zed/script/bundle-mac

#!/usr/bin/env bash

set -euo pipefail
source script/lib/blob-store.sh

build_flag="--release"
zed_features=""
remote_server_features=""
target_dir="release"
open_result=false
local_install=false
can_code_sign=false

# This must match the team in the provisioning profile.
IDENTITY="Zed Industries, Inc."
APPLE_NOTARIZATION_TEAM="MQ55VZLNZQ"

# Function for displaying help info
help_info() {
  echo "
Usage: ${0##*/} [options] [architecture=host]
Build the application bundle for macOS.

Options:
  -d    Compile in debug mode
  -o    Open dir with the resulting DMG or launch the app itself in local mode.
  -i    Install the resulting DMG into /Applications.
  -h    Display this help and exit.
  "
}

while getopts 'dloih' flag
do
    case "${flag}" in
        o) open_result=true;;
        d)
            export CARGO_INCREMENTAL=true
            build_flag="";
            zed_features="--features util/debug-embed"
            remote_server_features="--features debug-embed"
            target_dir="debug"
            ;;
        i) local_install=true;;
        h)
           help_info
           exit 0
           ;;
    esac
done

shift $((OPTIND-1))


# Get release channel
pushd crates/zed
channel=$(<RELEASE_CHANNEL)
export ZED_RELEASE_CHANNEL="${channel}"
popd

export ZED_BUNDLE=true
export CARGO_BUNDLE_SKIP_BUILD=true

cargo_bundle_version=$(cargo -q bundle --help 2>&1 | head -n 1 || echo "")
if [ "$cargo_bundle_version" != "cargo-bundle v0.6.1-zed" ]; then
    cargo install cargo-bundle --git https://github.com/zed-industries/cargo-bundle.git --branch zed-deploy
fi

# Deal with versions of macOS that don't include libstdc++ headers
export CXXFLAGS="-stdlib=libc++"

version_info=$(rustc --version --verbose)
host_line=$(echo "$version_info" | grep host)
target_triple=${host_line#*: }
if [[ $# -gt 0 && -n "$1" ]]; then
    target_triple="$1"
fi
arch_suffix=""

if [[ "$target_triple" = "x86_64-apple-darwin" ]]; then
    arch_suffix="x86_64"
elif [[ "$target_triple" = "aarch64-apple-darwin" ]]; then
    arch_suffix="aarch64"
else
    echo "Unsupported architecture $target_triple"
    exit 1
fi

# Generate the licenses first, so they can be baked into the binaries
script/generate-licenses

rustup target add $target_triple

echo "Compiling zed binaries"
cargo --config .cargo/bundle-config.toml build ${build_flag} ${zed_features} --package zed --package cli --target $target_triple
# Build remote_server in separate invocation to prevent feature unification from other crates
# from influencing dynamic libraries required by it.
cargo --config .cargo/bundle-config.toml build ${build_flag} ${remote_server_features} --package remote_server --target $target_triple

echo "Creating application bundle"
pushd crates/zed
cp Cargo.toml Cargo.toml.backup
sed \
    -i.backup \
    "s/package.metadata.bundle-${channel}/package.metadata.bundle/" \
    Cargo.toml

app_path=$(cargo bundle ${build_flag} --target $target_triple --select-workspace-root | xargs)

mv Cargo.toml.backup Cargo.toml
popd
echo "Bundled ${app_path}"

# DocumentTypes.plist references CFBundleTypeIconFile "Document", so the bundle must contain Document.icns.
# We use the app icon as a placeholder document icon for now.
document_icon_source="crates/zed/resources/Document.icns"
document_icon_target="${app_path}/Contents/Resources/Document.icns"
if [[ -f "${document_icon_source}" ]]; then
    mkdir -p "$(dirname "${document_icon_target}")"
    cp "${document_icon_source}" "${document_icon_target}"
else
    echo "cargo::warning=Missing ${document_icon_source}; macOS document icons may not appear in Finder."
fi

if [[ -n "${MACOS_CERTIFICATE:-}" && -n "${MACOS_CERTIFICATE_PASSWORD:-}" && -n "${APPLE_NOTARIZATION_KEY:-}" && -n "${APPLE_NOTARIZATION_KEY_ID:-}" && -n "${APPLE_NOTARIZATION_ISSUER_ID:-}" ]]; then
    can_code_sign=true

    echo "Setting up keychain for code signing..."
    security create-keychain -p "$MACOS_CERTIFICATE_PASSWORD" zed.keychain || echo ""
    security default-keychain -s zed.keychain
    security unlock-keychain -p "$MACOS_CERTIFICATE_PASSWORD" zed.keychain
    # Calling set-keychain-settings without `-t` disables the auto-lock timeout
    security set-keychain-settings zed.keychain
    echo "$MACOS_CERTIFICATE" | base64 --decode > /tmp/zed-certificate.p12
    security import /tmp/zed-certificate.p12 -k zed.keychain -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
    rm /tmp/zed-certificate.p12
    security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_CERTIFICATE_PASSWORD" zed.keychain

    function cleanup() {
        echo "Cleaning up keychain"
        security default-keychain -s login.keychain
        security delete-keychain zed.keychain
    }

    trap cleanup EXIT
fi

GIT_VERSION="v2.43.3"
GIT_VERSION_SHA="fa29823"
PDFIUM_TAG="chromium/8066"

function download_and_unpack() {
    local url=$1
    local path_to_unpack=$2
    local target_path=$3

    temp_dir=$(mktemp -d)

    if ! command -v curl &> /dev/null; then
        echo "curl is not installed. Please install curl to continue."
        exit 1
    fi

    curl --silent --fail --location "$url" | tar -xvz -C "$temp_dir" -f - $path_to_unpack

    mv "$temp_dir/$path_to_unpack" "$target_path"

    rm -rf "$temp_dir"
}

function download_git() {
    local architecture=$1
    local target_binary=$2

    tmp_dir=$(mktemp -d)
    pushd "$tmp_dir"

    case "$architecture" in
        aarch64-apple-darwin)
            download_and_unpack "https://github.com/desktop/dugite-native/releases/download/${GIT_VERSION}/dugite-native-${GIT_VERSION}-${GIT_VERSION_SHA}-macOS-arm64.tar.gz" bin/git ./git
            ;;
        x86_64-apple-darwin)
            download_and_unpack "https://github.com/desktop/dugite-native/releases/download/${GIT_VERSION}/dugite-native-${GIT_VERSION}-${GIT_VERSION_SHA}-macOS-x64.tar.gz" bin/git ./git
            ;;
        *)
            echo "Unsupported architecture: $architecture"
            exit 1
            ;;
    esac

    popd

    mv "${tmp_dir}/git" "${target_binary}"
    rm -rf "$tmp_dir"
}

function download_pdfium() {
    local architecture=$1
    local target_path=$2

    case "$architecture" in
        aarch64-apple-darwin)
            pdfium_flavor="mac-arm64"
            pdfium_sha256="336219e80580b93c6523f44db7dc1de59cc497b13a7390ddac84223f68ca162b"
            ;;
        x86_64-apple-darwin)
            pdfium_flavor="mac-x64"
            pdfium_sha256="841ecac278cdd46288dd065873522cf72f3996560d8978f473d336f01d59942c"
            ;;
        *)
            echo "Unsupported architecture for pdfium: $architecture"
            exit 1
            ;;
    esac

    # sha256sum is not present on stock macOS, so checksums go through shasum.
    pdfium_tgz="${target_dir}/pdfium-${pdfium_flavor}.tgz"
    if ! echo "${pdfium_sha256}  ${pdfium_tgz}" | shasum -a 256 -c >/dev/null 2>&1; then
        mkdir -p "${target_dir}"
        curl --silent --fail --location --output "${pdfium_tgz}" \
            "https://github.com/bblanchon/pdfium-binaries/releases/download/${PDFIUM_TAG}/pdfium-${pdfium_flavor}.tgz"
        echo "${pdfium_sha256}  ${pdfium_tgz}" | shasum -a 256 -c
    fi

    pdfium_tmp=$(mktemp -d)
    tar -xzf "${pdfium_tgz}" -C "${pdfium_tmp}" "lib/libpdfium.dylib" "LICENSE" "licenses"
    cp "${pdfium_tmp}/lib/libpdfium.dylib" "${target_path}"
    mkdir -p "${app_path}/Contents/Resources/pdfium-licenses"
    cp "${pdfium_tmp}/LICENSE" "${pdfium_tmp}/licenses/"* "${app_path}/Contents/Resources/pdfium-licenses/"
    rm -rf "${pdfium_tmp}"
}

function sign_app_binaries() {
    rm -rf "${app_path}/Contents/Frameworks"
    mkdir -p "${app_path}/Contents/Frameworks"

    echo "Downloading git binary"
    download_git "${target_triple}" "${app_path}/Contents/MacOS/git"

    # PDFium is dlopen'd at runtime by the bundled pdf_viewer for native PDF viewing.
    echo "Downloading pdfium library"
    download_pdfium "${target_triple}" "${app_path}/Contents/Frameworks/libpdfium.dylib"

    # Note: The app identifier for our development builds is the same as the app identifier for nightly.
    cp crates/zed/contents/$channel/embedded.provisionprofile "${app_path}/Contents/"

    if [[ $can_code_sign = true ]]; then
        echo "Code signing binaries"
        # sequence of codesign commands modeled after this example: https://developer.apple.com/forums/thread/701514
        /usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/cli" -v
        /usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "${app_path}/Contents/MacOS/git" -v
        /usr/bin/codesign --deep --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${app_path}/Contents/MacOS/zed" -v
        /usr/bin/codesign --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${app_path}" -v
    else
        echo "One or more of the following variables are missing: MACOS_CERTIFICATE, MACOS_CERTIFICATE_PASSWORD, APPLE_NOTARIZATION_KEY, APPLE_NOTARIZATION_KEY_ID, APPLE_NOTARIZATION_ISSUER_ID"

        echo "====== WARNING ======"
        echo "This bundle is being signed without all entitlements, some features (e.g. universal links) will not work"
        echo "====== WARNING ======"

        # NOTE: if you need to test universal links you have a few paths forward:
        # - create a PR and tag it with the `run-bundling` label, and download the .dmg file from there.
        # - get a signing key for the MQ55VZLNZQ team from Nathan.
        # - create your own signing key, and update references to MQ55VZLNZQ to your own team ID
        # then comment out this line.
        cat crates/zed/resources/zed.entitlements | sed '/com.apple.developer.associated-domains/,+1d' > "${app_path}/Contents/Resources/zed.entitlements"

        codesign --force --deep --entitlements "${app_path}/Contents/Resources/zed.entitlements" --sign ${MACOS_SIGNING_KEY:- -} "${app_path}" -v
    fi

    bundle_name=$(basename "$app_path")

    if [ "$local_install" = true ]; then
        rm -rf "/Applications/$bundle_name"
        mv "$app_path" "/Applications/$bundle_name"
        echo "Installed application bundle: /Applications/$bundle_name"
        if [ "$open_result" = true ]; then
            echo "Opening /Applications/$bundle_name"
            open "/Applications/$bundle_name"
        fi
    elif [ "$open_result" = true ]; then
        open "$app_path"
    fi

    if [[ "$target_dir" = "debug" ]]; then
        echo "Debug build detected - skipping DMG creation and signing"
        if [ "$local_install" = false ]; then
            echo "Created application bundle:"
            echo "$app_path"
        fi
    else
        dmg_target_directory="target/${target_triple}/${target_dir}"
        dmg_source_directory="${dmg_target_directory}/dmg"
        dmg_file_path="${dmg_target_directory}/Gwen-${arch_suffix}.dmg"
        xcode_bin_dir_path="$(xcode-select -p)/usr/bin"

        rm -rf ${dmg_source_directory}
        mkdir -p ${dmg_source_directory}
        mv "${app_path}" "${dmg_source_directory}"
        notarization_key_file=$(mktemp)

        echo "Adding symlink to /Applications to ${dmg_source_directory}"
        ln -s /Applications ${dmg_source_directory}

        echo "Creating final DMG at ${dmg_file_path} using ${dmg_source_directory}"
        hdiutil create -volname Gwen -srcfolder "${dmg_source_directory}" -ov -format UDZO "${dmg_file_path}"

        # If someone runs this bundle script locally, a symlink will be placed in `dmg_source_directory`.
        # This symlink causes CPU issues with Zed if the Zed codebase is the project being worked on, so we simply remove it for now.
        echo "Removing symlink to /Applications from ${dmg_source_directory}"
        rm ${dmg_source_directory}/Applications

        echo "Adding license agreement to DMG"
        npm install --global dmg-license minimist
        dmg-license script/terms/terms.json "${dmg_file_path}"

        if [[ $can_code_sign = true ]]; then
            echo "Notarizing DMG with Apple"
            /usr/bin/codesign --deep --force --timestamp --options runtime --sign "$IDENTITY" "$(pwd)/${dmg_file_path}" -v
            echo "$APPLE_NOTARIZATION_KEY" > "$notarization_key_file"
            "${xcode_bin_dir_path}/notarytool" submit --wait --key "$notarization_key_file" --key-id "$APPLE_NOTARIZATION_KEY_ID" --issuer "$APPLE_NOTARIZATION_ISSUER_ID" "${dmg_file_path}"
            rm "$notarization_key_file"
            "${xcode_bin_dir_path}/stapler" staple "${dmg_file_path}"
        fi

        if [ "$open_result" = true ]; then
            open $dmg_target_directory
        fi
    fi
}

function sign_binary() {
    local binary_path=$1

    if [[ $can_code_sign = true ]]; then
        echo "Code signing executable $binary_path"
        /usr/bin/codesign --deep --force --timestamp --options runtime --entitlements crates/zed/resources/zed.entitlements --sign "$IDENTITY" "${binary_path}" -v
    fi
}

debug_symbols_extracted=false
function extract_debug_symbols() {
    if [ "$debug_symbols_extracted" = true ]; then
        return
    fi
    debug_symbols_extracted=true
    if ! dsymutil --flat "target/${target_triple}/${target_dir}/zed" 2> target/dsymutil.log; then
        echo "dsymutil failed"
        cat target/dsymutil.log
        exit 1
    fi
    if ! dsymutil --flat "target/${target_triple}/${target_dir}/remote_server" 2> target/dsymutil.log; then
        echo "dsymutil failed"
        cat target/dsymutil.log
        exit 1
    fi
}

function upload_debug_symbols() {
    if [ "$local_install" = true ]; then
        echo "local install; skipping sentry upload."
    elif [[ -n "${SENTRY_AUTH_TOKEN:-}" ]]; then
        echo "Uploading zed debug symbols to sentry..."
        extract_debug_symbols
        # Try uploading up to 3 times
        for attempt in 1 2 3; do
            echo "Sentry upload attempt $attempt..."
            if sentry-cli debug-files upload --include-sources --wait -p zed -o zed-dev \
                "target/${target_triple}/${target_dir}/zed.dwarf" \
                "target/${target_triple}/${target_dir}/remote_server.dwarf"; then
                break
            else
                echo "Sentry upload failed on attempt $attempt"
                if [ $attempt -eq 3 ]; then
                    echo "All sentry upload attempts failed"
                    exit 1
                fi
            fi
        done
    else
        echo "missing SENTRY_AUTH_TOKEN. skipping sentry upload."
    fi
}

upload_debug_symbols

# Sentry receives the extracted zed.dwarf, not the binary, so debug symbols
# must be extracted before the binaries are stripped below. The .dwarf files
# also keep symbols recoverable when the sentry upload is skipped.
if [[ "$target_dir" == "release" && "$local_install" != true ]]; then
    extract_debug_symbols
    strip -x "target/${target_triple}/${target_dir}/zed"
    strip -x "target/${target_triple}/${target_dir}/cli"
    strip -x "target/${target_triple}/${target_dir}/remote_server"
fi

cp target/${target_triple}/${target_dir}/zed "${app_path}/Contents/MacOS/zed"
cp target/${target_triple}/${target_dir}/cli "${app_path}/Contents/MacOS/cli"
sign_app_binaries

sign_binary "target/$target_triple/release/remote_server"
gzip -f --stdout --best target/$target_triple/release/remote_server > target/zed-remote-server-macos-$arch_suffix.gz