Repository navigation
Conversation
Adds a Makefile that wraps scripts/build_app.sh: - make build-macos runs the same steps as CI (build_app.sh, pub get, prebuild.sh, flutter build macos). PREBUILTS=0 compiles native assets from source (the generated pubspec.yaml is removed first so an earlier -d run does not stick). Produces the same app as upstream (Stack Wallet.app, com.cypherstack.stack_wallet). - make bootstrap-macos (Homebrew; pins Flutter 3.47.2), nix develop via flake.nix/.envrc (sets FLUTTER_ROOT so `dart run` works), make bootstrap-xcode, and an opt-in make bootstrap-xcode-download (archive.org; SHA-1 and Apple signature are both checked). - make sccache-setup (opt-in): sccache for native-asset hook builds via ~/.cargo/config.toml. - make build-linux; writes a git-ignored .cargo/config.toml with PROTOC so crates that ship a generic-Linux protoc build on NixOS. - bm/ benchmark scripts and MWC integration tests. Docs: new "Building with make" section in docs/building.md. Verified (one machine each, one run): - macOS 27.2 / Xcode 27.1: make build-macos from a clean checkout (946 s cold, 319.0 MB), PREBUILTS=0 (596 s), and inside nix develop (Flutter 3.47.4, 261 s). - Linux: NixOS x86_64, nix develop, Rust 1.99.1, make build-linux produced build/linux/x64/release/bundle/stack_wallet (291 MB). - Xcode 27.1 download from archive.org: SHA-1 and pkgutil signature check pass (install step not run). Not tested: Ubuntu, Windows, Android, iOS, bootstrap-macos on a fresh Mac.
…set hooks Measured on macOS with the unmodified upstream tree: a repeated build takes 33-40 s with an unchanged environment, but 536 s after one extra directory in PATH and 156-164 s after adding a NIX_* variable or restoring PATH, because hooks_runner reruns every hook when the environment it hashes changes.
download_xcode.sh used sudo for rm/mv/xattr unconditionally. It now checks whether the parent of the target directory is writable and only then uses sudo, so Xcode can be installed into ~/Applications without a password. Verified on macOS 27.2: -d ~/Applications/Xcode_27.1_test.app installed Xcode 27.1 (27A9275), the extracted app has no quarantine attribute, and free space dropped by about 4 GB; hash and signature checks passed before it. The install-time prompt text now says about 20 GB free are needed.
…ptional install_macos_build_tools.sh aborted at the first brew failure. On a machine where weasyprint was installed another way, brew could not link it, set -e stopped the script, and the Flutter step was never reached. It also upgraded formulae that were already installed (cmake, go), changing the build machine under the user. - export HOMEBREW_NO_INSTALL_UPGRADE=1 for the required packages - install pandoc/weasyprint/toilet/figlet (only used by the bm/ report rendering) in a separate, non-fatal step Verified on macOS 27.2: first run failed as described; after the change the installer ended with rc=0, cloned Flutter 3.47.4 into a temporary FLUTTER_DIR, left the existing Flutter 3.47.2 untouched, and only appended the brew shellenv and Flutter PATH lines to ~/.zshrc (restored afterwards).
…lock make build-macos now runs ./build_app.sh from the scripts directory (as the CI jobs and the other targets do), so scripts/build_app.sh stays exactly as in staging; the earlier path-resolution and variable-rename edits are reverted. make build-linux no longer recreates lib/external_api_keys.dart: prebuild.sh already creates it, and the block never ran in any of the Linux builds I did. Verified on macOS 27.2: make build-macos OK, Stack Wallet.app with the unchanged bundle ID. The Linux target was only checked with make -n after this change.
archive.org sometimes resets the connection (curl exit 56) a minute into the transfer, which aborted the script even though the download can be resumed. curl now retries up to 8 times (--retry-all-errors) and resumes with -C -. Seen in a fresh macOS 27.2 VM; the retry itself is exercised in the next VM run.
…e, docs make build-linux now passes -d (PREBUILTS=1, the default, like make build-macos and the CI job) and -s with SYSTEM_DEPS=1. With -s the Makefile sets only USE_SYSTEM_SECURE_STORAGE_DEPS=1 for the app build; the local libsecret pkg-config override is kept for the default path (it is needed where libsecret is built from source, for example on NixOS). download_xcode.sh accepts XCODE_XIP_URL to download from another mirror; the SHA-1 and the Apple signature are still checked. docs: a second Xcode via DEVELOPER_DIR, and what reaches the hooks for sccache (exported RUSTC_WRAPPER does not, the cargo config file does). Verified: NixOS (nix develop) make build-linux with -d builds the bundle; Ubuntu 24.04 container make build-linux SYSTEM_DEPS=1 (-d -s, the CI flags) builds the bundle; make -n and bash -n pass for all targets and scripts.
… bm/bench.sh clean-app removes build/ and the Pods but keeps .dart_tool/hooks_runner, so the next build does not rebuild the native assets; clean-native removes only the native-asset outputs. bm/bench.sh zeroes the sccache statistics before the build and stores 'sccache hits/executed requests' in the comment column of the CSV.
stack-bom.toml records the expected toolchain (Flutter, Dart, Rust, Go, Xcode) and the git revisions of the pinned native plugins. make verify-bom (dart tool/verify_bom.dart, no packages needed) checks the local machine and pubspec.lock against it: a mismatch in Rust, Dart, minimum Flutter/Go or a plugin pin fails, a different recommended Flutter or Xcode only warns. dart tool/verify_bom.dart --update regenerates the [plugins] section from pubspec.lock. Verified on macOS 27.2: passes with 1 warning (Flutter 3.47.2 vs. recommended 3.47.4); a wrong Rust version and a wrong plugin pin both exit 1.
…targets make build-windows wraps the steps of the build-windows CI job (prebuild.sh, build_app.sh -p windows -d -s, pub get, coinlib:build_windows, flutter build windows). WINDOWS_COPY_ASSETS=1 replaces the asset links with copies for runners that cannot create symlinks. .github/workflows/make-build.yaml runs make build-windows and make build-macos on hosted runners (manual dispatch or pushes to ci/make-* branches).
…ing key exists The release build fails at packageRelease without android/key.properties (SigningConfig release is missing storeFile). android-dev-key creates a debug keystore and key.properties for local builds only; both files are git-ignored and the APKs are not for distribution.
parasew
changed the title
…deps and bm - build-windows: with WINDOWS_COPY_ASSETS=1 remove the asset copies of an earlier run before build_app.sh runs link_assets.sh, whose `rm -f` cannot delete real directories (second run failed) - bootstrap-macos: skip the Homebrew installer in a Nix shell with one conditional recipe instead of `exit 0`, which only ended that line's shell; failures of the Xcode step now propagate - build_secure_storage_deps.sh: stop when cmake, make, meson or ninja fails, before writing the pkg-config file; reconfigure an existing meson build directory instead of failing on it - install_macos_build_tools.sh: put rustup on PATH after `brew install` (resolved with `brew --prefix rustup`), not only if its directory existed before - install_xcode.sh: keep any valid selected Xcode (Xcode_27.1.app, ~/Applications, ...) and only pick one from /Applications when the selection is missing or the Command Line Tools - mwc_ffi_test_service: the invalid-slatepack assertion no longer sits inside its own catch - bm/compare.py: pair measurements by label and host instead of the first row of each file - bm/bench.sh: record failed builds and return make's exit status
- Remove the MWC FFI integration tests; they belong in flutter_libmwc. - Run prepare_release_bundle.py from make build-linux. - Honor APP_NAME on macOS and make WINDOWS_COPY_ASSETS copy in link_assets.sh. - Stop rewriting the tracked libsecret pkg-config file and drop duplicate toolchain steps. - Harden verify_bom.dart for Windows and missing plugin pins. - Fix bootstrap/Xcode selection, download resume, and benchmark script edge cases.
Resolve docs/building.md: keep patchelf and staging's removal of libopencv-dev.
Author
|
@julian-CStack thanks — I worked through the review items and the follow-ups.
|
parasew
marked this pull request as ready for review
November 11, 2026 18:16
The fork has a single hosted macOS concurrency slot. Running the two jobs together leaves one queued until GitHub's 15-minute timeout cancels it. Run macOS first, then iOS, so each waits for the runner instead of competing.
Author
|
Runner follow-up: the macOS cancellations were caused by the fork's single hosted macOS concurrency slot, with Commit |
Author
|
All checks are green on
The macOS runner issue is resolved by serialising the two macOS jobs. The PR is up to date with |
Author
|
Clean-room follow-up: the two remaining platform gaps are now actually validated. macOS VM (Tart, macOS 26.6.2 arm64; Homebrew present, no Xcode/Flutter/Rust):
Android (x86_64 Linux host,
Xcode resume harness: a partial The remaining limitations are now only physical-Windows hardware, real Android release signing, and iOS simulator/signing. The PR is still green and ready for review. |
parasew
force-pushed
the
feat/makefile-macos-build
branch
from
November 12, 2026 07:51
b82bc47 to
4481c00
Compare
Author
|
Author metadata update: all commits on this branch are now authored and committed by |
…used secp copy
- bootstrap-macos invoked $(MAKE) bootstrap-xcode; a recipe line containing
$(MAKE) is executed even under `make -n`, so a dry run accepted the Xcode
license and ran first-launch setup for real (observed: sudo prompt and
exit 2 under make -n). Call scripts/install_xcode.sh directly instead --
exactly what the bootstrap-xcode target runs.
- verify-bom with no dart on PATH expanded $(DART) to empty and /bin/sh
tried to execute tool/verify_bom.dart as a command ("Permission denied",
exit 126). Guard it the same way check-reqs guards Flutter/Dart.
- scripts/linux/build_secp256k1.sh copied the library to
build/linux/x64/release/secp256k1/lib ("Location expected by
Flutter/CMake install step"). No consumer exists in this tree or in cypherstack#1505
(coinlib_flutter, pinned f0e12dac, builds its own secp256k1 via CMake
ExternalProject into its own CMAKE_BINARY_DIR), and the path hardcoded x64
instead of deriving the arch. Drop it; keep the legacy
build/libsecp256k1.so copy consumed by coinlib:build_linux and
test/utilities/electrum_seed_utils_test.dart.
- The workflow declared no permissions and would inherit the repo default. Add top-level permissions: contents: read (the jobs only check out code and build; no artifacts are uploaded, no registry images pulled). - Drop libopencv-dev from the Linux apt list: staging removed it in 9a02aa2 ("Use the build-hook camera_linux, drop libopencv-dev"), the CI image installs no OpenCV, and this PR's own docs/building.md apt line does not list it. Keep ocl-icd-opencl-dev/opencl-headers/libtss2-dev, which the staging image still ships.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Developer-experience tooling for building Stack Wallet from a checkout with
make, plus the build fixes and docs needed to make those targets match CI.Current head:
7619f9cf2, withstagingat40c9a054merged in (the branch is current, not behind). This update addresses the remaining review findings (dry-run safety, workflow permissions, an OpenCV build dependency, a dead secp256k1 copy, and theverify-bomfailure mode without Dart) and makes the earlier author-metadata rewrite explicit.Review fixes in this update
make -nis a true dry run again:bootstrap-macosinvoked$(MAKE) bootstrap-xcode; GNU make executes recipe lines containing$(MAKE)even under-n, so a dry run ran the Xcode first-launch/license path and failed with exit 2. It now callsscripts/install_xcode.shdirectly (exactly what thebootstrap-xcodetarget runs). All 20 targets return 0 undermake -n.verify-bomwithout Dart: with nodartonPATHthe recipe executedtool/verify_bom.dartdirectly (Permission denied, exit 126). It now fails with a clear[ERROR] Dart not installed ...message, matchingcheck-reqs.make-build.yamldeclarespermissions: contents: read; the jobs only check out code and build.libopencv-devfrom the make-build Linux apt list: staging removed it in9a02aa2e7("Use the build-hook camera_linux, drop libopencv-dev") and the CI image installs no OpenCV. The list now matches the staging image; OpenCL andlibtss2-devstay.scripts/linux/build_secp256k1.shcopied the library tobuild/linux/x64/release/secp256k1/libas "Location expected by Flutter/CMake install step". No consumer exists in this tree or in Repro dnix packages #1505 (coinlib_flutter builds its own secp256k1 via CMake ExternalProject), and the path hardcodedx64. The legacybuild/libsecp256k1.socopy used bycoinlib:build_linuxstays.Author metadata
All commits on this branch are authored and committed by
parasew <9727+parasew@users.noreply.github.com>. The original chain was authored byLunar Dev <m@lunarmint.net>; the rewrite is content-preserving (every rewritten commit is tree-identical), and this note makes it explicit.Earlier review fixes
integration_test/mwc_ffi_test.dart,mwc_ffi_test_service.dart,mwc_test_result.dartandmake test-mwc. These tests exercise MWC itself and belong influtter_libmwc, not Stack Wallet. They are ported tocypherstack/flutter_libmwc#16; the new plugin-level suite passes locally on macOS arm64 and Linux x86_64 (9 tests each).make build-linuxnow runsscripts/linux/prepare_release_bundle.py;check-reqsverifiespatchelf,readelfandpython3.APP_NAME: macOS builds pass$(APP_NAME)instead of a literalstack_wallet, and Windows asset selection uses the selected app variant.link_assets.shcopies directly whenWINDOWS_COPY_ASSETS=1. It no longer relies onmklinksucceeding first, and removes old junctions withcmd.exe rmdirbefore falling back to a normal delete.scripts/linux/pc/libsecret-1.pcis removed and git-ignored.build_secure_storage_deps.shgenerates it; the Makefile no longer rewrites it.coinlib:build_linuxDocker step;build_app.shalready builds secp256k1.build-linuxuses a repo-local.pub-cache, for the local cargoPROTOCconfig. Other targets use Flutter's normal per-user cache.verify_bom.dartfails on missing plugin pins, parses only stdout for Flutter's JSON, usesrunInShellon Windows and honours theFLUTTERoverride.rustup overriderather than changing the global default; Xcode selection prefers the newest full app, and license/first-launch only run when pending; partial.xipdownloads resume.bm/render.shonly opens output with--open;bm/bench.shsurvives missingdu/sccache; unused imports removed;bm/collect.shis wired intobm/run_all.sh.make-build.yamlnow runs macOS first and iOS after it. Running both together left one job queued until GitHub's 15-minute timeout cancelled it.git diff --checkerrors are fixed.What it adds
make build-macos: CI flow,PREBUILTS=1by default (-d),PREBUILTS=0compiles native assets from source.make build-linux: CI flow,SYSTEM_DEPS=1for system libsecret/jsoncpp, then bundle preparation.make build-windows(Git Bash),make build-android(throw-away dev key if no signing key),make build-ios(no code signing).make bootstrap-macos,make bootstrap-xcode, opt-inmake bootstrap-xcode-download,check-reqs,check-sdk-macos,diagnose-env-macos.make clean-app/clean-native,make sccache-setup/cache-stats.stack-bom.toml+tool/verify_bom.dart+make verify-bom..github/workflows/make-build.yaml(manual only): Windows, macOS, Linux (withverify-bom) and iOS make targets.bm/benchmark scripts.docs/building.md.Verification
git diff --checkagainststaging: clean. The PR diff is exactly the 25 files listed bygh pr diff.bash -nandshellcheckon all changed scripts: clean (0 errors).make -nfor all 20 targets: all exit 0.make verify-bominsidenix develop(Flutter 3.47.4, Dart 3.13.3, Xcode 27.2): 0 failures, 1 warning (Xcode 27.2 vs recommended 27.1).Make buildrun 43399415382 on this head: all four jobs pass (windows, linux, macos, ios). The same workflow ran green for linux and windows on the identical code changes in run 43306602943 (macOS/iOS were cancelled while queued — fork runner capacity, no steps executed).make build-macos(insidenix develop, Xcode 27.2, Flutter 3.47.4) on this head: pass,Stack Wallet.app318.8 MB.cypherstack/flutter_libmwc#16: the moved FFI suite passes 9/9 locally on macOS arm64; the pluginTestsworkflow (ubuntu-24.04, xcode-27, windows-latest) ran on the build v 1.4.36 #16 head (run 43399598924) and passed on all three platforms.docs/building.mdconflicts; allmake -ntargets parse; the merged tree builds macOS (Stack Wallet.app, 320.0 MB);make verify-bomneeds its plugin pins refreshed after Repro dnix packages #1505 changespubspec.lock.Not tested / known limitations
windows-2022runner was exercised.--no-codesign.Follow-ups
cypherstack/flutter_libmwc#16; it is no longer part of this PR. The plugin'sTestsworkflow runs the suite once its first-contributor approval is granted.^3.47.4in CI/docs in a separate change. The Nix shell already uses 3.47.4; CI and the Homebrew bootstrap currently use 3.47.2.flutter_libmwcprotoc path fix and a per-library dylib install name remain separate follow-ups.Supersedes #1336.