mirror of
https://github.com/openclaw/openclaw.git
synced 2026-10-03 17:53:39 +00:00
76 lines
3.6 KiB
Bash
Executable file
76 lines
3.6 KiB
Bash
Executable file
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# Called after the canonical source build, before the app is signed. The
|
|
# complete npm artifact owns dependency selection; this is not a dist closure.
|
|
ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
|
|
DESTINATION="$1"
|
|
shift
|
|
[[ "$#" -gt 0 ]] || { echo "ERROR: No worker architectures requested" >&2; exit 1; }
|
|
case "${OPENCLAW_MAC_SIGNING_VARIANT:-standard}" in
|
|
standard|elevation-host) ;;
|
|
*) echo "ERROR: Unknown Mac signing variant" >&2; exit 1 ;;
|
|
esac
|
|
# Scratch follows the caller's temp volume; only installed payloads need to
|
|
# share the destination volume so publishing remains a rename, not a copy.
|
|
SCRATCH="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-mac-worker.XXXXXX")"
|
|
trap 'rm -rf "$SCRATCH"' EXIT
|
|
mkdir -p "$(dirname "$DESTINATION")"
|
|
STAGE="$(cd "$(dirname "$DESTINATION")" && mktemp -d "$PWD/.openclaw-mac-worker.XXXXXX")"
|
|
trap 'rm -rf "$STAGE" "$SCRATCH"' EXIT
|
|
mkdir -p "$SCRATCH/home" "$SCRATCH/package"
|
|
|
|
# Lifecycle hooks must never see operator config, credentials, or state;
|
|
# installer main discovers launchd by UID even with a new HOME.
|
|
# Use the build's pinned pnpm packer, not the host npm's expanding file globs.
|
|
TARBALL="$(env -i HOME="$SCRATCH/home" PATH="$PATH" TMPDIR="$SCRATCH" \
|
|
node "$ROOT_DIR/scripts/package-openclaw-for-docker.mjs" \
|
|
--skip-build --pnpm-pack --allow-unreleased-changelog --output-dir "$SCRATCH/package" \
|
|
--output-name openclaw.tgz)"
|
|
[[ -f "$TARBALL" ]] || { echo "ERROR: Canonical worker package missing" >&2; exit 1; }
|
|
|
|
for arch in "$@"; do
|
|
case "$arch" in
|
|
arm64) node_arch=arm64 ;;
|
|
x86_64) node_arch=x64 ;;
|
|
*) echo "ERROR: Unsupported Mac worker architecture: $arch" >&2; exit 1 ;;
|
|
esac
|
|
mkdir -p "$SCRATCH/$arch/home" "$SCRATCH/$arch/tmp"
|
|
env -i HOME="$SCRATCH/$arch/home" PATH="/usr/bin:/bin:/usr/sbin:/sbin" \
|
|
TMPDIR="$SCRATCH/$arch/tmp" OPENCLAW_INSTALL_CLI_SH_NO_RUN=1 \
|
|
OPENCLAW_NODE_VERSION="${OPENCLAW_NODE_VERSION:-}" \
|
|
/bin/bash -c '
|
|
set -euo pipefail
|
|
source "$1/scripts/install-cli.sh"
|
|
PREFIX="$2/prefix"
|
|
OPENCLAW_VERSION="$3"
|
|
install_node darwin "$4"
|
|
export PATH="$(node_dir)/bin:$PATH"
|
|
"$(node_bin)" -e '\''if (process.arch !== process.argv[1]) process.exit(1)'\'' "$4" || {
|
|
echo "ERROR: Cannot execute requested Node architecture $4; x64 on ARM requires Rosetta" >&2
|
|
exit 1
|
|
}
|
|
install_openclaw
|
|
mv "$(node_dir)" "$2/installed"
|
|
' bash "$ROOT_DIR" "$STAGE/$arch" "$TARBALL" "$node_arch"
|
|
# Unused Intel prebuilds can trigger macOS compatibility warnings even when
|
|
# the app and its selected worker are native Apple silicon.
|
|
env -i HOME="$SCRATCH/$arch/home" PATH="/usr/bin:/bin:/usr/sbin:/sbin" \
|
|
TMPDIR="$SCRATCH/$arch/tmp" /usr/bin/python3 -B "$ROOT_DIR/scripts/materialize-mac-node-worker.py" \
|
|
"$STAGE/$arch/installed" "$STAGE/$arch/runtime" "$STAGE/$arch" "$arch"
|
|
# Validate after moving out of its install prefix: absolute wrappers/symlinks
|
|
# cannot accidentally make a non-relocatable payload pass the proof.
|
|
env -i HOME="$SCRATCH/$arch/home" PATH="/usr/bin:/bin:/usr/sbin:/sbin" \
|
|
TMPDIR="$SCRATCH/$arch/tmp" \
|
|
"$STAGE/$arch/runtime/bin/node" "$ROOT_DIR/scripts/verify-mac-node-worker.mjs" \
|
|
"$STAGE/$arch/runtime" "$ROOT_DIR/dist/build-info.json"
|
|
done
|
|
|
|
mkdir -p "$DESTINATION"
|
|
# The packager owns this private parent; reject every occupant before any move.
|
|
for arch in "$@"; do
|
|
[[ ! -e "$DESTINATION/$arch" && ! -L "$DESTINATION/$arch" ]] || { echo "ERROR: Worker destination exists: $DESTINATION/$arch" >&2; exit 1; }
|
|
done
|
|
for arch in "$@"; do
|
|
mv "$STAGE/$arch/runtime" "$DESTINATION/$arch"
|
|
done
|