BrowserOS/build/modules/package.py

#!/usr/bin/env python3
"""
DMG creation and packaging module for BrowserOS
NOTE: This module is macOS-specific. Windows packaging would require different tools (MSI/NSIS)
"""

import sys
import shutil
from pathlib import Path
from typing import Optional, List
from context import BuildContext
from utils import run_command, log_info, log_error, log_success


def package(ctx: BuildContext) -> bool:
    """Create DMG package (only if not done by signing)"""
    if ctx.sign_package:
        # Already handled by signing process
        return True
    
    log_info("\n📀 Creating DMG package...")
    
    app_path = ctx.get_app_path()
    dmg_dir = ctx.root_dir / "dmg"
    dmg_name = ctx.get_dmg_name()
    dmg_path = dmg_dir / dmg_name
    
    # Use Chromium's pkg-dmg tool
    pkg_dmg_path = ctx.get_pkg_dmg_path()
    
    if create_dmg(app_path, dmg_path, "BrowserOS", pkg_dmg_path):
        log_success(f"Created {dmg_name}")
        return True
    else:
        log_error("Failed to create DMG")
        raise RuntimeError("Failed to create DMG")


def create_dmg(app_path: Path, dmg_path: Path, volume_name: str = "BrowserOS",
               pkg_dmg_path: Optional[Path] = None) -> bool:
    """Create a DMG package from an app bundle"""
    log_info(f"\n📀 Creating DMG package: {dmg_path.name}")
    
    # Verify app exists
    if not app_path.exists():
        log_error(f"App not found at: {app_path}")
        return False
    
    # Create DMG directory if needed
    dmg_path.parent.mkdir(parents=True, exist_ok=True)
    
    # Remove existing DMG if present
    if dmg_path.exists():
        log_info(f"  Removing existing DMG: {dmg_path.name}")
        dmg_path.unlink()
    
    # Build command
    cmd = []
    
    if pkg_dmg_path and pkg_dmg_path.exists():
        # Use Chromium's pkg-dmg tool if available
        cmd = [str(pkg_dmg_path)]
    else:
        # Fallback to system pkg-dmg if available
        pkg_dmg_system = shutil.which('pkg-dmg')
        if pkg_dmg_system:
            cmd = [pkg_dmg_system]
        else:
            log_error("No pkg-dmg tool found")
            return False
    
    cmd.extend([
        "--sourcefile",
        "--source", str(app_path),
        "--target", str(dmg_path),
        "--volname", volume_name,
        "--symlink", "/Applications:/Applications",
        "--format", "UDBZ"
    ])
    
    # Add verbosity for Chromium's pkg-dmg
    if pkg_dmg_path:
        cmd.extend(["--verbosity", "2"])
    
    try:
        run_command(cmd)
        log_success(f"DMG created: {dmg_path}")
        return True
    except Exception as e:
        log_error(f"Failed to create DMG: {e}")
        return False


def sign_dmg(dmg_path: Path, certificate_name: str) -> bool:
    """Sign a DMG file"""
    log_info(f"\n🔏 Signing DMG: {dmg_path.name}")
    
    if not dmg_path.exists():
        log_error(f"DMG not found at: {dmg_path}")
        return False
    
    try:
        run_command([
            "codesign", "--sign", certificate_name,
            "--force", "--timestamp", str(dmg_path)
        ])
        
        # Verify signature
        log_info("🔍 Verifying DMG signature...")
        run_command(["codesign", "-vvv", str(dmg_path)])
        
        log_success("DMG signed successfully")
        return True
    except Exception as e:
        log_error(f"Failed to sign DMG: {e}")
        return False


def notarize_dmg(dmg_path: Path, keychain_profile: str = "notarytool-profile") -> bool:
    """Notarize a DMG file"""
    log_info(f"\n📤 Notarizing DMG: {dmg_path.name}")
    
    if not dmg_path.exists():
        log_error(f"DMG not found at: {dmg_path}")
        return False
    
    try:
        # Submit for notarization
        log_info("📤 Submitting DMG for notarization (this may take a while)...")
        result = run_command(
            ["xcrun", "notarytool", "submit", str(dmg_path),
             "--keychain-profile", keychain_profile, "--wait"],
            check=False
        )
        
        log_info(result.stdout)
        if result.stderr:
            log_error(result.stderr)
        
        if result.returncode != 0:
            log_error("DMG notarization submission failed")
            return False
        
        # Check if accepted
        if "status: Accepted" not in result.stdout:
            log_error("DMG notarization failed - status was not 'Accepted'")
            # Try to extract submission ID for debugging
            for line in result.stdout.split('\n'):
                if 'id:' in line:
                    submission_id = line.split('id:')[1].strip().split()[0]
                    log_info(f"Get detailed logs with: xcrun notarytool log {submission_id} --keychain-profile \"{keychain_profile}\"")
                    break
            return False
        
        log_success("DMG notarization successful - status: Accepted")
        
        # Staple the ticket
        log_info("📎 Stapling notarization ticket to DMG...")
        result = run_command(
            ["xcrun", "stapler", "staple", str(dmg_path)],
            check=False
        )
        
        if result.returncode != 0:
            log_error("Failed to staple notarization ticket to DMG")
            return False
        
        log_success("DMG notarization ticket stapled successfully")
        
        # Verify stapling
        log_info("🔍 Verifying DMG stapling...")
        result = run_command(
            ["xcrun", "stapler", "validate", str(dmg_path)],
            check=False
        )
        
        if result.returncode != 0:
            log_error("DMG stapling verification failed")
            return False
        
        log_success("DMG stapling verification successful")
        
        # Final security assessment
        log_info("🔍 Performing final security assessment...")
        result = run_command(
            ["spctl", "-a", "-vvv", "-t", "open",
             "--context", "context:primary-signature", str(dmg_path)],
            check=False
        )
        
        if result.returncode != 0:
            log_error("Final security assessment failed")
            return False
        
        log_success("Final security assessment passed")
        return True
        
    except Exception as e:
        log_error(f"Unexpected error during DMG notarization: {e}")
        return False


def create_signed_notarized_dmg(app_path: Path, dmg_path: Path, 
                               certificate_name: str,
                               volume_name: str = "BrowserOS",
                               pkg_dmg_path: Optional[Path] = None,
                               keychain_profile: str = "notarytool-profile") -> bool:
    """Create, sign, and notarize a DMG in one go"""
    log_info("="*70)
    log_info("📦 Creating signed and notarized DMG package")
    log_info("="*70)
    
    # Create DMG
    if not create_dmg(app_path, dmg_path, volume_name, pkg_dmg_path):
        return False
    
    # Sign DMG
    if not sign_dmg(dmg_path, certificate_name):
        return False
    
    # Notarize DMG
    if not notarize_dmg(dmg_path, keychain_profile):
        return False
    
    log_info("="*70)
    log_success(f"DMG package ready: {dmg_path}")
    log_info("="*70)
    return True


def package_universal(contexts: List[BuildContext]) -> bool:
    """Create DMG package for universal binary"""
    log_info("=" * 70)
    log_info("📦 Creating universal DMG package...")
    log_info("=" * 70)
    
    if len(contexts) < 2:
        log_error("Universal packaging requires at least 2 architectures")
        return False
    
    # Use the universal app path
    universal_dir = contexts[0].chromium_src / "out/Default_universal"
    universal_app_path = universal_dir / contexts[0].NXTSCAPE_APP_NAME
    
    if not universal_app_path.exists():
        log_error(f"Universal app not found: {universal_app_path}")
        return False
    
    # Create DMG in root dmg directory
    dmg_dir = contexts[0].root_dir / "dmg"
    dmg_dir.mkdir(parents=True, exist_ok=True)
    
    # Create a temporary universal context for DMG naming
    universal_ctx = BuildContext(
        root_dir=contexts[0].root_dir,
        chromium_src=contexts[0].chromium_src,
        architecture="universal",
        build_type=contexts[0].build_type,
        apply_patches=False,
        sign_package=contexts[0].sign_package,
        package=False,
        build=False,
    )
    
    # Use context's DMG naming
    dmg_name = universal_ctx.get_dmg_name()
    dmg_path = dmg_dir / dmg_name
    
    # Get pkg-dmg tool
    pkg_dmg_path = contexts[0].get_pkg_dmg_path()
    
    # Create the universal DMG
    if create_dmg(universal_app_path, dmg_path, "BrowserOS", pkg_dmg_path):
        log_success(f"Universal DMG created: {dmg_name}")
        return True
    else:
        log_error("Failed to create universal DMG")
        return False