252 lines
11 KiB
Bash
Executable File
252 lines
11 KiB
Bash
Executable File
#!/bin/bash
|
|
# Build the macOS installer for the tokend and command line tools.
|
|
#
|
|
# This is only tested and supported on macOS 10.10 or later, using Xcode 6.0.1.
|
|
# Building should also work on older macOS versions with slight changes; YMMV.
|
|
|
|
# You need to install the following packages from homebrew or macports or fink:
|
|
# autoconf automake libtool pkg-config help2man gengetopt
|
|
|
|
export MACOSX_DEPLOYMENT_TARGET="10.10"
|
|
|
|
set -ex
|
|
test -x ./configure || ./bootstrap
|
|
BUILDPATH=${PWD}
|
|
|
|
xcode_ver=$(xcodebuild -version | sed -En 's/Xcode[[:space:]](.*)/\1/p')
|
|
base_ver="12.2"
|
|
if [ $(echo -e $base_ver"\n"$xcode_ver | sort -V | head -1) == "$base_ver" ]; then
|
|
export BUILD_ARM="true"
|
|
fi
|
|
|
|
export SED=/usr/bin/sed
|
|
PREFIX=/Library/OpenSC
|
|
export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/lib/pkgconfig
|
|
|
|
if ! pkg-config libcrypto --atleast-version=1.0.1; then
|
|
# OpenSSL is not installed
|
|
if ! test -e $BUILDPATH/openssl_bin/$PREFIX/lib/pkgconfig; then
|
|
# Build OpenSSL manually, because Apple's binaries are deprecated
|
|
if ! test -e openssl; then
|
|
git clone --depth=1 https://github.com/openssl/openssl.git -b OpenSSL_1_1_1-stable
|
|
fi
|
|
cd openssl
|
|
MACHINE=x86_64 ./config no-shared --prefix=$PREFIX
|
|
make clean
|
|
make -j 4
|
|
make DESTDIR=$BUILDPATH/openssl_bin install_sw
|
|
if test -n "${BUILD_ARM}"; then
|
|
make clean
|
|
MACHINE=arm64 KERNEL_BITS=64 ./config no-shared --prefix=$PREFIX
|
|
make -j 4
|
|
make DESTDIR=$BUILDPATH/openssl_arm64 install_sw
|
|
lipo -create $BUILDPATH/openssl_arm64/$PREFIX/lib/libcrypto.a $BUILDPATH/openssl_bin/$PREFIX/lib/libcrypto.a -output libcrypto.a
|
|
lipo -create $BUILDPATH/openssl_arm64/$PREFIX/lib/libssl.a $BUILDPATH/openssl_bin/$PREFIX/lib/libssl.a -output libssl.a
|
|
mv libcrypto.a $BUILDPATH/openssl_bin/$PREFIX/lib/libcrypto.a
|
|
mv libssl.a $BUILDPATH/openssl_bin/$PREFIX/lib/libssl.a
|
|
fi
|
|
cd ..
|
|
fi
|
|
export OPENSSL_CFLAGS="`env PKG_CONFIG_PATH=$BUILDPATH/openssl_bin/$PREFIX/lib/pkgconfig PKG_CONFIG_SYSROOT_DIR=$BUILDPATH/openssl_bin pkg-config --static --cflags libcrypto`"
|
|
export OPENSSL_LIBS="` env PKG_CONFIG_PATH=$BUILDPATH/openssl_bin/$PREFIX/lib/pkgconfig PKG_CONFIG_SYSROOT_DIR=$BUILDPATH/openssl_bin pkg-config --static --libs libcrypto`"
|
|
fi
|
|
|
|
# Locate the latest OSX SDK
|
|
SDK_PATH=$(xcrun --sdk macosx --show-sdk-path)
|
|
export CFLAGS="$CFLAGS -isysroot $SDK_PATH"
|
|
|
|
if test -n "${BUILD_ARM}"; then
|
|
export CFLAGS="$CFLAGS -arch x86_64 -arch arm64"
|
|
export LDFLAGS="$LDFLAGS -arch x86_64 -arch arm64"
|
|
fi
|
|
export OBJCFLAGS=$CFLAGS
|
|
|
|
if ! test -e $BUILDPATH/openpace_bin/$PREFIX/lib/pkgconfig; then
|
|
if ! test -e openpace; then
|
|
git clone --depth=1 https://github.com/frankmorgner/openpace.git -b 1.1.1
|
|
fi
|
|
cd openpace
|
|
autoreconf -vis
|
|
./configure --disable-shared --prefix=$PREFIX CRYPTO_CFLAGS="$OPENSSL_CFLAGS" CRYPTO_LIBS="$OPENSSL_LIBS" HELP2MAN=/usr/bin/true
|
|
touch src/cvc-create.1 src/cvc-print.1
|
|
make DESTDIR=$BUILDPATH/openpace_bin install
|
|
cd ..
|
|
fi
|
|
export OPENPACE_CFLAGS="`env PKG_CONFIG_PATH=$BUILDPATH/openssl_bin/$PREFIX/lib/pkgconfig:$BUILDPATH/openpace_bin/$PREFIX/lib/pkgconfig PKG_CONFIG_SYSROOT_DIR=$BUILDPATH/openpace_bin pkg-config --static --cflags libeac` $OPENSSL_CFLAGS"
|
|
export OPENPACE_LIBS="` env PKG_CONFIG_PATH=$BUILDPATH/openssl_bin/$PREFIX/lib/pkgconfig:$BUILDPATH/openpace_bin/$PREFIX/lib/pkgconfig PKG_CONFIG_SYSROOT_DIR=$BUILDPATH/openpace_bin pkg-config --static --libs libeac` $OPENSSL_LIBS"
|
|
|
|
if ! test -e ${BUILDPATH}/target/$PREFIX/lib/pkgconfig; then
|
|
./configure --prefix=$PREFIX \
|
|
--sysconfdir=$PREFIX/etc \
|
|
--enable-cvcdir=$PREFIX/etc/cvc \
|
|
--enable-x509dir=$PREFIX/etc/x509 \
|
|
--enable-openssl-secure-malloc=65536 \
|
|
--disable-dependency-tracking \
|
|
--enable-shared \
|
|
--enable-static \
|
|
--enable-strict \
|
|
--disable-assert \
|
|
--enable-sm # TODO: remove this (must be sensible default in master)
|
|
|
|
# always make clean
|
|
make clean
|
|
|
|
# compile
|
|
make -j 4
|
|
|
|
# copy files
|
|
rm -rf ${BUILDPATH}/target
|
|
make install DESTDIR=${BUILDPATH}/target
|
|
|
|
# remove garbage
|
|
rm -f ${BUILDPATH}/target/$PREFIX/lib/*.la
|
|
rm -f ${BUILDPATH}/target/$PREFIX/lib/*.a
|
|
|
|
# generate .bundle (required by Adobe Acrobat)
|
|
./MacOSX/libtool-bundle ${BUILDPATH}/target/$PREFIX/lib/opensc-pkcs11.so ${BUILDPATH}/target/$PREFIX/lib
|
|
fi
|
|
|
|
|
|
if ! test -e NotificationProxy; then
|
|
git clone http://github.com/frankmorgner/NotificationProxy.git
|
|
fi
|
|
if test -n "${CODE_SIGN_IDENTITY}" -a -n "${DEVELOPMENT_TEAM}"; then
|
|
xcodebuild -target NotificationProxy -configuration Release -project NotificationProxy/NotificationProxy.xcodeproj install DSTROOT=$BUILDPATH/target/Library/OpenSC/ \
|
|
CODE_SIGN_IDENTITY="${CODE_SIGN_IDENTITY}" DEVELOPMENT_TEAM="${DEVELOPMENT_TEAM}" OTHER_CODE_SIGN_FLAGS="--timestamp --options=runtime" CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO CODE_SIGN_STYLE=Manual
|
|
else
|
|
xcodebuild -target NotificationProxy -configuration Release -project NotificationProxy/NotificationProxy.xcodeproj install DSTROOT=$BUILDPATH/target/Library/OpenSC/
|
|
fi
|
|
mkdir -p "$BUILDPATH/target/Applications/Utilities"
|
|
osacompile -o "$BUILDPATH/target/Applications/Utilities/OpenSC Notify.app" "MacOSX/OpenSC_Notify.applescript"
|
|
if test -n "${CODE_SIGN_IDENTITY}"; then
|
|
codesign --force --sign "${CODE_SIGN_IDENTITY}" --entitlements MacOSX/OpenSC_applescripts.entitlements --deep --timestamp --options runtime "$BUILDPATH/target/Applications/Utilities/OpenSC Notify.app"
|
|
fi
|
|
|
|
|
|
# Build OpenSC.tokend when XCode version < 10
|
|
if (( $(xcodebuild -version | sed -En 's/Xcode[[:space:]]+([0-9]+)(\.[0-9]*)*/\1/p') < 10 )); then
|
|
# Check out OpenSC.tokend, if not already fetched.
|
|
if ! test -e OpenSC.tokend; then
|
|
git clone http://github.com/OpenSC/OpenSC.tokend.git
|
|
fi
|
|
|
|
# Create the symlink to OpenSC sources
|
|
test -L OpenSC.tokend/build/opensc-src || ln -sf ${BUILDPATH}/src OpenSC.tokend/build/opensc-src
|
|
|
|
# Build and copy OpenSC.tokend
|
|
if test -n "${CODE_SIGN_IDENTITY}" -a -n "${DEVELOPMENT_TEAM}"; then
|
|
xcodebuild -target OpenSC -configuration Deployment -project OpenSC.tokend/Tokend.xcodeproj install DSTROOT=${BUILDPATH}/target_tokend \
|
|
CODE_SIGN_IDENTITY="${CODE_SIGN_IDENTITY}" DEVELOPMENT_TEAM="${DEVELOPMENT_TEAM}" OTHER_CODE_SIGN_FLAGS="--timestamp --options=runtime" CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO CODE_SIGN_STYLE=Manual
|
|
else
|
|
xcodebuild -target OpenSC -configuration Deployment -project OpenSC.tokend/Tokend.xcodeproj install DSTROOT=${BUILDPATH}/target_tokend
|
|
fi
|
|
|
|
TOKEND="-tokend"
|
|
else
|
|
# https://github.com/OpenSC/OpenSC.tokend/issues/33
|
|
mkdir -p ${BUILDPATH}/target_tokend
|
|
TOKEND=""
|
|
fi
|
|
|
|
#if ! test -e $BUILDPATH/target/Library/Security/tokend/OpenSC.tokend/Contents/Resources/Applications/terminal-notifier.app; then
|
|
#if ! test -e terminal-notifier-1.7.1.zip; then
|
|
#curl -L https://github.com/julienXX/terminal-notifier/releases/download/1.7.1/terminal-notifier-1.7.1.zip > terminal-notifier-1.7.1.zip
|
|
#fi
|
|
#if ! test -e terminal-notifier-1.7.1; then
|
|
#unzip terminal-notifier-1.7.1.zip
|
|
#fi
|
|
#mkdir -p $BUILDPATH/target/Library/Security/tokend/OpenSC.tokend/Contents/Resources/Applications
|
|
#cp -r terminal-notifier-1.7.1/terminal-notifier.app $BUILDPATH/target/Library/Security/tokend/OpenSC.tokend/Contents/Resources/Applications
|
|
#fi
|
|
|
|
imagedir=$(mktemp -d)
|
|
|
|
# Prepare target root
|
|
mkdir -p ${BUILDPATH}/target/usr/local/bin
|
|
cp MacOSX/opensc-uninstall ${BUILDPATH}/target/usr/local/bin
|
|
|
|
# Prepare startup root
|
|
mkdir -p ${BUILDPATH}/target_startup/Library/LaunchAgents
|
|
cp src/tools/org.opensc-project.mac.pkcs11-register.plist ${BUILDPATH}/target_startup/Library/LaunchAgents
|
|
cp src/tools/org.opensc-project.mac.opensc-notify.plist ${BUILDPATH}/target_startup/Library/LaunchAgents
|
|
|
|
# Build OpenSCToken if possible
|
|
if test -e OpenSCToken -a -n "${CODE_SIGN_IDENTITY}" -a -n "${DEVELOPMENT_TEAM}"; then
|
|
cd OpenSCToken
|
|
# make sure OpenSCToken builds with the same dependencies as before
|
|
if ! test -e OpenSC; then
|
|
git clone --depth=1 file://$PWD/../../OpenSC
|
|
else
|
|
cd OpenSC && git pull && cd ..
|
|
fi
|
|
mkdir -p build
|
|
if ! test -e build/openssl; then
|
|
# build/openssl/lib/libcrypto.a is hardcoded in OpenSCToken
|
|
ln -sf $BUILDPATH/openssl_bin/$PREFIX build/openssl
|
|
# in OpenSCToken's variant of OpenSC we still use OpenSSL flags from above
|
|
fi
|
|
if ! test -e build/openpace; then
|
|
# build/openpace/lib/libeac.a is hardcoded in OpenSCToken
|
|
ln -sf $BUILDPATH/openpace_bin/$PREFIX build/openpace
|
|
# in OpenSCToken's variant of OpenSC we still use OpenPACE flags from above
|
|
fi
|
|
BP=${BUILDPATH}
|
|
. ./bootstrap
|
|
BUILDPATH=${BP}
|
|
xcodebuild -target OpenSCTokenApp -configuration Debug -project OpenSCTokenApp.xcodeproj install DSTROOT=${BUILDPATH}/target_token \
|
|
CODE_SIGN_IDENTITY="${CODE_SIGN_IDENTITY}" DEVELOPMENT_TEAM="${DEVELOPMENT_TEAM}" OTHER_CODE_SIGN_FLAGS="--timestamp --options=runtime" CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO CODE_SIGN_STYLE=Manual
|
|
cd ..
|
|
|
|
COMPONENT_TOKEN="--component-plist MacOSX/target_token.plist"
|
|
else
|
|
# if no OpenSCToken is checked out, then we create a dummy package
|
|
mkdir -p ${BUILDPATH}/target_token
|
|
fi
|
|
|
|
if test -n "${CODE_SIGN_IDENTITY}"; then
|
|
for d in ${BUILDPATH}/target/Library/OpenSC/bin ${BUILDPATH}/target/Library/OpenSC/lib
|
|
do
|
|
# find executable files and run codesign on them
|
|
find ${d} -type f -perm +111 -print -exec \
|
|
codesign --force --sign "${CODE_SIGN_IDENTITY}" --entitlements MacOSX/OpenSC_binaries.entitlements --deep --timestamp --options runtime {} \;
|
|
done
|
|
fi
|
|
|
|
|
|
# Build package
|
|
pkgbuild --root ${BUILDPATH}/target --component-plist MacOSX/target.plist --scripts MacOSX/scripts --identifier org.opensc-project.mac --version @PACKAGE_VERSION@ --install-location / OpenSC.pkg
|
|
pkgbuild --root ${BUILDPATH}/target_tokend --component-plist MacOSX/target_tokend.plist --identifier org.opensc-project.tokend --version @PACKAGE_VERSION@ --install-location / OpenSC-tokend.pkg
|
|
pkgbuild --root ${BUILDPATH}/target_token $COMPONENT_TOKEN --identifier org.opensc-project.mac.opensctoken --version @PACKAGE_VERSION@ --install-location / OpenSCToken.pkg
|
|
pkgbuild --root ${BUILDPATH}/target_startup --component-plist MacOSX/target_startup.plist --identifier org.opensc-project.startup --version @PACKAGE_VERSION@ --install-location / OpenSC-startup.pkg
|
|
|
|
# Build product
|
|
productbuild --distribution MacOSX/Distribution.xml --package-path . --resources MacOSX/resources "${imagedir}/OpenSC @PACKAGE_VERSION@.pkg"
|
|
|
|
# Sign installer
|
|
if test -n "${INSTALLER_SIGN_IDENTITY}"; then
|
|
productsign --sign "${INSTALLER_SIGN_IDENTITY}" "${imagedir}/OpenSC @PACKAGE_VERSION@.pkg" "${BUILDPATH}/OpenSC @PACKAGE_VERSION@.pkg"
|
|
mv "${BUILDPATH}/OpenSC @PACKAGE_VERSION@.pkg" "${imagedir}/OpenSC @PACKAGE_VERSION@.pkg"
|
|
fi
|
|
|
|
# Build "Uninstaller"
|
|
osacompile -o "${imagedir}/OpenSC Uninstaller.app" "MacOSX/OpenSC_Uninstaller.applescript"
|
|
if test -n "${CODE_SIGN_IDENTITY}"; then
|
|
codesign --force --sign "${CODE_SIGN_IDENTITY}" --entitlements MacOSX/OpenSC_applescripts.entitlements --deep --timestamp --options runtime "${imagedir}/OpenSC Uninstaller.app"
|
|
fi
|
|
|
|
# Create .dmg
|
|
rm -f OpenSC-@PACKAGE_VERSION@$TOKEND.dmg
|
|
i=0
|
|
while ! hdiutil create -srcfolder "${imagedir}" -volname "@PACKAGE_NAME@" -fs JHFS+ OpenSC-@PACKAGE_VERSION@$TOKEND.dmg
|
|
do
|
|
i=$[$i+1]
|
|
if [ $i -gt 2 ]
|
|
then
|
|
exit 1
|
|
fi
|
|
done
|
|
rm -rf ${imagedir}
|
|
|
|
#if [ "$TRAVIS_EVENT_TYPE" != "pull_request" ]; then xcrun altool --notarize-app --file $(pwd)/vorteil_darwin-x86.dmg --username $OSX_NOTARIZE_USERNAME --primary-bundle-id com.vorteil.cli -p $OSX_NOTARIZE_PW -- >> /dev/null; fi;
|
|
#if [ "$TRAVIS_EVENT_TYPE" != "pull_request" ]; then for ((i=1;i<=30;i+=1)); do xcrun stapler staple $(pwd)/vorteil_darwin-x86.dmg >> /dev/null; if [ $? = 65 ]; then echo "Waiting for notarization to complete..." && sleep 10; fi; done; fi;
|