macos: packaging support for MacOS X 11.0

[openafs.git] / src / packaging / MacOS / pkgbuild.sh.in

diff --git a/src/packaging/MacOS/pkgbuild.sh.in b/src/packaging/MacOS/pkgbuild.sh.in
index 4c4d629..6b82363 100644 (file)
--- a/src/packaging/MacOS/pkgbuild.sh.in
+++ b/src/packaging/MacOS/pkgbuild.sh.in
@@ -6,10 +6,20 @@ usage() {
     exec >&2
 
     echo 'Usage: pkgbuild.sh [-x] [--app-key <appkey>] [--inst-key <instkey>]'
+    echo '                   [--apple-id <appleid> <password>]'
     echo '                   [--pass N] [--csdb <CellServDB>] <binary-dir>'
     echo
     echo '--app-key and --inst-key are for signing. -x prints all comamnds as '
-    echo 'they are run.'
+    echo 'they are run. --apple-id is for notarizing.'
+    echo
+    echo 'Note: the password associated with <appleid> can be a reference to a'
+    echo 'keychain item. Including your password as cleartext is not'
+    echo 'recommended. e.g.'
+    echo
+    echo '--apple-id foo@bar.com "@keychain:PASSWORD"'
+    echo
+    echo 'In this case, keychain must hold a keychain item named PASSWORD with'
+    echo 'an account matching foo@bar.com.'
     echo
     echo 'By default, all passes are run. Available passes:'
     echo '    --pass 1: prepare pkgroot'
@@ -30,6 +40,8 @@ PASS2=
 
 APP_KEY=
 INST_KEY=
+APPLE_ID=
+APPLE_PW=
 DEST_DIR=
 CSDB=
 
@@ -48,6 +60,12 @@ while [ x"$#" != x0 ] ; do
        INST_KEY="$1"
        shift
        ;;
+    --apple-id)
+       APPLE_ID="$1"
+       shift
+       APPLE_PW="$1"
+       shift
+       ;;
     --csdb)
        CSDB="$1"
        shift
@@ -145,6 +163,13 @@ elif [ x"$majorvers" = x19 ]; then
     RELNAME="Catalina"
     THISREL=15
 
+elif [ x"$majorvers" = x20 ]; then
+    RELNAME="BigSur"
+    # Big Sur version number is 11.0 (not 10.16). Still, set THISREL to 16 so we
+    # know that this version came after the ones listed above.
+    THISREL=16
+    OSVER=11
+
 elif [ x"$majorvers" = x ] ; then
     echo "Error running uname" >&2
     exit 1
@@ -322,6 +347,10 @@ if [ x"$PASS1" = x1 ]; then
     chmod  og-rx "$PKGROOT"/private/var/db/openafs/cache
 
     if [ x"$APP_KEY" != x ] ; then
+       # To be notarized by Apple, all files must be signed.
+       find "$PKGROOT" -type f -exec codesign --verbose --force \
+           --timestamp --sign "$APP_KEY" $CODESIGN_OPTS {} \;
+
        # Sign each 'thing' that we have (commands, kexts, etc)
        for obj in "$DPKGROOT"/Library/OpenAFS/Debug/afs.kext \
                   "$PKGROOT"/Library/OpenAFS/Tools/root.client/usr/vice/etc/afs.kext \
@@ -331,14 +360,13 @@ if [ x"$PASS1" = x1 ]; then
                   "$PKGROOT"/Library/Security/SecurityAgentPlugins/aklog.bundle \
                   "$PKGROOT"/Library/OpenAFS/Tools/tools/growlagent-openafs.app \
                   "$PKGROOT"/Library/OpenAFS/Tools/tools/aklog.bundle \
+                  "$PKGROOT"/Library/OpenAFS/Tools/tools/OpenAFS.prefPane/Contents/Resources/AFSBackgrounder.app \
+                  "$PKGROOT"/Library/OpenAFS/Tools/tools/OpenAFS.prefPane \
                   "$PLUGINS"/afscell.bundle
        do
            codesign --verbose --force --timestamp --sign "$APP_KEY" $CODESIGN_OPTS "$obj"
        done
 
-       # To be notarized by Apple, all files must be signed.
-       find "$PKGROOT" -type f -exec codesign --verbose --force \
-           --timestamp --sign "$APP_KEY" $CODESIGN_OPTS {} \;
 
        # Check if our signatures for our kexts are valid. 'kextutil' will exit
        # with an error and print out a message if something is wrong with the
@@ -349,7 +377,13 @@ if [ x"$PASS1" = x1 ]; then
                    "$PKGROOT"/Library/OpenAFS/Tools/root.client/usr/vice/etc/afs.kext \
                    "$PKGROOT"/private/var/db/openafs/etc/afs.kext
        do
-           kextutil -no-load -print-diagnostics "$kext"
+           # This check will fail on systems that require notarization, because we haven't
+           # notarized anything yet.  For now, just disable the check for those versions.
+           if [ $THISREL -ge 14 ]; then
+               echo "Skipping kextutil checks for $kext"
+           else
+               kextutil -no-load -print-diagnostics "$kext"
+           fi
        done
     fi
 
@@ -478,11 +512,26 @@ if [ x"$PASS2" = x1 ]; then
     fi
 
     # generate Distribution.xml from Distribution.xml.in -- nonstandard substs
-    sed -e "s/%%OSX_MAJOR_CUR%%/$THISREL/g" \
-       -e "s/%%OSX_MAJOR_NEXT%%/$(( $THISREL + 1 ))/g" \
-       -e "s,%%PRES_EXTRA%%,$PRES_EXTRA,g" \
-       -e "s/%%OPENAFS_VERSION%%/@PACKAGE_VERSION@/g" \
-       < Distribution.xml.in > Distribution.xml
+    if [ $majorvers -ge 20 ] ; then
+       # Unlike older versions, point releases for macOS Big Sur increment the
+       # second component of the release number (prior releases increment the
+       # third component of this number).
+       sed -e "s/%%OSX_MAJOR_CUR%%/0/g" \
+           -e "s/%%OSX_MAJOR_NEXT%%/0/g" \
+           -e "s/%%OSVER_CUR%%/$OSVER/g" \
+           -e "s/%%OSVER_NEXT%%/$(( $OSVER + 1 ))/g" \
+           -e "s,%%PRES_EXTRA%%,$PRES_EXTRA,g" \
+           -e "s/%%OPENAFS_VERSION%%/@PACKAGE_VERSION@/g" \
+           < Distribution.xml.in > Distribution.xml
+    else
+       sed -e "s/%%OSX_MAJOR_CUR%%/$THISREL/g" \
+           -e "s/%%OSX_MAJOR_NEXT%%/$(( $THISREL + 1 ))/g" \
+           -e "s/%%OSVER_CUR%%/10/g" \
+           -e "s/%%OSVER_NEXT%%/10/g" \
+           -e "s,%%PRES_EXTRA%%,$PRES_EXTRA,g" \
+           -e "s/%%OPENAFS_VERSION%%/@PACKAGE_VERSION@/g" \
+           < Distribution.xml.in > Distribution.xml
+    fi
 
     rm -rf "$CURDIR/prod"
     mkdir "$CURDIR/prod"
@@ -510,6 +559,7 @@ if [ x"$PASS2" = x1 ]; then
 
     if [ x"$APP_KEY" != x ] ; then
        codesign --verbose --force --timestamp --sign "$APP_KEY" "$CURDIR"/dmg/Uninstall.command
+       codesign --verbose --force --timestamp --sign "$APP_KEY" "$CURDIR"/dmg/OpenAFS.pkg
     fi
 
     hdiutil create -srcfolder "$CURDIR"/dmg -volname OpenAFS \
@@ -519,4 +569,9 @@ if [ x"$PASS2" = x1 ]; then
 
     echo
     echo "Created $CURDIR/OpenAFS-@PACKAGE_VERSION@-$RELNAME".dmg
+
+    if [ x"$APPLE_ID" != x ] ; then
+       echo "Notarizing package..."
+       ./notarize.pl "$APPLE_ID" "$APPLE_PW" "$CURDIR/OpenAFS-@PACKAGE_VERSION@-$RELNAME.dmg"
+    fi
 fi