Merge wip/133-macos-package: macOS .app/.dmg for Apple silicon (macOS 11+) and Intel (macOS 10.15+), dependencies built from source for the minimum, minos check per arch (#133)

The Organizer message-pane height change is kept to macOS; Linux is unchanged.
Catalina VM: all 34 executables of the Intel app bind with DYLD_BIND_AT_LAUNCH=1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PFPK14wBcLD1s4dYUowpP4

Author: andy

.github/workflows/build.yml

@@ -266,8 +266,21 @@ jobs:
 
   macos:
     if: ${{ github.event_name != 'workflow_dispatch' || inputs.only == '' || inputs.only == 'macos' }}
-    name: macOS (Homebrew)
-    runs-on: macos-latest
+    name: macOS (${{ matrix.arch }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { os: macos-latest, arch: arm64, target: "11.0", experimental: false }
+          # Catalina: the oldest macOS many 2012-2014 Intel Macs can run.
+          - { os: macos-15-intel, arch: x86_64, target: "10.15", experimental: true }
+    env:
+      # Oldest macOS the app is built for (#133).  Our code and every
+      # bundled library are built to this; the minimum-macOS step fails
+      # the job on any Mach-O above it.
+      MACOSX_DEPLOYMENT_TARGET: ${{ matrix.target }}
+      ECCE_DEPS: /Users/runner/ecce-deps
     # Bounded so a hung job cannot hold a runner slot for GitHub's
     # 6-hour default; see the concurrency note above.
     timeout-minutes: 90
@@ -278,22 +291,50 @@ jobs:
     # here to track the gap with a real, current compile log instead of
     # nothing -- it's expected to fail until #3 gets real porting work,
     # not a sign the workflow itself is broken.
-    continue-on-error: true
+    # x86_64 may fail until it is proven; arm64 must be green.
+    continue-on-error: ${{ matrix.experimental }}
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install build dependencies
-        run: |
-          brew install cmake ninja wxwidgets xerces-c mosquitto gcc libssh pkgconf
-          # The vendored Inventor core needs GLX and pre-C++17 code that
-          # Apple's compiler rejects; the Coin build (#166) skips it.
-          brew install coin3d || { echo "::error::Homebrew has no coin3d formula"; exit 1; }
+      - name: Install build tools
+        # Only tools: the libraries come from build-deps.sh, because
+        # Homebrew bottles are built for the runner's own macOS.
+        run: brew install cmake ninja pkgconf gcc bash
+
+      - name: Cache libraries built for macOS ${{ env.MACOSX_DEPLOYMENT_TARGET }}
+        id: deps
+        uses: actions/cache/restore@v4
+        with:
+          path: ${{ env.ECCE_DEPS }}
+          key: macos-deps-${{ matrix.arch }}-${{ env.MACOSX_DEPLOYMENT_TARGET }}-${{ hashFiles('packaging/macos/build-deps.sh') }}
+
+      - name: Build libraries (wxWidgets, Coin, Xerces, Mosquitto, libssh, OpenSSL)
+        if: steps.deps.outputs.cache-hit != 'true'
+        run: packaging/macos/build-deps.sh "$ECCE_DEPS"
+
+      - name: Save the libraries
+        if: steps.deps.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v4
+        with:
+          path: ${{ env.ECCE_DEPS }}
+          key: ${{ steps.deps.outputs.cache-primary-key }}
 
       - name: Configure
         # ECCE_HOME_DIR/ECCE_WRAPPER_DESTINATION point the install at a
         # staging tree inside the workspace for the run step below.
+        # Homebrew's prefixes are ignored so nothing is picked up from
+        # them by accident.
         run: |
-          cmake -G Ninja -B build-cmake -DECCE_USE_COIN=ON -DCMAKE_PREFIX_PATH="$(brew --prefix)" \
+          export PATH="$ECCE_DEPS/bin:$PATH"
+          export PKG_CONFIG_LIBDIR="$ECCE_DEPS/lib/pkgconfig"
+          cmake -G Ninja -B build-cmake -DECCE_USE_COIN=ON \
+            -DCMAKE_OSX_DEPLOYMENT_TARGET="$MACOSX_DEPLOYMENT_TARGET" \
+            -DCMAKE_PREFIX_PATH="$ECCE_DEPS" \
+            -DCMAKE_IGNORE_PREFIX_PATH="/opt/homebrew;/usr/local" \
+            -DCMAKE_MAKE_PROGRAM="$(command -v ninja)" -DPKG_CONFIG_EXECUTABLE="$(command -v pkg-config)" \
+            -DCMAKE_Fortran_COMPILER="$(ls $(brew --prefix)/bin/gfortran-* | head -1)" \
+            -DFREETYPE_UNQUALIFIED_INCLUDE_DIR="$ECCE_DEPS/include/freetype2/freetype" \
+            -DFREETYPE_ROOT_INCLUDE_DIR="$ECCE_DEPS/include/freetype2" \
             -DECCE_HOME_DIR="$PWD/stage/ecce" -DECCE_WRAPPER_DESTINATION="$PWD/stage/bin" \
             -DCMAKE_INSTALL_PREFIX="$PWD/stage/ecce"
 
@@ -308,14 +349,78 @@ jobs:
         continue-on-error: true
         timeout-minutes: 25
         run: |
-          brew install bash || true
+          export PATH="$ECCE_DEPS/sbin:$ECCE_DEPS/bin:$PATH"
           cmake --install build-cmake
           tests/macos/run.sh stage macos-run
           cat macos-run/summary.txt >> "$GITHUB_STEP_SUMMARY"
 
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: macos-run
+          name: macos-run-${{ matrix.arch }}
           path: macos-run/
           if-no-files-found: ignore
+
+      # ECCE.app in a .dmg (#133), then the start test again on a copy of
+      # the app taken out of the mounted image, away from the build tree.
+      # The two steps below fail the job when they fail.  The job itself
+      # is continue-on-error (the native build is still experimental), so
+      # the workflow stays green but the job and these steps show red and
+      # the summary says FAILED.
+      - name: Package ECCE.app
+        run: |
+          export PATH="$ECCE_DEPS/bin:$PATH"
+          packaging/macos/make-app.sh stage dist
+
+      # Oldest macOS the bundle can run on (#133): the step fails when any
+      # Mach-O needs more than the deployment target or is not this runner's arch.
+      - name: Minimum macOS of every Mach-O in the app
+        run: |
+          mkdir -p minos
+          app=$(mktemp -d)
+          mnt=$(mktemp -d)
+          hdiutil attach dist/ECCE-*.dmg -mountpoint "$mnt" -nobrowse -quiet
+          cp -R "$mnt/ECCE.app" "$app/"
+          hdiutil detach "$mnt" -quiet
+          python3 packaging/macos/minos.py "$app/ECCE.app" minos/minos.txt \
+            --floor "$MACOSX_DEPLOYMENT_TARGET" --arch "${{ matrix.arch }}" > /dev/null || rc=$?
+          echo "runner: $(sw_vers -productVersion) $(uname -m)" >> minos/minos.txt
+          { echo '### Minimum macOS (ECCE.app)'; echo '```';
+            sed -n '/^Mach-O files/,$p' minos/minos.txt; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
+          exit ${rc:-0}
+
+      - name: Run the packaged app
+        if: always() && hashFiles('dist/*.dmg') != ''
+        timeout-minutes: 25
+        run: |
+          pkill -f "$PWD/stage" || true
+          mnt=$(mktemp -d)
+          hdiutil attach dist/ECCE-*.dmg -mountpoint "$mnt" -nobrowse -quiet
+          appdir=$(mktemp -d)
+          cp -R "$mnt/ECCE.app" "$appdir/"
+          hdiutil detach "$mnt" -quiet
+          # The build tree and the staging prefix must not be needed.
+          mv build-cmake build-cmake.gone
+          mv stage stage.gone
+          ECCE_APP="$appdir/ECCE.app" tests/macos/run.sh "$appdir/ECCE.app/Contents/Resources" macos-app-run
+          cat macos-app-run/summary.txt >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Summary on failure
+        if: failure()
+        run: echo '### macOS packaging FAILED (see the failed step above)' >> "$GITHUB_STEP_SUMMARY"
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: ECCE-macos-dmg-${{ matrix.arch }}
+          path: |
+            dist/*.dmg
+            minos/minos.txt
+          if-no-files-found: ignore
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: macos-app-run-${{ matrix.arch }}
+          path: macos-app-run/
+          if-no-files-found: ignore

CMakeLists.txt

@@ -338,9 +338,12 @@ target_link_libraries(eccewxgui PRIVATE ${wxWidgets_LIBRARIES})
 # ewxApp.C installs a g_log_set_writer_func() filter for a known-benign
 # wxWidgets/GTK3 backend warning (see the comment there) -- needs GLib's
 # own headers directly, which wxWidgets_INCLUDE_DIRS doesn't expose.
-pkg_check_modules(GLIB2 REQUIRED glib-2.0)
-target_include_directories(eccewxgui PRIVATE ${GLIB2_INCLUDE_DIRS})
-target_link_libraries(eccewxgui PRIVATE ${GLIB2_LIBRARIES})
+# GTK only: wx's macOS and Windows ports do not use GLib.
+if(NOT APPLE)
+  pkg_check_modules(GLIB2 REQUIRED glib-2.0)
+  target_include_directories(eccewxgui PRIVATE ${GLIB2_INCLUDE_DIRS})
+  target_link_libraries(eccewxgui PRIVATE ${GLIB2_LIBRARIES})
+endif()
 
 # ewxRaiseWindow() (ewxWindowUtils.C) calls gtk_window_present*() and, on an
 # X11 display only, gdk_x11_get_server_time() (#120); needs gtk+-3.0 headers
@@ -535,6 +538,11 @@ function(ecce_fortran_app name)
   # doesn't know that and refuses to build with a shared output).
   set_target_properties(${name} PROPERTIES
     Fortran_MODULE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/${name}.mod)
+  # The Fortran runtime comes with the compiler, not the OS: link it in
+  # so the app bundles no libgfortran and its minimum macOS stays ours.
+  if(APPLE)
+    target_link_options(${name} PRIVATE -static-libgfortran -static-libgcc -static-libquadmath)
+  endif()
 endfunction()
 
 set(_sym_dir ${CMAKE_SOURCE_DIR}/src/apps/symmetry)

README.md

@@ -132,6 +132,10 @@ your `PATH`.
 goal ([#133](https://github.com/FriendsofECCE/ECCE/issues/133),
 [#232](https://github.com/FriendsofECCE/ECCE/issues/232)); the state of
 the macOS build is tracked in #133. Until then, ECCE runs on Linux only.
+CI builds an experimental `ECCE.app` in a `.dmg` (workflow artifact
+`ECCE-macos-dmg`). It is signed ad hoc only, so macOS refuses it at
+first: right-click the app and choose Open, or run
+`xattr -dr com.apple.quarantine /Applications/ECCE.app`.
 
 ### 2. Create your account
 

packaging/macos/Info.plist.in

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key><string>ECCE</string>
+  <key>CFBundleDisplayName</key><string>ECCE</string>
+  <key>CFBundleIdentifier</key><string>org.friendsofecce.ecce</string>
+  <key>CFBundleExecutable</key><string>ecce</string>
+  <key>CFBundleIconFile</key><string>ecce</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>CFBundleShortVersionString</key><string>@VERSION@</string>
+  <key>CFBundleVersion</key><string>@VERSION@</string>
+  <key>LSMinimumSystemVersion</key><string>12.0</string>
+  <key>NSHighResolutionCapable</key><true/>
+  <key>LSApplicationCategoryType</key><string>public.app-category.education</string>
+</dict>
+</plist>

packaging/macos/build-deps.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# build-deps.sh <prefix>: the libraries ECCE.app bundles, built from source
+# for MACOSX_DEPLOYMENT_TARGET (default 11.0; CI uses 10.15 on Intel) and the machine's own
+# architecture.  Homebrew bottles carry the runner's macOS version as their
+# minimum, so they cannot give an app that runs on older systems (#133).
+# All libraries are shared and install with absolute install names, which
+# bundle_libs.py then rewrites.  CI caches <prefix> keyed on this file.
+set -euo pipefail
+P=$1
+mkdir -p "$P"
+P=$(cd "$P" && pwd)
+export MACOSX_DEPLOYMENT_TARGET=${MACOSX_DEPLOYMENT_TARGET:-11.0}
+JOBS=$(sysctl -n hw.ncpu)
+ARCH=$(uname -m)
+W=$(mktemp -d)
+trap 'rm -rf "$W"' EXIT
+cd "$W"
+
+fetch() { # url dir
+  echo "== fetch $1"
+  curl -fsSL --retry 3 "$1" -o src.tar
+  mkdir -p "$2"
+  tar -xf src.tar -C "$2" --strip-components=1
+  rm -f src.tar
+}
+cm() { # srcdir extra cmake args...
+  local s=$1; shift
+  cmake -G Ninja -S "$s" -B "$s/build" -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_INSTALL_PREFIX="$P" -DCMAKE_PREFIX_PATH="$P" \
+    -DCMAKE_OSX_DEPLOYMENT_TARGET="$MACOSX_DEPLOYMENT_TARGET" \
+    -DCMAKE_INSTALL_NAME_DIR="$P/lib" -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \
+    -DBUILD_SHARED_LIBS=ON "$@"
+  cmake --build "$s/build" -j "$JOBS"
+  cmake --install "$s/build"
+}
+
+# openssl: libssh and the broker
+fetch https://github.com/openssl/openssl/releases/download/openssl-3.5.4/openssl-3.5.4.tar.gz openssl
+( cd openssl
+  ./Configure "darwin64-$( [ "$ARCH" = arm64 ] && echo arm64 || echo x86_64 )-cc" shared \
+    --prefix="$P" --openssldir="$P/ssl" --libdir=lib no-tests no-docs \
+    "-mmacosx-version-min=$MACOSX_DEPLOYMENT_TARGET"
+  make -j "$JOBS" build_libs && make install_dev install_runtime_libs ) > openssl.log 2>&1 \
+  || { tail -50 openssl.log; exit 1; }
+
+fetch https://github.com/DaveGamble/cJSON/archive/refs/tags/v1.7.19.tar.gz cjson
+cm cjson -DENABLE_CJSON_TEST=OFF -DENABLE_CJSON_UNINSTALL=OFF
+
+fetch https://mosquitto.org/files/source/mosquitto-2.1.2.tar.gz mosquitto
+cm mosquitto -DOPENSSL_ROOT_DIR="$P" -DWITH_TESTS=OFF -DWITH_WEBSOCKETS=OFF \
+  -DWITH_CLIENTS=OFF -DWITH_PLUGINS=OFF -DWITH_DOCS=OFF -DWITH_LTO=OFF \
+  -DWITH_CTRL_SHELL=OFF -DWITH_SRV=OFF \
+  -DCMAKE_DISABLE_FIND_PACKAGE_argon2=ON
+
+fetch https://www.libssh.org/files/0.11/libssh-0.11.3.tar.xz libssh
+cm libssh -DOPENSSL_ROOT_DIR="$P" -DWITH_EXAMPLES=OFF \
+  -DUNIT_TESTING=OFF -DCLIENT_TESTING=OFF -DWITH_GSSAPI=OFF
+
+fetch https://archive.apache.org/dist/xerces/c/3/sources/xerces-c-3.3.0.tar.xz xerces
+cm xerces -Dnetwork=OFF
+
+fetch https://github.com/freetype/freetype/archive/refs/tags/VER-2-13-3.tar.gz freetype
+cm freetype -DFT_DISABLE_BZIP2=ON -DFT_DISABLE_PNG=ON -DFT_DISABLE_HARFBUZZ=ON \
+  -DFT_DISABLE_BROTLI=ON
+
+# ECCE links -ljpeg itself (texture images in the viewer)
+fetch https://github.com/libjpeg-turbo/libjpeg-turbo/releases/download/3.1.2/libjpeg-turbo-3.1.2.tar.gz jpeg
+cm jpeg -DENABLE_STATIC=OFF -DWITH_TURBOJPEG=OFF -DWITH_SIMD=OFF
+
+fetch https://github.com/coin3d/coin/releases/download/v4.0.10/coin-4.0.10-src.tar.gz coin
+cm coin -DCOIN_BUILD_SHARED_LIBS=ON -DCOIN_BUILD_TESTS=OFF -DHAVE_SOUND=OFF \
+  -DCOIN_HAVE_JAVASCRIPT=OFF
+
+# wxWidgets 3.3: 3.2 still links the AGL framework, gone from the macOS 26
+# SDK.  The image libraries are wx's own copies.
+fetch https://github.com/wxWidgets/wxWidgets/releases/download/v3.3.3/wxWidgets-3.3.3.tar.bz2 wx
+( cd wx
+  ./configure --prefix="$P" --enable-shared --with-cocoa \
+    --with-opengl --with-macosx-version-min="$MACOSX_DEPLOYMENT_TARGET" \
+    --with-libpng=builtin --with-libjpeg=builtin --with-libtiff=builtin \
+    --with-zlib=builtin --with-expat=builtin --with-regex=builtin \
+    --disable-webview --disable-mediactrl --without-libcurl --without-libwebp
+  make -j "$JOBS" && make install ) > wx.log 2>&1 \
+  || { tail -60 wx.log; exit 1; }
+echo "deps installed in $P"