No need to run on Python 2 any more.
[cdist.git] / cdist
diff --git a/cdist b/cdist
index 10bed90f89262b3656d0d6ca844b6516090fad45..0c9874f5934a7f29d4ebb1c5a9a23143168cddf3 100755 (executable)
--- a/cdist
+++ b/cdist
@@ -1,6 +1,6 @@
 #!/usr/bin/python3
 
-#    Copyright (C) 2012-2020 Carl Hetherington <cth@carlh.net>
+#    Copyright (C) 2012-2022 Carl Hetherington <cth@carlh.net>
 #
 #    This program is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU General Public License as published by
@@ -26,8 +26,10 @@ import glob
 import inspect
 import multiprocessing
 import os
+from pathlib import Path
 import platform
 import re
+import signal
 import shlex
 import shutil
 import subprocess
@@ -35,8 +37,6 @@ import sys
 import tempfile
 import time
 
-TEMPORARY_DIRECTORY = '/var/tmp'
-
 class Error(Exception):
     def __init__(self, value):
         self.value = value
@@ -54,25 +54,25 @@ class Trees:
     def __init__(self):
         self.trees = []
 
-    def get(self, name, specifier, target, required_by=None):
+    def get(self, name, commit_ish, target, required_by=None):
         for t in self.trees:
-            if t.name == name and t.specifier == specifier and t.target == target:
+            if t.name == name and t.commit_ish == commit_ish and t.target == target:
                 return t
-            elif t.name == name and t.specifier != specifier:
-                a = specifier if specifier is not None else "[Any]"
+            elif t.name == name and t.commit_ish != commit_ish:
+                a = commit_ish if commit_ish is not None else "[Any]"
                 if required_by is not None:
                     a += ' by %s' % required_by
-                b = t.specifier if t.specifier is not None else "[Any]"
+                b = t.commit_ish if t.commit_ish is not None else "[Any]"
                 if t.required_by is not None:
                     b += ' by %s' % t.required_by
                 raise Error('conflicting versions of %s required (%s versus %s)' % (name, a, b))
 
-        nt = Tree(name, specifier, target, required_by)
+        nt = Tree(name, commit_ish, target, required_by)
         self.trees.append(nt)
         return nt
 
-    def add_built(self, name, specifier, target):
-        self.trees.append(Tree(name, specifier, target, None, built=True))
+    def add_built(self, name, commit_ish, target):
+        self.trees.append(Tree(name, commit_ish, target, None, built=True))
 
 
 class Globals:
@@ -88,7 +88,7 @@ globals = Globals()
 # Configuration
 #
 
-class Option(object):
+class Option:
     def __init__(self, key, default=None):
         self.key = key
         self.value = default
@@ -97,14 +97,14 @@ class Option(object):
         if key == self.key:
             self.value = value
 
-class BoolOption(object):
+class BoolOption:
     def __init__(self, key):
         self.key = key
         self.value = False
 
     def offer(self, key, value):
         if key == self.key:
-            self.value = (value == 'yes' or value == '1' or value == 'true')
+            self.value = value in ['yes', '1', 'true']
 
 class Config:
     def __init__(self):
@@ -114,6 +114,9 @@ class Config:
                          Option('osx_environment_prefix'),
                          Option('osx_sdk_prefix'),
                          Option('osx_sdk'),
+                         Option('osx_intel_deployment'),
+                         Option('osx_arm_deployment'),
+                         Option('osx_old_deployment'),
                          Option('osx_keychain_file'),
                          Option('osx_keychain_password'),
                          Option('apple_id'),
@@ -122,7 +125,8 @@ class Config:
                          BoolOption('docker_no_user'),
                          Option('docker_hub_repository'),
                          Option('flatpak_state_dir'),
-                         Option('parallel', multiprocessing.cpu_count()) ]
+                         Option('parallel', multiprocessing.cpu_count()),
+                         Option('temp', '/var/tmp')]
 
         config_dir = '%s/.config' % os.path.expanduser('~')
         if not os.path.exists(config_dir):
@@ -256,13 +260,12 @@ def rmtree(a):
 
 def command(c):
     log_normal(c)
-    posix = sys.platform != 'win32'
     try:
-        r = subprocess.run(shlex.split(c, posix=posix), shell=True)
+        r = subprocess.run(c, shell=True)
         if r.returncode != 0:
-            raise Error(f'command {c} failed ({r.returncode})')
+            raise Error('command %s failed (%d)' % (c, r.returncode))
     except Exception as e:
-        raise Error(f'command {c} failed ({e})')
+        raise Error('command %s failed (%s)' % (c, e))
 
 def command_and_read(c):
     log_normal(c)
@@ -380,7 +383,7 @@ class Version:
 # Targets
 #
 
-class Target(object):
+class Target:
     """
     Class representing the target that we are building for.  This is exposed to cscripts,
     though not all of it is guaranteed 'API'.  cscripts may expect:
@@ -415,7 +418,7 @@ class Target(object):
         self.build_dependencies = True
 
         if directory is None:
-            self.directory = tempfile.mkdtemp('', 'tmp', TEMPORARY_DIRECTORY)
+            self.directory = tempfile.mkdtemp('', 'tmp', config.get('temp'))
             self.rmdir = True
             self.set('CCACHE_BASEDIR', os.path.realpath(self.directory))
             self.set('CCACHE_NOHASHDIR', '')
@@ -427,7 +430,11 @@ class Target(object):
     def setup(self):
         pass
 
-    def _build_packages(self, tree, options):
+    def _cscript_package(self, tree, options):
+        """
+        Call package() in the cscript and return what it returns, except that
+        anything not in a list will be put into one.
+        """
         if len(inspect.getfullargspec(tree.cscript['package']).args) == 3:
             packages = tree.call('package', tree.version, options)
         else:
@@ -438,19 +445,19 @@ class Target(object):
 
     def _copy_packages(self, tree, packages, output_dir):
         for p in packages:
-            copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, p))))
+            copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.commit, p))))
 
-    def package(self, project, checkout, output_dir, options, no_notarize):
-        tree = self.build(project, checkout, options)
+    def package(self, project, checkout, output_dir, options, notarize):
+        tree = self.build(project, checkout, options, for_package=True)
         tree.add_defaults(options)
-        p = self._build_packages(tree, options)
+        p = self._cscript_package(tree, options)
         self._copy_packages(tree, p, output_dir)
 
-    def build(self, project, checkout, options):
+    def build(self, project, checkout, options, for_package=False):
         tree = globals.trees.get(project, checkout, self)
         if self.build_dependencies:
             tree.build_dependencies(options)
-        tree.build(options)
+        tree.build(options, for_package=for_package)
         return tree
 
     def test(self, project, checkout, target, test, options):
@@ -537,12 +544,17 @@ class DockerTarget(Target):
         if self.privileged:
             opts += '--privileged=true '
         if self.ccache:
-            opts += "-e CCACHE_DIR=/ccache/%s-%d --mount source=ccache,target=/ccache" % (self.image, os.getuid())
+            opts += "-e CCACHE_DIR=/ccache/%s-%d --mount source=ccache,target=/ccache " % (self.image, os.getuid())
+        opts += "--rm "
 
         tag = self.image
         if config.has('docker_hub_repository'):
             tag = '%s:%s' % (config.get('docker_hub_repository'), tag)
 
+        def signal_handler(signum, frame):
+            raise Error('Killed')
+        signal.signal(signal.SIGTERM, signal_handler)
+
         self.container = command_and_read('%s run %s %s -itd %s /bin/bash' % (config.docker(), self._user_tag(), opts, tag))[0].strip()
 
     def command(self, cmd):
@@ -730,7 +742,7 @@ class AppImageTarget(LinuxTarget):
         self.privileged = True
 
 
-def notarize(dmg, bundle_id):
+def notarize_dmg(dmg, bundle_id):
     p = subprocess.run(
         ['xcrun', 'altool', '--notarize-app', '-t', 'osx', '-f', dmg, '--primary-bundle-id', bundle_id, '-u', config.get('apple_id'), '-p', config.get('apple_password'), '--output-format', 'xml'],
         capture_output=True
@@ -744,18 +756,30 @@ def notarize(dmg, bundle_id):
 
     request_uuid = string_after(p, "RequestUUID")
     if request_uuid is None:
+        print("Looking for upload ID")
+        message = string_after(p, "message")
+        print("Looking in %s" % message)
+        if message:
+            m = re.match('.*The upload ID is ([0-9a-f\-]*)', message)
+            if m:
+                request_uuid = m.groups()[0]
+    if request_uuid is None:
+        print("Response: %s" % p)
         raise Error('No RequestUUID found in response from Apple')
 
     for i in range(0, 30):
-        print('Checking up on %s' % request_uuid)
+        print('%s: checking up on %s' % (datetime.datetime.now(), request_uuid))
         p = subprocess.run(['xcrun', 'altool', '--notarization-info', request_uuid, '-u', config.get('apple_id'), '-p', config.get('apple_password'), '--output-format', 'xml'], capture_output=True)
         status = string_after(p, 'Status')
-        print('Got %s' % status)
+        print('%s: got status %s' % (datetime.datetime.now(), status))
         if status == 'invalid':
             raise Error("Notarization failed")
         elif status == 'success':
             subprocess.run(['xcrun', 'stapler', 'staple', dmg])
             return
+        elif status != "in progress":
+            print("Could not understand xcrun response")
+            print(p)
         time.sleep(30)
 
     raise Error("Notarization timed out")
@@ -764,7 +788,6 @@ def notarize(dmg, bundle_id):
 class OSXTarget(Target):
     def __init__(self, directory=None):
         super(OSXTarget, self).__init__('osx', directory)
-        self.sdk = config.get('osx_sdk')
         self.sdk_prefix = config.get('osx_sdk_prefix')
         self.environment_prefix = config.get('osx_environment_prefix')
         self.apple_id = config.get('apple_id')
@@ -775,33 +798,59 @@ class OSXTarget(Target):
     def command(self, c):
         command('%s %s' % (self.variables_string(False), c))
 
-    def build(self, *a, **k):
+    def unlock_keychain(self):
         self.command('security unlock-keychain -p %s %s' % (self.osx_keychain_password, self.osx_keychain_file))
-        return super().build(*a, **k)
+
+    def _copy_packages(self, tree, packages, output_dir):
+        for p in packages:
+            dest = os.path.join(output_dir, os.path.basename(devel_to_git(tree.commit, p)))
+            copyfile(p, dest)
+            if os.path.exists(p + ".id"):
+                copyfile(p + ".id", dest + ".id")
+
+    def _cscript_package_and_notarize(self, tree, options, notarize):
+        """
+        Call package() in the cscript and notarize the .dmgs that are returned, if notarize == True
+        """
+        p = self._cscript_package(tree, options)
+        for x in p:
+            if not isinstance(x, tuple):
+                raise Error('macOS packages must be returned from cscript as tuples of (dmg-filename, bundle-id)')
+            if notarize:
+                notarize_dmg(x[0], x[1])
+            else:
+                with open(x[0] + '.id', 'w') as f:
+                    print(x[1], file=f)
+        return [x[0] for x in p]
 
 
 class OSXSingleTarget(OSXTarget):
-    def __init__(self, bits, directory=None):
+    def __init__(self, arch, sdk, deployment, directory=None, can_notarize=True):
         super(OSXSingleTarget, self).__init__(directory)
-        self.bits = bits
-
-        if bits == 32:
-            arch = 'i386'
+        self.arch = arch
+        self.sdk = sdk
+        self.deployment = deployment
+        self.can_notarize = can_notarize
+        self.sub_targets = [self]
+
+        flags = '-isysroot %s/MacOSX%s.sdk -arch %s' % (self.sdk_prefix, sdk, arch)
+        if arch == 'x86_64':
+            host_enviro = '%s/x86_64/%s' % (config.get('osx_environment_prefix'), deployment)
         else:
-            arch = 'x86_64'
+            host_enviro = '%s/x86_64/10.10' % config.get('osx_environment_prefix')
+        target_enviro = '%s/%s/%s' % (config.get('osx_environment_prefix'), arch, deployment)
 
-        flags = '-isysroot %s/MacOSX%s.sdk -arch %s' % (self.sdk_prefix, self.sdk, arch)
-        enviro = '%s/%d' % (config.get('osx_environment_prefix'), bits)
+        self.bin = '%s/bin' % target_enviro
 
         # Environment variables
-        self.set('CFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, enviro, flags))
+        self.set('CFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, target_enviro, flags))
         self.set('CPPFLAGS', '')
-        self.set('CXXFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, enviro, flags))
-        self.set('LDFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, enviro, flags))
-        self.set('LINKFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, enviro, flags))
-        self.set('PKG_CONFIG_PATH', '%s/lib/pkgconfig:%s/lib/pkgconfig:/usr/lib/pkgconfig' % (self.directory, enviro))
-        self.set('PATH', '$PATH:/usr/bin:/sbin:/usr/local/bin:%s/bin' % enviro)
-        self.set('MACOSX_DEPLOYMENT_TARGET', config.get('osx_sdk'))
+        self.set('CXXFLAGS', '"-I%s/include -I%s/include -stdlib=libc++ %s"' % (self.directory, target_enviro, flags))
+        self.set('LDFLAGS', '"-L%s/lib -L%s/lib -stdlib=libc++ %s"' % (self.directory, target_enviro, flags))
+        self.set('LINKFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, target_enviro, flags))
+        self.set('PKG_CONFIG_PATH', '%s/lib/pkgconfig:%s/lib/pkgconfig:/usr/lib/pkgconfig' % (self.directory, target_enviro))
+        self.set('PATH', '$PATH:/usr/bin:/sbin:/usr/local/bin:%s/bin' % host_enviro)
+        self.set('MACOSX_DEPLOYMENT_TARGET', self.deployment)
         self.set('CCACHE_BASEDIR', self.directory)
 
     @Target.ccache.setter
@@ -811,44 +860,38 @@ class OSXSingleTarget(OSXTarget):
             self.set('CC', '"ccache gcc"')
             self.set('CXX', '"ccache g++"')
 
-    def package(self, project, checkout, output_dir, options, no_notarize):
-        tree = self.build(project, checkout, options)
+    def package(self, project, checkout, output_dir, options, notarize):
+        tree = self.build(project, checkout, options, for_package=True)
         tree.add_defaults(options)
-        p = self._build_packages(tree, options)
-        for x in p:
-            if not isinstance(x, tuple):
-                raise Error('macOS packages must be returned from cscript as tuples of (dmg-filename, bundle-id)')
-            if not no_notarize:
-                notarize(x[0], x[1])
-        self._copy_packages(tree, [x[0] for x in p], output_dir)
+        self.unlock_keychain()
+        p = self._cscript_package_and_notarize(tree, options, self.can_notarize and notarize)
+        self._copy_packages(tree, p, output_dir)
 
 
 class OSXUniversalTarget(OSXTarget):
     def __init__(self, directory=None):
         super(OSXUniversalTarget, self).__init__(directory)
-        self.bits = None
-
-    def package(self, project, checkout, output_dir, options, no_notarize):
-
-        for b in [32, 64]:
-            target = OSXSingleTarget(b, os.path.join(self.directory, '%d' % b))
+        self.sdk = config.get('osx_sdk')
+        self.sub_targets = []
+        for arch, deployment in (('x86_64', config.get('osx_intel_deployment')), ('arm64', config.get('osx_arm_deployment'))):
+            target = OSXSingleTarget(arch, self.sdk, deployment, os.path.join(self.directory, arch, deployment))
             target.ccache = self.ccache
+            self.sub_targets.append(target)
+
+    def package(self, project, checkout, output_dir, options, notarize):
+        for target in self.sub_targets:
             tree = globals.trees.get(project, checkout, target)
             tree.build_dependencies(options)
-            tree.build(options)
+            tree.build(options, for_package=True)
 
+        self.unlock_keychain()
         tree = globals.trees.get(project, checkout, self)
         with TreeDirectory(tree):
-            if len(inspect.getfullargspec(tree.cscript['package']).args) == 3:
-                packages = tree.call('package', tree.version, options)
-            else:
-                log_normal("Deprecated cscript package() method with no options parameter")
-                packages = tree.call('package', tree.version)
-            for p in packages:
-                copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, p))))
+            p = self._cscript_package_and_notarize(tree, options, notarize)
+            self._copy_packages(tree, p, output_dir)
 
 class SourceTarget(Target):
-    """Build a source .tar.bz2"""
+    """Build a source .tar.bz2 and .zst"""
     def __init__(self):
         super(SourceTarget, self).__init__('source')
 
@@ -859,13 +902,17 @@ class SourceTarget(Target):
     def cleanup(self):
         rmtree(self.directory)
 
-    def package(self, project, checkout, output_dir, options, no_notarize):
+    def package(self, project, checkout, output_dir, options, notarize):
         tree = globals.trees.get(project, checkout, self)
         with TreeDirectory(tree):
             name = read_wscript_variable(os.getcwd(), 'APPNAME')
             command('./waf dist')
-            p = os.path.abspath('%s-%s.tar.bz2' % (name, tree.version))
-            copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, p))))
+            bz2 = os.path.abspath('%s-%s.tar.bz2' % (name, tree.version))
+            copyfile(bz2, os.path.join(output_dir, os.path.basename(devel_to_git(tree.commit, bz2))))
+            command('tar xjf %s' % bz2)
+            command('tar --zstd -cf %s-%s.tar.zst %s-%s' % (name, tree.version, name, tree.version))
+            zstd = os.path.abspath('%s-%s.tar.zst' % (name, tree.version))
+            copyfile(zstd, os.path.join(output_dir, os.path.basename(devel_to_git(tree.commit, zstd))))
 
 # @param s Target string:
 #       windows-{32,64}
@@ -874,11 +921,10 @@ class SourceTarget(Target):
 #    or centos-version-{32,64}
 #    or fedora-version-{32,64}
 #    or mageia-version-{32,64}
-#    or osx-{32,64}
+#    or osx
 #    or source
 #    or flatpak
 #    or appimage
-# @param debug True to build with debugging symbols (where possible)
 def target_factory(args):
     s = args.target
     target = None
@@ -905,13 +951,12 @@ def target_factory(args):
         target = LinuxTarget(p[0], None, int(p[1]), args.work)
     elif s == 'raspbian':
         target = LinuxTarget(s, None, None, args.work)
-    elif s.startswith('osx-'):
-        target = OSXSingleTarget(int(s.split('-')[1]), args.work)
     elif s == 'osx':
-        if args.command == 'build':
-            target = OSXSingleTarget(64, args.work)
-        else:
-            target = OSXUniversalTarget(args.work)
+        target = OSXUniversalTarget(args.work)
+    elif s == 'osx-intel':
+        target = OSXSingleTarget('x86_64', config.get('osx_sdk'), config.get('osx_intel_deployment'), args.work)
+    elif s == 'osx-old':
+        target = OSXSingleTarget('x86_64', config.get('osx_sdk'), config.get('osx_old_deployment'), args.work, False)
     elif s == 'source':
         target = SourceTarget()
     elif s == 'flatpak':
@@ -941,25 +986,25 @@ def target_factory(args):
 # Tree
 #
 
-class Tree(object):
+class Tree:
     """Description of a tree, which is a checkout of a project,
        possibly built.  This class is never exposed to cscripts.
        Attributes:
            name -- name of git repository (without the .git)
-           specifier -- git tag or revision to use
+           commit_ish -- git tag or revision to use
            target -- target object that we are using
            version -- version from the wscript (if one is present)
-           git_commit -- git revision that is actually being used
+           commit -- git revision that is actually being used
            built -- true if the tree has been built yet in this run
            required_by -- name of the tree that requires this one
     """
 
-    def __init__(self, name, specifier, target, required_by, built=False):
+    def __init__(self, name, commit_ish, target, required_by, built=False):
         self.name = name
-        self.specifier = specifier
+        self.commit_ish = commit_ish
         self.target = target
         self.version = None
-        self.git_commit = None
+        self.commit = None
         self.built = built
         self.required_by = required_by
 
@@ -976,15 +1021,12 @@ class Tree(object):
                 ref = '--reference-if-able %s/%s.git' % (config.get('git_reference'), self.name)
             else:
                 ref = ''
-            command('git clone %s %s %s/%s.git %s/src/%s' % (flags, ref, config.get('git_prefix'), self.name, target.directory, self.name))
+            command('git -c protocol.file.allow=always clone %s %s %s/%s.git %s/src/%s' % (flags, ref, config.get('git_prefix'), self.name, target.directory, self.name))
             os.chdir('%s/src/%s' % (target.directory, self.name))
 
-            spec = self.specifier
-            if spec is None:
-                spec = 'master'
-
-            command('git checkout %s %s %s' % (flags, spec, redirect))
-            self.git_commit = command_and_read('git rev-parse --short=7 HEAD')[0].strip()
+            if self.commit_ish is not None:
+                command('git checkout %s %s %s' % (flags, self.commit_ish, redirect))
+            self.commit = command_and_read('git rev-parse --short=7 HEAD')[0].strip()
 
         self.cscript = {}
         exec(open('%s/cscript' % proj).read(), self.cscript)
@@ -1003,7 +1045,7 @@ class Tree(object):
                         if os.path.exists(ref_path):
                             ref = '--reference %s' % ref_path
                     path = path.split(' ')[1]
-                    command('git submodule --quiet update %s %s' % (ref, path))
+                    command('git -c protocol.file.allow=always submodule --quiet update %s %s' % (ref, path))
 
         if os.path.exists('%s/wscript' % proj):
             v = read_wscript_variable(proj, "VERSION");
@@ -1012,7 +1054,7 @@ class Tree(object):
                     self.version = Version(v)
                 except:
                     try:
-                        tag = command_and_read('git -C %s describe --tags' % proj)[0][1:]
+                        tag = command_and_read('git -C %s describe --match v* --tags' % proj)[0][1:]
                         self.version = Version.from_git_tag(tag)
                     except:
                         # We'll leave version as None if we can't read it; maybe this is a bad idea
@@ -1077,11 +1119,11 @@ class Tree(object):
         for i in self.dependencies(options):
             i[0].build(i[1])
 
-    def build(self, options):
+    def build(self, options, for_package=False):
         if self.built:
             return
 
-        log_verbose("Building %s %s %s with %s" % (self.name, self.specifier, self.version, options))
+        log_verbose("Building %s %s %s with %s" % (self.name, self.commit_ish, self.version, options))
 
         variables = copy.copy(self.target.variables)
 
@@ -1089,7 +1131,10 @@ class Tree(object):
         self.add_defaults(options)
 
         if not globals.dry_run:
-            if len(inspect.getfullargspec(self.cscript['build']).args) == 2:
+            num_args = len(inspect.getfullargspec(self.cscript['build']).args)
+            if num_args == 3:
+                self.call('build', options, for_package)
+            elif num_args == 2:
                 self.call('build', options)
             else:
                 self.call('build')
@@ -1163,6 +1208,8 @@ def main():
     parser_checkout = subparsers.add_parser("checkout", help="check out the project")
     parser_revision = subparsers.add_parser("revision", help="print the head git revision number")
     parser_dependencies = subparsers.add_parser("dependencies", help="print details of the project's dependencies as a .dot file")
+    parser_notarize = subparsers.add_parser("notarize", help="notarize .dmgs in a directory using *.dmg.id files")
+    parser_notarize.add_argument('--dmgs', help='directory containing *.dmg and *.dmg.id')
 
     global args
     args = parser.parse_args()
@@ -1193,7 +1240,7 @@ def main():
         if not os.path.exists(args.work):
             os.makedirs(args.work)
 
-    if args.project is None and args.command != 'shell':
+    if args.project is None and not args.command in ['shell', 'notarize']:
         raise Error('you must specify -p or --project')
 
     globals.quiet = args.quiet
@@ -1205,9 +1252,11 @@ def main():
             raise Error('you must specify -t or --target')
 
         target = target_factory(args)
-        target.build(args.project, args.checkout, get_command_line_options(args))
-        if not args.keep:
-            target.cleanup()
+        try:
+            target.build(args.project, args.checkout, get_command_line_options(args))
+        finally:
+            if not args.keep:
+                target.cleanup()
 
     elif args.command == 'package':
         if args.target is None:
@@ -1226,14 +1275,10 @@ def main():
                 output_dir = args.output
 
             makedirs(output_dir)
-            target.package(args.project, args.checkout, output_dir, get_command_line_options(args), args.no_notarize)
-        except Error as e:
+            target.package(args.project, args.checkout, output_dir, get_command_line_options(args), not args.no_notarize)
+        finally:
             if target is not None and not args.keep:
                 target.cleanup()
-            raise
-
-        if target is not None and not args.keep:
-            target.cleanup()
 
     elif args.command == 'release':
         if args.minor is False and args.micro is False:
@@ -1268,6 +1313,7 @@ def main():
     elif args.command == 'manual':
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
+        tree.checkout_dependencies()
 
         outs = tree.call('make_manual')
         for o in outs:
@@ -1373,6 +1419,18 @@ def main():
             print("%s -> %s;" % (d[2].name.replace("-", "-"), d[0].name.replace("-", "_")))
         print("}")
 
+    elif args.command == 'notarize':
+        if args.dmgs is None:
+            raise Error('you must specify ---dmgs')
+
+        for dmg in Path(args.dmgs).glob('*.dmg'):
+            id = None
+            try:
+                with open(str(dmg) + '.id') as f:
+                    id = f.readline().strip()
+            except OSError:
+                raise Error('could not find ID file for %s' % dmg)
+            notarize_dmg(dmg, id)
 
 try:
     main()