Use notarytool instead of altool for notarizing macOS apps.
[cdist.git] / cdist
diff --git a/cdist b/cdist
index 48eb9eb95c3cab861f875f1a9d99a307ce3581c2..b9687d708d4ee1dc8e8839d1c6d0c3fec6c8c4ba 100755 (executable)
--- a/cdist
+++ b/cdist
@@ -1,6 +1,6 @@
-#!/usr/bin/python
+#!/usr/bin/python3
 
-#    Copyright (C) 2012-2020 Carl Hetherington <cth@carlh.net>
+#    Copyright (C) 2012-2022 Carl Hetherington <cth@carlh.net>
 #
 #    This program is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU General Public License as published by
 #    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 
 from __future__ import print_function
-import os
-import sys
-import shutil
-import glob
-import tempfile
+
 import argparse
-import datetime
-import subprocess
-import re
 import copy
-import inspect
+import datetime
 import getpass
-import shlex
+import glob
+import inspect
 import multiprocessing
-
-TEMPORARY_DIRECTORY = '/var/tmp'
+import os
+from pathlib import Path
+import platform
+import re
+import signal
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
 
 class Error(Exception):
     def __init__(self, value):
@@ -51,23 +54,27 @@ class Trees:
     def __init__(self):
         self.trees = []
 
-    def get(self, name, specifier, target, required_by=None):
+    def get(self, name, commit_ish, target, required_by=None):
         for t in self.trees:
-            if t.name == name and t.specifier == specifier and t.target == target:
+            if t.name == name and t.commit_ish == commit_ish and t.target == target:
                 return t
-            elif t.name == name and t.specifier != specifier:
-                a = specifier if specifier is not None else "[Any]"
+            elif t.name == name and t.commit_ish != commit_ish:
+                a = commit_ish if commit_ish is not None else "[Any]"
                 if required_by is not None:
                     a += ' by %s' % required_by
-                b = t.specifier if t.specifier is not None else "[Any]"
+                b = t.commit_ish if t.commit_ish is not None else "[Any]"
                 if t.required_by is not None:
                     b += ' by %s' % t.required_by
                 raise Error('conflicting versions of %s required (%s versus %s)' % (name, a, b))
 
-        nt = Tree(name, specifier, target, required_by)
+        nt = Tree(name, commit_ish, target, required_by)
         self.trees.append(nt)
         return nt
 
+    def add_built(self, name, commit_ish, target):
+        self.trees.append(Tree(name, commit_ish, target, None, built=True))
+
+
 class Globals:
     quiet = False
     command = None
@@ -81,7 +88,7 @@ globals = Globals()
 # Configuration
 #
 
-class Option(object):
+class Option:
     def __init__(self, key, default=None):
         self.key = key
         self.value = default
@@ -90,29 +97,38 @@ class Option(object):
         if key == self.key:
             self.value = value
 
-class BoolOption(object):
+class BoolOption:
     def __init__(self, key):
         self.key = key
         self.value = False
 
     def offer(self, key, value):
         if key == self.key:
-            self.value = (value == 'yes' or value == '1' or value == 'true')
+            self.value = value in ['yes', '1', 'true']
 
 class Config:
     def __init__(self):
         self.options = [ Option('mxe_prefix'),
                          Option('git_prefix'),
+                         Option('git_reference'),
                          Option('osx_environment_prefix'),
                          Option('osx_sdk_prefix'),
                          Option('osx_sdk'),
+                         Option('osx_intel_deployment'),
+                         Option('osx_arm_deployment'),
+                         Option('osx_old_deployment'),
+                         Option('osx_keychain_file'),
+                         Option('osx_keychain_password'),
                          Option('apple_id'),
                          Option('apple_password'),
+                         Option('apple_team_id'),
                          BoolOption('docker_sudo'),
                          BoolOption('docker_no_user'),
                          Option('docker_hub_repository'),
                          Option('flatpak_state_dir'),
-                         Option('parallel', multiprocessing.cpu_count()) ]
+                         Option('parallel', multiprocessing.cpu_count()),
+                         Option('temp', '/var/tmp'),
+                         Option('osx_notarytool', ['xcrun', 'notarytool'])]
 
         config_dir = '%s/.config' % os.path.expanduser('~')
         if not os.path.exists(config_dir):
@@ -126,22 +142,23 @@ class Config:
             print('Template config file written to %s; please edit and try again.' % config_file, file=sys.stderr)
             sys.exit(1)
 
-        try:
-            f = open('%s/.config/cdist' % os.path.expanduser('~'), 'r')
-            while True:
-                l = f.readline()
-                if l == '':
-                    break
-
-                if len(l) > 0 and l[0] == '#':
-                    continue
-
-                s = l.strip().split()
-                if len(s) == 2:
-                    for k in self.options:
-                        k.offer(s[0], s[1])
-        except:
-            raise
+        f = open('%s/.config/cdist' % os.path.expanduser('~'), 'r')
+        while True:
+            l = f.readline()
+            if l == '':
+                break
+
+            if len(l) > 0 and l[0] == '#':
+                continue
+
+            s = l.strip().split()
+            if len(s) == 2:
+                for k in self.options:
+                    k.offer(s[0], s[1])
+
+        if not isinstance(self.get('osx_notarytool'), list):
+            self.set('osx_notarytool', [self.get('osx_notarytool')])
+
 
     def has(self, k):
         for o in self.options:
@@ -203,7 +220,7 @@ def copytree(a, b):
         command('scp -r %s %s' % (scp_escape(a), scp_escape(b)))
 
 def copyfile(a, b):
-    log_normal('copy %s -> %s' % (scp_escape(a), scp_escape(b)))
+    log_normal('copy %s -> %s with cwd %s' % (scp_escape(a), scp_escape(b), os.getcwd()))
     if b.startswith('s3://'):
         command('s3cmd -P put "%s" "%s"' % (a, b))
     else:
@@ -246,9 +263,12 @@ def rmtree(a):
 
 def command(c):
     log_normal(c)
-    r = os.system(c)
-    if (r >> 8):
-        raise Error('command %s failed' % c)
+    try:
+        r = subprocess.run(c, shell=True)
+        if r.returncode != 0:
+            raise Error('command %s failed (%d)' % (c, r.returncode))
+    except Exception as e:
+        raise Error('command %s failed (%s)' % (c, e))
 
 def command_and_read(c):
     log_normal(c)
@@ -273,45 +293,6 @@ def read_wscript_variable(directory, variable):
     f.close()
     return None
 
-def set_version_in_wscript(version):
-    f = open('wscript', 'rw')
-    o = open('wscript.tmp', 'w')
-    while True:
-        l = f.readline()
-        if l == '':
-            break
-
-        s = l.split()
-        if len(s) == 3 and s[0] == "VERSION":
-            print("VERSION = '%s'" % version, file=o)
-        else:
-            print(l, file=o, end="")
-    f.close()
-    o.close()
-
-    os.rename('wscript.tmp', 'wscript')
-
-def append_version_to_changelog(version):
-    try:
-        f = open('ChangeLog', 'r')
-    except:
-        log_normal('Could not open ChangeLog')
-        return
-
-    c = f.read()
-    f.close()
-
-    f = open('ChangeLog', 'w')
-    now = datetime.datetime.now()
-    f.write('%d-%02d-%02d  Carl Hetherington  <cth@carlh.net>\n\n\t* Version %s released.\n\n' % (now.year, now.month, now.day, version))
-    f.write(c)
-
-def append_version_to_debian_changelog(version):
-    if not os.path.exists('debian'):
-        log_normal('Could not find debian directory')
-        return
-
-    command('dch -b -v %s-1 "New upstream release."' % version)
 
 def devel_to_git(git_commit, filename):
     if git_commit is not None:
@@ -405,7 +386,7 @@ class Version:
 # Targets
 #
 
-class Target(object):
+class Target:
     """
     Class representing the target that we are building for.  This is exposed to cscripts,
     though not all of it is guaranteed 'API'.  cscripts may expect:
@@ -440,46 +421,59 @@ class Target(object):
         self.build_dependencies = True
 
         if directory is None:
-            self.directory = tempfile.mkdtemp('', 'tmp', TEMPORARY_DIRECTORY)
+            self.directory = tempfile.mkdtemp('', 'tmp', config.get('temp'))
             self.rmdir = True
             self.set('CCACHE_BASEDIR', os.path.realpath(self.directory))
             self.set('CCACHE_NOHASHDIR', '')
         else:
-            self.directory = directory
+            self.directory = os.path.realpath(directory)
             self.rmdir = False
 
 
     def setup(self):
         pass
 
-    def package(self, project, checkout, output_dir, options):
-        tree = self.build(project, checkout, options)
-        tree.add_defaults(options)
+    def _cscript_package(self, tree, options):
+        """
+        Call package() in the cscript and return what it returns, except that
+        anything not in a list will be put into one.
+        """
         if len(inspect.getfullargspec(tree.cscript['package']).args) == 3:
             packages = tree.call('package', tree.version, options)
         else:
             log_normal("Deprecated cscript package() method with no options parameter")
             packages = tree.call('package', tree.version)
 
-        if isinstance(packages, (str, unicode)):
-            copyfile(packages, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, packages))))
-        else:
-            for p in packages:
-                copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, p))))
+        return packages if isinstance(packages, list) else [packages]
+
+    def _copy_packages(self, tree, packages, output_dir):
+        for p in packages:
+            copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.commit, p))))
 
-    def build(self, project, checkout, options):
+    def package(self, project, checkout, output_dir, options, notarize):
+        tree = self.build(project, checkout, options, for_package=True)
+        tree.add_defaults(options)
+        p = self._cscript_package(tree, options)
+        self._copy_packages(tree, p, output_dir)
+
+    def build(self, project, checkout, options, for_package=False):
         tree = globals.trees.get(project, checkout, self)
         if self.build_dependencies:
             tree.build_dependencies(options)
-        tree.build(options)
+        tree.build(options, for_package=for_package)
         return tree
 
-    def test(self, tree, test, options):
+    def test(self, project, checkout, target, test, options):
         """test is the test case to run, or None"""
-        if self.build_dependencies:
-            tree.build_dependencies(options)
-        tree.build(options)
-        return tree.call('test', test)
+        tree = globals.trees.get(project, checkout, target)
+
+        tree.add_defaults(options)
+        with TreeDirectory(tree):
+            if len(inspect.getfullargspec(tree.cscript['test']).args) == 3:
+                return tree.call('test', options, test)
+            else:
+                log_normal('Deprecated cscript test() method with no options parameter')
+                return tree.call('test', test)
 
     def set(self, a, b):
         self.variables[a] = b
@@ -541,19 +535,29 @@ class DockerTarget(Target):
             return ''
         return '-u %s' % getpass.getuser()
 
+    def _mount_option(self, d):
+        return '-v %s:%s ' % (os.path.realpath(d), os.path.realpath(d))
+
     def setup(self):
-        opts = '-v %s:%s ' % (self.directory, self.directory)
+        opts = self._mount_option(self.directory)
         for m in self.mounts:
-            opts += '-v %s:%s ' % (m, m)
+            opts += self._mount_option(m)
+        if config.has('git_reference'):
+            opts += self._mount_option(config.get('git_reference'))
         if self.privileged:
             opts += '--privileged=true '
         if self.ccache:
-            opts += "-e CCACHE_DIR=/ccache --volumes-from ccache-%s" % self.image
+            opts += "-e CCACHE_DIR=/ccache/%s-%d --mount source=ccache,target=/ccache " % (self.image, os.getuid())
+        opts += "--rm "
 
         tag = self.image
         if config.has('docker_hub_repository'):
             tag = '%s:%s' % (config.get('docker_hub_repository'), tag)
 
+        def signal_handler(signum, frame):
+            raise Error('Killed')
+        signal.signal(signal.SIGTERM, signal_handler)
+
         self.container = command_and_read('%s run %s %s -itd %s /bin/bash' % (config.docker(), self._user_tag(), opts, tag))[0].strip()
 
     def command(self, cmd):
@@ -596,7 +600,7 @@ class FlatpakTarget(Target):
         return b
 
 
-class WindowsTarget(DockerTarget):
+class WindowsDockerTarget(DockerTarget):
     """
     This target exposes the following additional API:
 
@@ -607,7 +611,7 @@ class WindowsTarget(DockerTarget):
     tool_path: path to 32- and 64-bit tools
     """
     def __init__(self, windows_version, bits, directory, environment_version):
-        super(WindowsTarget, self).__init__('windows', directory)
+        super(WindowsDockerTarget, self).__init__('windows', directory)
         self.version = windows_version
         self.bits = bits
 
@@ -621,8 +625,6 @@ class WindowsTarget(DockerTarget):
         self.set('PKG_CONFIG_LIBDIR', '%s/lib/pkgconfig' % self.environment_prefix)
         self.set('PKG_CONFIG_PATH', '%s/lib/pkgconfig:%s/bin/pkgconfig' % (self.directory, self.directory))
         self.set('PATH', '%s/bin:%s:%s' % (self.environment_prefix, self.tool_path, os.environ['PATH']))
-        self.set('CC', '%s-gcc' % self.name)
-        self.set('CXX', '%s-g++' % self.name)
         self.set('LD', '%s-ld' % self.name)
         self.set('RANLIB', '%s-ranlib' % self.name)
         self.set('WINRC', '%s-windres' % self.name)
@@ -637,6 +639,15 @@ class WindowsTarget(DockerTarget):
         if environment_version is not None:
             self.image += '_%s' % environment_version
 
+    def setup(self):
+        super().setup()
+        if self.ccache:
+            self.set('CC', '"ccache %s-gcc"' % self.name)
+            self.set('CXX', '"ccache %s-g++"' % self.name)
+        else:
+            self.set('CC', '%s-gcc' % self.name)
+            self.set('CXX', '%s-g++' % self.name)
+
     @property
     def library_prefix(self):
         log_normal('Deprecated property library_prefix: use environment_prefix')
@@ -663,6 +674,28 @@ class WindowsTarget(DockerTarget):
         return self.name
 
 
+class WindowsNativeTarget(Target):
+    """
+    This target exposes the following additional API:
+
+    version: Windows version ('xp' or None)
+    bits: bitness of Windows (32 or 64)
+    name: name of our target e.g. x86_64-w64-mingw32.shared
+    environment_prefix: path to Windows environment for the appropriate target (libraries and some tools)
+    """
+    def __init__(self, directory):
+        super().__init__('windows', directory)
+        self.version = None
+        self.bits = 64
+
+        self.environment_prefix = config.get('windows_native_environmnet_prefix')
+
+        self.set('PATH', '%s/bin:%s' % (self.environment_prefix, os.environ['PATH']))
+
+    def command(self, cmd):
+        command(cmd)
+
+
 class LinuxTarget(DockerTarget):
     """
     Build for Linux in a docker container.
@@ -699,10 +732,10 @@ class LinuxTarget(DockerTarget):
             self.set('CC', '"ccache gcc"')
             self.set('CXX', '"ccache g++"')
 
-    def test(self, tree, test, options):
+    def test(self, project, checkout, target, test, options):
         self.append_with_colon('PATH', '%s/bin' % self.directory)
         self.append_with_colon('LD_LIBRARY_PATH', '%s/lib' % self.directory)
-        super(LinuxTarget, self).test(tree, test, options)
+        super(LinuxTarget, self).test(project, checkout, target, test, options)
 
 
 class AppImageTarget(LinuxTarget):
@@ -712,41 +745,94 @@ class AppImageTarget(LinuxTarget):
         self.privileged = True
 
 
+def notarize_dmg(dmg):
+    p = subprocess.run(
+            config.get('osx_notarytool') + [
+            'submit',
+            '--apple-id',
+            config.get('apple_id'),
+            '--password',
+            config.get('apple_password'),
+            '--team-id',
+            config.get('apple_team_id'),
+            '--wait',
+            dmg
+        ], capture_output=True)
+
+    last_line = [x.strip() for x in p.stdout.decode('utf-8').splitlines() if x.strip()][-1]
+    if last_line != 'status: Accepted':
+        print("Could not understand notarytool response")
+        print(p)
+        print(f"Last line: {last_line}")
+        raise Error('Notarization failed')
+
+    subprocess.run(['xcrun', 'stapler', 'staple', dmg])
+
+
 class OSXTarget(Target):
     def __init__(self, directory=None):
         super(OSXTarget, self).__init__('osx', directory)
-        self.sdk = config.get('osx_sdk')
         self.sdk_prefix = config.get('osx_sdk_prefix')
         self.environment_prefix = config.get('osx_environment_prefix')
         self.apple_id = config.get('apple_id')
         self.apple_password = config.get('apple_password')
+        self.osx_keychain_file = config.get('osx_keychain_file')
+        self.osx_keychain_password = config.get('osx_keychain_password')
 
     def command(self, c):
         command('%s %s' % (self.variables_string(False), c))
 
+    def unlock_keychain(self):
+        self.command('security unlock-keychain -p %s %s' % (self.osx_keychain_password, self.osx_keychain_file))
+
+    def _copy_packages(self, tree, packages, output_dir):
+        for p in packages:
+            dest = os.path.join(output_dir, os.path.basename(devel_to_git(tree.commit, p)))
+            copyfile(p, dest)
+
+    def _cscript_package_and_notarize(self, tree, options, notarize):
+        """
+        Call package() in the cscript and notarize the .dmgs that are returned, if notarize == True
+        """
+        output = []
+        for x in self._cscript_package(tree, options):
+            # Some older cscripts give us the DMG filename and the bundle ID, even though
+            # (since using notarytool instead of altool for notarization) the bundle ID
+            # is no longer necessary.  Cope with either type of cscript.
+            dmg = x[0] if isinstance(x, tuple) else x
+            if notarize:
+                notarize_dmg(dmg)
+            output.append(dmg)
+        return output
+
 
 class OSXSingleTarget(OSXTarget):
-    def __init__(self, bits, directory=None):
+    def __init__(self, arch, sdk, deployment, directory=None, can_notarize=True):
         super(OSXSingleTarget, self).__init__(directory)
-        self.bits = bits
-
-        if bits == 32:
-            arch = 'i386'
+        self.arch = arch
+        self.sdk = sdk
+        self.deployment = deployment
+        self.can_notarize = can_notarize
+        self.sub_targets = [self]
+
+        flags = '-isysroot %s/MacOSX%s.sdk -arch %s' % (self.sdk_prefix, sdk, arch)
+        if arch == 'x86_64':
+            host_enviro = '%s/x86_64/%s' % (config.get('osx_environment_prefix'), deployment)
         else:
-            arch = 'x86_64'
+            host_enviro = '%s/x86_64/10.10' % config.get('osx_environment_prefix')
+        target_enviro = '%s/%s/%s' % (config.get('osx_environment_prefix'), arch, deployment)
 
-        flags = '-isysroot %s/MacOSX%s.sdk -arch %s' % (self.sdk_prefix, self.sdk, arch)
-        enviro = '%s/%d' % (config.get('osx_environment_prefix'), bits)
+        self.bin = '%s/bin' % target_enviro
 
         # Environment variables
-        self.set('CFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, enviro, flags))
+        self.set('CFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, target_enviro, flags))
         self.set('CPPFLAGS', '')
-        self.set('CXXFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, enviro, flags))
-        self.set('LDFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, enviro, flags))
-        self.set('LINKFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, enviro, flags))
-        self.set('PKG_CONFIG_PATH', '%s/lib/pkgconfig:%s/lib/pkgconfig:/usr/lib/pkgconfig' % (self.directory, enviro))
-        self.set('PATH', '$PATH:/usr/bin:/sbin:/usr/local/bin:%s/bin' % enviro)
-        self.set('MACOSX_DEPLOYMENT_TARGET', config.get('osx_sdk'))
+        self.set('CXXFLAGS', '"-I%s/include -I%s/include -stdlib=libc++ %s"' % (self.directory, target_enviro, flags))
+        self.set('LDFLAGS', '"-L%s/lib -L%s/lib -stdlib=libc++ %s"' % (self.directory, target_enviro, flags))
+        self.set('LINKFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, target_enviro, flags))
+        self.set('PKG_CONFIG_PATH', '%s/lib/pkgconfig:%s/lib/pkgconfig:/usr/lib/pkgconfig' % (self.directory, target_enviro))
+        self.set('PATH', '$PATH:/usr/bin:/sbin:/usr/local/bin:%s/bin' % host_enviro)
+        self.set('MACOSX_DEPLOYMENT_TARGET', self.deployment)
         self.set('CCACHE_BASEDIR', self.directory)
 
     @Target.ccache.setter
@@ -756,33 +842,38 @@ class OSXSingleTarget(OSXTarget):
             self.set('CC', '"ccache gcc"')
             self.set('CXX', '"ccache g++"')
 
+    def package(self, project, checkout, output_dir, options, notarize):
+        tree = self.build(project, checkout, options, for_package=True)
+        tree.add_defaults(options)
+        self.unlock_keychain()
+        p = self._cscript_package_and_notarize(tree, options, self.can_notarize and notarize)
+        self._copy_packages(tree, p, output_dir)
+
 
 class OSXUniversalTarget(OSXTarget):
     def __init__(self, directory=None):
         super(OSXUniversalTarget, self).__init__(directory)
-        self.bits = None
-
-    def package(self, project, checkout, output_dir, options):
-
-        for b in [32, 64]:
-            target = OSXSingleTarget(b, os.path.join(self.directory, '%d' % b))
+        self.sdk = config.get('osx_sdk')
+        self.sub_targets = []
+        for arch, deployment in (('x86_64', config.get('osx_intel_deployment')), ('arm64', config.get('osx_arm_deployment'))):
+            target = OSXSingleTarget(arch, self.sdk, deployment, os.path.join(self.directory, arch, deployment))
             target.ccache = self.ccache
+            self.sub_targets.append(target)
+
+    def package(self, project, checkout, output_dir, options, notarize):
+        for target in self.sub_targets:
             tree = globals.trees.get(project, checkout, target)
             tree.build_dependencies(options)
-            tree.build(options)
+            tree.build(options, for_package=True)
 
+        self.unlock_keychain()
         tree = globals.trees.get(project, checkout, self)
         with TreeDirectory(tree):
-            if len(inspect.getargspec(tree.cscript['package']).args) == 3:
-                packages = tree.call('package', tree.version, options)
-            else:
-                log_normal("Deprecated cscript package() method with no options parameter")
-                packages = tree.call('package', tree.version)
-            for p in packages:
-                copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, p))))
+            p = self._cscript_package_and_notarize(tree, options, notarize)
+            self._copy_packages(tree, p, output_dir)
 
 class SourceTarget(Target):
-    """Build a source .tar.bz2"""
+    """Build a source .tar.bz2 and .zst"""
     def __init__(self):
         super(SourceTarget, self).__init__('source')
 
@@ -793,13 +884,17 @@ class SourceTarget(Target):
     def cleanup(self):
         rmtree(self.directory)
 
-    def package(self, project, checkout, output_dir, options):
+    def package(self, project, checkout, output_dir, options, notarize):
         tree = globals.trees.get(project, checkout, self)
         with TreeDirectory(tree):
             name = read_wscript_variable(os.getcwd(), 'APPNAME')
             command('./waf dist')
-            p = os.path.abspath('%s-%s.tar.bz2' % (name, tree.version))
-            copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, p))))
+            bz2 = os.path.abspath('%s-%s.tar.bz2' % (name, tree.version))
+            copyfile(bz2, os.path.join(output_dir, os.path.basename(devel_to_git(tree.commit, bz2))))
+            command('tar xjf %s' % bz2)
+            command('tar --zstd -cf %s-%s.tar.zst %s-%s' % (name, tree.version, name, tree.version))
+            zstd = os.path.abspath('%s-%s.tar.zst' % (name, tree.version))
+            copyfile(zstd, os.path.join(output_dir, os.path.basename(devel_to_git(tree.commit, zstd))))
 
 # @param s Target string:
 #       windows-{32,64}
@@ -808,22 +903,24 @@ class SourceTarget(Target):
 #    or centos-version-{32,64}
 #    or fedora-version-{32,64}
 #    or mageia-version-{32,64}
-#    or osx-{32,64}
+#    or osx
 #    or source
 #    or flatpak
 #    or appimage
-# @param debug True to build with debugging symbols (where possible)
 def target_factory(args):
     s = args.target
     target = None
     if s.startswith('windows-'):
         x = s.split('-')
-        if len(x) == 2:
-            target = WindowsTarget(None, int(x[1]), args.work, args.environment_version)
-        elif len(x) == 3:
-            target = WindowsTarget(x[1], int(x[2]), args.work, args.environment_version)
+        if platform.system() == "Windows":
+            target = WindowsNativeTarget(args.work)
         else:
-            raise Error("Bad Windows target name `%s'")
+            if len(x) == 2:
+                target = WindowsDockerTarget(None, int(x[1]), args.work, args.environment_version)
+            elif len(x) == 3:
+                target = WindowsDockerTarget(x[1], int(x[2]), args.work, args.environment_version)
+            else:
+                raise Error("Bad Windows target name `%s'")
     elif s.startswith('ubuntu-') or s.startswith('debian-') or s.startswith('centos-') or s.startswith('fedora-') or s.startswith('mageia-'):
         p = s.split('-')
         if len(p) != 3:
@@ -836,13 +933,12 @@ def target_factory(args):
         target = LinuxTarget(p[0], None, int(p[1]), args.work)
     elif s == 'raspbian':
         target = LinuxTarget(s, None, None, args.work)
-    elif s.startswith('osx-'):
-        target = OSXSingleTarget(int(s.split('-')[1]), args.work)
     elif s == 'osx':
-        if globals.command == 'build':
-            target = OSXSingleTarget(64, args.work)
-        else:
-            target = OSXUniversalTarget(args.work)
+        target = OSXUniversalTarget(args.work)
+    elif s == 'osx-intel':
+        target = OSXSingleTarget('x86_64', config.get('osx_sdk'), config.get('osx_intel_deployment'), args.work)
+    elif s == 'osx-old':
+        target = OSXSingleTarget('x86_64', config.get('osx_sdk'), config.get('osx_old_deployment'), args.work, False)
     elif s == 'source':
         target = SourceTarget()
     elif s == 'flatpak':
@@ -872,54 +968,66 @@ def target_factory(args):
 # Tree
 #
 
-class Tree(object):
+class Tree:
     """Description of a tree, which is a checkout of a project,
        possibly built.  This class is never exposed to cscripts.
        Attributes:
            name -- name of git repository (without the .git)
-           specifier -- git tag or revision to use
+           commit_ish -- git tag or revision to use
            target -- target object that we are using
            version -- version from the wscript (if one is present)
-           git_commit -- git revision that is actually being used
+           commit -- git revision that is actually being used
            built -- true if the tree has been built yet in this run
            required_by -- name of the tree that requires this one
     """
 
-    def __init__(self, name, specifier, target, required_by):
+    def __init__(self, name, commit_ish, target, required_by, built=False):
         self.name = name
-        self.specifier = specifier
+        self.commit_ish = commit_ish
         self.target = target
         self.version = None
-        self.git_commit = None
-        self.built = False
+        self.commit = None
+        self.built = built
         self.required_by = required_by
 
         cwd = os.getcwd()
+        proj = '%s/src/%s' % (target.directory, self.name)
 
-        flags = ''
-        redirect = ''
-        if globals.quiet:
-            flags = '-q'
-            redirect = '>/dev/null'
-        command('git clone %s %s/%s.git %s/src/%s' % (flags, config.get('git_prefix'), self.name, target.directory, self.name))
-        os.chdir('%s/src/%s' % (target.directory, self.name))
-
-        spec = self.specifier
-        if spec is None:
-            spec = 'master'
-
-        command('git checkout %s %s %s' % (flags, spec, redirect))
-        self.git_commit = command_and_read('git rev-parse --short=7 HEAD')[0].strip()
+        if not built:
+            flags = ''
+            redirect = ''
+            if globals.quiet:
+                flags = '-q'
+                redirect = '>/dev/null'
+            if config.has('git_reference'):
+                ref = '--reference-if-able %s/%s.git' % (config.get('git_reference'), self.name)
+            else:
+                ref = ''
+            command('git -c protocol.file.allow=always clone %s %s %s/%s.git %s/src/%s' % (flags, ref, config.get('git_prefix'), self.name, target.directory, self.name))
+            os.chdir('%s/src/%s' % (target.directory, self.name))
 
-        proj = '%s/src/%s' % (target.directory, self.name)
+            if self.commit_ish is not None:
+                command('git checkout %s %s %s' % (flags, self.commit_ish, redirect))
+            self.commit = command_and_read('git rev-parse --short=7 HEAD')[0].strip()
 
         self.cscript = {}
         exec(open('%s/cscript' % proj).read(), self.cscript)
 
-        # cscript can include submodules = False to stop submodules being fetched
-        if not 'submodules' in self.cscript or self.cscript['submodules'] == True:
-            command('git submodule init --quiet')
-            command('git submodule update --quiet')
+        if not built:
+            # cscript can include submodules = False to stop submodules being fetched
+            if (not 'submodules' in self.cscript or self.cscript['submodules'] == True) and os.path.exists('.gitmodules'):
+                command('git submodule --quiet init')
+                paths = command_and_read('git config --file .gitmodules --get-regexp path')
+                urls = command_and_read('git config --file .gitmodules --get-regexp url')
+                for path, url in zip(paths, urls):
+                    ref = ''
+                    if config.has('git_reference'):
+                        url = url.split(' ')[1]
+                        ref_path = os.path.join(config.get('git_reference'), os.path.basename(url))
+                        if os.path.exists(ref_path):
+                            ref = '--reference %s' % ref_path
+                    path = path.split(' ')[1]
+                    command('git -c protocol.file.allow=always submodule --quiet update %s %s' % (ref, path))
 
         if os.path.exists('%s/wscript' % proj):
             v = read_wscript_variable(proj, "VERSION");
@@ -927,8 +1035,13 @@ class Tree(object):
                 try:
                     self.version = Version(v)
                 except:
-                    tag = command_and_read('git -C %s describe --tags' % proj)[0][1:]
-                    self.version = Version.from_git_tag(tag)
+                    try:
+                        tag = command_and_read('git -C %s describe --match v* --tags' % proj)[0][1:]
+                        self.version = Version.from_git_tag(tag)
+                    except:
+                        # We'll leave version as None if we can't read it; maybe this is a bad idea
+                        # Should probably just install git on the Windows VM
+                        pass
 
         os.chdir(cwd)
 
@@ -952,13 +1065,13 @@ class Tree(object):
     def dependencies(self, options):
         """
         yield details of the dependencies of this tree.  Each dependency is returned
-        as a tuple of (tree, options).  The 'options' parameter are the options that
+        as a tuple of (tree, options, parent_tree).  The 'options' parameter are the options that
         we want to force for 'self'.
         """
         if not 'dependencies' in self.cscript:
             return
 
-        if len(inspect.getargspec(self.cscript['dependencies']).args) == 2:
+        if len(inspect.getfullargspec(self.cscript['dependencies']).args) == 2:
             self_options = copy.copy(options)
             self.add_defaults(self_options)
             deps = self.call('dependencies', self_options)
@@ -974,7 +1087,7 @@ class Tree(object):
             dep_options = d[2] if len(d) > 2 else {}
             for i in dep.dependencies(dep_options):
                 yield i
-            yield (dep, dep_options)
+            yield (dep, dep_options, self)
 
     def checkout_dependencies(self, options={}):
         for i in self.dependencies(options):
@@ -988,11 +1101,11 @@ class Tree(object):
         for i in self.dependencies(options):
             i[0].build(i[1])
 
-    def build(self, options):
+    def build(self, options, for_package=False):
         if self.built:
             return
 
-        log_verbose("Building %s %s %s with %s" % (self.name, self.specifier, self.version, options))
+        log_verbose("Building %s %s %s with %s" % (self.name, self.commit_ish, self.version, options))
 
         variables = copy.copy(self.target.variables)
 
@@ -1000,7 +1113,10 @@ class Tree(object):
         self.add_defaults(options)
 
         if not globals.dry_run:
-            if len(inspect.getfullargspec(self.cscript['build']).args) == 2:
+            num_args = len(inspect.getfullargspec(self.cscript['build']).args)
+            if num_args == 3:
+                self.call('build', options, for_package)
+            elif num_args == 2:
                 self.call('build', options)
             else:
                 self.call('build')
@@ -1008,39 +1124,14 @@ class Tree(object):
         self.target.variables = variables
         self.built = True
 
+
 #
 # Command-line parser
 #
 
 def main():
-
-    commands = {
-        "build": "build project",
-        "package": "package and build project",
-        "release": "release a project using its next version number (changing wscript and tagging)",
-        "pot": "build the project's .pot files",
-        "manual": "build the project's manual",
-        "doxygen": "build the project's Doxygen documentation",
-        "latest": "print out the latest version",
-        "test": "run the project's unit tests",
-        "shell": "build the project then start a shell",
-        "checkout": "check out the project",
-        "revision": "print the head git revision number"
-    }
-
-    one_of = "Command is one of:\n"
-    summary = ""
-    for k, v in commands.items():
-        one_of += "\t%s\t%s\n" % (k, v)
-        summary += k + " "
-
     parser = argparse.ArgumentParser()
-    parser.add_argument('command', help=summary)
     parser.add_argument('-p', '--project', help='project name')
-    parser.add_argument('--minor', help='minor version number bump', action='store_true')
-    parser.add_argument('--micro', help='micro version number bump', action='store_true')
-    parser.add_argument('--latest-major', help='major version to return with latest', type=int)
-    parser.add_argument('--latest-minor', help='minor version to return with latest', type=int)
     parser.add_argument('-c', '--checkout', help='string to pass to git for checkout')
     parser.add_argument('-o', '--output', help='output directory', default='.')
     parser.add_argument('-q', '--quiet', help='be quiet', action='store_true')
@@ -1050,14 +1141,36 @@ def main():
     parser.add_argument('--debug', help='build with debugging symbols where possible', action='store_true')
     parser.add_argument('-w', '--work', help='override default work directory')
     parser.add_argument('-g', '--git-prefix', help='override configured git prefix')
-    parser.add_argument('--test', help="name of test to run (with `test'), defaults to all")
     parser.add_argument('-n', '--dry-run', help='run the process without building anything', action='store_true')
     parser.add_argument('-e', '--environment', help='pass the value of the named environment variable into the build', action='append')
     parser.add_argument('-m', '--mount', help='mount a given directory in the build environment', action='append')
-    parser.add_argument('--no-version-commit', help="use just tags for versioning, don't modify wscript, ChangeLog etc.", action='store_true')
     parser.add_argument('--option', help='set an option for the build (use --option key:value)', action='append')
     parser.add_argument('--ccache', help='use ccache', action='store_true')
     parser.add_argument('--verbose', help='be verbose', action='store_true')
+
+    subparsers = parser.add_subparsers(help='command to run', dest='command')
+    parser_build = subparsers.add_parser("build", help="build project")
+    parser_package = subparsers.add_parser("package", help="build and package project")
+    parser_package.add_argument('--no-notarize', help='do not notarize .dmg packages', action='store_true')
+    parser_release = subparsers.add_parser("release", help="release a project using its next version number (adding a tag)")
+    parser_release.add_argument('--minor', help='minor version number bump', action='store_true')
+    parser_release.add_argument('--micro', help='micro version number bump', action='store_true')
+    parser_pot = subparsers.add_parser("pot", help="build the project's .pot files")
+    parser_manual = subparsers.add_parser("manual", help="build the project's manual")
+    parser_doxygen = subparsers.add_parser("doxygen", help="build the project's Doxygen documentation")
+    parser_latest = subparsers.add_parser("latest", help="print out the latest version")
+    parser_latest.add_argument('--major', help='major version to return', type=int)
+    parser_latest.add_argument('--minor', help='minor version to return', type=int)
+    parser_test = subparsers.add_parser("test", help="build the project and run its unit tests")
+    parser_test.add_argument('--no-implicit-build', help='do not build first', action='store_true')
+    parser_test.add_argument('--test', help="name of test to run, defaults to all")
+    parser_shell = subparsers.add_parser("shell", help="start a shell in the project's work directory")
+    parser_checkout = subparsers.add_parser("checkout", help="check out the project")
+    parser_revision = subparsers.add_parser("revision", help="print the head git revision number")
+    parser_dependencies = subparsers.add_parser("dependencies", help="print details of the project's dependencies as a .dot file")
+    parser_notarize = subparsers.add_parser("notarize", help="notarize .dmgs in a directory")
+    parser_notarize.add_argument('--dmgs', help='directory containing *.dmg')
+
     global args
     args = parser.parse_args()
 
@@ -1087,28 +1200,25 @@ def main():
         if not os.path.exists(args.work):
             os.makedirs(args.work)
 
-    if args.project is None and args.command != 'shell':
+    if args.project is None and not args.command in ['shell', 'notarize']:
         raise Error('you must specify -p or --project')
 
     globals.quiet = args.quiet
     globals.verbose = args.verbose
-    globals.command = args.command
     globals.dry_run = args.dry_run
 
-    if not globals.command in commands:
-        e = 'command must be one of:\n' + one_of
-        raise Error('command must be one of:\n%s' % one_of)
-
-    if globals.command == 'build':
+    if args.command == 'build':
         if args.target is None:
             raise Error('you must specify -t or --target')
 
         target = target_factory(args)
-        target.build(args.project, args.checkout, get_command_line_options(args))
-        if not args.keep:
-            target.cleanup()
+        try:
+            target.build(args.project, args.checkout, get_command_line_options(args))
+        finally:
+            if not args.keep:
+                target.cleanup()
 
-    elif globals.command == 'package':
+    elif args.command == 'package':
         if args.target is None:
             raise Error('you must specify -t or --target')
 
@@ -1125,16 +1235,12 @@ def main():
                 output_dir = args.output
 
             makedirs(output_dir)
-            target.package(args.project, args.checkout, output_dir, get_command_line_options(args))
-        except Error as e:
+            target.package(args.project, args.checkout, output_dir, get_command_line_options(args), not args.no_notarize)
+        finally:
             if target is not None and not args.keep:
                 target.cleanup()
-            raise
 
-        if target is not None and not args.keep:
-            target.cleanup()
-
-    elif globals.command == 'release':
+    elif args.command == 'release':
         if args.minor is False and args.micro is False:
             raise Error('you must specify --minor or --micro')
 
@@ -1149,25 +1255,12 @@ def main():
             version.bump_micro()
 
         with TreeDirectory(tree):
-            if not args.no_version_commit:
-                set_version_in_wscript(version)
-                append_version_to_changelog(version)
-                append_version_to_debian_changelog(version)
-                command('git commit -a -m "Bump version"')
-
             command('git tag -m "v%s" v%s' % (version, version))
-
-            if not args.no_version_commit:
-                version.to_devel()
-                set_version_in_wscript(version)
-                command('git commit -a -m "Bump version"')
-                command('git push')
-
             command('git push --tags')
 
         target.cleanup()
 
-    elif globals.command == 'pot':
+    elif args.command == 'pot':
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
 
@@ -1177,9 +1270,10 @@ def main():
 
         target.cleanup()
 
-    elif globals.command == 'manual':
+    elif args.command == 'manual':
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
+        tree.checkout_dependencies()
 
         outs = tree.call('make_manual')
         for o in outs:
@@ -1190,7 +1284,7 @@ def main():
 
         target.cleanup()
 
-    elif globals.command == 'doxygen':
+    elif args.command == 'doxygen':
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
 
@@ -1203,7 +1297,7 @@ def main():
 
         target.cleanup()
 
-    elif globals.command == 'latest':
+    elif args.command == 'latest':
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
 
@@ -1223,38 +1317,37 @@ def main():
                             t = s[1]
                         if len(t) > 0 and t[0] == 'v':
                             v = Version(t[1:])
-                            if (args.latest_major is None or v.major == args.latest_major) and (args.latest_minor is None or v.minor == args.latest_minor):
+                            if (args.major is None or v.major == args.major) and (args.minor is None or v.minor == args.minor):
                                 latest = v
 
         print(latest)
         target.cleanup()
 
-    elif globals.command == 'test':
+    elif args.command == 'test':
         if args.target is None:
             raise Error('you must specify -t or --target')
 
         target = None
         try:
             target = target_factory(args)
-            tree = globals.trees.get(args.project, args.checkout, target)
-            with TreeDirectory(tree):
-                target.test(tree, args.test, get_command_line_options(args))
-        except Error as e:
+            options = get_command_line_options(args)
+            if args.no_implicit_build:
+                globals.trees.add_built(args.project, args.checkout, target)
+            else:
+                target.build(args.project, args.checkout, options)
+            target.test(args.project, args.checkout, target, args.test, options)
+        finally:
             if target is not None and not args.keep:
                 target.cleanup()
-            raise
-
-        if target is not None and not args.keep:
-            target.cleanup()
 
-    elif globals.command == 'shell':
+    elif args.command == 'shell':
         if args.target is None:
             raise Error('you must specify -t or --target')
 
         target = target_factory(args)
         target.command('bash')
 
-    elif globals.command == 'revision':
+    elif args.command == 'revision':
 
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
@@ -1262,7 +1355,7 @@ def main():
             print(command_and_read('git rev-parse HEAD')[0].strip()[:7])
         target.cleanup()
 
-    elif globals.command == 'checkout':
+    elif args.command == 'checkout':
 
         if args.output is None:
             raise Error('you must specify -o or --output')
@@ -1273,8 +1366,25 @@ def main():
             shutil.copytree('.', args.output)
         target.cleanup()
 
-    else:
-        raise Error('invalid command %s' % globals.command)
+    elif args.command == 'dependencies':
+        if args.target is None:
+            raise Error('you must specify -t or --target')
+        if args.checkout is None:
+            raise Error('you must specify -c or --checkout')
+
+        target = target_factory(args)
+        tree = globals.trees.get(args.project, args.checkout, target)
+        print("strict digraph {")
+        for d in list(tree.dependencies({})):
+            print("%s -> %s;" % (d[2].name.replace("-", "-"), d[0].name.replace("-", "_")))
+        print("}")
+
+    elif args.command == 'notarize':
+        if args.dmgs is None:
+            raise Error('you must specify ---dmgs')
+
+        for dmg in Path(args.dmgs).glob('*.dmg'):
+            notarize_dmg(dmg)
 
 try:
     main()