-
Notifications
You must be signed in to change notification settings - Fork 81
Macos support into main #228
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
7cb211c
935b78c
131b5c8
fbc23c3
e3ed096
f21429c
dc18602
9569cbe
ee2cf84
c197e8a
3208239
e08bbec
1ed4d7b
95d995f
da0117d
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,8 +1,8 @@ | ||||||||||||||||
| name: Package installers | ||||||||||||||||
|
|
||||||||||||||||
| # Builds the per-platform installer/setup tool (WiiCompiled-Setup.exe / | ||||||||||||||||
| # WiiCompiled-Setup-x86_64.AppImage) via Launcher/Build-Installer.ps1 and | ||||||||||||||||
| # Launcher/build-appimage.sh respectively - the same scripts a maintainer runs by hand today to | ||||||||||||||||
| # WiiCompiled-Setup-x86_64.AppImage / WiiCompiled-Setup.pkg) via the platform packaging scripts - | ||||||||||||||||
| # the same scripts a maintainer runs by hand today to | ||||||||||||||||
| # produce a GitHub Release asset. This does NOT build the actual translated game executable: | ||||||||||||||||
| # that step requires the end user's own Mario Kart Wii dump (Assets/main.dol, Assets/StaticR.rel), | ||||||||||||||||
| # which is proprietary and not present in this repository or in CI. | ||||||||||||||||
|
|
@@ -11,6 +11,11 @@ on: | |||||||||||||||
| tags: | ||||||||||||||||
| - '*' | ||||||||||||||||
| workflow_dispatch: | ||||||||||||||||
| inputs: | ||||||||||||||||
| version: | ||||||||||||||||
| description: Package version | ||||||||||||||||
| required: true | ||||||||||||||||
| type: string | ||||||||||||||||
|
|
||||||||||||||||
| permissions: | ||||||||||||||||
| contents: read | ||||||||||||||||
|
|
@@ -90,14 +95,130 @@ jobs: | |||||||||||||||
| if-no-files-found: error | ||||||||||||||||
| archive: false | ||||||||||||||||
|
|
||||||||||||||||
| macos-setup-package: | ||||||||||||||||
| name: macOS (universal Setup.pkg) | ||||||||||||||||
| runs-on: macos-14 | ||||||||||||||||
| steps: | ||||||||||||||||
| - uses: actions/checkout@v7 | ||||||||||||||||
| with: | ||||||||||||||||
| persist-credentials: false | ||||||||||||||||
|
|
||||||||||||||||
| - uses: actions/setup-dotnet@v6 | ||||||||||||||||
| with: | ||||||||||||||||
| dotnet-version: '8.0.x' | ||||||||||||||||
|
|
||||||||||||||||
| - name: Verify Apple Silicon runner | ||||||||||||||||
| shell: bash | ||||||||||||||||
| run: | | ||||||||||||||||
| test "$(uname -m)" = arm64 | ||||||||||||||||
| xcode-select -p | ||||||||||||||||
|
|
||||||||||||||||
| - name: Download pinned Nod tools | ||||||||||||||||
| shell: bash | ||||||||||||||||
| run: | | ||||||||||||||||
| mkdir -p Launcher/artifacts/macos | ||||||||||||||||
| nodtool_version=v2.0.0-alpha.10 | ||||||||||||||||
| nodtool_arm64_asset=nodtool-macos-arm64 | ||||||||||||||||
| nodtool_arm64_sha256=e23ca466999b720c55e6d29c9683fce8cc74451ba64ead2e543d50129f24528a | ||||||||||||||||
| nodtool_x86_64_asset=nodtool-macos-x86_64 | ||||||||||||||||
| nodtool_x86_64_sha256=f68f504dc2b72694b468ca78b6a24142c7aa5c8800f77564297f4143682e6575 | ||||||||||||||||
| curl -fsSL --retry 3 \ | ||||||||||||||||
| "https://github.com/encounter/nod/releases/download/${nodtool_version}/${nodtool_arm64_asset}" \ | ||||||||||||||||
| -o Launcher/artifacts/macos/nodtool-arm64 | ||||||||||||||||
| curl -fsSL --retry 3 \ | ||||||||||||||||
| "https://github.com/encounter/nod/releases/download/${nodtool_version}/${nodtool_x86_64_asset}" \ | ||||||||||||||||
| -o Launcher/artifacts/macos/nodtool-x86_64 | ||||||||||||||||
| printf '%s %s\n' "$nodtool_arm64_sha256" Launcher/artifacts/macos/nodtool-arm64 | shasum -a 256 -c - | ||||||||||||||||
| printf '%s %s\n' "$nodtool_x86_64_sha256" Launcher/artifacts/macos/nodtool-x86_64 | shasum -a 256 -c - | ||||||||||||||||
| chmod +x Launcher/artifacts/macos/nodtool-arm64 Launcher/artifacts/macos/nodtool-x86_64 | ||||||||||||||||
|
|
||||||||||||||||
| - name: Publish self-contained Translator tools | ||||||||||||||||
| shell: bash | ||||||||||||||||
| run: | | ||||||||||||||||
| dotnet publish translator/src/Translator.Cli/Translator.Cli.csproj \ | ||||||||||||||||
| -c Release -r osx-arm64 --self-contained true \ | ||||||||||||||||
| -p:PublishSingleFile=true \ | ||||||||||||||||
| -o Launcher/artifacts/macos/translator-arm64 | ||||||||||||||||
| dotnet publish translator/src/Translator.Cli/Translator.Cli.csproj \ | ||||||||||||||||
| -c Release -r osx-x64 --self-contained true \ | ||||||||||||||||
| -p:PublishSingleFile=true \ | ||||||||||||||||
| -o Launcher/artifacts/macos/translator-x86_64 | ||||||||||||||||
|
|
||||||||||||||||
| - name: Download pinned universal Ninja | ||||||||||||||||
| shell: bash | ||||||||||||||||
| run: | | ||||||||||||||||
| ninja_version=1.13.2 | ||||||||||||||||
| ninja_sha256=c99048673aa765960a99cf10c6ddb9f1fad506099ff0a0e137ad8960a88f321b | ||||||||||||||||
| curl -fsSL --retry 3 "https://github.com/ninja-build/ninja/releases/download/v${ninja_version}/ninja-mac.zip" -o ninja-mac.zip | ||||||||||||||||
| printf '%s %s\n' "$ninja_sha256" ninja-mac.zip | shasum -a 256 -c - | ||||||||||||||||
| unzip -q ninja-mac.zip -d Launcher/artifacts/macos/ninja | ||||||||||||||||
| chmod +x Launcher/artifacts/macos/ninja/ninja | ||||||||||||||||
|
|
||||||||||||||||
| - name: Download pinned portable CMake | ||||||||||||||||
| shell: bash | ||||||||||||||||
| run: | | ||||||||||||||||
| cmake_version=4.4.3 | ||||||||||||||||
| archive="cmake-${cmake_version}-macos-universal.tar.gz" | ||||||||||||||||
| base_url="https://github.com/Kitware/CMake/releases/download/v${cmake_version}" | ||||||||||||||||
| expected_sha256=0c5d65251c14cc884bfa16bdbed3c263ce5bffe2e21c0d0d00962cb0610464fa | ||||||||||||||||
| curl -fsSL --retry 3 "$base_url/$archive" -o "$archive" | ||||||||||||||||
| printf '%s %s\n' "$expected_sha256" "$archive" | shasum -a 256 -c - | ||||||||||||||||
| tar -xzf "$archive" | ||||||||||||||||
| mv "cmake-${cmake_version}-macos-universal/CMake.app/Contents" Launcher/artifacts/macos/cmake | ||||||||||||||||
|
|
||||||||||||||||
| - name: Build Setup.pkg | ||||||||||||||||
| env: | ||||||||||||||||
| PACKAGE_VERSION: ${{ inputs.version }} | ||||||||||||||||
| TAG_VERSION: ${{ github.ref_name }} | ||||||||||||||||
| shell: bash | ||||||||||||||||
| run: | | ||||||||||||||||
| package_version="$PACKAGE_VERSION" | ||||||||||||||||
| if [[ -z "$package_version" ]]; then package_version="${TAG_VERSION#v}"; fi | ||||||||||||||||
| mkdir -p Launcher/dist | ||||||||||||||||
| Launcher/macos/build-setup-pkg.command \ | ||||||||||||||||
| --nodtool-arm64 Launcher/artifacts/macos/nodtool-arm64 \ | ||||||||||||||||
| --nodtool-x86_64 Launcher/artifacts/macos/nodtool-x86_64 \ | ||||||||||||||||
| --translator-arm64 Launcher/artifacts/macos/translator-arm64/Translator.Cli \ | ||||||||||||||||
| --translator-x86_64 Launcher/artifacts/macos/translator-x86_64/Translator.Cli \ | ||||||||||||||||
| --cmake-root Launcher/artifacts/macos/cmake \ | ||||||||||||||||
| --ninja-arm64 Launcher/artifacts/macos/ninja/ninja \ | ||||||||||||||||
| --ninja-x86_64 Launcher/artifacts/macos/ninja/ninja \ | ||||||||||||||||
| --output Launcher/dist/WiiCompiled-Setup.pkg \ | ||||||||||||||||
| --version "$package_version" | ||||||||||||||||
|
|
||||||||||||||||
| - name: Verify package layout and architecture-specific tools | ||||||||||||||||
| shell: bash | ||||||||||||||||
| run: | | ||||||||||||||||
| pkgutil --check-signature Launcher/dist/WiiCompiled-Setup.pkg | ||||||||||||||||
| ! pkgutil --payload-files Launcher/dist/WiiCompiled-Setup.pkg | \ | ||||||||||||||||
| grep -E '/(Assets|generated|PulsarPacks|WiiCompiled.app|RetroRewind.app)(/|$)' | ||||||||||||||||
|
Comment on lines
+193
to
+194
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win Make the forbidden-payload check fail the step. The negated pipeline suppresses errexit. If Use an explicit conditional or exit after a match. Proposed fix- ! pkgutil --payload-files Launcher/dist/WiiCompiled-Setup.pkg | \
- grep -E '/(Assets|generated|PulsarPacks|WiiCompiled.app|RetroRewind.app)(/|$)'
+ if pkgutil --payload-files Launcher/dist/WiiCompiled-Setup.pkg | \
+ grep -E '/(Assets|generated|PulsarPacks|WiiCompiled.app|RetroRewind.app)(/|$)'; then
+ echo "::error::Setup.pkg contains a forbidden payload"
+ exit 1
+ fi📝 Committable suggestion
Suggested change
🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||||||||||||
| expanded="$RUNNER_TEMP/wiicompiled-setup-expanded" | ||||||||||||||||
| pkgutil --expand-full Launcher/dist/WiiCompiled-Setup.pkg "$expanded" | ||||||||||||||||
| resources="$expanded/Payload/Applications/WiiCompiled Setup.app/Contents/Resources" | ||||||||||||||||
| for arch in arm64 x86_64; do | ||||||||||||||||
| for tool in nodtool Translator.Cli ninja; do | ||||||||||||||||
| lipo "$resources/tools/$arch/$tool" -verify_arch "$arch" | ||||||||||||||||
| done | ||||||||||||||||
| done | ||||||||||||||||
| lipo "$resources/tools/cmake/bin/cmake" -verify_arch arm64 x86_64 | ||||||||||||||||
| bash "$resources/setup.command" --help | ||||||||||||||||
| /usr/bin/arch -x86_64 /bin/bash "$resources/setup.command" --help | ||||||||||||||||
|
|
||||||||||||||||
| - uses: actions/upload-artifact@v7 | ||||||||||||||||
| with: | ||||||||||||||||
| name: WiiCompiled-Setup-macos-universal | ||||||||||||||||
| path: Launcher/dist/WiiCompiled-Setup.pkg | ||||||||||||||||
| if-no-files-found: error | ||||||||||||||||
| archive: false | ||||||||||||||||
|
|
||||||||||||||||
| # Publishes the packaged installers as a GitHub Release whenever a v* tag is pushed. Wheel Wizard | ||||||||||||||||
| # discovers updates from these releases, so the contract it relies on is enforced here: a full | ||||||||||||||||
| # (non-prerelease) release whose tag is v<semver>, carrying an asset named exactly | ||||||||||||||||
| # WiiCompiled-Setup.exe, produced by a setup host that reports that same version. | ||||||||||||||||
| # (non-prerelease) release whose tag is v<semver>, carrying the expected platform assets, | ||||||||||||||||
| # produced by setup hosts that report that same version. | ||||||||||||||||
| release: | ||||||||||||||||
| name: Publish GitHub Release | ||||||||||||||||
| if: startsWith(github.ref, 'refs/tags/v') | ||||||||||||||||
| needs: [linux-appimage, windows-installer, recompilation] | ||||||||||||||||
| needs: [linux-appimage, windows-installer, macos-setup-package, recompilation] | ||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||
| permissions: | ||||||||||||||||
| contents: write | ||||||||||||||||
|
|
@@ -143,7 +264,7 @@ jobs: | |||||||||||||||
| set -euo pipefail | ||||||||||||||||
| ls -lR artifacts | ||||||||||||||||
| assets=() | ||||||||||||||||
| for name in WiiCompiled-Setup.exe WiiCompiled-Setup-x86_64.AppImage WiiCompiled-Setup-aarch64.AppImage; do | ||||||||||||||||
| for name in WiiCompiled-Setup.exe WiiCompiled-Setup-x86_64.AppImage WiiCompiled-Setup-aarch64.AppImage WiiCompiled-Setup.pkg; do | ||||||||||||||||
| found="$(find artifacts -type f -name "$name" | head -n 1)" | ||||||||||||||||
| [ -n "$found" ] && [ -s "$found" ] || { echo "::error::missing release asset $name"; exit 1; } | ||||||||||||||||
| assets+=("$found") | ||||||||||||||||
|
|
||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🔎 Supported by static analysis
🏁 Script executed:
Repository: patchzyy/Wiicompiled
Length of output: 18280
🏁 Script executed:
Repository: patchzyy/Wiicompiled
Length of output: 50376
🌐 Web query:
Apple macOS pkgutil --check-signature unsigned package exit status man page💡 Result:
<search_synthesis>
When using the pkgutil --check-signature command on macOS, the exit status of the command does not depend solely on whether the package is signed or unsigned; rather, it primarily reflects whether the command executed successfully [1]. According to technical community documentation and practical testing, the pkgutil --check-signature command generally exits with a status of 0 when it successfully completes the verification process, regardless of whether that verification result indicates the package is signed or unsigned [1]. An unsigned package will return a status message stating Status: no signature in the terminal output, but the command itself will still typically exit with 0 [2][3][1]. The man page for pkgutil does not explicitly document specific exit codes for different signature states [4][5][6][7]. Because the tool is designed to report the validity and trust of a signature (or the lack thereof) to standard output, you should rely on parsing the textual output of the command (e.g., searching for "no signature") in automated workflows rather than relying on the exit status [2][1].
</search_synthesis>
<source_evidence>
Citations:
Sign and notarize the release package.
build-setup-pkg.commandpasses no--installer-identity, so it copies the unsigned package.pkgutil --check-signaturereports this state but does not reject it. The release job then uploads the same unsigned artifact. No later signing, notarization, or stapling step exists.Make the Developer ID Installer certificate and private key available through repository secrets. Pass its identity name with
--installer-identity. Notarize and staple the final package before upload. The builder has no environment-based signing fallback.🤖 Prompt for AI Agents