Add CI Support

.github/workflows/main.yml

@@ -0,0 +1,58 @@
+name: Build Tools
+
+on:
+  push:
+    branches:
+      - oz/ci # TODO: change this
+
+jobs:
+  build-mac:
+    runs-on: macos-latest
+    env:
+      TAG: ${{ github.ref_name }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: brew install just ninja
+      - name: Clone
+        run: just clone
+      - name: Prepare
+        run: just prepare
+      - name: Build rust, cargo and newlib
+        run: just build-all
+      - name: Package
+        env:
+          APPLE_CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
+          APPLE_CRED: ${{ secrets.APPLE_CRED }}
+          APPLE_P12_BASE64: ${{ secrets.APPLE_P12_BASE64 }}
+          APPLE_P12_PASSWORD: ${{ secrets.APPLE_P12_PASSWORD }}
+          APPLE_TEAMID: ${{ secrets.APPLE_TEAMID }}
+          APPLE_TEMPKEYCHAIN_PASSWORD: ${{ secrets.APPLE_TEMPKEYCHAIN_PASSWORD }}
+        run: just package
+      - uses: actions/upload-artifact@v4
+        with:
+          name: platform-tools-osx-aarch64.tar.bz2
+          path: out/platform-tools-osx-aarch64.tar.bz2
+
+  build-linux:
+    runs-on: ubuntu-latest
+    env:
+      TAG: ${{ github.ref_name }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install just
+        uses: taiki-e/install-action@just
+      - name: Install ninja
+        run: sudo apt update; sudo apt install ninja-build
+      - name: Clone
+        run: just clone
+      - name: Prepare
+        run: just prepare
+      - name: Build rust, cargo and newlib
+        run: just build-all
+      - name: Package
+        run: just package
+      - uses: actions/upload-artifact@v4
+        with:
+          name: platform-tools-linux-x86_64.tar.bz2
+          path: out/platform-tools-linux-x86_64.tar.bz2

justfile

@@ -30,11 +30,11 @@ build-cargo:
 	# AG: this fails for me with macport and libiconv
 	# AG: I have to disable libiconv, run this manually
 	# AG: and then re-enable it
-	cd {{ out_dir }}/cargo && env OPENSSL_STATIC=1 cargo build --release
+	cd {{ out_dir }}/cargo && cargo update && env OPENSSL_STATIC=1 cargo build --release
 
 [linux]
 build-cargo:
-	cd {{ out_dir }}/cargo && env OPENSSL_STATIC=1 OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu OPENSSL_INCLUDE_DIR=/usr/include/openssl cargo build --release
+	cd {{ out_dir }}/cargo && cargo update && env OPENSSL_STATIC=1 OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu OPENSSL_INCLUDE_DIR=/usr/include/openssl cargo build --release
 
 
 [linux,macos]

scripts/package.sh

@@ -82,6 +82,26 @@ if [[ "${HOST_TRIPLE}" != "x86_64-pc-windows-msvc" ]] ; then
     #cp -R rust/build/${HOST_TRIPLE}/llvm/lib/python* deploy/llvm/lib/
 fi
 
+# Sign macOS binaries
+if [[ $HOST_TRIPLE == *apple-darwin* ]]; then
+    LLVM_BIN="./deploy/llvm/bin"
+    RUST_BIN="./deploy/rust/bin"
+    RUST_LIB="./deploy/rust/lib"
+
+    ../scripts/sign.sh \
+        "$LLVM_BIN/llvm-objdump" \
+        "$LLVM_BIN/llvm-ar" \
+        "$LLVM_BIN/llvm-readobj" \
+        "$LLVM_BIN/llvm-objcopy" \
+        "$RUST_BIN/rustc" \
+        "$RUST_BIN/rustdoc" \
+        "$RUST_BIN/cargo" \
+        "$RUST_LIB/librustc_driver-b4e91886a4c059a0.dylib" \
+        "$RUST_LIB/libstd-6eff127b55c063c2.dylib" \
+        "$RUST_LIB/libtest-090d77c63b6e9f11.dylib"\
+
+fi
+
 # Check the Rust binaries
 while IFS= read -r f
 do

scripts/sign.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -ex
+
+FILES_TO_SIGN=$@
+
+for FILE_PATH in $FILES_TO_SIGN; do
+    FILE_NAME=$(basename $FILE_PATH)
+    APPLE_TEMPKEYCHAIN_NAME=$(echo $FILE_NAME | tr -cd 'a-zA-Z')$(($RANDOM)) # use a random name
+
+    echo "File path: $FILE_PATH"
+    echo "File name: $FILE_NAME"
+    echo "Apple temp keychain name: $APPLE_TEMPKEYCHAIN_NAME"
+
+    # create keychain
+    printf "$APPLE_P12_BASE64" | base64 -d > dev.p12
+    security create-keychain -p "$APPLE_TEMPKEYCHAIN_PASSWORD" "$APPLE_TEMPKEYCHAIN_NAME"
+    security list-keychains -d user -s "$APPLE_TEMPKEYCHAIN_NAME" $(security list-keychains -d user | tr -d '"')
+    security set-keychain-settings "$APPLE_TEMPKEYCHAIN_NAME"
+    security import dev.p12 -k "$APPLE_TEMPKEYCHAIN_NAME" -P "$APPLE_P12_PASSWORD" -T "/usr/bin/codesign"
+    security set-key-partition-list -S apple-tool:,apple: -s -k "$APPLE_TEMPKEYCHAIN_PASSWORD" -D "$APPLE_CODESIGN_IDENTITY" -t private "$APPLE_TEMPKEYCHAIN_NAME"
+    security default-keychain -d user -s "$APPLE_TEMPKEYCHAIN_NAME"
+    security unlock-keychain -p "$APPLE_TEMPKEYCHAIN_PASSWORD" "$APPLE_TEMPKEYCHAIN_NAME"
+
+    # sign the binary
+    codesign -o runtime --force --timestamp -s "$APPLE_CODESIGN_IDENTITY" -v $FILE_PATH
+
+    # notarize binary
+    ditto -c -k $FILE_PATH $FILE_NAME.zip # notarization require zip files
+    xcrun notarytool store-credentials --apple-id [email protected] --password "$APPLE_CRED" --team-id "$APPLE_TEAMID" altool
+    xcrun notarytool submit $FILE_NAME.zip --keychain-profile altool --wait
+done