tenant.openagents/omega

1#!/usr/bin/env bash
2
3set -euo pipefail
4source script/lib/blob-store.sh
5
6build_flag="--release"
7target_dir="release"
8open_result=false
9local_install=false
10can_code_sign=false
11
12# Prefer OpenAgents Developer ID. Override with MACOS_SIGNING_IDENTITY when needed.
13IDENTITY="${MACOS_SIGNING_IDENTITY:-Developer ID Application: OpenAgents, Inc. (HQWSG26L43)}"
14APPLE_NOTARIZATION_TEAM="${APPLE_NOTARIZATION_TEAM:-HQWSG26L43}"
15
16# Function for displaying help info
17help_info() {
18  echo "
19Usage: ${0##*/} [options] [architecture=host]
20Build the application bundle for macOS.
21
22Options:
23  -d    Compile in debug mode
24  -o    Open dir with the resulting DMG or launch the app itself in local mode.
25  -i    Install the resulting DMG into /Applications.
26  -h    Display this help and exit.
27  "
28}
29
30while getopts 'dloih' flag
31do
32    case "${flag}" in
33        o) open_result=true;;
34        d)
35            export CARGO_INCREMENTAL=true
36            export CARGO_BUNDLE_SKIP_BUILD=true
37            build_flag="";
38            target_dir="debug"
39            ;;
40        i) local_install=true;;
41        h)
42           help_info
43           exit 0
44           ;;
45    esac
46done
47
48shift $((OPTIND-1))
49
50
51# Get release channel
52pushd crates/zed
53channel=$(<RELEASE_CHANNEL)
54export ZED_RELEASE_CHANNEL="${channel}"
55popd
56
57export ZED_BUNDLE=true
58
59cargo_bundle_version=$(cargo -q bundle --help 2>&1 | head -n 1 || echo "")
60if [ "$cargo_bundle_version" != "cargo-bundle v0.6.1-zed" ]; then
61    cargo install cargo-bundle --git https://github.com/zed-industries/cargo-bundle.git --branch zed-deploy
62fi
63
64# Deal with versions of macOS that don't include libstdc++ headers
65export CXXFLAGS="-stdlib=libc++"
66
67version_info=$(rustc --version --verbose)
68host_line=$(echo "$version_info" | grep host)
69target_triple=${host_line#*: }
70if [[ $# -gt 0 && -n "$1" ]]; then
71    target_triple="$1"
72fi
73arch_suffix=""
74
75if [[ "$target_triple" = "x86_64-apple-darwin" ]]; then
76    arch_suffix="x86_64"
77elif [[ "$target_triple" = "aarch64-apple-darwin" ]]; then
78    arch_suffix="aarch64"
79else
80    echo "Unsupported architecture $target_triple"
81    exit 1
82fi
83
84# Generate the licenses first, so they can be baked into the binaries
85script/generate-licenses
86
87rustup target add $target_triple
88
89echo "Compiling zed binaries"
90cargo build ${build_flag} --package zed --package cli --target $target_triple
91# Build remote_server in separate invocation to prevent feature unification from other crates
92# from influencing dynamic libraries required by it.
93cargo build ${build_flag} --package remote_server --target $target_triple
94
95echo "Creating application bundle"
96pushd crates/zed
97cp Cargo.toml Cargo.toml.backup
98sed \
99    -i.backup \
100    "s/package.metadata.bundle-${channel}/package.metadata.bundle/" \
101    Cargo.toml
102
103app_path=$(cargo bundle ${build_flag} --target $target_triple --select-workspace-root | xargs)
104
105mv Cargo.toml.backup Cargo.toml
106popd
107echo "Bundled ${app_path}"
108
109# DocumentTypes.plist references CFBundleTypeIconFile "Document", so the bundle must contain Document.icns.
110# We use the app icon as a placeholder document icon for now.
111document_icon_source="crates/zed/resources/Document.icns"
112document_icon_target="${app_path}/Contents/Resources/Document.icns"
113if [[ -f "${document_icon_source}" ]]; then
114    mkdir -p "$(dirname "${document_icon_target}")"
115    cp "${document_icon_source}" "${document_icon_target}"
116else
117    echo "cargo::warning=Missing ${document_icon_source}; macOS document icons may not appear in Finder."
118fi
119
120if [[ -n "${MACOS_CERTIFICATE:-}" && -n "${MACOS_CERTIFICATE_PASSWORD:-}" && -n "${APPLE_NOTARIZATION_KEY:-}" && -n "${APPLE_NOTARIZATION_KEY_ID:-}" && -n "${APPLE_NOTARIZATION_ISSUER_ID:-}" ]]; then
121    can_code_sign=true
122
123    echo "Setting up keychain for code signing..."
124    security create-keychain -p "$MACOS_CERTIFICATE_PASSWORD" zed.keychain || echo ""
125    security default-keychain -s zed.keychain
126    security unlock-keychain -p "$MACOS_CERTIFICATE_PASSWORD" zed.keychain
127    # Calling set-keychain-settings without `-t` disables the auto-lock timeout
128    security set-keychain-settings zed.keychain
129    echo "$MACOS_CERTIFICATE" | base64 --decode > /tmp/zed-certificate.p12
130    security import /tmp/zed-certificate.p12 -k zed.keychain -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
131    rm /tmp/zed-certificate.p12
132    security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CERTIFICATE_PASSWORD" zed.keychain
133
134    function cleanup() {
135        echo "Cleaning up keychain"
136        security default-keychain -s login.keychain
137        security delete-keychain zed.keychain
138    }
139
140    trap cleanup EXIT
141fi
142
143GIT_VERSION="v2.43.3"
144GIT_VERSION_SHA="fa29823"
145
146function download_and_unpack() {
147    local url=$1
148    local path_to_unpack=$2
149    local target_path=$3
150
151    temp_dir=$(mktemp -d)
152
153    if ! command -v curl &> /dev/null; then
154        echo "curl is not installed. Please install curl to continue."
155        exit 1
156    fi
157
158    curl --silent --fail --location "$url" | tar -xvz -C "$temp_dir" -f - $path_to_unpack
159
160    mv "$temp_dir/$path_to_unpack" "$target_path"
161
162    rm -rf "$temp_dir"
163}
164
165function download_git() {
166    local architecture=$1
167    local target_binary=$2
168
169    tmp_dir=$(mktemp -d)
170    pushd "$tmp_dir"
171
172    case "$architecture" in
173        aarch64-apple-darwin)
174            download_and_unpack "https://github.com/desktop/dugite-native/releases/download/${GIT_VERSION}/dugite-native-${GIT_VERSION}-${GIT_VERSION_SHA}-macOS-arm64.tar.gz" bin/git ./git
175            ;;
176        x86_64-apple-darwin)
177            download_and_unpack "https://github.com/desktop/dugite-native/releases/download/${GIT_VERSION}/dugite-native-${GIT_VERSION}-${GIT_VERSION_SHA}-macOS-x64.tar.gz" bin/git ./git
178            ;;
179        *)
180            echo "Unsupported architecture: $architecture"
181            exit 1
182            ;;
183    esac
184
185    popd
186
187    mv "${tmp_dir}/git" "${target_binary}"
188    rm -rf "$tmp_dir"
189}
190
191function sign_app_binaries() {
192    rm -rf "${app_path}/Contents/Frameworks"
193    mkdir -p "${app_path}/Contents/Frameworks"
194
195    echo "Downloading git binary"
196    download_git "${target_triple}" "${app_path}/Contents/MacOS/git"
197
198    # Note: The app identifier for our development builds is the same as the app identifier for nightly.
199    cp crates/zed/contents/$channel/embedded.provisionprofile "${app_path}/Contents/"
200
201    if [[ $can_code_sign = true ]]; then
202        echo "Code signing binaries"
203        # sequence of codesign commands modeled after this example: https://developer.apple.com/forums/thread/701514
204        /usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/cli" -v
205        /usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/git" -v
206        /usr/bin/codesign --deep --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${app_path}/Contents/MacOS/omega" -v
207        /usr/bin/codesign --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${app_path}" -v
208    else
209        echo "One or more of the following variables are missing: MACOS_CERTIFICATE, MACOS_CERTIFICATE_PASSWORD, APPLE_NOTARIZATION_KEY, APPLE_NOTARIZATION_KEY_ID, APPLE_NOTARIZATION_ISSUER_ID"
210
211        echo "====== WARNING ======"
212        echo "This bundle is being signed without all entitlements, some features (e.g. universal links) will not work"
213        echo "====== WARNING ======"
214
215        # NOTE: if you need to test universal links you have a few paths forward:
216        # - create a PR and tag it with the `run-bundling` label, and download the .dmg file from there.
217        # - get a signing key for the MQ55VZLNZQ team from Nathan.
218        # - create your own signing key, and update references to MQ55VZLNZQ to your own team ID
219        # then comment out this line.
220        cat crates/zed/resources/zed.entitlements | sed '/com.apple.developer.associated-domains/,+1d' > "${app_path}/Contents/Resources/zed.entitlements"
221
222        codesign --force --deep --entitlements "${app_path}/Contents/Resources/zed.entitlements" --sign ${MACOS_SIGNING_KEY:- -} "${app_path}" -v
223    fi
224
225    bundle_name=$(basename "$app_path")
226
227    if [ "$local_install" = true ]; then
228        rm -rf "/Applications/$bundle_name"
229        mv "$app_path" "/Applications/$bundle_name"
230        echo "Installed application bundle: /Applications/$bundle_name"
231        if [ "$open_result" = true ]; then
232            echo "Opening /Applications/$bundle_name"
233            open "/Applications/$bundle_name"
234        fi
235    elif [ "$open_result" = true ]; then
236        open "$app_path"
237    fi
238
239    if [[ "$target_dir" = "debug" ]]; then
240        echo "Debug build detected - skipping DMG creation and signing"
241        if [ "$local_install" = false ]; then
242            echo "Created application bundle:"
243            echo "$app_path"
244        fi
245    else
246        dmg_target_directory="target/${target_triple}/${target_dir}"
247        dmg_source_directory="${dmg_target_directory}/dmg"
248        channel_slug="${ZED_RELEASE_CHANNEL:-$(<crates/zed/RELEASE_CHANNEL)}"
249        case "${channel_slug}" in
250            preview|rc) volume_name="Omega RC" ;;
251            nightly) volume_name="Omega Nightly" ;;
252            stable) volume_name="Omega" ;;
253            *) volume_name="Omega Dev" ;;
254        esac
255        if [[ "${arch_suffix}" = "aarch64" ]]; then
256            dmg_arch="arm64"
257        else
258            dmg_arch="x86_64"
259        fi
260        dmg_file_path="${dmg_target_directory}/Omega-${dmg_arch}.dmg"
261        xcode_bin_dir_path="$(xcode-select -p)/usr/bin"
262
263        rm -rf ${dmg_source_directory}
264        mkdir -p ${dmg_source_directory}
265        mv "${app_path}" "${dmg_source_directory}"
266        notarization_key_file=$(mktemp)
267
268        echo "Adding open-source license notices to ${dmg_source_directory}"
269        cp LICENSE-GPL LICENSE-APACHE "${dmg_source_directory}/"
270        if [[ -f assets/licenses.md ]]; then
271            cp assets/licenses.md "${dmg_source_directory}/"
272        fi
273
274        echo "Adding symlink to /Applications to ${dmg_source_directory}"
275        ln -s /Applications ${dmg_source_directory}
276
277        echo "Creating final DMG at ${dmg_file_path} using ${dmg_source_directory}"
278        hdiutil create -volname "${volume_name}" -srcfolder "${dmg_source_directory}" -ov -format UDZO "${dmg_file_path}"
279
280        # If someone runs this bundle script locally, a symlink will be placed in `dmg_source_directory`.
281        # This symlink causes CPU issues with Zed if the Zed codebase is the project being worked on, so we simply remove it for now.
282        echo "Removing symlink to /Applications from ${dmg_source_directory}"
283        rm ${dmg_source_directory}/Applications
284
285        # Do not attach Zed commercial terms. GPL/Apache notices are copied into the image above.
286
287        if [[ $can_code_sign = true ]]; then
288            echo "Notarizing DMG with Apple"
289            /usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "$(pwd)/${dmg_file_path}" -v
290            echo "$APPLE_NOTARIZATION_KEY" > "$notarization_key_file"
291            "${xcode_bin_dir_path}/notarytool" submit --wait --key "$notarization_key_file" --key-id "$APPLE_NOTARIZATION_KEY_ID" --issuer "$APPLE_NOTARIZATION_ISSUER_ID" "${dmg_file_path}"
292            rm "$notarization_key_file"
293            "${xcode_bin_dir_path}/stapler" staple "${dmg_file_path}"
294        fi
295
296        if [ "$open_result" = true ]; then
297            open $dmg_target_directory
298        fi
299    fi
300}
301
302function sign_binary() {
303    local binary_path=$1
304
305    if [[ $can_code_sign = true ]]; then
306        echo "Code signing executable $binary_path"
307        /usr/bin/codesign --deep --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${binary_path}" -v
308    fi
309}
310
311function upload_debug_symbols() {
312    if [ "$local_install" = true ]; then
313        echo "local install; skipping sentry upload."
314    elif [[ -n "${SENTRY_AUTH_TOKEN:-}" ]]; then
315        echo "Uploading zed debug symbols to sentry..."
316        exe_path="target/${target_triple}/release/omega"
317        if ! dsymutil --flat "target/${target_triple}/${target_dir}/omega" 2> target/dsymutil.log; then
318            echo "dsymutil failed"
319            cat target/dsymutil.log
320            exit 1
321        fi
322        if ! dsymutil --flat "target/${target_triple}/${target_dir}/remote_server" 2> target/dsymutil.log; then
323            echo "dsymutil failed"
324            cat target/dsymutil.log
325            exit 1
326        fi
327        # note: this uploads the unstripped binary which is needed because it contains
328        # .eh_frame data for stack unwinding. see https://github.com/getsentry/symbolic/issues/783
329        # Try uploading up to 3 times
330        for attempt in 1 2 3; do
331            echo "Sentry upload attempt $attempt..."
332            if sentry-cli debug-files upload --include-sources --wait -p zed -o zed-dev \
333                "target/${target_triple}/${target_dir}/omega.dwarf" \
334                "target/${target_triple}/${target_dir}/remote_server.dwarf"; then
335                break
336            else
337                echo "Sentry upload failed on attempt $attempt"
338                if [ $attempt -eq 3 ]; then
339                    echo "All sentry upload attempts failed"
340                    exit 1
341                fi
342            fi
343        done
344    else
345        echo "missing SENTRY_AUTH_TOKEN. skipping sentry upload."
346    fi
347}
348
349upload_debug_symbols
350
351cp target/${target_triple}/${target_dir}/omega "${app_path}/Contents/MacOS/omega"
352cp target/${target_triple}/${target_dir}/cli "${app_path}/Contents/MacOS/cli"
353sign_app_binaries
354
355sign_binary "target/$target_triple/release/remote_server"
356gzip -f --stdout --best target/$target_triple/release/remote_server > target/zed-remote-server-macos-$arch_suffix.gz
357