1# This must match the team in the provisioning profile.
2IDENTITY="Zed Industries, Inc."
3APPLE_NOTARIZATION_TEAM="MQ55VZLNZQ"
4
5local_arch=false
6local_only=false
7local_install=false
8can_code_sign=false
9app_path=""
10app_target=""
11# Function for displaying help info
12help_info() {
13 echo "
14Usage: ${0##*/} [options] [bundle_name]
15Notarize the application bundle for macOS.
16
17Options:
18 -l Notarize local architecture only.
19 -o Open dir with the resulting DMG or launch the app itself in local mode.
20 -i Install the resulting DMG into /Applications in local mode. Noop without -l.
21 -h Display this help and exit.
22 "
23}
24
25while getopts 'loih' flag
26do
27 case "${flag}" in
28 o) open_result=true
29 ;;
30 l)
31 local_arch=true
32 local_only=true
33 ;;
34 i) local_install=true;;
35 h)
36 help_info
37 exit 0
38 ;;
39 esac
40done
41
42shift
43if [[ $# -gt 0 ]]; then
44 if [ "$1" ]; then
45 app_path=$1
46 fi
47 if [ "$2" ]; then
48 app_target=$2
49 fi
50fi
51
52pushd crates/zed
53channel=$(<RELEASE_CHANNEL)
54export ZED_RELEASE_CHANNEL="${channel}"
55popd
56
57if [[ -n "${MACOS_CERTIFICATE:-}" && -n "${MACOS_CERTIFICATE_PASSWORD:-}" && -n "${APPLE_NOTARIZATION_KEY:-}" && -n "${APPLE_NOTARIZATION_KEY_ID:-}" && -n "${APPLE_NOTARIZATION_ISSUER_ID:-}" ]]; then
58 can_code_sign=true
59
60 echo "Setting up keychain for code signing..."
61 security create-keychain -p "$MACOS_CERTIFICATE_PASSWORD" zed.keychain || echo ""
62 security default-keychain -s zed.keychain
63 security unlock-keychain -p "$MACOS_CERTIFICATE_PASSWORD" zed.keychain
64 echo "$MACOS_CERTIFICATE" | base64 --decode > /tmp/zed-certificate.p12
65 security import /tmp/zed-certificate.p12 -k zed.keychain -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
66 rm /tmp/zed-certificate.p12
67 security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CERTIFICATE_PASSWORD" zed.keychain
68
69 function cleanup() {
70 echo "Cleaning up keychain"
71 security default-keychain -s login.keychain
72 security delete-keychain zed.keychain
73 }
74
75 trap cleanup EXIT
76fi
77
78
79GIT_VERSION="v2.43.3"
80GIT_VERSION_SHA="fa29823"
81
82function download_and_unpack() {
83 local url=$1
84 local path_to_unpack=$2
85 local target_path=$3
86
87 temp_dir=$(mktemp -d)
88
89 if ! command -v curl &> /dev/null; then
90 echo "curl is not installed. Please install curl to continue."
91 exit 1
92 fi
93
94 curl --silent --fail --location "$url" | tar -xvz -C "$temp_dir" -f - $path_to_unpack
95
96 mv "$temp_dir/$path_to_unpack" "$target_path"
97
98 rm -rf "$temp_dir"
99}
100
101function download_git() {
102 local architecture=$1
103 local target_binary=$2
104
105 tmp_dir=$(mktemp -d)
106 pushd "$tmp_dir"
107
108 case "$architecture" in
109 aarch64-apple-darwin)
110 download_and_unpack "https://github.com/desktop/dugite-native/releases/download/${GIT_VERSION}/dugite-native-${GIT_VERSION}-${GIT_VERSION_SHA}-macOS-arm64.tar.gz" bin/git ./git
111 ;;
112 x86_64-apple-darwin)
113 download_and_unpack "https://github.com/desktop/dugite-native/releases/download/${GIT_VERSION}/dugite-native-${GIT_VERSION}-${GIT_VERSION_SHA}-macOS-x64.tar.gz" bin/git ./git
114 ;;
115 *)
116 echo "Unsupported architecture: $architecture"
117 exit 1
118 ;;
119 esac
120
121 popd
122
123 mv "${tmp_dir}/git" "${target_binary}"
124 rm -rf "$tmp_dir"
125}
126
127
128function sign_app_binaries() {
129 local app_path=$1
130 local architecture=$2
131 local architecture_dir=$architecture
132 rm -rf "${app_path}/Contents/Frameworks"
133 mkdir -p "${app_path}/Contents/Frameworks"
134
135 echo "Downloading git binary"
136 download_git "${architecture}" "${app_path}/Contents/MacOS/git"
137
138 # Note: The app identifier for our development builds is the same as the app identifier for nightly.
139 cp crates/zed/contents/$channel/embedded.provisionprofile "${app_path}/Contents/"
140
141 if [[ $can_code_sign = true ]]; then
142 echo "Code signing binaries"
143 # sequence of codesign commands modeled after this example: https://developer.apple.com/forums/thread/701514
144 /usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/cli" -v
145 /usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/git" -v
146 /usr/bin/codesign --deep --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${app_path}/Contents/MacOS/zed" -v
147 /usr/bin/codesign --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${app_path}" -v
148 else
149 echo "One or more of the following variables are missing: MACOS_CERTIFICATE, MACOS_CERTIFICATE_PASSWORD, APPLE_NOTARIZATION_KEY, APPLE_NOTARIZATION_KEY_ID, APPLE_NOTARIZATION_ISSUER_ID"
150 if [[ "$local_only" = false ]]; then
151 echo "To create a self-signed local build use ./scripts/build.sh -ldf"
152 exit 1
153 fi
154
155 echo "====== WARNING ======"
156 echo "This bundle is being signed without all entitlements, some features (e.g. universal links) will not work"
157 echo "====== WARNING ======"
158
159 # NOTE: if you need to test universal links you have a few paths forward:
160 # - create a PR and tag it with the `run-bundling` label, and download the .dmg file from there.
161 # - get a signing key for the MQ55VZLNZQ team from Nathan.
162 # - create your own signing key, and update references to MQ55VZLNZQ to your own team ID
163 # then comment out this line.
164 cat crates/zed/resources/zed.entitlements | sed '/com.apple.developer.associated-domains/,+1d' > "${app_path}/Contents/Resources/zed.entitlements"
165
166 codesign --force --deep --entitlements "${app_path}/Contents/Resources/zed.entitlements" --sign ${MACOS_SIGNING_KEY:- -} "${app_path}" -v
167 fi
168
169 if [[ "$target_dir" = "debug" && "$local_only" = false ]]; then
170 if [ "$open_result" = true ]; then
171 open "$app_path"
172 else
173 echo "Created application bundle:"
174 echo "$app_path"
175 fi
176 exit 0
177 fi
178 bundle_name=$(basename "$app_path")
179
180 # If bundle_name doesn't end in .app, append it
181 if [[ "$bundle_name" != *.app ]]; then
182 bundle_name="$bundle_name.app"
183 fi
184
185 if [ "$local_only" = true ]; then
186 if [ "$local_install" = true ]; then
187 rm -rf "/Applications/$bundle_name"
188 mv "$app_path" "/Applications/$bundle_name"
189 echo "Installed application bundle: /Applications/$bundle_name"
190 if [ "$open_result" = true ]; then
191 echo "Opening /Applications/$bundle_name"
192 open "/Applications/$bundle_name"
193 fi
194 else
195 if [ "$open_result" = true ]; then
196 echo "Opening $app_path"
197 open "$app_path"
198 fi
199 fi
200 else
201 dmg_target_directory="target/${architecture_dir}/${target_dir}"
202 dmg_source_directory="${dmg_target_directory}/dmg"
203 dmg_file_path="${dmg_target_directory}/Zed.dmg"
204 xcode_bin_dir_path="$(xcode-select -p)/usr/bin"
205
206 rm -rf ${dmg_source_directory}
207 mkdir -p ${dmg_source_directory}
208 mv "${app_path}" "${dmg_source_directory}"
209 notarization_key_file=$(mktemp)
210
211 echo "Adding symlink to /Applications to ${dmg_source_directory}"
212 ln -s /Applications ${dmg_source_directory}
213
214 echo "Creating final DMG at ${dmg_file_path} using ${dmg_source_directory}"
215 hdiutil create -volname Zed -srcfolder "${dmg_source_directory}" -ov -format UDZO "${dmg_file_path}"
216
217 # If someone runs this bundle script locally, a symlink will be placed in `dmg_source_directory`.
218 # This symlink causes CPU issues with Zed if the Zed codebase is the project being worked on, so we simply remove it for now.
219 echo "Removing symlink to /Applications from ${dmg_source_directory}"
220 rm ${dmg_source_directory}/Applications
221
222 echo "Adding license agreement to DMG"
223 npm install --global dmg-license minimist
224 dmg-license script/terms/terms.json "${dmg_file_path}"
225
226 if [[ $can_code_sign = true ]]; then
227 echo "Notarizing DMG with Apple"
228 /usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "$(pwd)/${dmg_file_path}" -v
229 echo "$APPLE_NOTARIZATION_KEY" > "$notarization_key_file"
230 "${xcode_bin_dir_path}/notarytool" submit --wait --key "$notarization_key_file" --key-id "$APPLE_NOTARIZATION_KEY_ID" --issuer "$APPLE_NOTARIZATION_ISSUER_ID" "${dmg_file_path}"
231 rm "$notarization_key_file"
232 "${xcode_bin_dir_path}/stapler" staple "${dmg_file_path}"
233 fi
234
235 if [ "$open_result" = true ]; then
236 open $dmg_target_directory
237 fi
238 fi
239}
240
241function sign_binary() {
242 local binary_path=$1
243
244 if [[ $can_code_sign = true ]]; then
245 echo "Code signing executable $binary_path"
246 /usr/bin/codesign --deep --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${binary_path}" -v
247 fi
248}
249
250sign_app_binaries "$app_path" "$app_target"
251sign_binary "target/x86_64-apple-darwin/release/remote_server"
252
253if [ "$local_arch" = false ]; then
254 gzip -f --stdout --best target/x86_64-apple-darwin/release/remote_server > target/zed-remote-server-macos-x86_64.gz
255fi