codemagic.yaml

workflows:

  # ── macOS Apple Silicon (arm64) — native M2 build ───────────────────────
  macos-arm64:
    name: macOS arm64 — interchainedd + nedb-ffi
    instance_type: mac_mini_m2
    max_build_duration: 90

    triggering:
      events:
        - tag
        - push
      branch_patterns:
        - pattern: 'main'
          include: true
      tag_patterns:
        - pattern: 'v*'
          include: true

    environment:
      groups:
        - itcd_signing        # CM_CERTIFICATE + CM_CERTIFICATE_PASSWORD
      vars:
        ARTIFACT_DIR: out

    scripts:
      - name: Initialize git submodules
        # ITC has secp256k1 + univalue as git submodules — required for build
        script: git submodule update --init --recursive

      - name: Install build deps (Homebrew)
        script: |
          brew update
          brew install autoconf automake libtool pkg-config \
            boost libevent miniupnpc zeromq sqlite

      - name: Install Rust (stable)
        script: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --profile minimal
          source "$HOME/.cargo/env"
          rustup default stable

      - name: Build NEDB FFI — Rust staticlib (lto=false for ELF extraction)
        script: |
          source "$HOME/.cargo/env"
          # Patch lto=true → lto=false so ar x produces native Mach-O objects
          sed -i '' 's/^lto[[:space:]]*=.*/lto = false/' nedb-ffi/Cargo.toml
          grep -E '^(lto|opt-level|codegen-units)' nedb-ffi/Cargo.toml
          cd nedb-ffi
          RUSTFLAGS="-C embed-bitcode=no" cargo rustc --release --crate-type=staticlib
          echo "libnedb_ffi.a (arm64): $(du -sh target/release/libnedb_ffi.a | cut -f1)"
          SYMS=$(nm target/release/libnedb_ffi.a 2>/dev/null | grep -c ' T _nedb_' || echo 0)
          echo "nedb_* T-symbols: $SYMS"
          [ "$SYMS" -gt 0 ] || { echo "ERROR: no nedb_* T symbols"; exit 1; }

      - name: Build Berkeley DB 4.8 from source
        script: |
          set -euo pipefail
          J=$(sysctl -n hw.logicalcpu || echo 4)
          BDB_PREFIX="$CM_BUILD_DIR/db4"
          rm -rf "$BDB_PREFIX" /tmp/bdb-src
          mkdir -p "$BDB_PREFIX"

          git clone --depth=1 https://github.com/observerdev/db-4.8.30.git /tmp/bdb-src

          # Patch all BDB sources for modern Apple Clang atomics (same as x86_64 step)
          find /tmp/bdb-src -type f \( \
            -name '*.h' -o -name '*.c' -o -name '*.cc' -o -name '*.cpp' \
          \) -print0 | xargs -0 perl -pi -e \
            's/\b__atomic_compare_exchange\b/__db_atomic_compare_exchange/g;
             s/\batomic_init\s*\(/db_atomic_init(/g;'

          cd /tmp/bdb-src/build_unix

          # --enable-posixmutexes / --with-mutex=POSIX/pthreads/library: required on
          # modern macOS (26+) where BDB 4.8's mutex auto-detection fails.
          CFLAGS="-O2 -fPIC" CXXFLAGS="-O2 -fPIC" \
          ../dist/configure \
            --prefix="$BDB_PREFIX" \
            --enable-cxx \
            --disable-shared \
            --with-pic \
            --enable-posixmutexes \
            --with-mutex=POSIX/pthreads/library \
          || { cat config.log; exit 1; }

          make -j"$J"
          make install

          # Force-stage headers if make install missed them
          mkdir -p "$BDB_PREFIX/include"
          for header in db.h db_cxx.h; do
            if [ ! -f "$BDB_PREFIX/include/$header" ]; then
              cp "/tmp/bdb-src/build_unix/$header" "$BDB_PREFIX/include/$header" 2>/dev/null \
                || cp "/tmp/bdb-src/$header" "$BDB_PREFIX/include/$header"
            fi
          done

          # Normalize lib names
          mkdir -p "$BDB_PREFIX/lib"
          [ -f "$BDB_PREFIX/lib/libdb_cxx.a" ] && \
            ln -sf "$BDB_PREFIX/lib/libdb_cxx.a" "$BDB_PREFIX/lib/libdb_cxx-4.8.a" || true
          [ -f "$BDB_PREFIX/lib/libdb.a" ] && \
            ln -sf "$BDB_PREFIX/lib/libdb.a" "$BDB_PREFIX/lib/libdb-4.8.a" || true

          echo "BDB staged at $BDB_PREFIX"
          ls -lah "$BDB_PREFIX/include/db"*.h "$BDB_PREFIX/lib/libdb"*.a 2>/dev/null || true

      - name: Configure & Build interchainedd (arm64)
        script: |
          source "$HOME/.cargo/env"
          J=$(sysctl -n hw.logicalcpu || echo 4)
          ./autogen.sh
          export CPATH="$CM_BUILD_DIR/db4/include:${CPATH:-}"
          export CPPFLAGS="-I$CM_BUILD_DIR/db4/include"
          export LDFLAGS="-L$CM_BUILD_DIR/db4/lib"
          export CFLAGS="-O2"
          export CXXFLAGS="-O2 -std=c++14"
          export BDB_LIBS="$CM_BUILD_DIR/db4/lib/libdb_cxx-4.8.a $CM_BUILD_DIR/db4/lib/libdb-4.8.a -pthread"
          ./configure \
            --enable-wallet --with-incompatible-bdb --without-gui \
            --disable-bench --disable-tests --with-zmq --with-miniupnpc \
            || { cat config.log; exit 1; }
          # -force_load is macOS equivalent of --whole-archive (bypasses single-pass ordering)
          NEDB_LIB="$(pwd)/nedb-ffi/target/release/libnedb_ffi.a"
          echo "LIBS += -Wl,-force_load,${NEDB_LIB} -lpthread" >> src/Makefile
          make -j"$J"
          test -f src/interchainedd && file src/interchainedd

      - name: Sign & Notarize interchainedd arm64 (Developer ID — Interchained LLC)
        script: |
          if [ -z "${CM_CERTIFICATE:-}" ]; then
            echo "⚠️  CM_CERTIFICATE not set — skipping signing"
            exit 0
          fi
          echo "$CM_CERTIFICATE" | base64 --decode > /tmp/developer_id.p12
          security create-keychain -p "" build.keychain 2>/dev/null || true
          security default-keychain -s build.keychain
          security unlock-keychain -p "" build.keychain
          security import /tmp/developer_id.p12 \
            -k build.keychain \
            -P "${CM_CERTIFICATE_PASSWORD:-}" \
            -T /usr/bin/codesign \
            -T /usr/bin/security
          security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain
          rm -f /tmp/developer_id.p12

          SIGN_ID=$(security find-identity -v -p codesigning build.keychain \
            | grep "Developer ID Application" | head -1 | awk '{print $2}')
          if [ -z "$SIGN_ID" ]; then
            echo "⚠️  No Developer ID Application cert found after import — skipping"
            exit 0
          fi
          echo "Signing with: $SIGN_ID"

          codesign --sign "$SIGN_ID" \
                   --options runtime \
                   --timestamp \
                   --force \
                   src/interchainedd src/interchained-cli
          codesign --verify --verbose src/interchainedd
          spctl --assess --type exec --verbose src/interchainedd 2>&1 || true

          if [ -n "${APP_STORE_CONNECT_PRIVATE_KEY:-}" ]; then
            echo "$APP_STORE_CONNECT_PRIVATE_KEY" > /tmp/asc_key.p8
            zip -j /tmp/interchainedd_notarize.zip src/interchainedd
            xcrun notarytool submit /tmp/interchainedd_notarize.zip \
              --key /tmp/asc_key.p8 \
              --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
              --issuer "$APP_STORE_CONNECT_ISSUER_ID" \
              --wait
            xcrun stapler staple src/interchainedd
            rm -f /tmp/asc_key.p8 /tmp/interchainedd_notarize.zip
            echo "✅ Notarized and stapled"
          else
            echo "ℹ️  Notarization skipped (APP_STORE_CONNECT_PRIVATE_KEY not set)"
          fi

      - name: Package arm64 binary
        script: |
          J_TAG="${FCI_TAG:-${CM_COMMIT:0:8}}"
          mkdir -p "$ARTIFACT_DIR"
          cp src/interchainedd src/interchained-cli "$ARTIFACT_DIR"/
          strip "$ARTIFACT_DIR/interchainedd" "$ARTIFACT_DIR/interchained-cli" 2>/dev/null || true
          [ -f README.md ] && cp README.md "$ARTIFACT_DIR"/ || true
          shasum -a 256 "$ARTIFACT_DIR"/* > "$ARTIFACT_DIR/SHA256SUMS"
          tar -C "$ARTIFACT_DIR" -czf "interchained-macos-arm64-${J_TAG}.tar.gz" .
          echo "Binary: $(du -sh $ARTIFACT_DIR/interchainedd)"

    artifacts:
      - interchained-macos-arm64-*.tar.gz
      - nedb-ffi/target/release/libnedb_ffi.a

  # ── macOS Intel x86_64 (via Rosetta 2 on M2 runner) ─────────────────────
  # For iMac Intel / MacBook Pro Intel. Uses arch -x86_64 (Rosetta) so
  # configure test compilations work correctly without a native Intel runner.
  macos-x86_64:
    name: macOS x86_64 Intel — interchainedd (for iMac)
    instance_type: mac_mini_m2
    max_build_duration: 120

    triggering:
      events:
        - tag
        - push
      branch_patterns:
        - pattern: 'main'
          include: true
      tag_patterns:
        - pattern: 'v*'
          include: true

    environment:
      groups:
        - itcd_signing        # CM_CERTIFICATE + CM_CERTIFICATE_PASSWORD
      vars:
        ARTIFACT_DIR: out

    scripts:
      - name: Initialize git submodules
        script: git submodule update --init --recursive

      - name: Install build deps (x86_64 Homebrew via Rosetta)
        # Homebrew on Apple Silicon installs to /opt/homebrew.
        # For x86_64 builds we use the Rosetta-compatible path /usr/local.
        # Pin boost@1.85: modern Boost (1.89+) removed libboost_system stub lib,
        # but the old Bitcoin autoconf macro requires a physical libboost_system.
        script: |
          arch -x86_64 /bin/bash -c "
            /bin/bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\" 2>/dev/null || true
            /usr/local/bin/brew update
            /usr/local/bin/brew install autoconf automake libtool pkg-config \
              boost@1.85 libevent miniupnpc zeromq sqlite
          "
          echo 'export PATH="/usr/local/bin:$PATH"' >> "$HOME/.profile"

      - name: Install Rust + x86_64-apple-darwin target
        script: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --profile minimal
          source "$HOME/.cargo/env"
          rustup default stable
          rustup target add x86_64-apple-darwin

      - name: Build NEDB FFI (x86_64-apple-darwin cross-compile)
        script: |
          source "$HOME/.cargo/env"
          sed -i '' 's/^lto[[:space:]]*=.*/lto = false/' nedb-ffi/Cargo.toml
          cd nedb-ffi
          RUSTFLAGS="-C embed-bitcode=no" \
            cargo rustc --release --crate-type=staticlib \
            --target x86_64-apple-darwin
          echo "libnedb_ffi.a (x86_64): $(du -sh target/x86_64-apple-darwin/release/libnedb_ffi.a | cut -f1)"
          SYMS=$(nm target/x86_64-apple-darwin/release/libnedb_ffi.a 2>/dev/null | grep -c ' T _nedb_' || echo 0)
          echo "nedb_* T-symbols: $SYMS"
          [ "$SYMS" -gt 0 ] || { echo "ERROR: no nedb_* T symbols"; exit 1; }

      - name: Build Berkeley DB 4.8 (x86_64 via Rosetta)
        script: |
          set -euo pipefail

          J=$(sysctl -n hw.logicalcpu || echo 4)
          BDB_PREFIX="$CM_BUILD_DIR/db4"

          echo "BDB_PREFIX=$BDB_PREFIX"

          rm -rf "$BDB_PREFIX" /tmp/bdb-src
          mkdir -p "$BDB_PREFIX"

          git clone --depth=1 https://github.com/observerdev/db-4.8.30.git /tmp/bdb-src

          # Patch all BDB sources for modern Apple Clang atomics
          find /tmp/bdb-src -type f \( \
            -name '*.h' -o -name '*.c' -o -name '*.cc' -o -name '*.cpp' \
          \) -print0 | xargs -0 perl -pi -e \
            's/\b__atomic_compare_exchange\b/__db_atomic_compare_exchange/g;
             s/\batomic_init\s*\(/db_atomic_init(/g;'

          cd /tmp/bdb-src/build_unix

          arch -x86_64 env \
            CC="clang -arch x86_64" \
            CXX="clang++ -arch x86_64" \
            CFLAGS="-O2 -fPIC -arch x86_64" \
            CXXFLAGS="-O2 -fPIC -arch x86_64" \
            ../dist/configure \
              --prefix="$BDB_PREFIX" \
              --enable-cxx \
              --disable-shared \
              --with-pic \
              --enable-posixmutexes \
              --with-mutex=POSIX/pthreads/library \
            || { cat config.log; exit 1; }

          arch -x86_64 make -j"$J"
          arch -x86_64 make install

          # Force-stage headers if make install missed them
          mkdir -p "$BDB_PREFIX/include"
          for header in db.h db_cxx.h; do
            if [ ! -f "$BDB_PREFIX/include/$header" ]; then
              cp "/tmp/bdb-src/build_unix/$header" "$BDB_PREFIX/include/$header" 2>/dev/null \
                || cp "/tmp/bdb-src/$header" "$BDB_PREFIX/include/$header"
            fi
          done

          # Add include alias so configure can find <db/db_cxx.h> if needed
          mkdir -p "$BDB_PREFIX/include/db"
          ln -sf ../db.h    "$BDB_PREFIX/include/db/db.h"
          ln -sf ../db_cxx.h "$BDB_PREFIX/include/db/db_cxx.h"

          # Normalize static library names
          mkdir -p "$BDB_PREFIX/lib"
          [ -f "$BDB_PREFIX/lib/libdb_cxx.a" ] && \
            ln -sf "$BDB_PREFIX/lib/libdb_cxx.a" "$BDB_PREFIX/lib/libdb_cxx-4.8.a" || true
          [ -f "$BDB_PREFIX/lib/libdb.a" ] && \
            ln -sf "$BDB_PREFIX/lib/libdb.a" "$BDB_PREFIX/lib/libdb-4.8.a" || true

          echo "BDB staged files:"
          find "$BDB_PREFIX" -maxdepth 4 \( -type f -o -type l \) | sort

          test -f "$BDB_PREFIX/include/db_cxx.h" || {
            echo "ERROR: missing $BDB_PREFIX/include/db_cxx.h"; exit 1; }
          test -f "$BDB_PREFIX/lib/libdb_cxx-4.8.a" || {
            echo "ERROR: missing $BDB_PREFIX/lib/libdb_cxx-4.8.a"; exit 1; }
          test -f "$BDB_PREFIX/lib/libdb-4.8.a" || {
            echo "ERROR: missing $BDB_PREFIX/lib/libdb-4.8.a"; exit 1; }

          lipo -info "$BDB_PREFIX/lib/libdb_cxx-4.8.a" || true
          lipo -info "$BDB_PREFIX/lib/libdb-4.8.a" || true

      - name: Configure & Build interchainedd (x86_64 via Rosetta)
        script: |
          set -euo pipefail

          source "$HOME/.cargo/env"

          J=$(sysctl -n hw.logicalcpu || echo 4)
          BDB_PREFIX="$CM_BUILD_DIR/db4"
          BOOST_PREFIX="$(arch -x86_64 /usr/local/bin/brew --prefix boost@1.85)"

          export PATH="/usr/local/bin:$PATH"
          export PKG_CONFIG_PATH="/usr/local/opt/sqlite/lib/pkgconfig:/usr/local/lib/pkgconfig:/usr/local/opt/openssl@3/lib/pkgconfig:${PKG_CONFIG_PATH:-}"

          echo "BDB_PREFIX=$BDB_PREFIX"
          echo "BOOST_PREFIX=$BOOST_PREFIX"

          echo "--- Preflight BDB ---"
          find "$BDB_PREFIX" -maxdepth 4 \( -type f -o -type l \) | sort

          test -f "$BDB_PREFIX/include/db_cxx.h"
          test -f "$BDB_PREFIX/lib/libdb_cxx-4.8.a"
          test -f "$BDB_PREFIX/lib/libdb-4.8.a"

          echo "--- Preflight Boost ---"
          ls -lah "$BOOST_PREFIX/lib" | grep boost_system || {
            echo "ERROR: boost@1.85 missing libboost_system"
            ls -lah "$BOOST_PREFIX/lib" | head -50
            exit 1
          }

          arch -x86_64 ./autogen.sh

          arch -x86_64 env \
            CC="clang -arch x86_64" \
            CXX="clang++ -arch x86_64" \
            CPPFLAGS="-I$BDB_PREFIX/include -I$BOOST_PREFIX/include -I/usr/local/include" \
            LDFLAGS="-arch x86_64 -L$BDB_PREFIX/lib -L$BOOST_PREFIX/lib -L/usr/local/lib -Wl,-search_paths_first" \
            CFLAGS="-O2 -arch x86_64" \
            CXXFLAGS="-O2 -std=c++14 -arch x86_64" \
            BDB_CFLAGS="-I$BDB_PREFIX/include" \
            BDB_LIBS="$BDB_PREFIX/lib/libdb_cxx-4.8.a $BDB_PREFIX/lib/libdb-4.8.a -pthread" \
            ./configure \
              --build=x86_64-apple-darwin \
              --host=x86_64-apple-darwin \
              --enable-wallet \
              --with-incompatible-bdb \
              --with-boost="$BOOST_PREFIX" \
              --without-gui \
              --disable-bench \
              --disable-tests \
              --disable-asm \
              --with-zmq \
              --without-miniupnpc \
            || { cat config.log; exit 1; }

          NEDB_LIB="$(pwd)/nedb-ffi/target/x86_64-apple-darwin/release/libnedb_ffi.a"
          echo "LIBS += -Wl,-force_load,${NEDB_LIB} -lpthread" >> src/Makefile

          # Makefile prerequisite checks for target/release/libnedb_ffi.la (native path).
          # Stage the x86_64 library there and create the .la wrapper it requires.
          mkdir -p "$(pwd)/nedb-ffi/target/release"
          cp "$NEDB_LIB" "$(pwd)/nedb-ffi/target/release/libnedb_ffi.a"
          printf '%s\n' \
            "# Generated by libtool (GNU libtool) 2.4.6" \
            "dlname=''" \
            "library_names=''" \
            "old_library='libnedb_ffi.a'" \
            "inherited_linker_flags=''" \
            "dependency_libs='-lpthread'" \
            "weak_library_names=''" \
            "current=0" "age=0" "revision=0" \
            "installed=no" "shouldnotlink=no" \
            "dlopen=''" "dlpreopen=''" \
            "libdir='$(pwd)/nedb-ffi/target/release'" \
            > "$(pwd)/nedb-ffi/target/release/libnedb_ffi.la"
          echo "NEDB .la staged at: $(pwd)/nedb-ffi/target/release/libnedb_ffi.la"

          arch -x86_64 make -j"$J"
          test -f src/interchainedd && file src/interchainedd

      - name: Sign & Notarize interchainedd (Developer ID — Interchained LLC)
        script: |
          # Import Developer ID cert from CM_CERTIFICATE env var (itcd_signing group)
          if [ -z "${CM_CERTIFICATE:-}" ]; then
            echo "⚠️  CM_CERTIFICATE not set — skipping signing"
            exit 0
          fi
          echo "$CM_CERTIFICATE" | base64 --decode > /tmp/developer_id.p12
          security create-keychain -p "" build.keychain 2>/dev/null || true
          security default-keychain -s build.keychain
          security unlock-keychain -p "" build.keychain
          security import /tmp/developer_id.p12 \
            -k build.keychain \
            -P "${CM_CERTIFICATE_PASSWORD:-}" \
            -T /usr/bin/codesign \
            -T /usr/bin/security
          security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain
          rm -f /tmp/developer_id.p12

          SIGN_ID=$(security find-identity -v -p codesigning build.keychain \
            | grep "Developer ID Application" | head -1 | awk '{print $2}')
          if [ -z "$SIGN_ID" ]; then
            echo "⚠️  No Developer ID Application cert found after import — skipping"
            exit 0
          fi
          echo "Signing with: $SIGN_ID"

          codesign --sign "$SIGN_ID" \
                   --options runtime \
                   --timestamp \
                   --force \
                   src/interchainedd src/interchained-cli
          codesign --verify --verbose src/interchainedd
          spctl --assess --type exec --verbose src/interchainedd 2>&1 || true

          # Notarize via App Store Connect API key
          if [ -n "${APP_STORE_CONNECT_PRIVATE_KEY:-}" ]; then
            echo "$APP_STORE_CONNECT_PRIVATE_KEY" > /tmp/asc_key.p8
            zip -j /tmp/interchainedd_notarize.zip src/interchainedd
            xcrun notarytool submit /tmp/interchainedd_notarize.zip \
              --key /tmp/asc_key.p8 \
              --key-id "$APP_STORE_CONNECT_KEY_IDENTIFIER" \
              --issuer "$APP_STORE_CONNECT_ISSUER_ID" \
              --wait
            xcrun stapler staple src/interchainedd
            rm -f /tmp/asc_key.p8 /tmp/interchainedd_notarize.zip
            echo "✅ Notarized and stapled"
          else
            echo "ℹ️  Notarization skipped (APP_STORE_CONNECT_PRIVATE_KEY not set)"
          fi

      - name: Package x86_64 binary (for iMac Intel)
        script: |
          J_TAG="${FCI_TAG:-${CM_COMMIT:0:8}}"
          mkdir -p "$ARTIFACT_DIR"
          cp src/interchainedd src/interchained-cli "$ARTIFACT_DIR"/
          strip "$ARTIFACT_DIR/interchainedd" "$ARTIFACT_DIR/interchained-cli" 2>/dev/null || true
          [ -f README.md ] && cp README.md "$ARTIFACT_DIR"/ || true
          shasum -a 256 "$ARTIFACT_DIR"/* > "$ARTIFACT_DIR/SHA256SUMS"
          tar -C "$ARTIFACT_DIR" -czf "interchained-macos-x86_64-${J_TAG}.tar.gz" .
          echo "Binary for iMac Intel: $(du -sh $ARTIFACT_DIR/interchainedd)"

    artifacts:
      - interchained-macos-x86_64-*.tar.gz
      - nedb-ffi/target/x86_64-apple-darwin/release/libnedb_ffi.a