Build system, platform, and deployment fixes

.gitignore

@@ -3,5 +3,6 @@ __pycache__/
 *.py[cod]
 cache/
 venv/
+.venv/
 target/
 .DS_Store

CHANGELOG.md

@@ -36,5 +36,5 @@
   `try/except TypeError` around `Path.resolve(strict=True)` and updated
   version-specific comments.
 - **Reduced macOS app bundle size** from ~110MB to ~77MB by stripping unused
-  Qt frameworks (QtQml, QtQuick, QtWebSockets), unused Qt plugins, and
+  Qt frameworks (QtQml, QtQmlModels, QtQuick, QtWebSockets), unused Qt plugins, and
   build-only dependencies (boto3/botocore) from the frozen bundle.

bin/desk.cmd

@@ -1,13 +1,20 @@
-set PATH=C:\Windows\SysWOW64\downlevel;C:\Program Files (x86)\NSIS;C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86;%PATH%
+FOR /F "delims=" %%i IN ('dir /b /ad /o-n "C:\Program Files (x86)\Windows Kits\10\bin\10.*"') DO (
+    SET "WIN_SDK_VER=%%i"
+    GOTO :sdk_found
+)
+:sdk_found
+set PATH=C:\Windows\SysWOW64\downlevel;C:\Program Files (x86)\NSIS;C:\Program Files (x86)\Windows Kits\10\bin\%WIN_SDK_VER%\x86;%PATH%
 
-SET ROOT=c:\Users\micha\dev\fman
+SET ROOT=%~dp0..
 CD %ROOT%
 
-CALL venv\scripts\activate.bat
+CALL .venv\scripts\activate.bat
 DOSKEY run=python build.py run $*
 DOSKEY clean=python build.py clean
 DOSKEY freeze=python build.py freeze $*
 DOSKEY installer=python build.py installer $*
+DOSKEY sign=python build.py sign $*
 DOSKEY sign_installer=python build.py sign_installer $*
+DOSKEY publish=python build.py publish $*
 DOSKEY tests=python build.py test $*
 DOSKEY release=python build.py release $*

bin/desk.sh

@@ -26,7 +26,7 @@ THIS_SCRIPT_DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
 PROJECT_DIR="$THIS_SCRIPT_DIR/.."
 
 cd "$PROJECT_DIR"
-source venv/bin/activate
+source .venv/bin/activate
 
 PS1="(fman) \h:\W \u\$ "
 

bin/post-commit

@@ -5,11 +5,15 @@ set -e
 
 URL=https://fman.io/api/record-commit/
 
+if [ -z "${FMAN_API_SECRET:-}" ]; then
+	exit 0
+fi
+
 message_tmp_file=`mktemp`
 git log --pretty=format:%B -n1 > ${message_tmp_file}
 sha=`git log --pretty=format:%H -n1`
 date=`git log --pretty=format:%cd --date=iso-strict -n1`
-curl --data-urlencode secret=k92XhhhmOf8rD7QJ --data-urlencode sha=${sha} \
+curl --fail --silent --data-urlencode secret=${FMAN_API_SECRET} --data-urlencode sha=${sha} \
 	--data-urlencode date=${date} --data-urlencode message@${message_tmp_file} \
 	${URL}
 rm ${message_tmp_file}

build.py

@@ -10,7 +10,6 @@
 from fbs.cmdline import command
 from fbs_runtime.platform import is_windows, is_mac, is_linux, is_ubuntu, \
 	is_fedora, is_arch_linux, linux_distribution
-from os.path import dirname
 
 import fbs.cmdline
 import re
@@ -49,7 +48,7 @@ def publish():
 		sign_installer()
 		upload()
 	elif is_linux():
-		if is_ubuntu():
+		if is_ubuntu() or linux_distribution() == 'Debian GNU/Linux':
 			freeze()
 			installer()
 			upload()
@@ -96,7 +95,7 @@ def release():
 					settings_path, next_version + snapshot_suffix,
 					'Bump version for next development iteration'
 				)
-				git('push', '-u', 'origin', 'master')
+				git('push', '-u', 'origin', 'main')
 				try:
 					git('push', 'origin', release_tag)
 					try:
@@ -106,24 +105,24 @@ def release():
 							'    git pull\n'
 							'    git checkout %s\n'
 							'    python build.py release\n'
-							'    git checkout master\n\n'
+							'    git checkout main\n\n'
 							'on the other OSs now, then come back here and do:'
 							'\n\n'
 							'    python build.py post_release\n'
 							% release_tag
 						)
-					except:
+					except Exception:
 						git('push', '--delete', 'origin', release_tag)
 						raise
-				except:
+				except Exception:
 					git('revert', '--no-edit', revision_before + '..HEAD' )
-					git('push', '-u', 'origin', 'master')
+					git('push', '-u', 'origin', 'main')
 					revision_before = git('rev-parse', 'HEAD').rstrip()
 					raise
-			except:
+			except Exception:
 				git('tag', '-d', release_tag)
 				raise
-		except:
+		except Exception:
 			git('reset', revision_before)
 			_replace_in_json(settings_path, 'version', version)
 			raise
@@ -136,7 +135,8 @@ def release():
 def post_release():
 	activate_profile('release')
 	version = SETTINGS['version']
-	assert not version.endswith(snapshot_suffix)
+	if version.endswith(snapshot_suffix):
+		raise ValueError('Cannot post_release a SNAPSHOT version: %s' % version)
 	cloudfront_items_to_invalidate = []
 	for item in ('fman.dmg', 'fman.deb', 'fman.pkg.tar.xz', 'fman.rpm'):
 		cloudfront_items_to_invalidate.append(item)
@@ -149,7 +149,7 @@ def post_release():
 	create_cloudfront_invalidation(cloudfront_items_to_invalidate)
 	record_release_on_server()
 	upload_core_to_github()
-	git('checkout', 'master')
+	git('checkout', 'main')
 
 def _prompt_for_next_version(release_version):
 	next_version = _get_suggested_next_version(release_version)

install.txt

@@ -7,14 +7,14 @@ Import developer certificate:
     security import "~/dev/fman/conf/mac/Private key.p12" -k ~/Library/Keychains/login.keychain -P "" -T /usr/bin/codesign
 
 Install a version of XCode that is compatible with your macOS version from
-https://developer.apple.com/download/more/?q=xcode.
+https://developer.apple.com/download/all/?q=xcode.
 
 Code signing usually does not work when invoked via SSH. It prompts for a pw
 with the GUI.
 
 NSIS:
 =====
-Install version 2.51 on Windows.
+Install NSIS 3.x on Windows.
 Add to PATH.
 
 Linux (Ubuntu) extra
@@ -30,10 +30,10 @@ fmanSetup.exe (Google Omaha installer)
 ======================================
 1)
 hammer -c
-set TIMESTAMP_SERVER=http://sha256timestamp.ws.symantec.com/sha256/timestamp
+set TIMESTAMP_SERVER=http://timestamp.digicert.com
 set SHA1_TIMESTAMP_SERVER=%TIMESTAMP_SERVER%
 set SHA2_TIMESTAMP_SERVER=%TIMESTAMP_SERVER%
-set AUTHENTICODE_FILE="c:\Users\Michael\dev\fman\conf\windows\michaelherrmann.pfx"
+set AUTHENTICODE_FILE="<path-to-your-pfx-certificate>"
 set AUTHENTICODE_PASSWORD="..."
 hammer MODE=opt-win --authenticode_file=%AUTHENTICODE_FILE% --authenticode_password=%AUTHENTICODE_PASSWORD% --sha1_authenticode_file=%AUTHENTICODE_FILE% --sha2_authenticode_file=%AUTHENTICODE_FILE% --sha1_authenticode_password=%AUTHENTICODE_PASSWORD% --sha2_authenticode_password=%AUTHENTICODE_PASSWORD%
 

requirements/arch.txt

@@ -1 +1,3 @@
+# pgi intentionally excluded — Gnome icon integration unavailable on Arch.
+# Qt's default QFileIconProvider is used instead.
 -r linux.txt

requirements/base.txt

@@ -1,4 +1,4 @@
-fbs[sentry] @ http://build-system.fman.io/pro/b5aab865-bd29-4f23-992c-0eb4f3a24f33/0.9.4
+fbs[sentry] @ https://build-system.fman.io/pro/b5aab865-bd29-4f23-992c-0eb4f3a24f33/0.9.4
 PyQt5==5.15.11
 PyInstaller==6.19.0
 rsa==4.9

requirements/windows.txt

@@ -1,6 +1,4 @@
 -r base.txt
-PyQt5==5.15.11
-# Note: Send2Trash 1.5.0 has no effect on Windows!
 Send2Trash==1.8.3
 adodbapi==2.6.0.7
 pywinpty==2.0.14

src/build/docker/arch/Dockerfile

@@ -14,9 +14,9 @@ WORKDIR /root/${app_name}
 
 # Set up virtual environment:
 ADD *.txt /tmp/requirements/
-RUN python -m venv venv && \
-    venv/bin/python -m pip install -U pip && \
-    venv/bin/python -m pip install -r "/tmp/requirements/${requirements}"
+RUN python -m venv .venv && \
+    .venv/bin/python -m pip install -U pip && \
+    .venv/bin/python -m pip install -r "/tmp/requirements/${requirements}"
 RUN rm -rf /tmp/requirements/
 
 ADD .bashrc /root/.bashrc

src/build/docker/fedora/Dockerfile

@@ -20,9 +20,9 @@ RUN dnf install -y gobject-introspection
 
 # Set up virtual environment:
 ADD *.txt /tmp/requirements/
-RUN python3.9 -m venv venv && \
-    venv/bin/python -m pip install -U pip && \
-    venv/bin/python -m pip install -r "/tmp/requirements/${requirements}"
+RUN python3.9 -m venv .venv && \
+    .venv/bin/python -m pip install -U pip && \
+    .venv/bin/python -m pip install -r "/tmp/requirements/${requirements}"
 RUN rm -rf /tmp/requirements/
 
 ADD .bashrc /root

src/build/docker/ubuntu/Dockerfile

@@ -16,7 +16,7 @@ RUN apt-get install libgl1-mesa-glx -y
 
 # fpm:
 RUN apt-get install ruby ruby-dev build-essential -y && \
-    gem install --no-ri --no-rdoc fpm
+    gem install --no-document fpm
 
 WORKDIR /root/${app_name}
 
@@ -25,9 +25,9 @@ RUN apt-get install gobject-introspection libgtk-3-0 -y
 
 # Set up virtual environment:
 ADD *.txt /tmp/requirements/
-RUN python3.9 -m venv venv && \
-    venv/bin/python -m pip install -U pip && \
-    venv/bin/python -m pip install -r "/tmp/requirements/${requirements}"
+RUN python3.9 -m venv .venv && \
+    .venv/bin/python -m pip install -U pip && \
+    .venv/bin/python -m pip install -r "/tmp/requirements/${requirements}"
 RUN rm -rf /tmp/requirements/
 
 ADD .bashrc /root/.bashrc

src/build/python/build_impl/__init__.py

@@ -25,7 +25,7 @@ def remove_if_exists(file_path):
 
 def copy_python_library(name, dest_dir):
 	library = import_module(name)
-	is_package = re.match(r'^__init__\.pyc?$', basename(library.__file__))
+	is_package = hasattr(library, '__path__')
 	if is_package:
 		package_dir = dirname(library.__file__)
 		copytree(package_dir, join(dest_dir, basename(package_dir)))
@@ -54,7 +54,7 @@ def upload_file(f, dest_dir, dest_name=None):
 		run(args, check=True)
 	else:
 		if isdir(f):
-			copytree(f, join(dest_dir, dest_name or basename(f)))
+			copytree(f, join(dest_path, dest_name or basename(f)))
 		else:
 			copy(f, dest_path)
 
@@ -79,10 +79,11 @@ def run_on_server(command):
 		return check_output_decode(command, shell=True)
 
 def check_output_decode(*args, **kwargs):
-	return check_output(*args, **kwargs).decode(sys.stdout.encoding)
+	return check_output(*args, **kwargs).decode(sys.stdout.encoding or 'utf-8')
 
 def upload_installer_to_aws(installer_name):
-	assert SETTINGS['release']
+	if not SETTINGS['release']:
+		raise RuntimeError('upload_installer_to_aws called in non-release mode')
 	src_path = path('target/' + installer_name)
 	upload_to_s3(src_path, installer_name)
 	version_dest_path = '%s/%s' % (SETTINGS['version'], installer_name)
@@ -105,7 +106,7 @@ def upload_core_to_github():
 	ssh_key = path('${core_plugin_ssh_key}')
 	if not is_windows():
 		# Prevent clone failing due to lacking access restrictions:
-		run(['chmod', '600', ssh_key])
+		run(['chmod', '600', ssh_key], check=True)
 	with TemporaryDirectory() as tmp_dir:
 		cwd_before = getcwd()
 		chdir(tmp_dir)
@@ -118,7 +119,7 @@ def upload_core_to_github():
 					if not line.startswith('#') and line.rstrip()
 				}
 			for name in listdir(tmp_dir):
-				if name not in extra_files:
+				if name not in extra_files and name != '.git':
 					if isdir(name):
 						rmtree(name)
 					else:
@@ -137,7 +138,7 @@ def upload_core_to_github():
 					'commit', '-m',
 					'Source code of the Core plugin in fman ' + version
 				)
-				git('push', '-u', 'origin', 'master', ssh_key=ssh_key)
+				git('push', '-u', 'origin', 'main', ssh_key=ssh_key)
 			tag = 'v' + version
 			git('tag', tag)
 			git('push', 'origin', tag, ssh_key=ssh_key)
@@ -146,8 +147,11 @@ def upload_core_to_github():
 
 def record_release_on_server():
 	import requests
-	response = requests.post(SETTINGS['record_release_url'], {
+	url = SETTINGS['record_release_url']
+	if not url.startswith('https://'):
+		raise ValueError('record_release_url must use HTTPS')
+	response = requests.post(url, {
 		'secret': SETTINGS['server_api_secret'],
 		'version': SETTINGS['version']
-	})
+	}, timeout=30)
 	response.raise_for_status()

src/build/python/build_impl/aws.py

@@ -44,7 +44,7 @@ def create_cloudfront_invalidation(items):
 				'Quantity': len(items),
 				'Items': ['/' + item for item in items]
 			},
-			'CallerReference': str(int(time()))
+			'CallerReference': '%s-%s' % (int(time()), id(items))
 		}
 	)