ci: Add standalone macOS build support by jamilbk · Pull Request #7581 · firezone/firezone

jamilbk · 2024-12-24T20:15:39Z

The CI swift workflow needs to be updated to accommodate the macOS standalone build. This required a decent amount of refactoring to make the Apple build process more maintainable.

Unfortunately this PR ended up being a giant ball of yarn where pulling on one thread tended to unravel things elsewhere, since building the Apple artifacts involve multiple interconnected systems. Combined with the slow iteration of running in CI, I wasn't able to split this PR into easier to digest commits, so I've annotated the PR as much as I can to explain what's changed.

The good news is that Apple release artifacts can now be easily built from a developer's machine with simply scripts/build/macos-standalone.sh. The only thing needed is the proper provisioning profiles and signing certs installed.

Since this PR is so big already, I'll save the swift/apple/README.md updates for another PR.

vercel · 2024-12-24T20:15:45Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
firezone	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Dec 28, 2024 10:14pm

jamilbk · 2024-12-28T05:28:04Z

-    name: build-${{ matrix.sdk }}
-    runs-on: ${{ matrix.runs-on }}
+    name: ${{ matrix.job_name }}
+    runs-on: macos-15


This was updated to match our development machines which reduces the build configuration drift between the two.

jamilbk · 2024-12-28T05:29:01Z

+      contents: read
+      id-token: "write"
+    env:
+      XCODE_VERSION: "16.2"


Updated to be a recent version. There were a few subtle differences in how provisioning profiles and certs are stored/loaded in Xcode 16 that will be noted where appropriate.

jamilbk · 2024-12-28T05:30:13Z

+          - job_name: build-ios
+            rust-targets: aarch64-apple-ios
+            build-script: scripts/build/ios-appstore.sh
+            ARTIFACT_PATH: "./Firezone.ipa"
+            upload-script: scripts/upload/app-store-connect.sh
+
+          - job_name: build-macos-appstore
+            rust-targets: aarch64-apple-darwin x86_64-apple-darwin
+            build-script: scripts/build/macos-appstore.sh
+            ARTIFACT_PATH: "./Firezone.pkg"
+            upload-script: scripts/upload/app-store-connect.sh
+
+          - job_name: build-macos-standalone
+            rust-targets: aarch64-apple-darwin x86_64-apple-darwin
+            build-script: scripts/build/macos-standalone.sh
+            # mark:next-apple-version
+            ARTIFACT_PATH: "./firezone-macos-client-1.4.0.dmg"
+            NOTARIZE: "${{ (github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main') && 'true' || 'false' }}"
+            # mark:next-apple-version
+            upload-script: scripts/upload/github.sh
+            RELEASE_NAME: macos-client-1.4.0


This was refactored to be a matrix for each distributable, with the upload process carved out into another script.

secrets are not available from the strategy context, otherwise I would have added them here and not in the build steps below.

jamilbk · 2024-12-28T05:31:43Z

-            exit 1
-          fi
-      - name: Upload build to App Store Connect
+          IOS_APP_PROVISIONING_PROFILE: "${{ secrets.APPLE_IOS_APP_PROVISIONING_PROFILE }}"


Not every matrix job requires every secret, but doing it like this simplifies the build scripts.

The overall goal here was to not require any ENV vars when building locally, and override appropriate ones from CI if we're building on a runner.

jamilbk · 2024-12-28T05:34:24Z

Embedding this was somewhat of a pain, but I think it's important. Many Mac users simply try to (mistakenly) run their apps directly from the readonly disk image.

For many apps that works just fine, but for ours it won't due to the network extension. So I spent some time educating the user just in case, to avoid future support burden here.

jamilbk · 2024-12-28T05:49:25Z

+# xcrun altool requires private keys to be files in a specific naming format
+API_PRIVATE_KEYS_DIR=${API_PRIVATE_KEYS_DIR:-$RUNNER_TEMP}
+PRIVATE_KEY_PATH="$API_PRIVATE_KEYS_DIR/AuthKey_$API_KEY_ID.p8"
+echo -n "$API_KEY" | base64 --decode -o "$PRIVATE_KEY_PATH"


Slight change here to use a base64-encoded version of the API key. It is already in a PEM format, but the downstream build-rust.sh script was barfing on its contained newlines, so this fixes that.

Could also reuse that utility decode function used in lib.sh when building. Not sure if it is worth consolidating though.

jamilbk · 2024-12-28T05:49:57Z

We do this from quite a few other places in CI. I'll look into reusing this script for those.

jamilbk · 2024-12-28T05:51:32Z

 xcuserdata/
 **/*.xcuserstate

-Firezone/xcconfig/config.xcconfig


Ok so this change simplifies things nicely. Instead of defining multiple xcconfigs and moving them into place just before build, we simply specify the build vars on the command directly. So we can now commit a single xcconfig and use that for development and the release build scripts will override what vars they need.

jamilbk · 2024-12-28T05:52:00Z

Simplifications from the removal of xcconfigs.

jamilbk · 2024-12-28T05:52:19Z

This file has been inlined in the ios build script.

thomaseizinger

Great job! I think the structure makes a lot of sense. ~~Can we extend swift/apple/README.md to document how to use the scripts?~~

Edit: Just read your PR description.

thomaseizinger · 2024-12-28T10:11:16Z

I've seen it for several MacOS apps to have a somewhat playful thing here. I think JetBrains for example has something like:

(<logo.png>).install()

It would probably be quite easy to just once-off hire a designer to come up with a cool idea here. Maybe a tunnel that you can drag the Firezone logo through?

Hm yeah, though generating this is a little tricky and requires some trial and error since the window coordinates didn't seem to line up to Figma's pixel coordinates. I.e. getting the icons placed onto the PNG in the right place in the script might make the process a little cumbersome for an external designer.

I'll spend a few more minutes to see if I can make it a little snazzier.

thomaseizinger · 2024-12-28T10:16:26Z

+    local profiles_path="$1"
+    local profile="$2"
+    local profile_file="$3"


Suggested change

local profiles_path="$1"

local profile="$2"

local profile_file="$3"

local profile="$1"

local profiles_path="$2"

local profile_file="$3"

I think this order would make more sense, perhaps also don't build the path within the function?

thomaseizinger · 2024-12-28T10:18:28Z

+        -t cert \
+        -f pkcs12 \
+        -k "$keychain_path"
+    security set-key-partition-list \


Perhaps add this information as a source-code comment as to why we are doing this.

thomaseizinger · 2024-12-28T10:19:35Z

+    rm "$cert_path"
+}
+
+function insert_build_timestamp() {


Suggested change

function insert_build_timestamp() {

function set_current_project_version() {

Apple calls these build version, updated this to set_project_build_version.

thomaseizinger · 2024-12-28T10:21:02Z

+    GIT_SHA="$git_sha" \
+    CODE_SIGN_STYLE=Manual \
+    CODE_SIGN_IDENTITY="$code_sign_identity" \
+    CONFIGURATION_BUILD_DIR="$temp_dir" \
+    APP_PROFILE_ID="$app_profile_id" \
+    NE_PROFILE_ID="$ne_profile_id" \
+    ONLY_ACTIVE_ARCH=NO \


Are these ENV variables? It is odd that they are defined as part of the build command and not at the very front like ENV vars for regular commands.

Yes and no. Xcode will pass them as env vars to downstream scripts when appropriate, but they won't persist beyond that.

I thought this way reduced the chance these env vars can affect the productbuild command just below and others.

I'm probably a little traumatized from my experience with env vars and Xcode / cargo downstream effects 😆

thomaseizinger · 2024-12-28T10:23:22Z

+# Notarize disk image and embedded app
+if [ "$notarize" = "true" ]; then
+    private_key_path="$temp_dir/firezone-api-key.p8"
+    echo -n "$API_KEY" | base64 --decode -o "$private_key_path"


This could reuse the other function in lib if you could just pass a single output path.

Yeah I made this a base64_decode function for reuse. Probably a good idea since it deals with secrets and we don't want to fudge that up.

thomaseizinger · 2024-12-28T10:23:55Z

+    private_key_path="$temp_dir/firezone-api-key.p8"
+    echo -n "$API_KEY" | base64 --decode -o "$private_key_path"
+
+    # Submit app bundle to be notarized. Can take a few minutes.


A few minutes? What does this do? Wait for manual approval of an Apple support person?

Yes, the API is quite unfriendly: https://developer.apple.com/documentation/security/customizing-the-notarization-workflow#Check-the-status-of-your-request

the notarization process typically takes less than an hour.

I was thinking we can start with this and see how long the waits are. If they really take an hour we might need the notarization step to happen in a separate workflow or job.

thomaseizinger · 2024-12-28T10:27:09Z

+# xcrun altool requires private keys to be files in a specific naming format
+API_PRIVATE_KEYS_DIR=${API_PRIVATE_KEYS_DIR:-$RUNNER_TEMP}
+PRIVATE_KEY_PATH="$API_PRIVATE_KEYS_DIR/AuthKey_$API_KEY_ID.p8"
+echo -n "$API_KEY" | base64 --decode -o "$PRIVATE_KEY_PATH"


Could also reuse that utility decode function used in lib.sh when building. Not sure if it is worth consolidating though.

thomaseizinger · 2024-12-28T10:28:19Z

Maybe call this script github-release because we also upload stuff as GitHub artifacts.

thomaseizinger · 2024-12-28T10:32:42Z

+          - job_name: build-ios
+            rust-targets: aarch64-apple-ios
+            build-script: scripts/build/ios-appstore.sh
+            ARTIFACT_PATH: "./Firezone.ipa"


So all env variables here are by convention upper-cased? Don't feel strongly about it but the convention seems a bit unnecessary.

Also would prefer all "scripts" to be grouped together.

vercel Bot deployed to Preview December 24, 2024 20:15 View deployment

jamilbk requested a review from a team December 24, 2024 20:15

jamilbk marked this pull request as draft December 24, 2024 20:57

jamilbk removed the request for review from a team December 24, 2024 20:57

jamilbk force-pushed the chore/update-macos-ci branch from 3a44ebc to 0a07ac0 Compare December 25, 2024 12:32

jamilbk changed the title ~~ci: Bump macOS runner and Xcode versions~~ ci: Add standalone macOS build support Dec 25, 2024

vercel Bot deployed to Preview December 25, 2024 12:33 View deployment

jamilbk force-pushed the chore/update-macos-ci branch from 0a07ac0 to 494ec47 Compare December 25, 2024 13:11

vercel Bot deployed to Preview December 25, 2024 13:13 View deployment

jamilbk force-pushed the chore/update-macos-ci branch from 494ec47 to c1c55cf Compare December 25, 2024 13:22

vercel Bot deployed to Preview December 25, 2024 13:24 View deployment

jamilbk force-pushed the chore/update-macos-ci branch 2 times, most recently from 77ea1cc to 0ddaa11 Compare December 25, 2024 13:28

vercel Bot deployed to Preview December 25, 2024 13:30 View deployment

jamilbk force-pushed the chore/update-macos-ci branch from 0ddaa11 to af801b9 Compare December 25, 2024 13:33

vercel Bot deployed to Preview December 25, 2024 13:34 View deployment

jamilbk force-pushed the chore/update-macos-ci branch from af801b9 to b36d45c Compare December 25, 2024 14:17

vercel Bot deployed to Preview December 25, 2024 14:19 View deployment

vercel Bot deployed to Preview December 25, 2024 14:24 View deployment

jamilbk force-pushed the chore/update-macos-ci branch from 6ecae4e to 1fdb04e Compare December 25, 2024 14:38

vercel Bot deployed to Preview December 25, 2024 14:39 View deployment

vercel Bot deployed to Preview December 25, 2024 14:43 View deployment

jamilbk force-pushed the chore/update-macos-ci branch from 0f28470 to 9dc8548 Compare December 25, 2024 14:45

vercel Bot deployed to Preview December 25, 2024 14:46 View deployment

vercel Bot deployed to Preview December 25, 2024 14:51 View deployment

jamilbk force-pushed the chore/update-macos-ci branch from 322094a to ce58771 Compare December 25, 2024 14:55

vercel Bot deployed to Preview December 25, 2024 14:57 View deployment

vercel Bot deployed to Preview December 25, 2024 15:02 View deployment

vercel Bot deployed to Preview December 25, 2024 15:16 View deployment

vercel Bot deployed to Preview December 27, 2024 19:22 View deployment

vercel Bot deployed to Preview December 27, 2024 19:26 View deployment

vercel Bot deployed to Preview December 28, 2024 01:30 View deployment

vercel Bot deployed to Preview December 28, 2024 02:17 View deployment

vercel Bot deployed to Preview December 28, 2024 02:21 View deployment

vercel Bot deployed to Preview December 28, 2024 02:24 View deployment

vercel Bot deployed to Preview December 28, 2024 02:36 View deployment

vercel Bot deployed to Preview December 28, 2024 02:43 View deployment

vercel Bot deployed to Preview December 28, 2024 02:45 View deployment

vercel Bot deployed to Preview December 28, 2024 02:48 View deployment

vercel Bot deployed to Preview December 28, 2024 03:02 View deployment

vercel Bot deployed to Preview December 28, 2024 03:09 View deployment

vercel Bot deployed to Preview December 28, 2024 03:21 View deployment

vercel Bot deployed to Preview December 28, 2024 03:24 View deployment

vercel Bot deployed to Preview December 28, 2024 03:28 View deployment

jamilbk commented Dec 28, 2024

View reviewed changes

Build macOS standalone app in CI using refactored CI scripts

abef8df

thomaseizinger approved these changes Dec 28, 2024

View reviewed changes

jamilbk added 2 commits December 28, 2024 09:36

Address PR feedback

6050ffe

Fix upload errors

1274519

thomaseizinger approved these changes Dec 28, 2024

View reviewed changes

jamilbk added 8 commits December 28, 2024 11:36

Fix upload bugs again

7e53987

fix another typo

8083f2a

Notarize app not disk image

c58ebb6

Use newer provisioning profiles location

ed14208

Specify platform

0aace4b

Update standalone build to include timestamp and avoid base entitlements

c05584c

Fix unbound var

2c15f33

Merge branch 'main' into chore/update-macos-ci

138e704

jamilbk mentioned this pull request Dec 29, 2024

docs: update Apple docs for standalone guidance #7589

Merged

	function insert_build_timestamp() {
	function set_current_project_version() {

Conversation

jamilbk commented Dec 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented Dec 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jamilbk Dec 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thomaseizinger left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

jamilbk commented Dec 24, 2024 •

edited

Loading

vercel Bot commented Dec 24, 2024 •

edited

Loading

jamilbk Dec 28, 2024 •

edited

Loading

thomaseizinger left a comment •

edited

Loading