syncmoss 0.4.0__tar.gz → 0.4.2__tar.gz

syncmoss-0.4.2/.gitattributes

@@ -0,0 +1,3 @@
+# Verbatim license texts: keep LF on every OS, so Windows checkouts (and the
+# Windows bundle) carry the files byte-for-byte as published by gnu.org.
+bundle/licenses/*.txt text eol=lf

syncmoss-0.4.2/.github/workflows/_MacOS.yml

@@ -0,0 +1,548 @@
+name: _macOS (PyInstaller universal2 app)
+
+# Modelled on crispy's release workflow (github.com/mretegan/crispy):
+#   1. build the app natively on an Apple Silicon AND an Intel runner,
+#   2. fuse the two bundles into one universal2 SYNCmoss.app,
+#   3. sign it (Developer ID + hardened runtime), pack the drag-and-drop DMG
+#      (window laid out as crispy's create-dmg.sh does), notarize, staple.
+#
+# Signing and notarization run only when the Apple secrets are set (repository
+# Settings -> Secrets and variables -> Actions; release.yml forwards them).
+# Without them the job still ships a universal2 DMG, ad-hoc signed and not
+# notarized, named SYNCmoss-macOS-universal2.dmg. A notarized one is named
+# SYNCmoss-macOS-universal2-signed.dmg; _TagRelease.yml / _UploadRelease.yml
+# tell the two apart by that name.
+#
+#   APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64
+#       the "Developer ID Application" certificate WITH its private key,
+#       exported from Keychain Access as .p12, then: base64 -i cert.p12 | pbcopy
+#   APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_PASSWORD   password of that .p12
+#   APPLE_ID                             Apple Account e-mail of the developer
+#   APPLE_TEAM_ID                        10-character Team ID (developer.apple.com -> Membership)
+#   APPLE_APPLICATION_SPECIFIC_PASSWORD  app-specific password (account.apple.com -> Sign-In and Security)
+#   APPLE_KEYCHAIN_PASSWORD              optional: password of the throwaway CI keychain
+#                                        (a random one is used when unset)
+
+on:
+  workflow_call:
+    secrets:
+      APPLE_ID:
+        required: false
+      APPLE_TEAM_ID:
+        required: false
+      APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_PASSWORD:
+        required: false
+      APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64:
+        required: false
+      APPLE_KEYCHAIN_PASSWORD:
+        required: false
+      APPLE_APPLICATION_SPECIFIC_PASSWORD:
+        required: false
+
+jobs:
+  build:
+    name: Build macOS app (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15
+            arch: arm64
+          - runner: macos-15-intel
+            arch: x86_64
+    env:
+      MACOSX_DEPLOYMENT_TARGET: "11"
+      CFLAGS: "-mmacosx-version-min=11"
+      LDFLAGS: "-mmacosx-version-min=11"
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: "pip"
+
+      - name: Check the runner architecture
+        run: |
+          MACHINE="$(python -c 'import platform; print(platform.machine())')"
+          echo "Python runs as ${MACHINE}"
+          if [ "${MACHINE}" != "${{ matrix.arch }}" ]; then
+            echo "::error::expected a ${{ matrix.arch }} runner, got ${MACHINE}"
+            exit 1
+          fi
+
+      - name: Download wheel artifact
+        uses: actions/download-artifact@v6
+        with:
+          name: wheels
+          path: wheels
+
+      # numba 0.62.x (llvmlite 0.45.x) is the last release with macOS x86_64
+      # wheels. The pin applies to BOTH architectures: the universal2 app holds
+      # one copy of the pure-Python code, so the two builds must resolve the
+      # same versions (checked again before the merge). --only-binary stops pip
+      # from quietly building an sdist on one architecture only.
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip setuptools wheel
+          python -m pip install --only-binary=:all: "numba==0.62.1" -r requirements.txt pyinstaller wheels/*.whl
+          python -m pip list --format=freeze
+
+      - name: Build the app
+        run: python bundle/macos_bundle.py --dist-dir bundle/MacOS/${{ matrix.arch }} --work-dir bundle/build/MacOS/${{ matrix.arch }}
+
+      # tar keeps the symlinks (Qt frameworks) and executable bits that
+      # upload-artifact would drop.
+      - name: Archive the app bundle
+        run: |
+          set -euo pipefail
+          DIST="bundle/MacOS/${{ matrix.arch }}"
+          APP_PATH=""
+          for candidate in "${DIST}/SYNCmoss.app" "${DIST}/SYNCmoss/SYNCmoss.app"; do
+            if [ -d "${candidate}" ]; then
+              APP_PATH="${candidate}"
+              break
+            fi
+          done
+          if [ -z "${APP_PATH}" ]; then
+            echo "::error::SYNCmoss.app not found in the ${{ matrix.arch }} build output"
+            find "${DIST}" -maxdepth 3 -print
+            exit 1
+          fi
+          echo "Executable architectures: $(lipo -archs "${APP_PATH}/Contents/MacOS/SYNCmoss")"
+          mkdir -p macos-artifact
+          tar -cpzf macos-artifact/SYNCmoss.app.tar.gz -C "$(dirname "${APP_PATH}")" SYNCmoss.app
+          python -m pip list --format=freeze > macos-artifact/pip-freeze.txt
+          echo "APP_PATH=${APP_PATH}" >> "${GITHUB_ENV}"
+
+      - name: Upload the app bundle
+        uses: actions/upload-artifact@v5
+        with:
+          name: macos-app-${{ matrix.arch }}
+          path: macos-artifact/
+          if-no-files-found: error
+          retention-days: 1
+
+      # Runs each architecture natively (the x86_64 slice is never exercised
+      # later). After archiving, so nothing the test writes reaches the artifact.
+      - name: Smoke-test the frozen app
+        run: |
+          "${APP_PATH}/Contents/MacOS/SYNCmoss" --test
+
+  universal2:
+    name: Merge, sign and notarize the universal2 app
+    needs: build
+    runs-on: macos-15
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Download the arm64 app
+        uses: actions/download-artifact@v6
+        with:
+          name: macos-app-arm64
+          path: bundles/arm64
+
+      - name: Download the x86_64 app
+        uses: actions/download-artifact@v6
+        with:
+          name: macos-app-x86_64
+          path: bundles/x86_64
+
+      - name: Check both builds used the same packages
+        run: |
+          if ! diff -u bundles/arm64/pip-freeze.txt bundles/x86_64/pip-freeze.txt; then
+            echo "::error::arm64 and x86_64 resolved different package versions, so the universal2 app would mix them; pin the differing packages in the build job's install step"
+            exit 1
+          fi
+
+      - name: Extract the app bundles
+        run: |
+          set -euo pipefail
+          mkdir -p arm64 x86_64
+          tar -xpf bundles/arm64/SYNCmoss.app.tar.gz -C arm64
+          tar -xpf bundles/x86_64/SYNCmoss.app.tar.gz -C x86_64
+
+      # Adapted from crispy's package/merge-universal.py: walk both bundles,
+      # fuse every pair of thin Mach-O files with lipo, copy everything else
+      # (identical files, already-universal binaries, data files, symlinks),
+      # then require every Mach-O file of the result to carry both slices.
+      - name: Merge into a universal2 app
+        shell: python
+        run: |
+          import filecmp
+          import os
+          import shutil
+          import subprocess
+          import sys
+
+          ARM_APP = "arm64/SYNCmoss.app"
+          X86_APP = "x86_64/SYNCmoss.app"
+          OUT_APP = "dist/universal2/SYNCmoss.app"
+
+          THIN_MAGICS = {b"\xfe\xed\xfa\xce", b"\xfe\xed\xfa\xcf", b"\xce\xfa\xed\xfe", b"\xcf\xfa\xed\xfe"}
+          FAT_MAGICS = {b"\xca\xfe\xba\xbe", b"\xbe\xba\xfe\xca"}
+
+
+          def macho_kind(path):
+              """'thin', 'fat' or None, from the magic bytes: PyInstaller ships
+              extension-less Mach-O files. Java .class files share the fat magic,
+              but a real universal binary has only a few architectures."""
+              with open(path, "rb") as f:
+                  header = f.read(8)
+              if len(header) < 8:
+                  return None
+              if header[:4] in THIN_MAGICS:
+                  return "thin"
+              if header[:4] in FAT_MAGICS:
+                  byteorder = "big" if header[:4] == b"\xca\xfe\xba\xbe" else "little"
+                  return "fat" if int.from_bytes(header[4:8], byteorder) < 30 else None
+              return None
+
+
+          def collect(root):
+              """Relative path -> 'dir', 'symlink' or 'file' (symlinked dirs are not descended)."""
+              entries = {}
+              for current, dirnames, filenames in os.walk(root):
+                  for name in dirnames + filenames:
+                      path = os.path.join(current, name)
+                      if os.path.islink(path):
+                          kind = "symlink"
+                      elif os.path.isdir(path):
+                          kind = "dir"
+                      else:
+                          kind = "file"
+                      entries[os.path.relpath(path, root)] = kind
+              return entries
+
+
+          arm = collect(ARM_APP)
+          x86 = collect(X86_APP)
+          os.makedirs(OUT_APP)
+          single_arch = []
+          fused = 0
+
+          for rel in sorted(set(arm) | set(x86)):
+              arm_kind, x86_kind = arm.get(rel), x86.get(rel)
+              arm_path = os.path.join(ARM_APP, rel)
+              x86_path = os.path.join(X86_APP, rel)
+              out_path = os.path.join(OUT_APP, rel)
+
+              if "dir" in (arm_kind, x86_kind):
+                  os.makedirs(out_path, exist_ok=True)
+                  continue
+              os.makedirs(os.path.dirname(out_path), exist_ok=True)
+
+              if "symlink" in (arm_kind, x86_kind):
+                  if arm_kind == x86_kind and os.readlink(arm_path) != os.readlink(x86_path):
+                      print(f"WARNING: symlink target differs, using arm64: {rel}")
+                  os.symlink(os.readlink(arm_path if arm_kind == "symlink" else x86_path), out_path)
+                  continue
+
+              if arm_kind is None or x86_kind is None:
+                  present = arm_path if arm_kind else x86_path
+                  if macho_kind(present):
+                      single_arch.append(rel)
+                  else:
+                      print(f"WARNING: data file present in one build only: {rel}")
+                      shutil.copy2(present, out_path)
+                  continue
+
+              if filecmp.cmp(arm_path, x86_path, shallow=False):
+                  shutil.copy2(arm_path, out_path)
+                  continue
+
+              arm_macho, x86_macho = macho_kind(arm_path), macho_kind(x86_path)
+              if arm_macho == x86_macho == "thin":
+                  subprocess.run(["lipo", "-create", arm_path, x86_path, "-output", out_path], check=True)
+                  shutil.copymode(arm_path, out_path)
+                  fused += 1
+              elif "fat" in (arm_macho, x86_macho):
+                  # Already universal; the two copies differ only in their signature.
+                  shutil.copy2(arm_path if arm_macho == "fat" else x86_path, out_path)
+              elif arm_macho or x86_macho:
+                  single_arch.append(rel)
+              else:
+                  print(f"WARNING: data file differs, using arm64: {rel}")
+                  shutil.copy2(arm_path, out_path)
+
+          if single_arch:
+              sys.exit(
+                  "ERROR: these Mach-O binaries exist for one architecture only, so the "
+                  "app would crash on the other:\n" + "\n".join(f"  - {p}" for p in single_arch)
+              )
+
+          not_universal = []
+          checked = 0
+          for rel, kind in sorted(collect(OUT_APP).items()):
+              path = os.path.join(OUT_APP, rel)
+              if kind != "file" or not macho_kind(path):
+                  continue
+              checked += 1
+              archs = subprocess.run(["lipo", "-archs", path], capture_output=True, text=True).stdout.split()
+              if not {"arm64", "x86_64"} <= set(archs):
+                  not_universal.append(f"  - {rel}: {' '.join(archs) or 'unreadable'}")
+
+          print(f"Fused {fused} binaries, checked {checked} Mach-O files")
+          if not_universal:
+              sys.exit("ERROR: these binaries are not universal2:\n" + "\n".join(not_universal))
+          print(f"Universal2 app written to {OUT_APP}")
+
+      # The merge leaves the bundle's seal stale, so the app is always re-signed:
+      # with the Developer ID when the certificate secrets are set, otherwise
+      # ad-hoc (so macOS reports "unverified developer", not "damaged").
+      - name: Sign the app
+        id: sign
+        env:
+          CERTIFICATE_BASE64: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_BASE64 }}
+          CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION_CERTIFICATE_PASSWORD }}
+          KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
+        run: |
+          set -euo pipefail
+          APP="dist/universal2/SYNCmoss.app"
+
+          # The hardened runtime needs these for the numba/llvmlite JIT (writable
+          # + executable memory) and for loading the bundled Python extensions.
+          ENTITLEMENTS="${RUNNER_TEMP}/entitlements.plist"
+          cat > "${ENTITLEMENTS}" <<'EOF'
+          <?xml version="1.0" encoding="UTF-8"?>
+          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+          <plist version="1.0">
+          <dict>
+              <key>com.apple.security.cs.allow-jit</key>
+              <true/>
+              <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+              <true/>
+              <key>com.apple.security.cs.disable-library-validation</key>
+              <true/>
+          </dict>
+          </plist>
+          EOF
+
+          # Extended attributes would invalidate the signature.
+          xattr -cr "${APP}"
+
+          if [ -n "${CERTIFICATE_BASE64}" ] && [ -n "${CERTIFICATE_PASSWORD}" ]; then
+            KEYCHAIN_PATH="${RUNNER_TEMP}/signing.keychain-db"
+            CERTIFICATE_PATH="${RUNNER_TEMP}/certificate.p12"
+            if [ -z "${KEYCHAIN_PASSWORD}" ]; then
+              KEYCHAIN_PASSWORD="$(openssl rand -base64 24)"
+              echo "::add-mask::${KEYCHAIN_PASSWORD}"
+            fi
+
+            echo "Creating a temporary keychain and importing the certificate"
+            echo "${CERTIFICATE_BASE64}" | base64 --decode -o "${CERTIFICATE_PATH}"
+            security create-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}"
+            security set-keychain-settings -lut 21600 "${KEYCHAIN_PATH}"
+            security unlock-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}"
+            security import "${CERTIFICATE_PATH}" -P "${CERTIFICATE_PASSWORD}" -A -t cert -f pkcs12 -k "${KEYCHAIN_PATH}"
+            rm -f "${CERTIFICATE_PATH}"
+            security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}" > /dev/null
+            security list-keychains -d user -s "${KEYCHAIN_PATH}"
+
+            IDENTITY="$(security find-identity -v -p codesigning "${KEYCHAIN_PATH}" | awk '/"Developer ID Application/ && !found { print $2; found = 1 }')"
+            if [ -z "${IDENTITY}" ]; then
+              echo "::error::the certificate holds no 'Developer ID Application' identity"
+              security find-identity -v -p codesigning "${KEYCHAIN_PATH}"
+              exit 1
+            fi
+
+            echo "Signing with the Developer ID (hardened runtime)"
+            codesign --force --deep --timestamp --options runtime \
+              --entitlements "${ENTITLEMENTS}" \
+              --keychain "${KEYCHAIN_PATH}" \
+              --sign "${IDENTITY}" \
+              "${APP}"
+            security delete-keychain "${KEYCHAIN_PATH}"
+            echo "developer_id=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "::warning::Apple certificate secrets are not set: the macOS DMG is ad-hoc signed and not notarized"
+            codesign --force --deep --sign - "${APP}"
+            echo "developer_id=false" >> "${GITHUB_OUTPUT}"
+          fi
+
+          codesign --verify --deep --strict --verbose=2 "${APP}"
+          echo "Universal executable architectures: $(lipo -archs "${APP}/Contents/MacOS/SYNCmoss")"
+
+      # On a copy, so files the test writes never reach the DMG. For a Developer
+      # ID build this runs under the hardened runtime, i.e. it also checks that
+      # the entitlements above are enough for numba.
+      - name: Smoke-test the signed universal2 app
+        run: |
+          set -euo pipefail
+          mkdir -p "${RUNNER_TEMP}/smoke"
+          ditto dist/universal2/SYNCmoss.app "${RUNNER_TEMP}/smoke/SYNCmoss.app"
+          "${RUNNER_TEMP}/smoke/SYNCmoss.app/Contents/MacOS/SYNCmoss" --test
+
+      # The drag-and-drop installer window, built as crispy's
+      # package/create-dmg.sh does: a writable image holding the app, a link to
+      # /Applications, the background picture (bundle/dmg_background.pdf) and
+      # the volume icon; Finder lays the window out (positions match the
+      # picture); then it is converted to the compressed read-only DMG.
+      - name: Create the DMG
+        run: |
+          set -euo pipefail
+          APP="dist/universal2/SYNCmoss.app"
+          STAGING="${RUNNER_TEMP}/dmg"
+          RW_DMG="${RUNNER_TEMP}/SYNCmoss-rw.dmg"
+          rm -rf "${STAGING}" "${RW_DMG}"
+
+          mkdir -p "${STAGING}/.background" "${STAGING}/.fseventsd"
+          ditto "${APP}" "${STAGING}/SYNCmoss.app"
+          ln -s /Applications "${STAGING}/Applications"
+          cp bundle/dmg_background.pdf "${STAGING}/.background/background.pdf"
+          # The volume shows the app's own icon.
+          ICON_FILE="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIconFile' "${APP}/Contents/Info.plist")"
+          case "${ICON_FILE}" in *.icns) ;; *) ICON_FILE="${ICON_FILE}.icns" ;; esac
+          cp "${APP}/Contents/Resources/${ICON_FILE}" "${STAGING}/.VolumeIcon.icns"
+          touch "${STAGING}/.fseventsd/no_log"
+
+          # Room for the .DS_Store Finder writes. hdiutil is occasionally
+          # "Resource busy" on hosted runners: retry.
+          SIZE_MB=$(( $(du -sm "${STAGING}" | cut -f1) + 50 ))
+          for attempt in 1 2 3; do
+            if hdiutil create -format UDRW -fs APFS -volname SYNCmoss -size "${SIZE_MB}m" \
+                -srcfolder "${STAGING}" -ov "${RW_DMG}"; then
+              break
+            fi
+            if [ "${attempt}" -eq 3 ]; then
+              exit 1
+            fi
+            echo "hdiutil create failed, retrying in 10 s"
+            sleep 10
+          done
+
+          ATTACH="$(hdiutil attach -readwrite -noverify -noautoopen "${RW_DMG}" | grep '^/dev/')"
+          DEVICE="$(echo "${ATTACH}" | head -n 1 | awk '{print $1}')"
+          MOUNT_POINT="$(echo "${ATTACH}" | awk -F'\t' '$3 != "" {print $3}' | tail -n 1 | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+          echo "Attached ${DEVICE} at ${MOUNT_POINT}"
+          if [ ! -d "${MOUNT_POINT}" ]; then
+            echo "::error::could not find where the image was mounted"
+            echo "${ATTACH}"
+            exit 1
+          fi
+          SetFile -a C "${MOUNT_POINT}"
+          SetFile -a V "${MOUNT_POINT}/.background"
+
+          LAYOUT="${RUNNER_TEMP}/dmg-layout.applescript"
+          cat > "${LAYOUT}" <<'EOF'
+          on run argv
+              tell application "Finder"
+                  tell disk (item 1 of argv)
+                      open
+                      set current view of container window to icon view
+                      set toolbar visible of container window to false
+                      set statusbar visible of container window to false
+                      set bounds of container window to {200, 120, 700, 420}
+                      set viewOptions to the icon view options of container window
+                      set arrangement of viewOptions to not arranged
+                      set icon size of viewOptions to 96
+                      set background picture of viewOptions to file ".background:background.pdf"
+                      set position of item "SYNCmoss.app" to {114, 124}
+                      set position of item "Applications" to {386, 124}
+                      close
+                      open
+                      delay 1
+                      update without registering applications
+                      delay 2
+                      close
+                  end tell
+              end tell
+          end run
+          EOF
+          # Finder scripting can time out on a busy runner: retry.
+          for attempt in 1 2 3; do
+            if osascript "${LAYOUT}" "$(basename "${MOUNT_POINT}")"; then
+              break
+            fi
+            if [ "${attempt}" -eq 3 ]; then
+              echo "::error::Finder could not lay out the DMG window"
+              exit 1
+            fi
+            echo "Finder layout failed, retrying in 5 s"
+            sleep 5
+          done
+          # Finder saves the layout in .DS_Store when the window closes.
+          for _ in $(seq 1 30); do
+            [ -f "${MOUNT_POINT}/.DS_Store" ] && break
+            sleep 1
+          done
+          if [ ! -f "${MOUNT_POINT}/.DS_Store" ]; then
+            echo "::error::Finder did not save the DMG window layout (.DS_Store)"
+            exit 1
+          fi
+
+          sync
+          for attempt in 1 2 3 4 5; do
+            if hdiutil detach "${DEVICE}"; then
+              break
+            fi
+            if [ "${attempt}" -eq 5 ]; then
+              hdiutil detach "${DEVICE}" -force
+              break
+            fi
+            echo "volume still busy, retrying in 5 s"
+            sleep 5
+          done
+          hdiutil convert "${RW_DMG}" -format UDZO -imagekey zlib-level=9 -ov -o dist/SYNCmoss.dmg
+          rm -f "${RW_DMG}"
+
+      - name: Notarize and staple the DMG
+        id: notarize
+        if: steps.sign.outputs.developer_id == 'true'
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLICATION_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APPLICATION_SPECIFIC_PASSWORD }}
+        run: |
+          set -euo pipefail
+          if [ -z "${APPLE_ID}" ] || [ -z "${APPLE_TEAM_ID}" ] || [ -z "${APPLICATION_SPECIFIC_PASSWORD}" ]; then
+            echo "::warning::APPLE_ID / APPLE_TEAM_ID / APPLE_APPLICATION_SPECIFIC_PASSWORD are not set: the DMG is signed but not notarized, so Gatekeeper will still block it"
+            exit 0
+          fi
+          DMG="dist/SYNCmoss.dmg"
+
+          echo "Submitting ${DMG} for notarization"
+          RESULT="$(xcrun notarytool submit "${DMG}" \
+            --apple-id "${APPLE_ID}" --team-id "${APPLE_TEAM_ID}" --password "${APPLICATION_SPECIFIC_PASSWORD}" \
+            --wait --timeout 1h --output-format json)" || true
+          echo "${RESULT}"
+          SUBMISSION_ID="$(python -c 'import json, sys; print(json.loads(sys.argv[1]).get("id", ""))' "${RESULT}" 2> /dev/null || true)"
+          STATUS="$(python -c 'import json, sys; print(json.loads(sys.argv[1]).get("status", ""))' "${RESULT}" 2> /dev/null || true)"
+          if [ "${STATUS}" != "Accepted" ]; then
+            echo "::error::notarization did not succeed (status: '${STATUS:-none}')"
+            if [ -n "${SUBMISSION_ID}" ]; then
+              xcrun notarytool log "${SUBMISSION_ID}" \
+                --apple-id "${APPLE_ID}" --team-id "${APPLE_TEAM_ID}" --password "${APPLICATION_SPECIFIC_PASSWORD}" || true
+            fi
+            exit 1
+          fi
+
+          xcrun stapler staple "${DMG}"
+          xcrun stapler validate "${DMG}"
+          echo "notarized=true" >> "${GITHUB_OUTPUT}"
+
+      - name: Name the DMG
+        env:
+          NOTARIZED: ${{ steps.notarize.outputs.notarized }}
+        run: |
+          if [ "${NOTARIZED}" = "true" ]; then
+            mv dist/SYNCmoss.dmg dist/SYNCmoss-macOS-universal2-signed.dmg
+          else
+            mv dist/SYNCmoss.dmg dist/SYNCmoss-macOS-universal2.dmg
+          fi
+          ls -lh dist/*.dmg
+
+      - name: Upload the universal2 DMG
+        uses: actions/upload-artifact@v5
+        with:
+          name: macos-universal2
+          path: dist/SYNCmoss-macOS-universal2*.dmg
+          if-no-files-found: error
+          retention-days: 5

{syncmoss-0.4.0 → syncmoss-0.4.2}/COPYING.txt

@@ -10,5 +10,11 @@ Third-party components are used under their respective licenses:
   - NumPy: BSD 3-Clause
   - SciPy: BSD 3-Clause
   - Matplotlib: BSD-compatible
+  - Numba: BSD 2-Clause
+  - llvmlite: BSD 2-Clause (contains LLVM: Apache 2.0 with LLVM Exceptions)
+  - Bliss (optional, not included; used only if installed separately):
+    LGPL v3.0
 
-For complete third-party license details, see NOTICE.txt.
+For complete third-party license details, see NOTICE.txt. The Windows and
+macOS bundles also carry the full license text of every third-party package
+they contain, in a "licenses" folder.

syncmoss-0.4.2/NOTICE.txt

@@ -0,0 +1,120 @@
+SYNCmoss - Third-Party Software Notices and Information
+=========================================================
+
+This project is licensed under the MIT License. See LICENSE for details.
+It uses the following third-party libraries, each distributed under
+their own license terms.
+
+The Windows and macOS bundles contain the full license text of every
+third-party package they include -- the libraries below, their own
+dependencies and the Python runtime -- in a "licenses" folder:
+  - Windows: _internal/licenses/
+  - macOS:   SYNCmoss.app/Contents/Resources/licenses/
+In the program, Supp -> License shows this notice and all of those texts.
+
+PySide6 (Qt for Python)
+-----------------------
+Licensed under the GNU Lesser General Public License (LGPL) v3.0
+Copyright (C) The Qt Company Ltd.
+https://www.qt.io/licensing/
+
+LGPL v3.0 COMPLIANCE NOTICE:
+This software dynamically links to PySide6. Under the terms of the
+LGPL v3.0, you may:
+  - Use this MIT-licensed software without your own code becoming LGPL.
+  - Replace the PySide6 library with any compatible version.
+  - Obtain PySide6 source code at:
+    https://code.qt.io/cgit/pyside/pyside-setup.git/
+  - Read the full LGPL v3.0 license, and the GNU GPL v3.0 it builds on,
+    in the bundles' licenses/LGPL-3.0.txt and licenses/GPL-3.0.txt, or at:
+    https://www.gnu.org/licenses/lgpl-3.0.html
+(The PySide6 wheels themselves carry only a Qt commercial-license notice,
+which is why the two texts are shipped separately.) Qt itself contains
+third-party components (FreeType, HarfBuzz, libpng, zlib, ...) under their
+own licenses; The Qt Company lists them at
+https://doc.qt.io/qt-6/licenses-used-in-qt.html
+
+NumPy
+-----
+Licensed under the BSD 3-Clause License
+Copyright (c) 2005-2025, NumPy Developers
+https://numpy.org/doc/stable/license.html
+
+SciPy
+-----
+Licensed under the BSD 3-Clause License
+Copyright (c) 2001-2002 Enthought, Inc. 2003, SciPy Developers
+https://scipy.org/scipylib/license.html
+
+Matplotlib
+----------
+Licensed under the Matplotlib License (BSD-compatible)
+Copyright (c) 2012- Matplotlib Development Team
+Copyright (c) 2002-2011 John D. Hunter
+https://matplotlib.org/stable/users/project/license.html
+
+Numba
+-----
+Licensed under the BSD 2-Clause License
+Copyright (c) 2012, Anaconda, Inc.
+https://github.com/numba/numba/blob/main/LICENSE
+
+llvmlite
+--------
+Licensed under the BSD 2-Clause License
+Copyright (c) 2014, Anaconda, Inc.
+https://github.com/numba/llvmlite/blob/main/LICENSE
+It contains LLVM, licensed under the Apache License v2.0 with LLVM
+Exceptions (https://llvm.org/LICENSE.txt).
+
+Python
+------
+Licensed under the Python Software Foundation License
+Copyright (c) Python Software Foundation; All Rights Reserved
+https://docs.python.org/3/license.html
+The bundles contain the Python runtime; its LICENSE.txt is included as
+licenses/Python/LICENSE.txt. The C libraries built into the runtime
+(OpenSSL, expat, libffi, zlib, libmpdec, ...) and their licenses are
+listed at the address above.
+
+Microsoft Visual C++ Runtime (Windows bundle only)
+--------------------------------------------------
+Copyright (c) Microsoft Corporation
+The Windows bundle contains Microsoft's C and C++ run-time libraries
+(VCRUNTIME140*.dll, MSVCP140*.dll, VCOMP140.dll and, where present,
+ucrtbase.dll with the api-ms-win-*.dll forwarders). They are "Microsoft
+Distributable Code", which Microsoft allows to be redistributed unmodified
+with the programs that use them, provided that whoever uses or passes on
+the Windows bundle does not:
+  - alter any copyright, trademark or patent notice in Microsoft's
+    Distributable Code;
+  - use Microsoft's trademarks in their programs' names or in a way that
+    suggests the programs come from or are endorsed by Microsoft;
+  - distribute Microsoft's Distributable Code to run on a platform other
+    than Microsoft operating systems, run-time technologies or application
+    platforms; or
+  - include Microsoft Distributable Code in malicious, deceptive or
+    unlawful programs.
+These conditions apply only to Microsoft's files, not to SYNCmoss or to
+the other components. The full terms are in Microsoft's documentation
+(included in its developer tools and on microsoft.com).
+
+Bliss (optional -- NOT included)
+--------------------------------
+Licensed under the GNU Lesser General Public License (LGPL) v3.0
+Copyright (c) Beamline Control Unit, ESRF
+https://gitlab.esrf.fr/bliss/bliss
+SYNCmoss neither contains nor distributes Bliss, and the Windows and macOS
+bundles never include it. Only when Bliss has been installed separately
+(Linux beamline installations) does SYNCmoss import it at run time, to read
+spectra online from a Bliss channel.
+
+PyInstaller (bundling only)
+---------------------------
+Licensed under the GPL 2.0 with a special bootloader exception that
+permits distributing non-GPL applications bundled with PyInstaller.
+Copyright (c) 2010-2023, PyInstaller Development Team
+https://pyinstaller.org/en/stable/license.html
+The Windows and macOS bundles are created with PyInstaller. The
+bootloader exception explicitly allows this use without requiring
+the application itself to be GPL-licensed.