spiegel-keyman/resources/build/mac/mac.inc.sh

# shellcheck shell=bash
# Keyman is copyright (C) SIL Global. MIT License.

if [ -z "${DEVELOPMENT_TEAM+x}" ]; then
    DEVELOPMENT_TEAM=3YE4W86L3G
fi

function mac_notarize() {
  local TARGET_PATH="$1"
  local TARGET_FILE="$2"

  local NOTARYTOOL_LOG_PATH="$TARGET_PATH/notarytool.log"

  xcrun notarytool submit \
      --apple-id "$APPSTORECONNECT_USERNAME" \
      --team-id "$DEVELOPMENT_TEAM" \
      --password "$APPSTORECONNECT_PASSWORD" \
      --output-format json \
      --wait \
      "$TARGET_FILE" > "$NOTARYTOOL_LOG_PATH"
  # notarytool output: {"status":"Accepted","id":"ca62bba0-6c49-43c2-90d8-83a8ef306e0f","message":"Processing complete"}

  cat "$NOTARYTOOL_LOG_PATH"
  local NOTARYTOOL_STATUS=`cat "$NOTARYTOOL_LOG_PATH" | jq -r .status`
  local NOTARYTOOL_SUBMISSION_ID=`cat "$NOTARYTOOL_LOG_PATH" | jq -r .id`
  if [[ "$NOTARYTOOL_STATUS" != Accepted ]]; then
      # We won't assume notarytool returns an error code if status != Accepted
      builder_die "Notarization failed with $NOTARYTOOL_STATUS"
  fi

  builder_heading "Notarization completed successfully. Review logs below for any warnings."

  xcrun notarytool log \
        --apple-id "$APPSTORECONNECT_USERNAME" \
        --team-id "$DEVELOPMENT_TEAM" \
        --password "$APPSTORECONNECT_PASSWORD" \
        "$NOTARYTOOL_SUBMISSION_ID"

  rm -f "$NOTARYTOOL_LOG_PATH"
}

mac_codesign() {
  # Allow the signing to fail up to 5 times (network transient error on timestamping)
  local ret_code=0
  local count=0
  local method="$1"
  shift
  if [[ "$method" == direct ]]; then
    method=
  fi
  while (( count <  5 )); do
    $method codesign "$@" || ret_code=$?
    if [ $ret_code == 0 ]; then
      return 0
    fi
    (( count++ ))
    builder_echo "codesign attempt $count failed with error $ret_code"
    sleep 5
  done

  builder_echo "*** codesign parameters: $@"
  builder_die "Unable to sign component after 5 attempts (exit code $ret_code)"
}

# Allows for a quick macOS check for those scripts requiring a macOS environment.
mac_verify_on_mac() {
  if ! builder_is_macos; then
    builder_die "This build script will only run in a Mac environment."
    exit 1
  fi
}

# Intended for use with macOS-based builds, as Xcode build phase "run script"s
# do not have access to important environment variables.  Doesn't hurt to run it
# at other times as well.  The output file is .gitignore'd.
function _mac_generate_xcode_environment_definition_script() {
  local ENVIRONMENT_SH="$KEYMAN_ROOT/resources/build/mac/xcode-environment.inc.sh"

  # Remove old copy if it exists
  [ -f "$ENVIRONMENT_SH" ] && rm "$ENVIRONMENT_SH"

  # Documentation about the script, within the script.
  echo "# Do not edit - this is an autogenerated script.  See /resources/build/mac/mac.inc.sh for more details." >> "$ENVIRONMENT_SH"
  echo "# This file redefines critical environment variables for import to Xcode build phases." >> "$ENVIRONMENT_SH"
  echo "" >> "$ENVIRONMENT_SH"

  # Defining variables for KEYMAN_VERSION here will leave static definitions
  # that don't automatically update when a user changes branches; some
  # branches are 'similar enough' to not require full command-line based
  # rebuilds. We want that KEYMAN_VERSION number to properly mirror the state
  # of its branch during development so that it matches any error reports that
  # get logged to Sentry.
  #
  # As a result, we explicitly do NOT define KEYMAN_VERSION or
  # KEYMAN_VERSION_TAG as part of ENVIRONMENT_SH.

  echo "# Required for successful dSYM upload for Sentry error reporting" >> "$ENVIRONMENT_SH"
  echo "export SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN:-}" >> "$ENVIRONMENT_SH"
  echo "export SENTRY_URL=${SENTRY_URL:-}" >> "$ENVIRONMENT_SH"
  echo "export SENTRY_ORG=${SENTRY_ORG:-}" >> "$ENVIRONMENT_SH"
}

#
# mac_print_xcode_build_script_logs: xcodebuild does not emit stdout from scripts in
# PBXShellScriptBuildPhase phases. This is a real problem for us because if
# there is an issue, we just can't see it. So we capture the output in a
# separate logfile, and then call mac_print_xcode_build_script_logs after any xcodebuild
# call to get the output.
#
# This file is captured in xcode-utils.inc.sh, logScriptsToFile function, and
# each script phase will append to the log file, until mac_print_xcode_build_script_logs
# is called, at which point the logfile will be deleted.
#
# The logfile is placed in $KEYMAN_ROOT/xcodebuild-scripts.log. It is used for
# both iOS and macOS builds.
#
# If there is no logfile, then this function will not emit anything.
#
mac_print_xcode_build_script_logs() {
  local SCRIPT_LOG="$KEYMAN_ROOT/xcodebuild-scripts.log"
  if [ -f "$SCRIPT_LOG" ]; then
    builder_echo "mac_print_xcode_build_script_logs: reporting script results from previous xcode build"
    cat "$SCRIPT_LOG"
    rm "$SCRIPT_LOG"
    builder_echo "mac_print_xcode_build_script_logs: done"
    echo
  fi
}

#
# Wraps xcodebuild with error handling and log printing
#
mac_xcodebuild() {
  typeset cmnd="$*"
  typeset ret_code
  local hasSetErrExit=false
  if [ -o errexit ]; then
    hasSetErrExit=true
    set +e
  fi
  eval xcodebuild $cmnd
  ret_code=$?
  if $hasSetErrExit; then
    set -e
  fi

  mac_print_xcode_build_script_logs
  if [ $ret_code != 0 ]; then
    builder_die "Build failed! Error: [$ret_code] when executing command: 'xcodebuild $cmnd'"
  fi
}

# If this script is running on macOS but  not within xcode script calls, generate the
# env script that will be used for xcode scripts
# Reference: https://gist.github.com/gdavis/6670468
# shellcheck disable=2310
if builder_is_macos && [[ -z "${XCODE_VERSION_ACTUAL:-}" ]] && [[ -z "${XCODE_PRODUCT_BUILD_VERSION:-}" ]]; then
  _mac_generate_xcode_environment_definition_script
fi