diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 518265a08..4ac5e4999 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -350,6 +350,17 @@ jobs: build-version: ${{ needs.build-data.outputs.version }} release-branch: ${{ inputs.update_branch }} + mac-uni: + name: macOS build (Universal) + uses: ./.github/workflows/macos-universal-release-build.yml + permissions: + contents: write + secrets: inherit + needs: [build-data] + with: + build-version: ${{ needs.build-data.outputs.version }} + release-branch: ${{ inputs.update_branch }} + appimage: name: AppImage build - Linux ${{ matrix.arch }} permissions: @@ -453,7 +464,7 @@ jobs: if: ${{ inputs.create_release || inputs.update_branch == 'twilight' }} permissions: write-all name: Release - needs: [build-data, linux, windows-step-3, check-release, mac, appimage, source, lint, stop-self-hosted] + needs: [build-data, linux, windows-step-3, check-release, mac-uni, appimage, source, lint, stop-self-hosted] runs-on: ubuntu-latest environment: name: ${{ inputs.update_branch == 'release' && 'Deploy-Release' || 'Deploy-Twilight' }} diff --git a/.github/workflows/macos-release-build.yml b/.github/workflows/macos-release-build.yml index e3bb85823..c7f352113 100644 --- a/.github/workflows/macos-release-build.yml +++ b/.github/workflows/macos-release-build.yml @@ -120,27 +120,12 @@ jobs: export SURFER_PLATFORM="darwin" bash .github/workflows/src/release-build.sh - - name: Import APPLE DEVELOPER ID CERTIFICATE for .app - uses: Apple-Actions/import-codesign-certs@v3 - with: - p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }} - p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }} - - - name: Import provisioning profile for .app - run: | - echo "${{ secrets.macOS_PROVISIONING_PROFILE }}" | base64 --decode > ./engine/Zen_Browser.provisionprofile - ls -la - - name: Package env: SURFER_COMPAT: ${{ matrix.arch }} ZEN_GA_DISABLE_PGO: true - MACOS_APPLE_ACCOUNT_ID: ${{ secrets.macOS_AppleAccountId }} - MACOS_APPLE_DEVELOPER_ID_TEAM_ID: ${{ secrets.macOS_AppleDeveloperIdTeamId }} - MACOS_APPLE_DEVELOPER_ID_PASSWORD: ${{ secrets.macOS_AppleDeveloperIdPassword }} run: | export SURFER_PLATFORM="darwin" - export MACOS_APPLE_DEVELOPER_ID="${{ secrets.macOS_AppleDeveloperId }}" export ZEN_RELEASE=1 pnpm package @@ -148,31 +133,12 @@ jobs: run: | mv ./dist/output.mar macos-${{ matrix.arch }}.mar - - name: Remove sensitive information - run: | - rm -f ./engine/Zen_Browser.provisionprofile - - - name: Sign .dmg - run: | - set -ex - hdiutil convert ./dist/*.dmg -format UDZO -imagekey zlib-level=9 -o zen.macos-${{ matrix.arch }}.dmg - xattr -cr zen.macos-${{ matrix.arch }}.dmg - codesign -s "${{ secrets.macOS_AppleDeveloperId }}" zen.macos-${{ matrix.arch }}.dmg - xcrun notarytool submit "zen.macos-${{ matrix.arch }}.dmg" \ - --apple-id "${{ secrets.macOS_AppleAccountId }}" \ - --team-id "${{ secrets.macOS_AppleDeveloperIdTeamId }}" \ - --password "${{ secrets.macOS_AppleDeveloperIdPassword }}" \ - --no-s3-acceleration \ - --verbose \ - --wait - xcrun stapler staple "zen.macos-${{ matrix.arch }}.dmg" - - - name: Upload build artifact + - name: Upload dist app folder uses: actions/upload-artifact@v4 with: - retention-days: 5 - name: zen.macos-${{ matrix.arch }}.dmg - path: ./zen.macos-${{ matrix.arch }}.dmg + retention-days: 1 + name: obj-${{ matrix.arch }}-apple-darwin + path: ./engine/obj-${{ matrix.arch }}-apple-darwin - name: Upload build artifact (.mar) uses: actions/upload-artifact@v4 diff --git a/.github/workflows/macos-universal-release-build.yml b/.github/workflows/macos-universal-release-build.yml new file mode 100644 index 000000000..04d95a992 --- /dev/null +++ b/.github/workflows/macos-universal-release-build.yml @@ -0,0 +1,201 @@ +name: macOS Release Build + +on: + workflow_call: + inputs: + build-version: + description: 'The version to build' + required: true + type: string + release-branch: + description: 'The branch to build' + required: true + type: string + +jobs: + mac-build: + name: Unify macOS (Universal) + runs-on: 'macos-14' + + strategy: + fail-fast: false + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: recursive + token: ${{ secrets.DEPLOY_KEY }} + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version-file: '.nvmrc' + + - name: Setup Python + uses: actions/setup-python@v5 + # note: This will use the version defined in '.python-version' by default + + - name: Setup Git + run: | + git config --global user.email "mauro-balades@users.noreply.github.com" + git config --global user.name "mauro-balades" + + - name: Install system dependencies + run: | + brew update + brew install cairo sccache gnu-tar mercurial + sudo pip install setuptools + + brew uninstall --ignore-dependencies python3.12 -f + + export PATH="$(python3 -m site --user-base)/bin":$PATH + python3 -m pip install --user mercurial + + rm '/usr/local/bin/2to3-3.11' '/usr/local/bin/2to3-3.12' '/usr/local/bin/2to3' + rm '/usr/local/bin/idle3.11' '/usr/local/bin/idle3.12' '/usr/local/bin/idle3' + rm '/usr/local/bin/pydoc3.11' '/usr/local/bin/pydoc3.12' '/usr/local/bin/pydoc3' + rm '/usr/local/bin/python3.11' '/usr/local/bin/python3.12' '/usr/local/bin/python3' + rm '/usr/local/bin/python3.11-config' '/usr/local/bin/python3.12-config' '/usr/local/bin/python3-config' + + brew install watchman + + cargo install apple-codesign + + - name: Force usage of gnu-tar + run: | + echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.bash_profile + echo 'export PATH="/usr/local/opt/gnu-tar/libexec/gnubin:$PATH"' >> ~/.zsh + source ~/.bash_profile + + - name: Setup pnpm + run: npm install -g pnpm + + - name: Get pnpm store directory + id: pnpm-cache + shell: bash + run: | + echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT + + - name: Install dependencies + run: | + pnpm install + + - name: Load surfer CI setup + run: pnpm surfer ci --brand ${{ inputs.release-branch }} --display-version ${{ inputs.build-version }} + + - name: Download Firefox source and dependencies + run: pnpm surfer download + + - name: Download x86_64 app folder from artifacts + uses: actions/download-artifact@v4 + with: + name: obj-x86_64-apple-darwin + path: engine + + - name: Download aarch64 app folder from artifacts + uses: actions/download-artifact@v4 + with: + name: obj-aarch64-apple-darwin + path: engine + + - name: Find first .app folder name + run: | + cd engine/obj-x86_64-apple-darwin/dist + export APP_NAME=$(basename $(find . -name "*.app" -type d | head -n 1)) + echo "APP_NAME=$APP_NAME" >> $GITHUB_ENV + echo "APP_NAME=$APP_NAME" + + - name: Bootstrap + run: | + cd engine + export SURFER_PLATFORM="darwin" + export PATH="$(python3 -m site --user-base)/bin":$PATH + ./mach --no-interactive bootstrap --application-choice browser --no-system-changes + cd .. + + - name: Import + run: pnpm surfer import + + - name: create .p12 for codesign 🖊️ + run: | + cd engine + echo ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }} > cert.txt + base64 --decode -i cert.txt -o zenCert.p12 + echo ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }} > zenpCertPassword.passwd + + - name: Remove certificate sensitive information + run: | + rm engine/cert.txt || true + + - name: Import provisioning profile for .app + run: | + echo "${{ secrets.macOS_PROVISIONING_PROFILE }}" | base64 --decode > ./engine/Zen_Browser.provisionprofile + ls -la + + - name: Copy provisioning profile for .app on both architectures (embedded in .app) + run: | + cd engine + echo "Copying provisioning profile for .app on both architectures (${{ env.APP_NAME }})" + cp ./Zen_Browser.provisionprofile ./obj-x86_64-apple-darwin/dist/${{ env.APP_NAME }}/Contents/embedded.provisionprofile + cp ./Zen_Browser.provisionprofile ./obj-aarch64-apple-darwin/dist/${{ env.APP_NAME }}/Contents/embedded.provisionprofile + + - name: Unify architectures + run: | + cd engine + ./mach python "./toolkit/mozapps/installer/unify.py" "./obj-x86_64-apple-darwin/dist/${{ env.APP_NAME }}" "./obj-aarch64-apple-darwin/dist/${{ env.APP_NAME }}" + echo "Merged aaarch64 into x86_64!" + + - name: Import APPLE DEVELOPER ID CERTIFICATE for .app + uses: Apple-Actions/import-codesign-certs@v3 + with: + p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }} + p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }} + + - name: Sign .app + run: | + cd engine + ./mach macos-sign -v -r -c "release" -e "production" -a "./obj-x86_64-apple-darwin/dist/zen/${{ env.APP_NAME }}" --rcodesign-p12-file zenCert.p12 --rcodesign-p12-password-file zenpCertPassword.passwd + + - name: Remove sensitive information + run: | + rm -f ./engine/Zen_Browser.provisionprofile + + - name: Create DMG + run: | + cd engine + ./mach python -m mozbuild.action.make_dmg ./obj-x86_64-apple-darwin/dist/zen zen-macOS-universal-temp.dmg + + - name: Sign .dmg + run: | + set -ex + hdiutil convert zen-macOS-universal-temp.dmg -format UDZO -imagekey zlib-level=9 -o zen.macos-universal.dmg + codesign -s "${{ secrets.macOS_AppleDeveloperId }}" zen.macos-universal.dmg + xcrun notarytool submit "zen.macos-universal.dmg" \ + --apple-id "${{ secrets.macOS_AppleAccountId }}" \ + --team-id "${{ secrets.macOS_AppleDeveloperIdTeamId }}" \ + --password "${{ secrets.macOS_AppleDeveloperIdPassword }}" \ + --no-s3-acceleration \ + --wait + xcrun stapler staple "zen.macos-universal.dmg" + + - name: Upload build artifact + uses: actions/upload-artifact@v4 + with: + retention-days: 5 + name: zen.macos-${{ matrix.arch }}.dmg + path: ./zen.macos-${{ matrix.arch }}.dmg + + - name: Upload build artifact (.mar) + uses: actions/upload-artifact@v4 + with: + retention-days: 5 + name: macos-${{ matrix.arch }}.mar + path: ./macos-${{ matrix.arch }}.mar + + - name: Upload build artifact (update manifests) + uses: actions/upload-artifact@v4 + with: + retention-days: 5 + name: macos_update_manifest_${{ matrix.arch }} + path: ./dist/update diff --git a/build/codesign/browser.developer.entitlements.xml b/build/codesign/browser.developer.entitlements.xml deleted file mode 100644 index 7722dd8df..000000000 --- a/build/codesign/browser.developer.entitlements.xml +++ /dev/null @@ -1,39 +0,0 @@ - - - - - - - com.apple.security.cs.allow-unsigned-executable-memory - - - com.apple.security.cs.allow-jit - - - com.apple.security.cs.disable-library-validation - - - com.apple.security.device.audio-input - - - com.apple.security.device.camera - - - com.apple.security.personal-information.location - - - com.apple.security.automation.apple-events - - - com.apple.security.smartcard - - - com.apple.application-identifier - H36NPCN86W.app.zen-browser.zen - - diff --git a/build/codesign/codesign.bash b/build/codesign/codesign.bash deleted file mode 100644 index 74104451b..000000000 --- a/build/codesign/codesign.bash +++ /dev/null @@ -1,179 +0,0 @@ -#!/bin/bash -# -# This Source Code Form is subject to the terms of the Mozilla Public -# License, v. 2.0. If a copy of the MPL was not distributed with this -# file, You can obtain one at https://mozilla.org/MPL/2.0/. -# -# Runs codesign commands to codesign a Firefox .app bundle and enable macOS -# Hardened Runtime. Intended to be manually run by developers working on macOS -# 10.14+ who want to enable Hardened Runtime for manual testing. This is -# provided as a stop-gap until automated build tooling is available that signs -# binaries with a certificate generated during builds (bug 1522409). This -# script requires macOS 10.14 because Hardened Runtime is only available for -# applications running on 10.14 despite support for the codesign "-o runtime" -# option being available in 10.13.6 and newer. -# -# The script requires an identity string (-i option) from an Apple Developer -# ID certificate. This can be found in the macOS KeyChain after configuring an -# Apple Developer ID certificate. -# -# Example usage on macOS 10.14: -# -# $ ./mach build -# $ ./mach build package -# $ open -# -# $ ./security/mac/hardenedruntime/codesign.bash \ -# -a ~/Nightly.app \ -# -i \ -# -b security/mac/hardenedruntime/browser.developer.entitlements.xml -# -p security/mac/hardenedruntime/plugin-container.developer.entitlements.xml -# $ open ~/Nightly.app -# - -usage () -{ - echo "Usage: $0 " - echo " -a " - echo " -i " - echo " -b " - echo " -p " - echo " [-o ]" - exit -1 -} - -# Make sure we are running on macOS with the sw_vers command available. -SWVERS=/usr/bin/sw_vers -if [ ! -x ${SWVERS} ]; then - echo "ERROR: macOS 10.14 or later is required" - exit -1 -fi - -# Require macOS 10.14 or newer. -#OSVERSION=`${SWVERS} -productVersion|sed -En 's/[0-9]+\.([0-9]+)\.[0-9]+/\1/p'`; -#if [ ${OSVERSION} \< 14 ]; then -# echo "ERROR: macOS 10.14 or later is required" -# exit -1 -#fi - -while getopts "a:i:b:o:p:" opt; do - case ${opt} in - a ) BUNDLE=$OPTARG ;; - i ) IDENTITY=$OPTARG ;; - b ) BROWSER_ENTITLEMENTS_FILE=$OPTARG ;; - p ) PLUGINCONTAINER_ENTITLEMENTS_FILE=$OPTARG ;; - o ) OUTPUT_DMG_FILE=$OPTARG ;; - \? ) usage; exit -1 ;; - esac -done - -if [ -z "${BUNDLE}" ] || - [ -z "${IDENTITY}" ] || - [ -z "${PLUGINCONTAINER_ENTITLEMENTS_FILE}" ] || - [ -z "${BROWSER_ENTITLEMENTS_FILE}" ]; then - usage - exit -1 -fi - -if [ ! -d "${BUNDLE}" ]; then - echo "Invalid bundle. Bundle should be a .app directory" - usage - exit -1 -fi - -if [ ! -e "${PLUGINCONTAINER_ENTITLEMENTS_FILE}" ]; then - echo "Invalid entitlements file" - usage - exit -1 -fi - -if [ ! -e "${BROWSER_ENTITLEMENTS_FILE}" ]; then - echo "Invalid entitlements file" - usage - exit -1 -fi - -# DMG file output flag is optional -if [ ! -z "${OUTPUT_DMG_FILE}" ] && - [ -e "${OUTPUT_DMG_FILE}" ]; then - echo "Output dmg file ${OUTPUT_DMG_FILE} exists. Please delete it first." - usage - exit -1 -fi - -echo "-------------------------------------------------------------------------" -echo "bundle: $BUNDLE" -echo "identity: $IDENTITY" -echo "browser entitlements file: $BROWSER_ENTITLEMENTS_FILE" -echo "plugin-container entitlements file: $PLUGINCONTAINER_ENTITLEMENTS_FILE" -echo "output dmg file (optional): $OUTPUT_DMG_FILE" -echo "-------------------------------------------------------------------------" - -set -x - -# move Zen_Browser.provisionprofile to the Contents directory -#cp Zen_Browser.provisionprofile "${BUNDLE}"/Contents/embedded.provisionprofile - -# Clear extended attributes which cause codesign to fail -xattr -cr "${BUNDLE}" - -# Sign these binaries first. Signing of some binaries has an ordering -# requirement where other binaries must be signed first. -codesign --force -o runtime --verbose --sign "$IDENTITY" \ -"${BUNDLE}/Contents/Library/LaunchServices/org.mozilla.updater" \ -"${BUNDLE}/Contents/MacOS/XUL" \ -"${BUNDLE}"/Contents/embedded.provisionprofile \ -"${BUNDLE}/Contents/MacOS/pingsender" - -# Sign every ${BUNDLE}/Contents/MacOS/*.dylib -find "${BUNDLE}"/Contents/MacOS -type f -name "*.dylib" -exec \ -codesign --force --verbose --sign "$IDENTITY" {} \; - -find "${BUNDLE}"/Contents/MacOS -type f -name "*.dylib" -exec \ -codesign -vvv --strict --deep --verbose {} \; - -codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \ -"${BUNDLE}"/Contents/MacOS/updater.app - -# Sign zen main executable -codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \ ---entitlements ${BROWSER_ENTITLEMENTS_FILE} \ -"${BUNDLE}"/Contents/MacOS/zen - -# Sign Library/LaunchServices -codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \ -"${BUNDLE}"/Contents/Library/LaunchServices/org.mozilla.updater - -# Sign gmp-clearkey files -find "${BUNDLE}"/Contents/Resources/gmp-clearkey -type f -exec \ -codesign --force -o runtime --verbose --sign "$IDENTITY" {} \; - -# Sign the main bundle -codesign --force -o runtime --verbose --sign "$IDENTITY" \ ---entitlements ${BROWSER_ENTITLEMENTS_FILE} "${BUNDLE}" - -# Sign the plugin-container bundle with deep -codesign --force -o runtime --verbose --sign "$IDENTITY" --deep \ ---entitlements ${PLUGINCONTAINER_ENTITLEMENTS_FILE} \ -"${BUNDLE}"/Contents/MacOS/plugin-container.app - -# Validate -codesign -vvv --deep --strict "${BUNDLE}" - -# Create a DMG -if [ ! -z "${OUTPUT_DMG_FILE}" ]; then - DISK_IMAGE_DIR=`mktemp -d` - TEMP_FILE=`mktemp` - TEMP_DMG=${TEMP_FILE}.dmg - NAME=`basename "${BUNDLE}"` - - ditto "${BUNDLE}" "${DISK_IMAGE_DIR}/${NAME}" - hdiutil create -size 400m -fs HFS+ \ - -volname Firefox -srcfolder "${DISK_IMAGE_DIR}" "${TEMP_DMG}" - hdiutil convert -format UDZO \ - -o "${OUTPUT_DMG_FILE}" "${TEMP_DMG}" - - rm ${TEMP_FILE} - rm ${TEMP_DMG} - rm -rf "${DISK_IMAGE_DIR}" -fi diff --git a/build/codesign/plugin-container.developer.entitlements.xml b/build/codesign/plugin-container.developer.entitlements.xml deleted file mode 100644 index 050c2df66..000000000 --- a/build/codesign/plugin-container.developer.entitlements.xml +++ /dev/null @@ -1,32 +0,0 @@ - - - - - - - com.apple.security.cs.allow-unsigned-executable-memory - - - com.apple.security.cs.allow-jit - - - com.apple.security.cs.disable-library-validation - - - com.apple.security.device.audio-input - - - com.apple.security.device.camera - - - com.apple.security.personal-information.location - - - com.apple.security.automation.apple-events - - \ No newline at end of file diff --git a/configs/macos/mozconfig b/configs/macos/mozconfig index 34ee5c6a5..7ab6a2275 100644 --- a/configs/macos/mozconfig +++ b/configs/macos/mozconfig @@ -12,12 +12,8 @@ export MOZ_LTO=cross,thin ac_add_options --enable-lto=cross,thin if test "$ZEN_RELEASE"; then - if test "$ZEN_GA_DISABLE_PGO"; then - export ZEN_DUMMY=1 - else - export MOZ_PGO=1 - ac_add_options MOZ_PGO=1 - fi + export ZEN_DUMMY=1 + fi if test "$SURFER_COMPAT" = "x86_64"; then