Fix macosx ventura updater (#768)

* Upload the signed bundle to s3 (#756)

* remove some code duplication regarding prerelease calculation

* add upload of the notarized bundle to s3 download bucket

* add upload of the notarized bundle to s3 download bucket

* add json to enable autoupdate with the new agent logic (#759)

* add json to enable autoupdate with the new agent logic

* binary output of the archive https://unix.stackexchange.com/questions/3675/how-can-i-get-a-base64-encoded-shax-on-the-cli

* workaround to allow darwin-arm64 to autoupdate

* parallelize bundle creation and notarization.
This will be helpful if/when we decide to build for darwin-arm64.
For now this is useful because we do not offer a binary for m1 yet,
`runtime.GOARCH` on an m1 machine returns ARM64, so the call for the update file would fail

* Implemented the autoupdater for MacOS

* Added more logging and fixed upgrade procedure

* Use MacOS openApplicationAtURL syscall to re-run updated app

* Bump minimum required macosx version to 10.15

This is required because the auto-update uses the function

warning: 'openApplicationAtURL:configuration:completionHandler:' is only available on macOS 10.15 or newer [-Wunguarded-availability-new]

* Removed diff-based updates

* Fixed update URL for different update methods

* fix invalid workflow

* Always complete the old auto-upgrade procedure

This is required for clients upgrading from versions <=1.2.7

* Moved the syscall to openApplicationAtURL inside Systray

* Added fallback restart for macosx.

* added some more logging

---------

Co-authored-by: Umberto Baldi <[email protected]>
Co-authored-by: Umberto Baldi <[email protected]>

Author: cmaglie

Diff for: .github/workflows/publish-go-tester-task.yml

@@ -132,9 +132,9 @@ jobs:
 
       - name: Build the Agent for macos
         env:
-          MACOSX_DEPLOYMENT_TARGET: 10.11 # minimum supported version for mac
-          CGO_CFLAGS: -mmacosx-version-min=10.11
-          CGO_LDFLAGS: -mmacosx-version-min=10.11
+          MACOSX_DEPLOYMENT_TARGET: 10.15 # minimum supported version for mac
+          CGO_CFLAGS: -mmacosx-version-min=10.15
+          CGO_LDFLAGS: -mmacosx-version-min=10.15
         run: task go:build
         if: runner.os == 'macOS'
 

Diff for: .github/workflows/release.yml

@@ -8,7 +8,7 @@ on:
 env:
   # As defined by the Taskfile's PROJECT_NAME variable
   PROJECT_NAME: arduino-create-agent
-  TARGET: "/CreateAgent/Stable"
+  TARGET: "/CreateAgent/Stable/"
   OLD_TARGET: "/CreateBridge/" # compatibility with older releases (we can't change config.ini)
   VERSION_TARGET: "arduino-create-static/agent-metadata/"
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -26,6 +26,8 @@ env:
 jobs:
   # The build job is responsible for: configuring the environment, testing and compiling process
   build:
+    outputs:
+      prerelease: ${{ steps.prerelease.outputs.IS_PRE }}
     strategy:
       matrix:
         os: [ubuntu-20.04, windows-2019, macos-12]
@@ -110,9 +112,9 @@ jobs:
 
       - name: Build the Agent for macos
         env:
-          MACOSX_DEPLOYMENT_TARGET: 10.11 # minimum supported version for mac
-          CGO_CFLAGS: -mmacosx-version-min=10.11
-          CGO_LDFLAGS: -mmacosx-version-min=10.11
+          MACOSX_DEPLOYMENT_TARGET: 10.15 # minimum supported version for mac
+          CGO_CFLAGS: -mmacosx-version-min=10.15
+          CGO_LDFLAGS: -mmacosx-version-min=10.15
         run: task go:build
         if: matrix.os == 'macos-12'
 
@@ -121,6 +123,14 @@ jobs:
         run: go-selfupdate ${{ env.PROJECT_NAME }}${{ matrix.ext }} ${TAG_VERSION}
         if: matrix.arch != '-386' && steps.prerelease.outputs.IS_PRE != 'true'
 
+        # for now we do not distribute m1 build, this is a workaround for now
+      - name: Copy autoupdate file for darwin-arm64 (m1 arch)
+        working-directory: public/
+        run: |
+          cp darwin-amd64.json darwin-arm64.json
+          cp ${TAG_VERSION}/darwin-amd64.gz ${TAG_VERSION}/darwin-arm64.gz
+        if: matrix.os == 'macos-12' && steps.prerelease.outputs.IS_PRE != 'true'
+
       - name: Create autoupdate files for win32
         run: go-selfupdate -platform windows${{ matrix.arch }} ${{ env.PROJECT_NAME }}${{ matrix.ext }} ${TAG_VERSION}
         if: matrix.arch == '-386' && matrix.os == 'windows-2019' && steps.prerelease.outputs.IS_PRE != 'true'
@@ -142,6 +152,11 @@ jobs:
   create-macos-bundle:
     needs: build
 
+    # for not they are exaclty the same
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+
     runs-on: macos-12
     env:
       EXE_PATH: "skel/ArduinoCreateAgent.app/Contents/MacOS/"
@@ -156,7 +171,7 @@ jobs:
       - name: Download artifact
         uses: actions/download-artifact@v3
         with:
-          name: ${{ env.PROJECT_NAME }}-macos-12-amd64
+          name: ${{ env.PROJECT_NAME }}-macos-12-amd64 # if we want to support darwin-arm64 in the future for real this has to change.
           path: ${{ env.EXE_PATH }}
 
       - name: Remove placeholder file
@@ -195,31 +210,37 @@ jobs:
           EOF
 
       - name: Tar bundle to keep permissions
-        run: tar -cvf ArduinoCreateAgent.app.tar -C skel/ .
+        run: tar -cvf ArduinoCreateAgent.app_${{ matrix.arch }}.tar -C skel/ .
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v3
         with:
           if-no-files-found: error
-          name: ArduinoCreateAgent.app
-          path: ArduinoCreateAgent.app.tar
+          name: ArduinoCreateAgent.app_${{ matrix.arch }}
+          path: ArduinoCreateAgent.app_${{ matrix.arch }}.tar
 
-  # The notarize-macos job will download the macos bundle from the previous job, sign, notarize and re-upload it.
+  # The notarize-macos job will download the macos bundle from the previous job, sign, notarize and re-upload it, uploading it also on s3 download servers for the autoupdate.
   notarize-macos:
     name: Notarize bundle
+
+    # for not they are exaclty the same
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
+
     runs-on: macos-12
     env:
       GON_PATH: ${{ github.workspace }}/gon
-    needs: create-macos-bundle
+    needs: [build, create-macos-bundle]
 
     steps:
       - name: Download artifact
         uses: actions/download-artifact@v3
         with:
-          name: ArduinoCreateAgent.app
+          name: ArduinoCreateAgent.app_${{ matrix.arch }}
 
       - name: un-Tar bundle
-        run: tar -xvf ArduinoCreateAgent.app.tar
+        run: tar -xvf ArduinoCreateAgent.app_${{ matrix.arch }}.tar
 
       - name: Import Code-Signing Certificates
         run: |
@@ -270,18 +291,37 @@ jobs:
           # Ask Gon for zip output to force notarization process to take place.
           # The CI will upload the zip output
           zip {
-            output_path = "ArduinoCreateAgent.app_notarized.zip"
+            output_path = "ArduinoCreateAgent.app_${{ matrix.arch }}_notarized.zip"
           }
           EOF
 
       - name: Sign and notarize binary
         run: gon -log-level=debug -log-json "${{ env.GON_CONFIG_PATH }}"
+        
+      - name: Upload autoupdate bundle to Arduino downloads servers
+        run: aws s3 cp ArduinoCreateAgent.app_${{ matrix.arch }}_notarized.zip s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.TARGET }}${GITHUB_REF/refs\/tags\//}/ # the version should be created in th the build job
+        if: ${{ needs.build.outputs.prerelease != 'true' }}
+
+      - name: Generate json file used for the new autoupdate
+        run: |
+          cat > darwin-${{ matrix.arch }}-bundle.json <<EOF
+          {
+              "Version": "${GITHUB_REF/refs\/tags\//}",
+              "Sha256": "$(shasum -a 256 ArduinoCreateAgent.app_${{ matrix.arch }}_notarized.zip | awk '{print $1}' |  xxd -r -p | base64)"
+          }
+          EOF
+        if: ${{ needs.build.outputs.prerelease != 'true' }}
+
+      - name: Upload autoupdate files to Arduino downloads servers
+        run: |
+          aws s3 cp darwin-${{ matrix.arch }}-bundle.json s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.TARGET }}
+        if: ${{ needs.build.outputs.prerelease != 'true' }}
 
       - name: Upload artifact
         uses: actions/upload-artifact@v3
         with:
-          name: ArduinoCreateAgent.app_notarized
-          path: ArduinoCreateAgent.app_notarized.zip
+          name: ArduinoCreateAgent.app_${{ matrix.arch }}_notarized
+          path: ArduinoCreateAgent.app_${{ matrix.arch }}_notarized.zip
           if-no-files-found: error
 
   # This job is responsible for generating the installers (using installbuilder)
@@ -334,7 +374,8 @@ jobs:
             install-builder-name: osx
             executable-path: artifacts/macos/ArduinoCreateAgent.app
             installer-extension: .app
-            artifact-name: ArduinoCreateAgent.app_notarized # this artifact contains the Contents directory
+            artifact-name: ArduinoCreateAgent.app_amd64_notarized # this artifact contains the Contents directory
+            # here we support only amd64 for macos. Hopefully in the future installbuilder for macOS will be removed, see https://github.com/arduino/arduino-create-agent/issues/739
 
     container:
       image: floydpink/ubuntu-install-builder:22.10.0
@@ -493,7 +534,7 @@ jobs:
 
   create-release:
     runs-on: ubuntu-20.04
-    needs: code-sign-mac-installers
+    needs: [build, code-sign-mac-installers]
 
     steps:
       - name: Checkout
@@ -504,14 +545,6 @@ jobs:
       - name: Download artifact
         uses: actions/download-artifact@v3 # download all the artifacts
 
-      - name: Identify Prerelease
-        # This is a workaround while waiting for create-release action to implement auto pre-release based on tag
-        id: prerelease
-        run: |
-          curl -L -s https://github.com/fsaintjacques/semver-tool/archive/3.1.0.zip -o /tmp/3.1.0.zip
-          unzip -p /tmp/3.1.0.zip semver-tool-3.1.0/src/semver >/tmp/semver && chmod +x /tmp/semver
-          if [[ $(/tmp/semver get prerel ${GITHUB_REF/refs\/tags\//}) ]]; then echo "IS_PRE=true" >> $GITHUB_OUTPUT; fi
-
       #  mandatory step because upload-release-action does not support multiple folders
       - name: prepare artifacts for the release
         run: |
@@ -562,7 +595,7 @@ jobs:
           release_name: ${{ github.ref }}
           body: ${{ steps.release_body.outputs.RBODY}}
           draft: false
-          prerelease: ${{ steps.prerelease.outputs.IS_PRE }}
+          prerelease: ${{ needs.build.outputs.prerelease }}
 
       - name: Upload release files on Github
         uses: svenstaro/upload-release-action@v2
@@ -574,10 +607,10 @@ jobs:
 
       - name: Upload release files on Arduino downloads servers
         run: aws s3 sync release/ s3://${{ secrets.DOWNLOADS_BUCKET }}${{ env.TARGET }}
-        if: steps.prerelease.outputs.IS_PRE != 'true'
+        if: ${{ needs.build.outputs.prerelease != 'true' }}
 
       - name: Update version file (used by frontend to trigger autoupdate and create filename)
         run: |
           echo {\"Version\": \"${GITHUB_REF##*/}\"} > /tmp/agent-version.json
           aws s3 cp /tmp/agent-version.json s3://${{ env.VERSION_TARGET }}
-        if: steps.prerelease.outputs.IS_PRE != 'true'
+        if: ${{ needs.build.outputs.prerelease != 'true' }}

Diff for: go.mod

@@ -12,7 +12,6 @@ require (
 	github.com/gin-gonic/gin v1.8.1
 	github.com/go-ini/ini v1.62.0
 	github.com/googollee/go-socket.io v0.0.0-20181101151912-c8aeb1ed9b49
-	github.com/kr/binarydist v0.1.0
 	github.com/mattn/go-shellwords v1.0.12
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/oleksandr/bonjour v0.0.0-20210301155756-30f43c61b915
@@ -56,6 +55,7 @@ require (
 	github.com/juju/errors v0.0.0-20200330140219-3fe23663418f // indirect
 	github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 // indirect
 	github.com/klauspost/compress v1.15.13 // indirect
+	github.com/kr/binarydist v0.1.0 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/leodido/go-urn v1.2.1 // indirect
 	github.com/manveru/faker v0.0.0-20171103152722-9fbc68a78c4d // indirect

Diff for: systray/exec_darwin.go

@@ -0,0 +1,74 @@
+package systray
+
+/*
+#cgo CFLAGS: -x objective-c
+#cgo LDFLAGS: -framework Cocoa
+#import <Cocoa/Cocoa.h>
+
+char **makeCharArray(int size) {
+	return calloc(sizeof(char*), size);
+}
+
+void setCharArray(char **a, int n, char *s) {
+	a[n] = s;
+}
+
+void freeCharArray(char **a, int size) {
+	int i;
+	for (i = 0; i < size; i++) {
+		free(a[i]);
+	}
+	free(a);
+}
+
+void runApplication(const char *path, const char **argv, int argc) {
+	NSMutableArray<NSString *> *stringArray = [NSMutableArray array];
+	for (int i=0; i<argc; i++) {
+		NSString *arg = [NSString stringWithCString:argv[i] encoding:NSUTF8StringEncoding];
+		[stringArray addObject:arg];
+	}
+	NSArray<NSString *> *arguments = [NSArray arrayWithArray:stringArray];
+
+	NSWorkspace *ws = [NSWorkspace sharedWorkspace];
+	NSURL *url = [NSURL fileURLWithPath:@(path) isDirectory:NO];
+
+	NSWorkspaceOpenConfiguration* configuration = [NSWorkspaceOpenConfiguration new];
+	//[configuration setEnvironment:env];
+	[configuration setPromptsUserIfNeeded:YES];
+	[configuration setCreatesNewApplicationInstance:YES];
+	[configuration setArguments:arguments];
+	dispatch_semaphore_t semaphore = dispatch_semaphore_create(0);
+	[ws openApplicationAtURL:url configuration:configuration completionHandler:^(NSRunningApplication* app, NSError* error) {
+		dispatch_semaphore_signal(semaphore);
+	}];
+	dispatch_semaphore_wait(semaphore, DISPATCH_TIME_FOREVER);
+}
+*/
+import "C"
+import (
+	"os/exec"
+	"path/filepath"
+
+	"github.com/sirupsen/logrus"
+)
+
+func execApp(path string, args ...string) error {
+	if filepath.Ext(path) != ".app" {
+		// If not .app, fallback to standard process execution
+		logrus.WithField("path", path).WithField("args", args).Info("Running new app with os/exec.Exec")
+		cmd := exec.Command(path, args...)
+		return cmd.Start()
+	}
+
+	logrus.WithField("path", path).WithField("args", args).Info("Running new app with openApplicationAtURL")
+	argc := C.int(len(args))
+	argv := C.makeCharArray(argc)
+	for i, arg := range args {
+		C.setCharArray(argv, C.int(i), C.CString(arg))
+	}
+
+	C.runApplication(C.CString(path), argv, argc)
+
+	C.freeCharArray(argv, argc)
+	return nil
+}

Diff for: systray/exec_default.go

@@ -0,0 +1,26 @@
+// Copyright 2022 Arduino SA
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published
+// by the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+//go:build !darwin
+
+package systray
+
+import "os/exec"
+
+// default execApp from golang
+func execApp(path string, args ...string) error {
+	cmd := exec.Command(path, args...)
+	return cmd.Start()
+}

Diff for: systray/systray.go

@@ -18,7 +18,6 @@ package systray
 import (
 	"fmt"
 	"os"
-	"os/exec"
 	"strings"
 
 	"github.com/arduino/go-paths-helper"
@@ -69,8 +68,7 @@ func (s *Systray) Restart() {
 	}
 
 	// Launch executable
-	cmd := exec.Command(s.path, args...)
-	err := cmd.Start()
+	err := execApp(s.path, args...)
 	if err != nil {
 		log.Printf("Error restarting process: %v\n", err)
 		return

Diff for: update.go

@@ -35,11 +35,15 @@ import (
 )
 
 func updateHandler(c *gin.Context) {
-	restartPath, err := updater.CheckForUpdates(version, *updateURL, *updateURL, *appName)
+	restartPath, err := updater.CheckForUpdates(version, *updateURL, *appName)
 	if err != nil {
 		c.JSON(500, gin.H{"error": err.Error()})
 		return
 	}
 	c.JSON(200, gin.H{"success": "Please wait a moment while the agent reboots itself"})
-	Systray.RestartWith(restartPath)
+	if restartPath == "quit" {
+		Systray.Quit()
+	} else {
+		Systray.RestartWith(restartPath)
+	}
 }