darwin
|
||||
path: engine
|
||||
|
||||
- name: Download aarch64 app folder from artifacts
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: obj-aarch64-apple-darwin
|
||||
path: engine
|
||||
|
||||
- name: Find first .app folder name
|
||||
run: |
|
||||
cd engine/obj-x86_64-apple-darwin/dist
|
||||
export APP_NAME=$(basename $(find . -name "*.app" -type d | head -n 1))
|
||||
echo "APP_NAME=$APP_NAME" >> $GITHUB_ENV
|
||||
echo "APP_NAME=$APP_NAME"
|
||||
|
||||
- name: Bootstrap
|
||||
run: |
|
||||
cd engine
|
||||
export SURFER_PLATFORM="darwin"
|
||||
export PATH="$(python3 -m site --user-base)/bin":$PATH
|
||||
./mach --no-interactive bootstrap --application-choice browser --no-system-changes
|
||||
cd ..
|
||||
|
||||
- name: Import
|
||||
run: pnpm surfer import
|
||||
|
||||
- name: create .p12 for codesign 🖊️
|
||||
run: |
|
||||
cd engine
|
||||
echo ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }} > cert.txt
|
||||
base64 --decode -i cert.txt -o zenCert.p12
|
||||
echo ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }} > zenpCertPassword.passwd
|
||||
|
||||
- name: Remove certificate sensitive information
|
||||
run: |
|
||||
rm engine/cert.txt || true
|
||||
|
||||
- name: Import provisioning profile for .app
|
||||
run: |
|
||||
echo "${{ secrets.macOS_PROVISIONING_PROFILE }}" | base64 --decode > ./engine/Zen_Browser.provisionprofile
|
||||
ls -la
|
||||
|
||||
- name: Copy provisioning profile for .app on both architectures (embedded in .app)
|
||||
run: |
|
||||
cd engine
|
||||
echo "Copying provisioning profile for .app on both architectures (${{ env.APP_NAME }})"
|
||||
cp ./Zen_Browser.provisionprofile ./obj-x86_64-apple-darwin/dist/${{ env.APP_NAME }}/Contents/embedded.provisionprofile
|
||||
cp ./Zen_Browser.provisionprofile ./obj-aarch64-apple-darwin/dist/${{ env.APP_NAME }}/Contents/embedded.provisionprofile
|
||||
|
||||
- name: Unify architectures
|
||||
run: |
|
||||
cd engine
|
||||
./mach python "./toolkit/mozapps/installer/unify.py" "./obj-x86_64-apple-darwin/dist/${{ env.APP_NAME }}" "./obj-aarch64-apple-darwin/dist/${{ env.APP_NAME }}"
|
||||
echo "Merged aaarch64 into x86_64!"
|
||||
|
||||
- name: Import APPLE DEVELOPER ID CERTIFICATE for .app
|
||||
uses: Apple-Actions/import-codesign-certs@v3
|
||||
with:
|
||||
p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}
|
||||
p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}
|
||||
|
||||
- name: Sign .app
|
||||
run: |
|
||||
cd engine
|
||||
./mach macos-sign -v -r -c "release" -e "production" -a "./obj-x86_64-apple-darwin/dist/zen/${{ env.APP_NAME }}" --rcodesign-p12-file zenCert.p12 --rcodesign-p12-password-file zenpCertPassword.passwd
|
||||
|
||||
- name: Remove sensitive information
|
||||
run: |
|
||||
rm -f ./engine/Zen_Browser.provisionprofile
|
||||
|
||||
- name: Create DMG
|
||||
run: |
|
||||
cd engine
|
||||
./mach python -m mozbuild.action.make_dmg ./obj-x86_64-apple-darwin/dist/zen zen-macOS-universal-temp.dmg
|
||||
|
||||
- name: Sign .dmg
|
||||
run: |
|
||||
set -ex
|
||||
hdiutil convert zen-macOS-universal-temp.dmg -format UDZO -imagekey zlib-level=9 -o zen.macos-universal.dmg
|
||||
codesign -s "${{ secrets.macOS_AppleDeveloperId }}" zen.macos-universal.dmg
|
||||
xcrun notarytool submit "zen.macos-universal.dmg" \
|
||||
--apple-id "${{ secrets.macOS_AppleAccountId }}" \
|
||||
--team-id "${{ secrets.macOS_AppleDeveloperIdTeamId }}" \
|
||||
--password "${{ secrets.macOS_AppleDeveloperIdPassword }}" \
|
||||
--no-s3-acceleration \
|
||||
--wait
|
||||
xcrun stapler staple "zen.macos-universal.dmg"
|
||||
|
||||
- name: Upload build artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
retention-days: 5
|
||||
name: zen.macos-${{ matrix.arch }}.dmg
|
||||
path: ./zen.macos-${{ matrix.arch }}.dmg
|
||||
|
||||
- name: Upload build artifact (.mar)
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
retention-days: 5
|
||||
name: macos-${{ matrix.arch }}.mar
|
||||
path: ./macos-${{ matrix.arch }}.mar
|
||||
|
||||
- name: Upload build artifact (update manifests)
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
retention-days: 5
|
||||
name: macos_update_manifest_${{ matrix.arch }}
|
||||
path: ./dist/update
|
||||
@@ -1,39 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<!--
|
||||
Entitlements to apply to the main browser process executable during
|
||||
codesigning of production channel builds.
|
||||
-->
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<!-- Firefox needs to create executable pages (without MAP_JIT) -->
|
||||
<key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
|
||||
|
||||
<!-- Firefox needs to create executable pages with MAP_JIT on aarch64 -->
|
||||
<key>com.apple.security.cs.allow-jit</key><true/>
|
||||
|
||||
<!-- Allow loading third party libraries. Needed for Flash and CDMs -->
|
||||
<key>com.apple.security.cs.disable-library-validation</key><true/>
|
||||
|
||||
<!-- Firefox needs to access the microphone on sites the user allows -->
|
||||
<key>com.apple.security.device.audio-input</key><true/>
|
||||
|
||||
<!-- Firefox needs to access the camera on sites the user allows -->
|
||||
<key>com.apple.security.device.camera</key><true/>
|
||||
|
||||
<!-- Firefox needs to access the location on sites the user allows -->
|
||||
<key>com.apple.security.personal-information.location</key><true/>
|
||||
|
||||
<!-- Allow Firefox to send Apple events to other applications. Needed
|
||||
for native messaging webextension helper applications launched by
|
||||
Firefox which rely on Apple Events to signal other processes. -->
|
||||
<key>com.apple.security.automation.apple-events</key><true/>
|
||||
|
||||
<!-- For SmartCardServices(7) -->
|
||||
<key>com.apple.security.smartcard</key><true/>
|
||||
|
||||
<!-- Required for com.apple.developer.web-browser.public-key-credential -->
|
||||
<key>com.apple.application-identifier</key>
|
||||
<string>H36NPCN86W.app.zen-browser.zen</string>
|
||||
</dict>
|
||||
</plist>
|
||||
@@ -1,179 +0,0 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
# Runs codesign commands to codesign a Firefox .app bundle and enable macOS
|
||||
# Hardened Runtime. Intended to be manually run by developers working on macOS
|
||||
# 10.14+ who want to enable Hardened Runtime for manual testing. This is
|
||||
# provided as a stop-gap until automated build tooling is available that signs
|
||||
# binaries with a certificate generated during builds (bug 1522409). This
|
||||
# script requires macOS 10.14 because Hardened Runtime is only available for
|
||||
# applications running on 10.14 despite support for the codesign "-o runtime"
|
||||
# option being available in 10.13.6 and newer.
|
||||
#
|
||||
# The script requires an identity string (-i option) from an Apple Developer
|
||||
# ID certificate. This can be found in the macOS KeyChain after configuring an
|
||||
# Apple Developer ID certificate.
|
||||
#
|
||||
# Example usage on macOS 10.14:
|
||||
#
|
||||
# $ ./mach build
|
||||
# $ ./mach build package
|
||||
# $ open </PATH/TO/DMG/FILE.dmg>
|
||||
# <Drag Nightly.app to ~>
|
||||
# $ ./security/mac/hardenedruntime/codesign.bash \
|
||||
# -a ~/Nightly.app \
|
||||
# -i <MY-IDENTITY-STRING> \
|
||||
# -b security/mac/hardenedruntime/browser.developer.entitlements.xml
|
||||
# -p security/mac/hardenedruntime/plugin-container.developer.entitlements.xml
|
||||
# $ open ~/Nightly.app
|
||||
#
|
||||
|
||||
usage ()
|
||||
{
|
||||
echo "Usage: $0 "
|
||||
echo " -a <PATH-TO-BROWSER.app>"
|
||||
echo " -i <IDENTITY>"
|
||||
echo " -b <ENTITLEMENTS-FILE>"
|
||||
echo " -p <CHILD-ENTITLEMENTS-FILE>"
|
||||
echo " [-o <OUTPUT-DMG-FILE>]"
|
||||
exit -1
|
||||
}
|
||||
|
||||
# Make sure we are running on macOS with the sw_vers command available.
|
||||
SWVERS=/usr/bin/sw_vers
|
||||
if [ ! -x ${SWVERS} ]; then
|
||||
echo "ERROR: macOS 10.14 or later is required"
|
||||
exit -1
|
||||
fi
|
||||
|
||||
# Require macOS 10.14 or newer.
|
||||
#OSVERSION=`${SWVERS} -productVersion|sed -En 's/[0-9]+\.([0-9]+)\.[0-9]+/\1/p'`;
|
||||
#if [ ${OSVERSION} \< 14 ]; then
|
||||
# echo "ERROR: macOS 10.14 or later is required"
|
||||
# exit -1
|
||||
#fi
|
||||
|
||||
while getopts "a:i:b:o:p:" opt; do
|
||||
case ${opt} in
|
||||
a ) BUNDLE=$OPTARG ;;
|
||||
i ) IDENTITY=$OPTARG ;;
|
||||
b ) BROWSER_ENTITLEMENTS_FILE=$OPTARG ;;
|
||||
p ) PLUGINCONTAINER_ENTITLEMENTS_FILE=$OPTARG ;;
|
||||
o ) OUTPUT_DMG_FILE=$OPTARG ;;
|
||||
\? ) usage; exit -1 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [ -z "${BUNDLE}" ] ||
|
||||
[ -z "${IDENTITY}" ] ||
|
||||
[ -z "${PLUGINCONTAINER_ENTITLEMENTS_FILE}" ] ||
|
||||
[ -z "${BROWSER_ENTITLEMENTS_FILE}" ]; then
|
||||
usage
|
||||
exit -1
|
||||
fi
|
||||
|
||||
if [ ! -d "${BUNDLE}" ]; then
|
||||
echo "Invalid bundle. Bundle should be a .app directory"
|
||||
usage
|
||||
exit -1
|
||||
fi
|
||||
|
||||
if [ ! -e "${PLUGINCONTAINER_ENTITLEMENTS_FILE}" ]; then
|
||||
echo "Invalid entitlements file"
|
||||
usage
|
||||
exit -1
|
||||
fi
|
||||
|
||||
if [ ! -e "${BROWSER_ENTITLEMENTS_FILE}" ]; then
|
||||
echo "Invalid entitlements file"
|
||||
usage
|
||||
exit -1
|
||||
fi
|
||||
|
||||
# DMG file output flag is optional
|
||||
if [ ! -z "${OUTPUT_DMG_FILE}" ] &&
|
||||
[ -e "${OUTPUT_DMG_FILE}" ]; then
|
||||
echo "Output dmg file ${OUTPUT_DMG_FILE} exists. Please delete it first."
|
||||
usage
|
||||
exit -1
|
||||
fi
|
||||
|
||||
echo "-------------------------------------------------------------------------"
|
||||
echo "bundle: $BUNDLE"
|
||||
echo "identity: $IDENTITY"
|
||||
echo "browser entitlements file: $BROWSER_ENTITLEMENTS_FILE"
|
||||
echo "plugin-container entitlements file: $PLUGINCONTAINER_ENTITLEMENTS_FILE"
|
||||
echo "output dmg file (optional): $OUTPUT_DMG_FILE"
|
||||
echo "-------------------------------------------------------------------------"
|
||||
|
||||
set -x
|
||||
|
||||
# move Zen_Browser.provisionprofile to the Contents directory
|
||||
#cp Zen_Browser.provisionprofile "${BUNDLE}"/Contents/embedded.provisionprofile
|
||||
|
||||
# Clear extended attributes which cause codesign to fail
|
||||
xattr -cr "${BUNDLE}"
|
||||
|
||||
# Sign these binaries first. Signing of some binaries has an ordering
|
||||
# requirement where other binaries must be signed first.
|
||||
codesign --force -o runtime --verbose --sign "$IDENTITY" \
|
||||
"${BUNDLE}/Contents/Library/LaunchServices/org.mozilla.updater" \
|
||||
"${BUNDLE}/Contents/MacOS/XUL" \
|
||||
"${BUNDLE}"/Contents/embedded.provisionprofile \
|
||||
"${BUNDLE}/Contents/MacOS/pingsender"
|
||||
|
||||
# Sign every ${BUNDLE}/Contents/MacOS/*.dylib
|
||||
find "${BUNDLE}"/Contents/MacOS -type f -name "*.dylib" -exec \
|
||||
codesign --force --verbose --sign "$IDENTITY" {} \;
|
||||
|
||||
find "${BUNDLE}"/Contents/MacOS -type f -name "*.dylib" -exec \
|
||||
codesign -vvv --strict --deep --verbose {} \;
|
||||
|
||||
codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
|
||||
"${BUNDLE}"/Contents/MacOS/updater.app
|
||||
|
||||
# Sign zen main executable
|
||||
codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
|
||||
--entitlements ${BROWSER_ENTITLEMENTS_FILE} \
|
||||
"${BUNDLE}"/Contents/MacOS/zen
|
||||
|
||||
# Sign Library/LaunchServices
|
||||
codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
|
||||
"${BUNDLE}"/Contents/Library/LaunchServices/org.mozilla.updater
|
||||
|
||||
# Sign gmp-clearkey files
|
||||
find "${BUNDLE}"/Contents/Resources/gmp-clearkey -type f -exec \
|
||||
codesign --force -o runtime --verbose --sign "$IDENTITY" {} \;
|
||||
|
||||
# Sign the main bundle
|
||||
codesign --force -o runtime --verbose --sign "$IDENTITY" \
|
||||
--entitlements ${BROWSER_ENTITLEMENTS_FILE} "${BUNDLE}"
|
||||
|
||||
# Sign the plugin-container bundle with deep
|
||||
codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \
|
||||
--entitlements ${PLUGINCONTAINER_ENTITLEMENTS_FILE} \
|
||||
"${BUNDLE}"/Contents/MacOS/plugin-container.app
|
||||
|
||||
# Validate
|
||||
codesign -vvv --deep --strict "${BUNDLE}"
|
||||
|
||||
# Create a DMG
|
||||
if [ ! -z "${OUTPUT_DMG_FILE}" ]; then
|
||||
DISK_IMAGE_DIR=`mktemp -d`
|
||||
TEMP_FILE=`mktemp`
|
||||
TEMP_DMG=${TEMP_FILE}.dmg
|
||||
NAME=`basename "${BUNDLE}"`
|
||||
|
||||
ditto "${BUNDLE}" "${DISK_IMAGE_DIR}/${NAME}"
|
||||
hdiutil create -size 400m -fs HFS+ \
|
||||
-volname Firefox -srcfolder "${DISK_IMAGE_DIR}" "${TEMP_DMG}"
|
||||
hdiutil convert -format UDZO \
|
||||
-o "${OUTPUT_DMG_FILE}" "${TEMP_DMG}"
|
||||
|
||||
rm ${TEMP_FILE}
|
||||
rm ${TEMP_DMG}
|
||||
rm -rf "${DISK_IMAGE_DIR}"
|
||||
fi
|
||||
@@ -1,32 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<!--
|
||||
Entitlements to apply to the plugin-container.app bundle during
|
||||
codesigning of production channel builds.
|
||||
-->
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<!-- Firefox needs to create executable pages (without MAP_JIT) -->
|
||||
<key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
|
||||
|
||||
<!-- Firefox needs to create executable pages with MAP_JIT on aarch64 -->
|
||||
<key>com.apple.security.cs.allow-jit</key><true/>
|
||||
|
||||
<!-- Allow loading third party libraries. Needed for Flash and CDMs -->
|
||||
<key>com.apple.security.cs.disable-library-validation</key><true/>
|
||||
|
||||
<!-- Firefox needs to access the microphone on sites the user allows -->
|
||||
<key>com.apple.security.device.audio-input</key><true/>
|
||||
|
||||
<!-- Firefox needs to access the camera on sites the user allows -->
|
||||
<key>com.apple.security.device.camera</key><true/>
|
||||
|
||||
<!-- Firefox needs to access the location on sites the user allows -->
|
||||
<key>com.apple.security.personal-information.location</key><true/>
|
||||
|
||||
<!-- Allow Firefox to send Apple events to other applications. Needed
|
||||
for native messaging webextension helper applications launched by
|
||||
Firefox which rely on Apple Events to signal other processes. -->
|
||||
<key>com.apple.security.automation.apple-events</key><true/>
|
||||
</dict>
|
||||
</plist>
|
||||
@@ -12,12 +12,8 @@ export MOZ_LTO=cross,thin
|
||||
ac_add_options --enable-lto=cross,thin
|
||||
|
||||
if test "$ZEN_RELEASE"; then
|
||||
if test "$ZEN_GA_DISABLE_PGO"; then
|
||||
export ZEN_DUMMY=1
|
||||
else
|
||||
export MOZ_PGO=1
|
||||
ac_add_options MOZ_PGO=1
|
||||
fi
|
||||
export ZEN_DUMMY=1
|
||||
|
||||
fi
|
||||
|
||||
if test "$SURFER_COMPAT" = "x86_64"; then
|
||||
|
||||
Reference in New Issue
Block a user