diff --git a/.github/workflows/build-desktop-osx64.yml b/.github/workflows/build-desktop-osx64.yml index 5f9547b0aca..64173acfd29 100644 --- a/.github/workflows/build-desktop-osx64.yml +++ b/.github/workflows/build-desktop-osx64.yml @@ -130,6 +130,31 @@ jobs: TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} run: npm run tauri build + - name: Re-sign bundled SSL dylibs after bundling + run: | + FRAMEWORKS_DIR="target/release/bundle/macos/Open Data Platform.app/Contents/Frameworks" + + if [ -f "$FRAMEWORKS_DIR/libcrypto.3.dylib" ]; then + codesign --force --sign "Developer ID Application" \ + --timestamp \ + --options runtime \ + "$FRAMEWORKS_DIR/libcrypto.3.dylib" + + codesign --verify --verbose=4 --deep --strict "$FRAMEWORKS_DIR/libcrypto.3.dylib" + echo "Re-signed libcrypto.3.dylib in bundle" + fi + + if [ -f "$FRAMEWORKS_DIR/libssl.3.dylib" ]; then + codesign --force --sign "Developer ID Application" \ + --timestamp \ + --options runtime \ + "$FRAMEWORKS_DIR/libssl.3.dylib" + + codesign --verify --verbose=4 --deep --strict "$FRAMEWORKS_DIR/libssl.3.dylib" + echo "Re-signed libssl.3.dylib in bundle" + fi + + - name: Rename artifacts run: | VERSION=$(jq -r .version src-tauri/tauri.conf.json) diff --git a/.github/workflows/build-desktop-osxARM.yml b/.github/workflows/build-desktop-osxARM.yml index e0a50ec0a68..411b8c2caa4 100644 --- a/.github/workflows/build-desktop-osxARM.yml +++ b/.github/workflows/build-desktop-osxARM.yml @@ -131,6 +131,30 @@ jobs: TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} run: npm run tauri build + - name: Re-sign bundled SSL dylibs after bundling + run: | + FRAMEWORKS_DIR="target/release/bundle/macos/Open Data Platform.app/Contents/Frameworks" + + if [ -f "$FRAMEWORKS_DIR/libcrypto.3.dylib" ]; then + codesign --force --sign "Developer ID Application" \ + --timestamp \ + --options runtime \ + "$FRAMEWORKS_DIR/libcrypto.3.dylib" + + codesign --verify --verbose=4 --deep --strict "$FRAMEWORKS_DIR/libcrypto.3.dylib" + echo "Re-signed libcrypto.3.dylib in bundle" + fi + + if [ -f "$FRAMEWORKS_DIR/libssl.3.dylib" ]; then + codesign --force --sign "Developer ID Application" \ + --timestamp \ + --options runtime \ + "$FRAMEWORKS_DIR/libssl.3.dylib" + + codesign --verify --verbose=4 --deep --strict "$FRAMEWORKS_DIR/libssl.3.dylib" + echo "Re-signed libssl.3.dylib in bundle" + fi + - name: Rename artifacts run: | VERSION=$(jq -r .version src-tauri/tauri.conf.json) diff --git a/desktop/src-tauri/scripts/fix_dylibs.sh b/desktop/src-tauri/scripts/fix_dylibs.sh index 333e22e557c..e21da5866c6 100644 --- a/desktop/src-tauri/scripts/fix_dylibs.sh +++ b/desktop/src-tauri/scripts/fix_dylibs.sh @@ -1,8 +1,6 @@ set -ex -# Determine the absolute path of the directory containing this script SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) -# Determine the project root directory, which is two levels above src-tauri/scripts PROJECT_ROOT="$SCRIPT_DIR/../.." if [ "$TAURI_ENV_DEBUG" = "true" ]; then @@ -11,51 +9,56 @@ else PROFILE="release" fi -# --- Step 1: Fix dylibs for the main binary of the current profile --- +# Fix dylibs for the main binary BIN_PATH="$PROJECT_ROOT/target/$PROFILE/openbb-platform" if [ ! -f "$BIN_PATH" ]; then - echo "Error: Main binary not found at $BIN_PATH" + echo "Binary not found at $BIN_PATH" exit 1 fi LIBCRYPTO_PATH=$(otool -L "$BIN_PATH" | grep 'libcrypto.3.dylib' | awk '{print $1}') LIBSSL_PATH=$(otool -L "$BIN_PATH" | grep 'libssl.3.dylib' | awk '{print $1}') +# Fix main binary references install_name_tool -change \ -"$LIBCRYPTO_PATH" \ -"@executable_path/../Frameworks/libcrypto.3.dylib" \ -"$BIN_PATH" + "$LIBCRYPTO_PATH" \ + "@executable_path/../Frameworks/libcrypto.3.dylib" \ + "$BIN_PATH" install_name_tool -change \ -"$LIBSSL_PATH" \ -"@executable_path/../Frameworks/libssl.3.dylib" \ -"$BIN_PATH" + "$LIBSSL_PATH" \ + "@executable_path/../Frameworks/libssl.3.dylib" \ + "$BIN_PATH" -echo "Successfully fixed dylibs for $PROFILE binary." +echo "Fixed dylibs for $PROFILE binary." -# --- Step 2: If it's a debug build, copy the release binary into the .app's Resources folder --- -if [ "$PROFILE" = "debug" ]; then - echo "DEBUG BUILD DETECTED: Copying release binary to app bundle." +# Fix the bundled dylibs themselves +FRAMEWORKS_DIR="$PROJECT_ROOT/target/$PROFILE/bundle/macos/Open Data Platform.app/Contents/Frameworks" - # This is the source: the release binary that has already been built - RELEASE_BIN_SOURCE_PATH="$PROJECT_ROOT/target/release/openbb-platform" +if [ -d "$FRAMEWORKS_DIR" ]; then + echo "Fixing bundled dylib references..." - # This is the destination, inside the .app bundle that Tauri creates before this script runs - APP_RESOURCES_DIR="$PROJECT_ROOT/target/debug/bundle/macos/OpenBB Platform.app/Contents/Resources" - DEST_PATH="$APP_RESOURCES_DIR/openbb-platform-release" + # Fix libssl.3.dylib's reference to libcrypto.3.dylib + if [ -f "$FRAMEWORKS_DIR/libssl.3.dylib" ]; then + LIBSSL_CRYPTO_PATH=$(otool -L "$FRAMEWORKS_DIR/libssl.3.dylib" | grep 'libcrypto.3.dylib' | awk '{print $1}') - # Verify source and destination exist - if [ ! -f "$RELEASE_BIN_SOURCE_PATH" ]; then - echo "Error: Release binary not found at $RELEASE_BIN_SOURCE_PATH. A release build must exist." - exit 1 - fi - if [ ! -d "$APP_RESOURCES_DIR" ]; then - echo "Error: App bundle resources directory not found at $APP_RESOURCES_DIR" - exit 1 + install_name_tool -change \ + "$LIBSSL_CRYPTO_PATH" \ + "@loader_path/libcrypto.3.dylib" \ + "$FRAMEWORKS_DIR/libssl.3.dylib" + + # Fix the install name of libssl itself + install_name_tool -id "@rpath/libssl.3.dylib" "$FRAMEWORKS_DIR/libssl.3.dylib" + + echo "Fixed libssl.3.dylib" fi - echo "Copying $RELEASE_BIN_SOURCE_PATH to $DEST_PATH" - cp "$RELEASE_BIN_SOURCE_PATH" "$DEST_PATH" - echo "Successfully copied release binary." + # Fix the install name of libcrypto + if [ -f "$FRAMEWORKS_DIR/libcrypto.3.dylib" ]; then + install_name_tool -id "@rpath/libcrypto.3.dylib" "$FRAMEWORKS_DIR/libcrypto.3.dylib" + echo "Fixed libcrypto.3.dylib" + fi fi + +echo "Successfully fixed all dylib references."