mirror of
https://github.com/TelegramMessenger/Telegram-iOS.git
synced 2026-07-06 03:33:41 +02:00
Embed xcodebuild-built tgwatch app into the Bazel Telegram IPA
Add the apple_prebuilt_watchos_application rule (prebuilt_watchos.bzl + its worker) that runs xcodebuild on the watch app, codesigns the .app and nested framework, and feeds it to the Telegram ios_application's watch_application slot, gated on //Telegram:embedWatchApp. Make.py gains device-gated watch embed flags (--watchApiId/--watchApiHash/--watchSigningIdentity/ --watchProvisioningProfile), and the embedded app's version is matched to the host (versions.json + buildNumber). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
isaac
parent
675252724f
commit
64c9e72fad
4 changed files with 318 additions and 1 deletions
|
|
@ -35,6 +35,10 @@ load(
|
|||
|
||||
load("@build_bazel_rules_apple//apple:apple.bzl", "local_provisioning_profile")
|
||||
|
||||
load("//Telegram:prebuilt_watchos.bzl",
|
||||
"apple_prebuilt_watchos_application",
|
||||
)
|
||||
|
||||
load("//build-system/bazel-utils:plist_fragment.bzl",
|
||||
"plist_fragment",
|
||||
)
|
||||
|
|
@ -97,6 +101,19 @@ config_setting(
|
|||
},
|
||||
)
|
||||
|
||||
bool_flag(
|
||||
name = "embedWatchApp",
|
||||
build_setting_default = False,
|
||||
visibility = ["//visibility:public"],
|
||||
)
|
||||
|
||||
config_setting(
|
||||
name = "embedWatchAppSetting",
|
||||
flag_values = {
|
||||
":embedWatchApp": "True",
|
||||
},
|
||||
)
|
||||
|
||||
config_setting(
|
||||
name = "projectIncludeReleaseSetting",
|
||||
flag_values = {
|
||||
|
|
@ -1724,6 +1741,11 @@ xcode_provisioning_profile(
|
|||
provisioning_profile = ":Telegram_local_profile",
|
||||
)
|
||||
|
||||
apple_prebuilt_watchos_application(
|
||||
name = "TelegramWatchApp",
|
||||
tags = ["manual"],
|
||||
)
|
||||
|
||||
ios_application(
|
||||
name = "Telegram",
|
||||
bundle_id = "{telegram_bundle_id}".format(
|
||||
|
|
@ -1772,6 +1794,14 @@ ios_application(
|
|||
":BroadcastUploadExtension",
|
||||
],
|
||||
}),
|
||||
# Embed the xcodebuild-built tgwatch watch app under Watch/ only when
|
||||
# --//Telegram:embedWatchApp is set (Make.py sets it for device configs when
|
||||
# --watchAppSourcePath is provided). Off by default, so simulator/dev builds
|
||||
# are unaffected.
|
||||
watch_application = select({
|
||||
":embedWatchAppSetting": ":TelegramWatchApp",
|
||||
"//conditions:default": None,
|
||||
}),
|
||||
deps = [
|
||||
":Main",
|
||||
":Lib",
|
||||
|
|
|
|||
127
Telegram/prebuilt_watchos.bzl
Normal file
127
Telegram/prebuilt_watchos.bzl
Normal file
|
|
@ -0,0 +1,127 @@
|
|||
"""Embeds the standalone, xcodebuild-built tgwatch watch app into the Bazel iOS build.
|
||||
|
||||
`apple_prebuilt_watchos_application` runs `xcodebuild` (via prebuilt_watchos_build.sh)
|
||||
against an exported tgwatch source tree, optionally codesigns the result, and exposes
|
||||
it through the providers that `ios_application(watch_application = ...)` consumes:
|
||||
|
||||
* AppleBundleInfo — bundle metadata (the host reads only `.product_type`).
|
||||
* AppleEmbeddableInfo — `watch_bundles` (the zipped .app placed under Watch/).
|
||||
|
||||
The watch source tree lives at an external, machine-specific absolute path passed via
|
||||
`--define=watchAppSourcePath=...`; the build action is therefore local/uncached.
|
||||
|
||||
Notes on the rules_apple providers used here:
|
||||
* AppleBundleInfo's public init is banned; we build it with the internal raw
|
||||
initializer `new_applebundleinfo` (rules_apple is vendored + pinned in this repo,
|
||||
so depending on the internal label is safe).
|
||||
"""
|
||||
|
||||
load(
|
||||
"@build_bazel_rules_apple//apple/internal:providers.bzl",
|
||||
"new_applebundleinfo",
|
||||
"new_watchosapplicationbundleinfo",
|
||||
)
|
||||
load("@build_bazel_rules_apple//apple/internal/providers:embeddable_info.bzl", "AppleEmbeddableInfo")
|
||||
|
||||
def _apple_prebuilt_watchos_application_impl(ctx):
|
||||
source_path = ctx.var.get("watchAppSourcePath", "")
|
||||
if not source_path:
|
||||
fail("apple_prebuilt_watchos_application requires --define=watchAppSourcePath=<abs path to exported tgwatch sources>")
|
||||
api_id = ctx.var.get("watchApiId", "0")
|
||||
api_hash = ctx.var.get("watchApiHash", "placeholder")
|
||||
identity = ctx.var.get("watchSigningIdentity", "")
|
||||
|
||||
# The provisioning profile is an external, machine-specific absolute path
|
||||
# (like watchAppSourcePath), passed via --define rather than a Bazel label so
|
||||
# the gitignored profile need not be exposed as a target. The local action
|
||||
# reads it directly. Empty => unsigned build.
|
||||
profile = ctx.var.get("watchProvisioningProfile", "")
|
||||
# The embedded watch app's CFBundleShortVersionString / CFBundleVersion must match
|
||||
# the host app, or rules_apple's child-version verification fails. Source the
|
||||
# marketing version from versions.json (same as the host's VersionInfoPlist) and the
|
||||
# build version from buildNumber (Make.py always emits --define=buildNumber).
|
||||
build_number = ctx.var.get("buildNumber", "1")
|
||||
archive = ctx.actions.declare_file(ctx.label.name + ".zip")
|
||||
# The host ios_application reads the watch app's Info.plist (via AppleBundleInfo.infoplist)
|
||||
# to verify WKCompanionAppBundleIdentifier against the host bundle id, so expose it as a
|
||||
# separate output (resources.bzl bundle_verification crashes on a None infoplist).
|
||||
infoplist = ctx.actions.declare_file(ctx.label.name + "_Info.plist")
|
||||
|
||||
ctx.actions.run(
|
||||
executable = "/bin/bash",
|
||||
arguments = [
|
||||
ctx.file._worker.path,
|
||||
source_path,
|
||||
archive.path,
|
||||
api_id,
|
||||
api_hash,
|
||||
identity,
|
||||
profile,
|
||||
infoplist.path,
|
||||
ctx.file.versions_json.path,
|
||||
build_number,
|
||||
],
|
||||
inputs = [ctx.file._worker, ctx.file.versions_json],
|
||||
outputs = [archive, infoplist],
|
||||
mnemonic = "PrebuiltWatchosBuild",
|
||||
progress_message = "Building%s watch app via xcodebuild" % (" + signing" if identity else ""),
|
||||
# The watch source tree is an external absolute path, not a tracked input,
|
||||
# so the action cannot be cached or sandboxed and may fetch SwiftPM deps.
|
||||
execution_requirements = {
|
||||
"no-cache": "1",
|
||||
"no-sandbox": "1",
|
||||
"no-remote": "1",
|
||||
"local": "1",
|
||||
"requires-network": "1",
|
||||
},
|
||||
use_default_shell_env = True,
|
||||
)
|
||||
|
||||
return [
|
||||
DefaultInfo(files = depset([archive])),
|
||||
new_applebundleinfo(
|
||||
archive = archive,
|
||||
bundle_id = ctx.attr.bundle_id,
|
||||
bundle_name = ctx.attr.bundle_name,
|
||||
bundle_extension = ".app",
|
||||
platform_type = "watchos",
|
||||
# Must be a single-target watchOS app (NOT watch2_application) so the host
|
||||
# skips the watchos_stub partial (see ios_rules.bzl product_type check).
|
||||
product_type = "com.apple.product-type.application",
|
||||
minimum_os_version = ctx.attr.minimum_os_version,
|
||||
minimum_deployment_os_version = ctx.attr.minimum_os_version,
|
||||
infoplist = infoplist,
|
||||
binary = None,
|
||||
entitlements = None,
|
||||
# Best-effort constant; the host ios_application reads only product_type.
|
||||
uses_swift = True,
|
||||
extension_safe = False,
|
||||
),
|
||||
# Marker provider required by ios_application's watch_application attr
|
||||
# (providers = [[AppleBundleInfo, WatchosApplicationBundleInfo]]).
|
||||
new_watchosapplicationbundleinfo(),
|
||||
AppleEmbeddableInfo(
|
||||
# The signed (or unsigned) .app archive, expanded into the host's Watch/ section.
|
||||
watch_bundles = depset([archive]),
|
||||
# Empty: the worker signs everything inside the watch app itself.
|
||||
signed_frameworks = depset(),
|
||||
),
|
||||
]
|
||||
|
||||
apple_prebuilt_watchos_application = rule(
|
||||
implementation = _apple_prebuilt_watchos_application_impl,
|
||||
attrs = {
|
||||
"bundle_id": attr.string(default = "ph.telegra.Telegraph.watchkitapp"),
|
||||
"bundle_name": attr.string(default = "tgwatch Watch App"),
|
||||
"minimum_os_version": attr.string(default = "26.0"),
|
||||
"versions_json": attr.label(
|
||||
allow_single_file = True,
|
||||
default = "//:versions.json",
|
||||
doc = "Source of the marketing version (key 'app'), kept in sync with the host app.",
|
||||
),
|
||||
"_worker": attr.label(
|
||||
default = "//Telegram:prebuilt_watchos_build.sh",
|
||||
allow_single_file = True,
|
||||
),
|
||||
},
|
||||
)
|
||||
90
Telegram/prebuilt_watchos_build.sh
Normal file
90
Telegram/prebuilt_watchos_build.sh
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
#!/usr/bin/env bash
|
||||
# Worker for the apple_prebuilt_watchos_application Bazel rule.
|
||||
#
|
||||
# Builds the tgwatch watch app via xcodebuild (device, Release, UNSIGNED), then
|
||||
# — if a signing identity is supplied — codesigns the app and its nested
|
||||
# frameworks with the Telegram distribution/development identity + the watchkitapp
|
||||
# provisioning profile, and finally zips the .app into the rule's output archive.
|
||||
#
|
||||
# The host ios_application embeds this archive under Watch/ and re-seals the host;
|
||||
# it does NOT re-sign the watch app, so the watch signing must happen here.
|
||||
#
|
||||
# Args:
|
||||
# $1 source_path Absolute path to the exported tgwatch source tree (contains tgwatch.xcodeproj)
|
||||
# $2 output_zip Path (declared by Bazel) to write the .app archive to
|
||||
# $3 api_id TG_API_ID build setting
|
||||
# $4 api_hash TG_API_HASH build setting
|
||||
# $5 identity Codesigning identity (SHA1 hash); empty => unsigned build
|
||||
# $6 profile Path to the watchkitapp .mobileprovision; empty => none
|
||||
set -euo pipefail
|
||||
|
||||
SRC="$1"; OUT_ZIP="$2"; API_ID="$3"; API_HASH="$4"; IDENTITY="${5:-}"; PROFILE="${6:-}"; INFOPLIST_OUT="${7:-}"; VERSIONS_JSON="${8:-}"; BUILD_NUMBER="${9:-1}"
|
||||
|
||||
if [ ! -e "$SRC/tgwatch.xcodeproj" ]; then
|
||||
echo "error: no tgwatch.xcodeproj at watchAppSourcePath=$SRC (run tools/export-sources.sh first)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Match the host app's version (rules_apple requires the embedded watch app's
|
||||
# CFBundleShortVersionString/CFBundleVersion to equal the parent's).
|
||||
MARKETING_VERSION="0.1"
|
||||
if [ -n "$VERSIONS_JSON" ]; then
|
||||
MARKETING_VERSION="$(python3 -c "import json,sys; print(json.load(open(sys.argv[1]))['app'])" "$VERSIONS_JSON")"
|
||||
fi
|
||||
|
||||
DD="$(mktemp -d)"
|
||||
trap 'rm -rf "$DD"' EXIT
|
||||
|
||||
xcodebuild \
|
||||
-project "$SRC/tgwatch.xcodeproj" \
|
||||
-scheme "tgwatch Watch App" \
|
||||
-configuration Release \
|
||||
-destination 'generic/platform=watchOS' \
|
||||
-derivedDataPath "$DD" \
|
||||
-quiet \
|
||||
CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO CODE_SIGN_IDENTITY="" \
|
||||
TG_API_ID="$API_ID" TG_API_HASH="$API_HASH" \
|
||||
MARKETING_VERSION="$MARKETING_VERSION" CURRENT_PROJECT_VERSION="$BUILD_NUMBER" \
|
||||
build 1>&2
|
||||
|
||||
APP="$(find "$DD/Build/Products" -maxdepth 2 -name 'tgwatch Watch App.app' -type d | head -1)"
|
||||
if [ -z "$APP" ]; then
|
||||
echo "error: built watch .app not found under $DD/Build/Products" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Expose the watch app's Info.plist (the host reads it to verify the companion
|
||||
# bundle-id linkage). Codesigning does not alter Info.plist content, so capture it now.
|
||||
if [ -n "$INFOPLIST_OUT" ]; then
|
||||
cp "$APP/Info.plist" "$INFOPLIST_OUT"
|
||||
fi
|
||||
|
||||
if [ -n "$IDENTITY" ]; then
|
||||
if [ -z "$PROFILE" ]; then
|
||||
echo "error: a signing identity was given but no provisioning profile (set --define=watchProvisioningProfile=<abs path>)" >&2
|
||||
exit 1
|
||||
fi
|
||||
cp "$PROFILE" "$APP/embedded.mobileprovision"
|
||||
ENT="$(mktemp)"
|
||||
trap 'rm -rf "$DD" "$ENT" "$ENT.plist"' EXIT
|
||||
security cms -D -i "$APP/embedded.mobileprovision" > "$ENT.plist"
|
||||
if ! /usr/libexec/PlistBuddy -x -c 'Print :Entitlements' "$ENT.plist" > "$ENT" 2>/dev/null; then
|
||||
echo "error: provisioning profile has no Entitlements key: $PROFILE" >&2
|
||||
exit 1
|
||||
fi
|
||||
# Sign inside-out: nested frameworks first, then the app bundle.
|
||||
if [ -d "$APP/Frameworks" ]; then
|
||||
for fw in "$APP/Frameworks/"*; do
|
||||
[ -e "$fw" ] || continue
|
||||
codesign --force --timestamp=none --sign "$IDENTITY" "$fw" 1>&2
|
||||
done
|
||||
fi
|
||||
codesign --force --timestamp=none --sign "$IDENTITY" --entitlements "$ENT" "$APP" 1>&2
|
||||
codesign --verify --deep --strict "$APP" 1>&2
|
||||
fi
|
||||
|
||||
# $OUT_ZIP is execroot-relative; the action's cwd is the execroot, so do NOT cd
|
||||
# (that would resolve $OUT_ZIP against the DerivedData dir). --keepParent makes the
|
||||
# archive root the .app itself even when $APP is an absolute path.
|
||||
rm -f "$OUT_ZIP"
|
||||
/usr/bin/ditto -c -k --keepParent "$APP" "$OUT_ZIP"
|
||||
Loading…
Add table
Add a link
Reference in a new issue