mac-dmg.yml 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273
  1. name: Build macOS .dmg
  2. on:
  3. release:
  4. types: [published]
  5. workflow_dispatch:
  6. inputs:
  7. version:
  8. description: 'Version'
  9. required: false
  10. notarize:
  11. description: 'Notarize'
  12. required: true
  13. default: false
  14. type: boolean
  15. env:
  16. JAVA_DIST: 'zulu'
  17. JAVA_VERSION: '22.0.2+9'
  18. jobs:
  19. get-version:
  20. uses: ./.github/workflows/get-version.yml
  21. with:
  22. version: ${{ inputs.version }}
  23. build:
  24. name: Build Cryptomator.app for ${{ matrix.output-suffix }}
  25. runs-on: ${{ matrix.os }}
  26. needs: [get-version]
  27. strategy:
  28. fail-fast: false
  29. matrix:
  30. include:
  31. - os: macos-12
  32. architecture: x64
  33. output-suffix: x64
  34. xcode-path: '/Applications/Xcode_13.2.1.app'
  35. fuse-lib: macFUSE
  36. openjfx-url: 'https://download2.gluonhq.com/openjfx/22.0.2/openjfx-22.0.2_osx-x64_bin-jmods.zip'
  37. openjfx-sha: '115cb08bb59d880cfff6e51e0bf0dcc45785ed9d456b8b8425597b04da6ab3d4'
  38. - os: [self-hosted, macOS, ARM64]
  39. architecture: aarch64
  40. output-suffix: arm64
  41. xcode-path: '/Applications/Xcode_13.2.1.app'
  42. fuse-lib: FUSE-T
  43. openjfx-url: 'https://download2.gluonhq.com/openjfx/22.0.2/openjfx-22.0.2_osx-aarch64_bin-jmods.zip'
  44. openjfx-sha: '813c6748f7c99cb7a579d48b48a087b4682b1fad1fc1a4fe5f9b21cf872b15a7'
  45. steps:
  46. - uses: actions/checkout@v4
  47. - name: Setup Java
  48. uses: actions/setup-java@v4
  49. with:
  50. distribution: ${{ env.JAVA_DIST }}
  51. java-version: ${{ env.JAVA_VERSION }}
  52. architecture: ${{ matrix.architecture }}
  53. check-latest: true
  54. cache: 'maven'
  55. - name: Download OpenJFX jmods
  56. id: download-jmods
  57. run: |
  58. curl -L ${{ matrix.openjfx-url }} -o openjfx-jmods.zip
  59. echo "${{ matrix.openjfx-sha }} *openjfx-jmods.zip" | shasum -a256 --check
  60. mkdir -p openjfx-jmods/
  61. unzip -jo openjfx-jmods.zip \*/javafx.base.jmod \*/javafx.controls.jmod \*/javafx.fxml.jmod \*/javafx.graphics.jmod -d openjfx-jmods
  62. - name: Ensure major jfx version in pom and in jmods is the same
  63. run: |
  64. JMOD_VERSION=$(jmod describe openjfx-jmods/javafx.base.jmod | head -1)
  65. JMOD_VERSION=${JMOD_VERSION#*@}
  66. JMOD_VERSION=${JMOD_VERSION%%.*}
  67. POM_JFX_VERSION=$(mvn help:evaluate "-Dexpression=javafx.version" -q -DforceStdout)
  68. POM_JFX_VERSION=${POM_JFX_VERSION#*@}
  69. POM_JFX_VERSION=${POM_JFX_VERSION%%.*}
  70. if [ "${POM_JFX_VERSION}" -ne "${JMOD_VERSION}" ]; then
  71. >&2 echo "Major JavaFX version in pom.xml (${POM_JFX_VERSION}) != jmod version (${JMOD_VERSION})"
  72. exit 1
  73. fi
  74. - name: Set version
  75. run : mvn versions:set -DnewVersion=${{ needs.get-version.outputs.semVerStr }}
  76. - name: Run maven
  77. run: mvn -B -Djavafx.platform=mac clean package -Pmac -DskipTests
  78. - name: Patch target dir
  79. run: |
  80. cp LICENSE.txt target
  81. cp target/cryptomator-*.jar target/mods
  82. - name: Run jlink
  83. #Remark: no compression is applied for improved build compression later (here dmg)
  84. run: >
  85. ${JAVA_HOME}/bin/jlink
  86. --verbose
  87. --output runtime
  88. --module-path "${JAVA_HOME}/jmods:openjfx-jmods"
  89. --add-modules java.base,java.desktop,java.instrument,java.logging,java.naming,java.net.http,java.scripting,java.sql,java.xml,javafx.base,javafx.graphics,javafx.controls,javafx.fxml,jdk.unsupported,jdk.accessibility,jdk.management.jfr,java.compiler
  90. --strip-native-commands
  91. --no-header-files
  92. --no-man-pages
  93. --strip-debug
  94. --compress zip-0
  95. - name: Run jpackage
  96. run: >
  97. ${JAVA_HOME}/bin/jpackage
  98. --verbose
  99. --type app-image
  100. --runtime-image runtime
  101. --input target/libs
  102. --module-path target/mods
  103. --module org.cryptomator.desktop/org.cryptomator.launcher.Cryptomator
  104. --dest appdir
  105. --name Cryptomator
  106. --vendor "Skymatic GmbH"
  107. --copyright "(C) 2016 - 2024 Skymatic GmbH"
  108. --app-version "${{ needs.get-version.outputs.semVerNum }}"
  109. --java-options "--enable-preview"
  110. --java-options "--enable-native-access=org.cryptomator.jfuse.mac"
  111. --java-options "-Xss5m"
  112. --java-options "-Xmx256m"
  113. --java-options "-Dfile.encoding=\"utf-8\""
  114. --java-options "-Djava.net.useSystemProxies=true"
  115. --java-options "-Dapple.awt.enableTemplateImages=true"
  116. --java-options "-Dsun.java2d.metal=true"
  117. --java-options "-Dcryptomator.appVersion=\"${{ needs.get-version.outputs.semVerStr }}\""
  118. --java-options "-Dcryptomator.logDir=\"@{userhome}/Library/Logs/Cryptomator\""
  119. --java-options "-Dcryptomator.pluginDir=\"@{userhome}/Library/Application Support/Cryptomator/Plugins\""
  120. --java-options "-Dcryptomator.settingsPath=\"@{userhome}/Library/Application Support/Cryptomator/settings.json\""
  121. --java-options "-Dcryptomator.p12Path=\"@{userhome}/Library/Application Support/Cryptomator/key.p12\""
  122. --java-options "-Dcryptomator.ipcSocketPath=\"@{userhome}/Library/Application Support/Cryptomator/ipc.socket\""
  123. --java-options "-Dcryptomator.integrationsMac.keychainServiceName=\"Cryptomator\""
  124. --java-options "-Dcryptomator.mountPointsDir=\"@{userhome}/Library/Application Support/Cryptomator/mnt\""
  125. --java-options "-Dcryptomator.showTrayIcon=true"
  126. --java-options "-Dcryptomator.buildNumber=\"dmg-${{ needs.get-version.outputs.revNum }}\""
  127. --mac-package-identifier org.cryptomator
  128. --resource-dir dist/mac/resources
  129. - name: Patch Cryptomator.app
  130. run: |
  131. mv appdir/Cryptomator.app Cryptomator.app
  132. mv dist/mac/resources/Cryptomator-Vault.icns Cryptomator.app/Contents/Resources/
  133. sed -i '' "s|###BUNDLE_SHORT_VERSION_STRING###|${VERSION_NO}|g" Cryptomator.app/Contents/Info.plist
  134. sed -i '' "s|###BUNDLE_VERSION###|${REVISION_NO}|g" Cryptomator.app/Contents/Info.plist
  135. echo -n "$PROVISIONING_PROFILE_BASE64" | base64 --decode --output Cryptomator.app/Contents/embedded.provisionprofile
  136. env:
  137. VERSION_NO: ${{ needs.get-version.outputs.semVerNum }}
  138. REVISION_NO: ${{ needs.get-version.outputs.revNum }}
  139. PROVISIONING_PROFILE_BASE64: ${{ secrets.MACOS_PROVISIONING_PROFILE_BASE64 }}
  140. - name: Generate license for dmg
  141. run: >
  142. mvn -B -Djavafx.platform=mac license:add-third-party
  143. -Dlicense.thirdPartyFilename=license.rtf
  144. -Dlicense.outputDirectory=dist/mac/dmg/resources
  145. -Dlicense.fileTemplate=dist/mac/dmg/resources/licenseTemplate.ftl
  146. -Dlicense.includedScopes=compile
  147. -Dlicense.excludedGroups=^org\.cryptomator
  148. -Dlicense.failOnMissing=true
  149. -Dlicense.licenseMergesUrl=file://${{ github.workspace }}/license/merges
  150. - name: Install codesign certificate
  151. run: |
  152. # create variables
  153. CERTIFICATE_PATH=$RUNNER_TEMP/codesign.p12
  154. KEYCHAIN_PATH=$RUNNER_TEMP/codesign.keychain-db
  155. # import certificate and provisioning profile from secrets
  156. echo -n "$CODESIGN_P12_BASE64" | base64 --decode --output $CERTIFICATE_PATH
  157. # create temporary keychain
  158. security create-keychain -p "$CODESIGN_TMP_KEYCHAIN_PW" $KEYCHAIN_PATH
  159. security set-keychain-settings -lut 900 $KEYCHAIN_PATH
  160. security unlock-keychain -p "$CODESIGN_TMP_KEYCHAIN_PW" $KEYCHAIN_PATH
  161. # import certificate to keychain
  162. security import $CERTIFICATE_PATH -P "$CODESIGN_P12_PW" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
  163. security list-keychain -d user -s $KEYCHAIN_PATH
  164. env:
  165. CODESIGN_P12_BASE64: ${{ secrets.MACOS_CODESIGN_P12_BASE64 }}
  166. CODESIGN_P12_PW: ${{ secrets.MACOS_CODESIGN_P12_PW }}
  167. CODESIGN_TMP_KEYCHAIN_PW: ${{ secrets.MACOS_CODESIGN_TMP_KEYCHAIN_PW }}
  168. - name: Codesign
  169. run: |
  170. echo "Codesigning jdk files..."
  171. find Cryptomator.app/Contents/runtime/Contents/Home/lib/ -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
  172. find Cryptomator.app/Contents/runtime/Contents/Home/lib/ \( -name 'jspawnhelper' -o -name 'pauseengine' -o -name 'simengine' \) -exec codesign --force -o runtime -s ${CODESIGN_IDENTITY} {} \;
  173. echo "Codesigning jar contents..."
  174. find Cryptomator.app/Contents/runtime/Contents/MacOS -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
  175. for JAR_PATH in `find Cryptomator.app -name "*.jar"`; do
  176. if [[ `unzip -l ${JAR_PATH} | grep '.dylib\|.jnilib'` ]]; then
  177. JAR_FILENAME=$(basename ${JAR_PATH})
  178. OUTPUT_PATH=${JAR_PATH%.*}
  179. echo "Codesigning libs in ${JAR_FILENAME}..."
  180. unzip -q ${JAR_PATH} -d ${OUTPUT_PATH}
  181. find ${OUTPUT_PATH} -name '*.dylib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
  182. find ${OUTPUT_PATH} -name '*.jnilib' -exec codesign --force -s ${CODESIGN_IDENTITY} {} \;
  183. rm ${JAR_PATH}
  184. pushd ${OUTPUT_PATH} > /dev/null
  185. zip -qr ../${JAR_FILENAME} *
  186. popd > /dev/null
  187. rm -r ${OUTPUT_PATH}
  188. fi
  189. done
  190. echo "Codesigning Cryptomator.app..."
  191. sed -i '' "s|###APP_IDENTIFIER_PREFIX###|${TEAM_IDENTIFIER}.|g" dist/mac/Cryptomator.entitlements
  192. sed -i '' "s|###TEAM_IDENTIFIER###|${TEAM_IDENTIFIER}|g" dist/mac/Cryptomator.entitlements
  193. codesign --force --deep --entitlements dist/mac/Cryptomator.entitlements -o runtime -s ${CODESIGN_IDENTITY} Cryptomator.app
  194. env:
  195. CODESIGN_IDENTITY: ${{ secrets.MACOS_CODESIGN_IDENTITY }}
  196. TEAM_IDENTIFIER: ${{ secrets.MACOS_TEAM_IDENTIFIER }}
  197. - name: Prepare .dmg contents
  198. run: |
  199. mkdir dmg
  200. mv Cryptomator.app dmg
  201. cp dist/mac/dmg/resources/${{ matrix.fuse-lib }}.webloc dmg
  202. ls -l dmg
  203. - name: Install create-dmg
  204. run: |
  205. brew install create-dmg
  206. create-dmg --help
  207. - name: Create .dmg
  208. run: >
  209. create-dmg
  210. --volname Cryptomator
  211. --volicon "dist/mac/dmg/resources/Cryptomator-Volume.icns"
  212. --background "dist/mac/dmg/resources/Cryptomator-${{ matrix.fuse-lib }}-background.tiff"
  213. --window-pos 400 100
  214. --window-size 640 694
  215. --icon-size 128
  216. --icon "Cryptomator.app" 128 245
  217. --hide-extension "Cryptomator.app"
  218. --icon "${{ matrix.fuse-lib }}.webloc" 320 501
  219. --hide-extension "${{ matrix.fuse-lib }}.webloc"
  220. --app-drop-link 512 245
  221. --eula "dist/mac/dmg/resources/license.rtf"
  222. --icon ".background" 128 758
  223. --icon ".VolumeIcon.icns" 512 758
  224. Cryptomator-${VERSION_NO}-${{ matrix.output-suffix }}.dmg dmg
  225. env:
  226. VERSION_NO: ${{ needs.get-version.outputs.semVerNum }}
  227. - name: Notarize .dmg
  228. if: startsWith(github.ref, 'refs/tags/') || inputs.notarize
  229. uses: cocoalibs/xcode-notarization-action@v1
  230. with:
  231. app-path: 'Cryptomator-*.dmg'
  232. apple-id: ${{ secrets.MACOS_NOTARIZATION_APPLE_ID }}
  233. password: ${{ secrets.MACOS_NOTARIZATION_PW }}
  234. team-id: ${{ secrets.MACOS_NOTARIZATION_TEAM_ID }}
  235. xcode-path: ${{ matrix.xcode-path }}
  236. - name: Add possible alpha/beta tags to installer name
  237. run: mv Cryptomator-*.dmg Cryptomator-${{ needs.get-version.outputs.semVerStr }}-${{ matrix.output-suffix }}.dmg
  238. - name: Create detached GPG signature with key 615D449FE6E6A235
  239. run: |
  240. echo "${GPG_PRIVATE_KEY}" | gpg --batch --quiet --import
  241. echo "${GPG_PASSPHRASE}" | gpg --batch --quiet --passphrase-fd 0 --pinentry-mode loopback -u 615D449FE6E6A235 --detach-sign -a Cryptomator-*.dmg
  242. env:
  243. GPG_PRIVATE_KEY: ${{ secrets.RELEASES_GPG_PRIVATE_KEY }}
  244. GPG_PASSPHRASE: ${{ secrets.RELEASES_GPG_PASSPHRASE }}
  245. - name: Clean up codesign certificate
  246. if: ${{ always() }}
  247. run: security delete-keychain $RUNNER_TEMP/codesign.keychain-db
  248. continue-on-error: true
  249. - name: Upload artifacts
  250. uses: actions/upload-artifact@v4
  251. with:
  252. name: dmg-${{ matrix.output-suffix }}
  253. path: |
  254. Cryptomator-*.dmg
  255. Cryptomator-*.asc
  256. if-no-files-found: error
  257. - name: Publish dmg on GitHub Releases
  258. if: startsWith(github.ref, 'refs/tags/') && github.event.action == 'published'
  259. uses: softprops/action-gh-release@v2
  260. with:
  261. fail_on_unmatched_files: true
  262. token: ${{ secrets.CRYPTOBOT_RELEASE_TOKEN }}
  263. files: |
  264. Cryptomator-*.dmg
  265. Cryptomator-*.asc