This is an archive of the discontinued Mercurial Phabricator instance.

Differential D6846

packaging: script the building of a MacOS installer using a custom python
Changes PlannedPublic

Authored by mharbison72 on Sep 12 2019, 6:21 PM.

Download Raw Diff

Details

Reviewers

None

Group Reviewers

hg-reviewers

Summary

The intent here is to get away from relying on system python (which is going
away in 10.16), so that an installer can easily be built to work on multiple
versions of the OS. 10.9 was chosen as the minimum platform here because that's
the SDK needed to notarize, and also what the binary python installer targets.
A lot of this was adapted from the script that builds the TortoiseHg DMG.

There's a useful thg customization (not duplicated here), which extends
sys.path to include $HOME/Library/Python/2.7/lib/python/site-packages, because
there's no way to add to the bundled python after the app is signed. As it
stands now, this installation won't see that, but does see
$HOME/.local/lib/python2.7/site-packages, and the bundled pip will install
there with --user. It does seem like only seeing the second --user location
will get confusing, especially since the current behavior is that
pip install --user ... just works for pip in PATH.

The prerequisite is to have python3 to run the script, and a working python2
with docutils installed to feed to the script. (The latter is used to build and
install the documentation for Mercurial without polluting the python distro to
be packaged, so maybe we can use python3 there.)

The general flow is to download, build and install OpenSSL off to the side, and
then use that to download, build and install Python to a separate staging area.
The certifi package is bundled for the root certificates. I'm not an expert in
what OpenSSL compilation options should be used, so if there's a way to tighten
things up, let me know.

I don't like how the other packaging scripts assume an existing path on the
system, so this uses the build directory to stage the Python and OpenSSL builds.
The existing system python installer stages in build/mercurial, but this
builds Mercurial into the staged python directory. (That path includes version
info, so it shouldn't be much to add python3 support and build both at the same
time.) I also wasn't sure where to stash the downloads (they seem somewhat
useful to cache), so I stuffed them into the packages directory (which gets
clobbered by make clean).

To distinguish from the system python installer (and with an eye towards
python3), -py2.7 is added after the Mercurial version to the file name.
Altogether, this takes about 10 minutes to build on a 2018 Mac Mini.

There's additional followup work to do, in addition to the obvious py3 support-
the readme still mentions depending on system python, and this could probably be
driven by the makefile as a separate target. It should be trivial to sign the
binaries and installer, and slightly less trivial to notarize the *.pkg, but
definitely doable. The files in the final *.pkg can be listed like so:

pkgutil --payload-files dist/Mercurial-*.pkg

Looking at that, there's probably a bunch of junk that can be removed:

include/
distutils/tests/
lib-tk/test/
ctypes/test/,
unittest
test
lib2to3
idle
pydoc

I didn't see config options for that, and maybe it isn't worth it. The
installer ends up around 39MB.

Diff Detail

Repository

rHG Mercurial

Lint

Lint Skipped

Unit

Unit Tests Skipped

Event Timeline

mharbison72 created this revision.Sep 12 2019, 6:21 PM

Herald added a reviewer: hg-reviewers. · View Herald TranscriptSep 12 2019, 6:21 PM

Herald added a subscriber: mercurial-devel. · View Herald Transcript

This seems to work (though the shebang line hack is painful)- until the original python build directory is deleted. Then a lot of things complain about unsupported hash type for md5 and sha{1,224,256,384,512}. Other modules like json can be imported with the installed python executable. I grepped around for the build directory, and it is in a bunch of *.so files (though this could be __FILE__ for all I know). Any ideas?

In D6846#100478, @mharbison72 wrote:

This seems to work (though the shebang line hack is painful)- until the original python build directory is deleted. Then a lot of things complain about unsupported hash type for md5 and sha{1,224,256,384,512}. Other modules like json can be imported with the installed python executable. I grepped around for the build directory, and it is in a bunch of *.so files (though this could be __FILE__ for all I know). Any ideas?

So, the problem here is that openssl libraries are being built and installed with the temporary install path, and the _ssl.so module is expecting to find them there. I tried a custom Setup.local that statically links _ssl.so against openssl before configuring python, but the build summary said dependencies were missing to build _ssl (among other things). For some reason, the resulting build still seemed to be able to talk to https servers. help(_ssl) said it was builtin, whereas help(_ssl) on the original build mentioned openssl (IIRC).

The _ssl.so module in the thg app has @executable_path in the library name, so that's why that works. I also tried messing with @rpath, but I can't get that working either. I'm not sure what else to try.

mharbison72 mentioned this in D6958: hg: move hg script to be a template that gets filled in via make.Oct 4 2019, 3:29 PM

mharbison72 mentioned this in D6754: contrib: proof of concept script to build Mac packages without system python.Dec 28 2019, 12:55 PM

What's the latest with this diff ? It seems to still be a work in progress. Should it be in the "need-review" state?

In D6846#118733, @marmoute wrote:

What's the latest with this diff ? It seems to still be a work in progress. Should it be in the "need-review" state?

The hangup here is that the installed code seems to want to look in the path where it was built to load libraries. I have no idea why. It would be good if somebody figured out why, because I have a similar problem with the thg build on Mac. (But unlike here, that's not fatal because it falls back to a library inside the bundle.)

My thought with this was to be able to build an official py2 installer that worked on more than the very latest platform. But I also thought that we would hang on to py2 for awhile. If we're not, then this probably isn't worth pursuing, assuming PyOxidizer works out on OS X (so far, so good). I'm not so excited about dropping py2 because of the amount of work still needed on hg on Windows, thg on Windows and Mac, and the packaging on both. But 10.16 will remove all builtin python, so something will probably need to be done one way or the other by September or so.

are we talking about python library or compiled library ? Go you have any "empty" item in the various PATH used for the build ?

In D6846#119328, @marmoute wrote:

are we talking about python library or compiled library ? Go you have any "empty" item in the various PATH used for the build ?

See https://phab.mercurial-scm.org/D6846#100512.

I'm not sure what you mean about empty items. The build directory is out of the way, not on PATH. It's just that _ssl.so wants to load OpenSSL libraries from the path where they were built. It actually works fine after installing- until you do a make clean, which is how I noticed the problem.

Ha, ok.

macOS supports a @loader_path and related magic tokens in rpath to load libraries relative to the current binary. See e.g. https://blogs.oracle.com/dipol/dynamic-libraries,-rpath,-and-mac-os and https://medium.com/@donblas/fun-with-rpath-otool-and-install-name-tool-e3e41ae86172 for examples.

indygreg added inline comments.Feb 11 2020, 9:56 PM

contrib/packaging/hgpackaging/downloads.py
29	1.0.2u is out and should be used.
contrib/packaging/hgpackaging/python.py
54	Where did you get this line and `enable-cms` from?
120	I _think_ we also want `--enable-lto` for more speed wins.
contrib/packaging/macosx/build.py
170	`fp.truncate()`?

In D6846#120513, @indygreg wrote:

macOS supports a @loader_path and related magic tokens in rpath to load libraries relative to the current binary. See e.g. https://blogs.oracle.com/dipol/dynamic-libraries,-rpath,-and-mac-os and https://medium.com/@donblas/fun-with-rpath-otool-and-install-name-tool-e3e41ae86172 for examples.

I saw those, thanks. I guess what's confusing is I don't see RPATH being configured when building OpenSSL for the TortoiseHg build, nor do I see it being overwritten when running py2app. I also interpreted this to mean that is should be automatic on Mac, but I guess not:

https://wiki.openssl.org/index.php/Compilation_and_Installation#Using_RPATHs

contrib/packaging/hgpackaging/python.py
54	From the scripts used to build TortoiseHg on Mac, and the OpenSSL wiki: https://bitbucket.org/Weeds2000/tortoisehg-osx-build-scripts/src/e459bb439730d7e7e3a4b8c474f74aab164d6c9f/toolchain/receipts/openssl.sh#lines-41 https://wiki.openssl.org/index.php/Compilation_and_Installation#OS_X
contrib/packaging/macosx/build.py
170	The original shebang line was much longer, so after writing it out with the shorter one, I think this was meant to trim the file. too the proper content.

What's the status of this ? @mharbison72 id the linking problem got solved ?

In D6846#124054, @marmoute wrote:

What's the status of this ? @mharbison72 id the linking problem got solved ?

I've been too busy to get back to this, and probably won't for the short term, anyway.

It would probably also be a good to have a general idea when we drop py2 completely. I'd be content leaving py2 around for awhile for various reasons, but I don't want to sink a bunch of time into something that lasts for one release. (I think a PyOxidizer build would end up being a lot different looking than this.)

So as I understand this is not ready to land and should be moved to change-requested (or change planned), right ?

In D6846#126171, @marmoute wrote:

So as I understand this is not ready to land and should be moved to change-requested (or change planned), right ?

Yeah, I'll move this out of the way, and can abandon it when PyOxidizer builds are in place.

Revision Contents
Changeset List

		Path
M		contrib/packaging/hgpackaging/downloads.py (12 lines)
A	M	contrib/packaging/hgpackaging/python.py (143 lines)
A	M	contrib/packaging/macosx/build.py (195 lines)
A	M	contrib/packaging/macosx/requirements.txt (12 lines)
A	M	contrib/packaging/macosx/requirements.txt.in (2 lines)

Commit	Parents	Author	Summary	Date
		Matt Harbison		Sep 12 2019, 5:38 PM

Diff 16526

contrib/packaging/hgpackaging/downloads.py

	'sha256': '60b9ef26bc5cceef036f0424e542106cf158352b2677f43a01affd6d82a1d641',			'sha256': '60b9ef26bc5cceef036f0424e542106cf158352b2677f43a01affd6d82a1d641',
	'version': '0.14.4',			'version': '0.14.4',
	},			},
	'gettext-dep': {			'gettext-dep': {
	'url': 'https://versaweb.dl.sourceforge.net/project/gnuwin32/gettext/0.14.4/gettext-0.14.4-dep.zip',			'url': 'https://versaweb.dl.sourceforge.net/project/gnuwin32/gettext/0.14.4/gettext-0.14.4-dep.zip',
	'size': 715086,			'size': 715086,
	'sha256': '411f94974492fd2ecf52590cb05b1023530aec67e64154a88b1e4ebcd9c28588',			'sha256': '411f94974492fd2ecf52590cb05b1023530aec67e64154a88b1e4ebcd9c28588',
	},			},
				'openssl': {
				'url': 'https://www.openssl.org/source/openssl-1.0.2t.tar.gz',
				indygregUnsubmitted Not Done 1.0.2u is out and should be used. indygreg: 1.0.2u is out and should be used.
				'size': 5355422,
				'sha256': '14cb464efe7ac6b54799b34456bd69558a749a4931ecfd9cf9f71d7881cac7bc',
				'version': '1.0.2t',
				},
	'py2exe': {			'py2exe': {
	'url': 'https://versaweb.dl.sourceforge.net/project/py2exe/py2exe/0.6.9/py2exe-0.6.9.zip',			'url': 'https://versaweb.dl.sourceforge.net/project/py2exe/py2exe/0.6.9/py2exe-0.6.9.zip',
	'size': 149687,			'size': 149687,
	'sha256': '6bd383312e7d33eef2e43a5f236f9445e4f3e0f6b16333c6f183ed445c44ddbd',			'sha256': '6bd383312e7d33eef2e43a5f236f9445e4f3e0f6b16333c6f183ed445c44ddbd',
	'version': '0.6.9',			'version': '0.6.9',
	},			},
				'python27': {
				'url': 'https://www.python.org/ftp/python/2.7.16/Python-2.7.16.tgz',
				'size': 17431748,
				'sha256': '01da813a3600876f03f46db11cc5c408175e99f03af2ba942ef324389a83bad5',
				'version': '2.7.16',
				},
	# The VC9 CRT merge modules aren't readily available on most systems because			# The VC9 CRT merge modules aren't readily available on most systems because
	# they are only installed as part of a full Visual Studio 2008 install.			# they are only installed as part of a full Visual Studio 2008 install.
	# While we could potentially extract them from a Visual Studio 2008			# While we could potentially extract them from a Visual Studio 2008
	# installer, it is easier to just fetch them from a known URL.			# installer, it is easier to just fetch them from a known URL.
	'vc9-crt-x86-msm': {			'vc9-crt-x86-msm': {
	'url': 'https://github.com/indygreg/vc90-merge-modules/raw/9232f8f0b2135df619bf7946eaa176b4ac35ccff/Microsoft_VC90_CRT_x86.msm',			'url': 'https://github.com/indygreg/vc90-merge-modules/raw/9232f8f0b2135df619bf7946eaa176b4ac35ccff/Microsoft_VC90_CRT_x86.msm',
	'size': 615424,			'size': 615424,
	'sha256': '837e887ef31b332feb58156f429389de345cb94504228bb9a523c25a9dd3d75e',			'sha256': '837e887ef31b332feb58156f429389de345cb94504228bb9a523c25a9dd3d75e',

contrib/packaging/hgpackaging/python.py

This file was added.

				# python.py - Build a functional python interpreter.
				#
				# Copyright 2019 Matt Harbison <mharbison72@gmail.com>
				#
				# This software may be used and distributed according to the terms of the
				# GNU General Public License version 2 or any later version.

				# no-check-code because Python 3 native.

				import multiprocessing
				import os
				import pathlib
				import subprocess

				from .downloads import (
				download_entry,
				)
				from .util import (
				extract_tar_to_directory,
				)

				def _build_openssl(download_dir: pathlib.Path, build_dir: pathlib.Path,
				common_env: dict):
				"""Build and locally install OpenSSL, downloading the source first if
				necessary. The exact local installation path is returned.
				"""
				local_path, entry = download_entry('openssl', download_dir)
				version = entry["version"]

				# We only need the static library, so most of the installation will be
				# thrown away.
				openssl_dir = build_dir / ("openssl-" + version)
				distdir = openssl_dir / "dist"
				openssl_lib = distdir / "usr" / "lib" / "libcrypto.a"

				if openssl_lib.exists():
				print("OpenSSL %s is already built" % version)
				return distdir

				if not openssl_dir.exists():
				extract_tar_to_directory(local_path, build_dir)

				env = common_env

				subprocess.check_call(["/bin/sh",
				"./Configure",
				"--prefix=%s/usr" % distdir,
				"--openssldir=%s/etc/openssl" % distdir,
				"no-ssl2",
				"zlib-dynamic",
				"shared",
				"enable-cms",
				"darwin64-x86_64-cc",
				"enable-ec_nistp_64_gcc_128"],
				indygregUnsubmitted Not Done Where did you get this line and `enable-cms` from? indygreg: Where did you get this line and `enable-cms` from?
				mharbison72AuthorUnsubmitted Done From the scripts used to build TortoiseHg on Mac, and the OpenSSL wiki: https://bitbucket.org/Weeds2000/tortoisehg-osx-build-scripts/src/e459bb439730d7e7e3a4b8c474f74aab164d6c9f/toolchain/receipts/openssl.sh#lines-41 https://wiki.openssl.org/index.php/Compilation_and_Installation#OS_X mharbison72: From the scripts used to build TortoiseHg on Mac, and the OpenSSL wiki: https://bitbucket.
				env=env,
				cwd=str(openssl_dir))

				subprocess.check_call(["make", "depend"],
				env=env,
				cwd=openssl_dir)

				subprocess.check_call(["make", "-j%d" % multiprocessing.cpu_count()],
				env=env,
				cwd=openssl_dir)

				subprocess.check_call(["make", "install"],
				env=env,
				cwd=openssl_dir)

				return distdir

				def build(source_dir: pathlib.Path, build_dir: pathlib.Path,
				download_dir: pathlib.Path, common_env: dict):
				"""Build and locally install a python interpreter suitable for running
				Mercurial, including package dependencies.

				The installation will be placed under ``build_dir``, and the exact path and
				path to the python executabel is returned.

				``source_dir`` is the path to the root of the Mercurial repository being
				packaged. The environment variables provided can control the compiler and
				compiler options used, and must also be used to build Mercurial itself.
				"""

				local_path, entry = download_entry('python27', download_dir)
				version = entry["version"]
				short_version = version[:version.rindex(".")]

				prefix = pathlib.Path("usr/local/mercurial") # Should be absolute path
				python_dir = build_dir / ("Python-%s" % version)
				dest_dir = python_dir / "dist"
				python = dest_dir / prefix / "bin" / ("python%s" % short_version)

				if not python.exists():
				openssl_dist = _build_openssl(download_dir, build_dir, common_env)

				env = {
				"CFLAGS": (("-Os -pipe -fno-common -fno-strict-aliasing -fwrapv "
				"-DENABLE_DTRACE -DMACOSX -DNDEBUG "
				"-I{distdir}/usr/include "
				"-I{sdkroot}/usr/include")
				.format(distdir=openssl_dist,
				sdkroot=common_env["SDKROOT"])),
				"LDFLAGS": "-L{distdir}/usr/lib".format(distdir=openssl_dist),
				"DESTDIR": str(dest_dir) # python "installed" here
				}

				env.update(common_env)

				if not python_dir.exists():
				extract_tar_to_directory(local_path, build_dir)

				env.update(os.environ)

				subprocess.check_call(["./configure",
				"--prefix=/" + str(prefix),
				"--with-ensurepip",
				"--enable-ipv6",
				"--with-threads",
				"--enable-optimizations"],
				indygregUnsubmitted Not Done I _think_ we also want `--enable-lto` for more speed wins. indygreg: I _think_ we also want `--enable-lto` for more speed wins.
				env=env,
				cwd=str(python_dir))

				subprocess.check_call(["make", "-j%d" % multiprocessing.cpu_count()],
				env=env,
				cwd=str(python_dir))

				subprocess.check_call(["make", "altinstall"],
				env=env,
				cwd=str(python_dir))
				else:
				print("Python %s is already built" % version)
				env = common_env

				# Install/update python packages needed to build hg
				subprocess.check_call([str(python),
				"-m", "pip", "install",
				"--disable-pip-version-check",
				"-r", "contrib/packaging/macosx/requirements.txt"],
				env=env,
				cwd=str(source_dir))

				return python, dest_dir

contrib/packaging/macosx/build.py

This file was added.

Property	Old Value	New Value
File Mode	null	100755

				#!/usr/bin/env python3
				# build.py - MacOS installer build script.
				#
				# Copyright 2019 Matt Harbison <mharbison72@gmail.com>
				#
				# This software may be used and distributed according to the terms of the
				# GNU General Public License version 2 or any later version.

				# This script automates the building of the MacOS installer for Mercurial.

				# no-check-code because Python 3 native.

				import argparse
				import os
				import pathlib
				import subprocess
				import sys


				if __name__ == '__main__':
				parser = argparse.ArgumentParser()

				parser.add_argument('--python',
				required=True,
				help='path to python.exe to use')
				parser.add_argument('--version',
				help='Mercurial version string to use '
				'(detected from __version__.py if not defined')

				args = parser.parse_args()

				if not os.path.isabs(args.python):
				raise Exception('--python arg must be an absolute path')

				here = pathlib.Path(os.path.abspath(os.path.dirname(__file__)))
				source_dir = here.parent.parent.parent
				build_dir = source_dir / 'build'
				download_dir = source_dir / 'packages' / 'downloaded'

				os.makedirs(download_dir, exist_ok=True)

				sys.path.insert(0, str(source_dir / 'contrib' / 'packaging'))

				sdkroot = subprocess.check_output(["xcrun", "--show-sdk-path"])
				sdkroot = sdkroot.decode(sys.stdout.encoding).strip()

				common_env = {
				"CC": "clang",
				"CXX": "clang++",
				"DEVELOPER_DIR": "/Library/Developer/CommandLineTools",
				"MACOSX_DEPLOYMENT_TARGET": "10.9",
				"PATH": "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
				"SDKROOT": sdkroot,
				}

				from hgpackaging.python import build

				python, dest_dir = build(source_dir, build_dir, download_dir, common_env)

				subprocess.check_call([python,
				"setup.py", "install", "--optimize=1",
				"--root=%s" % dest_dir,
				"--prefix=/usr/local",
				"--install-lib=/usr/local/mercurial/lib/python2.7/site-packages"],
				cwd=str(source_dir),
				env=common_env)

				# Generate and stage docs using external python, so the newly built
				# interpreter isn't polluted with docutils junk.
				subprocess.check_call(["make",
				"PYTHON=%s" % args.python,
				"DESTDIR=%s" % dest_dir,
				"install-doc"],
				cwd=str(source_dir),
				env=common_env)

				# Install binaries into custom python.
				subprocess.check_call(["make",
				"PYTHON=%s" % python,
				"DESTDIR=%s" % dest_dir,
				"PREFIX=/usr/local/mercurial",
				"install-bin"],
				cwd=str(source_dir),
				env=common_env)

				# Place a bogon .DS_Store file in the target dir so we can be
				# sure it doesn't get included in the final package.
				with open(dest_dir / ".DS_Store", "w+"):
				pass

				# install zsh completions - this location appears to be
				# searched by default as of macOS Sierra.
				zsh_dest = dest_dir / "usr" / "local" / "share" / "zsh" / "site-functions"

				subprocess.check_call(["install", "-d", str(zsh_dest)],
				cwd=str(source_dir),
				env=common_env)

				subprocess.check_call(["install", "-m", "0644", "contrib/zsh_completion",
				str(zsh_dest / "_hg")],
				cwd=str(source_dir),
				env=common_env)

				# install bash completions - there doesn't appear to be a
				# place that's searched by default for bash, so we'll follow
				# the lead of Apple's git install and just put it in a
				# location of our own.
				bash_dest = dest_dir / "usr" / "local" / "hg" / "contrib"

				subprocess.check_call(["install", "-d", str(bash_dest)],
				cwd=str(source_dir),
				env=common_env)

				subprocess.check_call(["install", "-m", "0644", "contrib/bash_completion",
				str(bash_dest / "hg-completion.bash")],
				cwd=str(source_dir),
				env=common_env)

				subprocess.check_call(["make", "-C", "contrib/chg",
				"HGPATH=/usr/local/bin/hg",
				"PYTHON=%s/usr/local/mercurial/bin/python2.7"
				% dest_dir,
				"HGEXTDIR=/usr/local/mercurial/lib/python2.7/"
				"site-packages/hgext",
				"DESTDIR=%s" % dest_dir,
				"PREFIX=/usr/local",
				"clean", "install"],
				cwd=str(source_dir),
				env=common_env)

				# TODO: optionally sign all binaries here

				# TODO: consult $OUTPUTDIR?
				output_dir = source_dir / "dist"
				os.makedirs(output_dir, exist_ok=True)

				hgver = args.version

				if not hgver:
				# In case hg isn't installed on PATH yet. `hg debuginstall` exits 1 in
				# the local repo if bdiff wasn't built locally.
				common_env["PATH"] = (os.environ["PATH"] + ":"
				+ str(dest_dir / "usr" / "local" / "bin"))

				f = ("%s/usr/local/mercurial/lib/python2.7/site-packages/"
				"mercurial/__version__.py" % dest_dir)

				# TODO: Figure out how to pass off ${OSXVERSIONFLAGS}?
				hgver = subprocess.check_output([args.python,
				"contrib/genosxversion.py", f],
				cwd=str(source_dir),
				env=common_env)
				hgver = hgver.decode(sys.stdout.encoding).strip()

				# XXX: There doesn't seem to be a way to get the shebang line correct
				# without the python interpreter being in the correct location already.
				# Since genosxversion.py needs a working hg, that's not a bad thing. But
				# it needs to be replaced before packaging it. The flip side is that
				# when building the installer again, the hg script isn't replaced if
				# it wasn't modified in the source, which breaks the version script if hg
				# wasn't subsequently installed.
				hg = dest_dir / "usr" / "local" / "bin" / "hg"
				with hg.open("r") as fp:
				hgscript = fp.readlines()

				hgscript[0] = '#!/usr/local/mercurial/bin/python2.7\n'

				with hg.open("w") as fp:
				fp.writelines(hgscript)
				fp.truncate()
				indygregUnsubmitted Not Done `fp.truncate()`? indygreg: `fp.truncate()`?
				mharbison72AuthorUnsubmitted Done The original shebang line was much longer, so after writing it out with the shorter one, I think this was meant to trim the file. too the proper content. mharbison72: The original shebang line was much longer, so after writing it out with the shorter one, I…

				osxver = common_env["MACOSX_DEPLOYMENT_TARGET"]

				subprocess.check_call(["pkgbuild", "--filter", ".DS_Store",
				"--root", str(dest_dir),
				"--identifier", "org.mercurial-scm.mercurial",
				"--version", hgver,
				"build/mercurial.pkg"],
				cwd=str(source_dir),
				env=common_env)

				pkg = "%s/Mercurial-%s-py2.7-macosx%s.pkg" % (output_dir, hgver, osxver)
				subprocess.check_call(["productbuild",
				"--distribution",
				"contrib/packaging/macosx/distribution.xml",
				"--package-path", "build/",
				"--version", hgver,
				"--resources", "contrib/packaging/macosx/",
				pkg],
				cwd=str(source_dir),
				env=common_env)

				# TODO: optionally sign and notarize the *.pkg here

				print("Created %s" % pkg)

contrib/packaging/macosx/requirements.txt

This file was added.

				#
				# This file is autogenerated by pip-compile
				# To update, run:
				#
				# pip-compile --generate-hashes --output-file=contrib/packaging/macosx/requirements.txt contrib/packaging/macosx/requirements.txt.in
				#
				certifi==2019.6.16 \
				--hash=sha256:046832c04d4e752f37383b628bc601a7ea7211496b4638f6514d0e5b9acc4939 \
				--hash=sha256:945e3ba63a0b9f577b1395204e13c3a231f9bc0223888be653286534e5873695
				pygments==2.4.2 \
				--hash=sha256:71e430bc85c88a430f000ac1d9b331d2407f681d6f6aec95e8bcfbc3df5b0127 \
				--hash=sha256:881c4c157e45f30af185c1ffe8d549d48ac9127433f2c380c24b84572ad66297

contrib/packaging/macosx/requirements.txt.in

This file was added.

				certifi
				pygments