fix(build): add missing --no-archive flag to build script

The caching idea is somewhat flawed, as there's a lot of things that
cane effect the outcome, and they're difficult to boil down into a
single unique key.

.github/workflows/build.yml

@@ -10,23 +10,23 @@ on:
         required: true
         default: "master"
       extraPlanArgs:
-        Description: "Extra plan args"
+        description: "Extra plan args"
         required: false
         default: ""
       extraCheckArgs:
-        Description: "Extra check args"
+        description: "Extra check args"
         required: false
         default: ""
       extraBuildArgs:
-        Description: "Extra build args"
+        description: "Extra build args"
         required: false
         default: ""
       extraPackageArgs:
-        Description: "Extra package args"
+        description: "Extra package args"
         required: false
         default: ""
       extraReleaseArgs:
-        Description: "Extra release args"
+        description: "Extra release args"
         required: false
         default: ""
 
@@ -40,11 +40,17 @@ jobs:
         uses: actions/checkout@v2
         with:
           repository: jimeh/build-emacs-for-macos
-          ref: "v0.5.0"
+          ref: "v0.6.15"
           path: builder
       - uses: actions/setup-go@v2
         with:
           go-version: 1.16
+      - uses: actions/cache@v2
+        id: builder-cache
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('builder/**/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-
       - name: Pre-build emacs-builder tool
         run: make build
         working-directory: builder
@@ -90,7 +96,7 @@ jobs:
         uses: actions/checkout@v2
         with:
           repository: jimeh/build-emacs-for-macos
-          ref: "v0.5.0"
+          ref: "v0.6.15"
           path: builder
       - uses: ruby/setup-ruby@v1
         with:
@@ -115,7 +121,8 @@ jobs:
       - name: Build Emacs
         run: >-
           ./builder/build-emacs-for-macos --plan build-plan.yml
-          --native-full-aot ${{ github.event.inputs.extraBuildArgs }}
+          --no-relink-eln-files --native-full-aot --no-archive
+          ${{ github.event.inputs.extraBuildArgs }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Install the Apple signing certificate
@@ -186,9 +193,14 @@ jobs:
         with:
           name: dmg
           path: builds
-      - name: Publish disk image to GitHub Release
+      - name: Publish disk image to a GitHub Release
         run: >-
           bin/emacs-builder -l debug release --plan build-plan.yml publish
           ${{ github.event.inputs.extraReleaseArgs }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Trigger update casks workflow in homebrew tap
+        run: >-
+          gh workflow run --repo jimeh/homebrew-emacs-builds update-casks.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.TAP_REPO_TOKEN }}

.github/workflows/test-build.yml

@@ -19,23 +19,23 @@ on:
         required: true
         default: "prerelease"
       extraPlanArgs:
-        Description: "Extra plan args"
+        description: "Extra plan args"
         required: false
         default: ""
       extraCheckArgs:
-        Description: "Extra check args"
+        description: "Extra check args"
         required: false
         default: ""
       extraBuildArgs:
-        Description: "Extra build args"
+        description: "Extra build args"
         required: false
-        default: ""
+        default: "--native-full-aot --no-relink-eln-files"
       extraPackageArgs:
-        Description: "Extra package args"
+        description: "Extra package args"
         required: false
         default: ""
       extraReleaseArgs:
-        Description: "Extra release args"
+        description: "Extra release args"
         required: false
         default: ""
 
@@ -43,7 +43,8 @@ jobs:
   plan:
     runs-on: macos-10.15
     outputs:
-      check: "${{ steps.check.outcome }}"
+      check: ${{ steps.check.outcome }}
+      builder_sha: ${{ steps.builder_sha.outputs.sha }}
     steps:
       - name: Checkout build-emacs-for-macos repo
         uses: actions/checkout@v2
@@ -51,9 +52,18 @@ jobs:
           repository: jimeh/build-emacs-for-macos
           ref: ${{ github.event.inputs.emacsBuilderGitRef }}
           path: builder
+      - name: Store builder Git SHA
+        id: builder_sha
+        run: echo "::set-output name=sha::$(git rev-parse HEAD)"
+        working-directory: builder
       - uses: actions/setup-go@v2
         with:
           go-version: 1.16
+      - uses: actions/cache@v2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('builder/**/go.sum') }}
+          restore-keys: ${{ runner.os }}-go-
       - name: Pre-build emacs-builder tool
         run: make build
         working-directory: builder
@@ -101,7 +111,7 @@ jobs:
         uses: actions/checkout@v2
         with:
           repository: jimeh/build-emacs-for-macos
-          ref: ${{ github.event.inputs.emacsBuilderGitRef }}
+          ref: ${{ needs.plan.outputs.builder_sha }}
           path: builder
       - uses: ruby/setup-ruby@v1
         with:
@@ -109,9 +119,39 @@ jobs:
       - name: Install dependencies
         run: make bootstrap-ci
         working-directory: builder
+      - name: Download build-plan.yml artifact
+        uses: actions/download-artifact@v2
+        with:
+          name: build-plan.yml
+          path: ./
+      - name: Build Emacs
+        run: >-
+          ./builder/build-emacs-for-macos --plan build-plan.yml
+          ${{ github.event.inputs.extraBuildArgs }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload unsigned app artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: unsigned-app
+          path: builds/*.tbz
+          if-no-files-found: error
+
+  package:
+    runs-on: macos-10.15
+    needs: [build]
+    steps:
+      - name: Download unsigned app artifact
+        uses: actions/download-artifact@v2
+        with:
+          name: unsigned-app
+          path: builds
+      - name: Extract unsigned app archive
+        run: |
+          find * -name '*.tbz' -exec tar xvjf "{}" \;
+        working-directory: builds
       - name: Download pre-built emacs-builder artifact
         uses: actions/download-artifact@v2
-        id: builder
         with:
           name: emacs-builder
           path: bin
@@ -119,16 +159,9 @@ jobs:
         run: chmod +x bin/emacs-builder
       - name: Download build-plan.yml artifact
         uses: actions/download-artifact@v2
-        id: plan
         with:
           name: build-plan.yml
           path: ./
-      - name: Build Emacs
-        run: >-
-          ./builder/build-emacs-for-macos --plan build-plan.yml
-          --native-full-aot ${{ github.event.inputs.extraBuildArgs }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Install the Apple signing certificate
         run: |
           # create variables
@@ -154,8 +187,7 @@ jobs:
       - name: Sign, package and notarize build
         run: >-
           bin/emacs-builder -l debug package -v --plan build-plan.yml
-          --sign --remove-source-dir
-          ${{ github.event.inputs.extraPackageArgs }}
+          --sign ${{ github.event.inputs.extraPackageArgs }}
         env:
           AC_USERNAME: ${{ secrets.AC_USERNAME }}
           AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
@@ -164,7 +196,7 @@ jobs:
       - name: Upload disk image artifacts
         uses: actions/upload-artifact@v2
         with:
-          name: dmg
+          name: signed-dmg
           path: |
             builds/*.dmg
             builds/*.sha*
@@ -176,11 +208,10 @@ jobs:
 
   release:
     runs-on: macos-10.15
-    needs: [build]
+    needs: [package]
     steps:
       - name: Download pre-built emacs-builder artifact
         uses: actions/download-artifact@v2
-        id: builder
         with:
           name: emacs-builder
           path: bin
@@ -188,14 +219,13 @@ jobs:
         run: chmod +x bin/emacs-builder
       - name: Download build-plan.yml artifact
         uses: actions/download-artifact@v2
-        id: plan
         with:
           name: build-plan.yml
           path: ./
       - name: Download disk image artifact
         uses: actions/download-artifact@v2
         with:
-          name: dmg
+          name: signed-dmg
           path: builds
       - name: Publish disk image to GitHub Release
         run: >-

README.md

@@ -8,13 +8,20 @@
 
 <p align="center">
   <a href="https://github.com/jimeh/emacs-builds/releases/latest">
-    <img alt="GitHub release (latest)" src="https://img.shields.io/github/v/release/jimeh/emacs-builds?style=flat&label=nightly&color=%237F5AB6&logo=GNU%20Emacs&logoColor=white">
+    <img alt="GitHub release (stable)" src="https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fjimeh%2Fhomebrew-emacs-builds%2Fmeta%2FCasks%2Femacs-app%2Fshield.json">
   </a>
+  <a href="https://github.com/jimeh/emacs-builds/releases">
+    <img alt="GitHub release (nightly)" src="https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fjimeh%2Fhomebrew-emacs-builds%2Fmeta%2FCasks%2Femacs-app-nightly%2Fshield.json">
+  </a>
+  <a href="https://github.com/jimeh/emacs-builds/issues/7">
+    <img alt="GitHub release (known good nightly)" src="https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fjimeh%2Fhomebrew-emacs-builds%2Fmeta%2FCasks%2Femacs-app-good%2Fshield.json">
+  </a>
+  <br />
   <a href="https://github.com/jimeh/emacs-builds/issues">
-    <img alt="GitHub issues" src="https://img.shields.io/github/issues-raw/jimeh/emacs-builds?style=flat&logo=github&colorColor=white">
+    <img alt="GitHub issues" src="https://img.shields.io/github/issues-raw/jimeh/emacs-builds?style=flat&logo=github&logoColor=white">
   </a>
   <a href="https://github.com/jimeh/emacs-builds/pulls">
-    <img alt="GitHub pull requests" src="https://img.shields.io/github/issues-pr-raw/jimeh/emacs-builds?style=flat&logo=github&colorColor=white">
+    <img alt="GitHub pull requests" src="https://img.shields.io/github/issues-pr-raw/jimeh/emacs-builds?style=flat&logo=github&logoColor=white">
   </a>
   <a href="https://github.com/jimeh/emacs-builds/releases">
     <img alt="GitHub all releases" src="https://img.shields.io/github/downloads/jimeh/emacs-builds/total?style=flat&logoColor=white&logo=data%3Aimage%2Fpng%3Bbase64,iVBORw0KGgoAAAANSUhEUgAAAA4AAAAOCAYAAAAfSC3RAAAEsmlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4KPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNS41LjAiPgogPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgeG1sbnM6ZXhpZj0iaHR0cDovL25zLmFkb2JlLmNvbS9leGlmLzEuMC8iCiAgICB4bWxuczp0aWZmPSJodHRwOi8vbnMuYWRvYmUuY29tL3RpZmYvMS4wLyIKICAgIHhtbG5zOnBob3Rvc2hvcD0iaHR0cDovL25zLmFkb2JlLmNvbS9waG90b3Nob3AvMS4wLyIKICAgIHhtbG5zOnhtcD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLyIKICAgIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIgogICAgeG1sbnM6c3RFdnQ9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZUV2ZW50IyIKICAgZXhpZjpQaXhlbFhEaW1lbnNpb249IjE0IgogICBleGlmOlBpeGVsWURpbWVuc2lvbj0iMTQiCiAgIGV4aWY6Q29sb3JTcGFjZT0iMSIKICAgdGlmZjpJbWFnZVdpZHRoPSIxNCIKICAgdGlmZjpJbWFnZUxlbmd0aD0iMTQiCiAgIHRpZmY6UmVzb2x1dGlvblVuaXQ9IjIiCiAgIHRpZmY6WFJlc29sdXRpb249IjcyLjAiCiAgIHRpZmY6WVJlc29sdXRpb249IjcyLjAiCiAgIHBob3Rvc2hvcDpDb2xvck1vZGU9IjMiCiAgIHBob3Rvc2hvcDpJQ0NQcm9maWxlPSJzUkdCIElFQzYxOTY2LTIuMSIKICAgeG1wOk1vZGlmeURhdGU9IjIwMjEtMDUtMThUMDE6MjU6NTQrMDE6MDAiCiAgIHhtcDpNZXRhZGF0YURhdGU9IjIwMjEtMDUtMThUMDE6MjU6NTQrMDE6MDAiPgogICA8eG1wTU06SGlzdG9yeT4KICAgIDxyZGY6U2VxPgogICAgIDxyZGY6bGkKICAgICAgc3RFdnQ6YWN0aW9uPSJwcm9kdWNlZCIKICAgICAgc3RFdnQ6c29mdHdhcmVBZ2VudD0iQWZmaW5pdHkgRGVzaWduZXIgMS45LjMiCiAgICAgIHN0RXZ0OndoZW49IjIwMjEtMDUtMThUMDE6MjU6NTQrMDE6MDAiLz4KICAgIDwvcmRmOlNlcT4KICAgPC94bXBNTTpIaXN0b3J5PgogIDwvcmRmOkRlc2NyaXB0aW9uPgogPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4KPD94cGFja2V0IGVuZD0iciI%2FPnP7qIwAAAGBaUNDUHNSR0IgSUVDNjE5NjYtMi4xAAAokXWRzytEURTHP2aIGBEWFhaThtWM%2FKiJjTLSUJM0RhlsZp55M2rezOu9N2myVbaKEhu%2FFvwFbJW1UkRKdsqa2KDnPKNGMud27vnc773ndO%2B54IplFc2s7gUtZxnRcMg7G5%2Fz1j5SQwvQzEBCMfWRqakIFe3thionXgWcWpXP%2FWsNiylTgao64WFFNyzhceHIsqU7vCncpmQSi8LHwn5DLih87ejJEj85nC7xh8NGLDoKrmZhb%2FoXJ3%2BxkjE0YXk5Pi1bUH7u47zEk8rNTEvsFO%2FAJEqYEF4mGGOUIH0MyRwkQD89sqJCfu93%2FiR5yVVk1ilisESaDBZ%2BUQtSPSVRFT0lI0vR6f%2FfvprqQH%2BpuicENQ%2B2%2FdIFtRvwuW7b7%2Fu2%2FXkA7ns4y5Xz83sw%2BCr6elnz7ULTKpycl7XkFpyuQfudnjAS35Jb3KWq8HwEjXFovYT6%2BVLPfvY5vIXYinzVBWzvQLecb1r4AjtZZ9JRQIRfAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAhUlEQVQokb3QsQnDMBRF0Y9J6QGylCt7GI%2BRPdJ4BIMXyA4pM0KKk0YCYawogZAHH4Tuvw%2BhiEowY67xarBirfHu68afijjXFvesK8AQEXeMB9KU2HDU2GPDE2P%2BHEzpbkNfe04pP9K8lw7knLa0k69pPpP%2BFyzaWfL%2BqXAvEXFr9K%2F58AJFIbDLRt48DAAAAABJRU5ErkJggg%3D%3D&color=blue&label=total%20downloads">
@@ -23,15 +30,15 @@
 
 <p align="center">
   <strong>
-    Nightly binary builds of Emacs for macOS as a self-contained Emacs.app,
-    with native-compilation.
+    Self-contained Emacs.app builds for macOS, with native-compilation support
+    in nightly builds.
   </strong>
 </p>
 
 ## Features
 
 - Self-contained Emacs.app application bundle, with no external dependencies.
-- Native-compilation ([gccemacs][]).
+- Native-compilation ([gccemacs][]), nightly builds only.
 - Native JSON parsing via libjansson.
 - SVG rendering via librsvg.
 - Various image formats are supported via macOS native image APIs.
@@ -44,8 +51,8 @@
 - Emacs source is fetched from the [emacs-mirror/emacs][] GitHub repository.
 - Build creation is transparent and public through the use of GitHub Actions,
   allowing anyone to inspect git commit SHAs, full source code, and exact
-  commands used to produce a build. This is especially important right now as
-  builds are not yet signed and notarized.
+  commands used to produce a build.
+- Emacs.app is signed with a developer certificate and notarized by Apple.
 - Uses [build-emacs-for-macos][] to build the self-contained application bundle.
 
 [build-emacs-for-macos]: https://github.com/jimeh/build-emacs-for-macos
@@ -59,11 +66,16 @@
 
 ## System Requirements
 
-- Intel-based Mac running macOS 10.15.x or later.
+- macOS 10.15.x or later (uses Rosetta2 on M1-based macs).
+- Homebrew `gcc` formula (nightly builds only).
+- Xcode Command Line Tools (nightly builds only).
 
-## Downloads
+## Installation
 
-See the [Releases][] page to download latest builds.
+### Manual Download
+
+See the [Releases][] page to download latest builds, or [here](latest) for the
+latest stable release.
 
 Nightly builds of Emacs are for the part just fine, but if you don't like living
 too close to the edge, see issue [#7 Known Good Nightly Builds][7] for a list of
@@ -71,32 +83,56 @@ recent nightly builds which have been actively used by a living being without
 any issues.
 
 [releases]: https://github.com/jimeh/emacs-builds/releases
+[latest]: https://github.com/jimeh/emacs-builds/releases/latest
 [7]: https://github.com/jimeh/emacs-builds/issues/7
 
-## Untrusted Application
+### Homebrew Cask
 
-Currently builds are not signed or notarized, meaning macOS cannot verify
-Emacs.app came from a trusted developer, and by default you are not given an
-option to trust the app and open it.
+1. Install the
+   [`jimeh/emacs-builds`](https://github.com/jimeh/homebrew-emacs-builds)
+   Homebrew tap:
+   ```
+   brew tap jimeh/emacs-builds
+   ```
+2. Install one of the available casks:
+   - `emacs-app-nightly` for the latest nightly build:
+     ```
+     brew install --cask emacs-app-nightly
+     ```
+   - `emacs-app-good` for the latest known good nightly build listed on [#7][7]:
+     ```
+     brew install --cask emacs-app-good
+     ```
+   - `emacs-app` for the latest stable release of Emacs (does not include
+     native-comp at time of writing):
+     ```
+     brew install --cask emacs-app
+     ```
 
-Simplest way around this is to right-click (or control-click) on the Emacs app
-in Finder and select "Open". You will then be given the same warning as before,
-but with a "Open" button now available to trust and open the app. After that you
-can open the application like normal without any warnings.
-
-Builds will soon be signed and notarized, progress is tracked in [Issue #1][1].
-
-[1]: https://github.com/jimeh/emacs-builds/issues/1
+[7]: https://github.com/jimeh/emacs-builds/issues/7
 
 ## Use Emacs.app as `emacs` CLI Tool
 
+### Installed via Homebrew Cask
+
+The cask installation method sets up CLI usage automatically by exposing a
+`emacs` command. However it will launch Emacs into GUI mode. To instead have
+`emacs` in your terminal open a terminal instance of Emacs, add the following
+alias to your shell setup:
+
+```bash
+alias emacs="emacs -nw"
+```
+
+### Installed Manually
+
 Builds come with a custom `emacs` shell script launcher for use from the command
 line, located next to `emacsclient` in `Emacs.app/Contents/MacOS/bin`.
 
 The custom `emacs` script makes sure to use the main
 `Emacs.app/Contents/MacOS/Emacs` executable from the correct path, ensuring it
 finds all the relevant dependencies within the Emacs.app bundle, regardless of
-it it's exposed via `PATH` or symlinked to from elsewhere.
+if it's exposed via `PATH` or symlinked from elsewhere.
 
 To use it, simply add `Emacs.app/Contents/MacOS/bin` to your `PATH`. For
 example, if you place Emacs.app in `/Applications`:
@@ -131,6 +167,24 @@ commit from the `master` branch of the [emacs-mirror/emacs][] repository. This
 means a nightly build will only be produced if there have been new commits since
 the last nightly build.
 
+## Application Signing / Trust
+
+As of June 21st, 2021, all builds are fully signed and notarized. The signing
+certificate used is: `Developer ID Application: Jim Myhrberg (5HX66GF82Z)`
+
+To verify the application signature and notarization, you can use `spctl`:
+
+```bash
+$ spctl -vvv --assess --type exec /Applications/Emacs.app
+/Applications/Emacs.app: accepted
+source=Notarized Developer ID
+origin=Developer ID Application: Jim Myhrberg (5HX66GF82Z)
+```
+
+All builds also come with a SHA256 checksum file, which itself can be double
+checked against the SHA256 checksum log output from the packaging step of the
+GitHub Actions workflow run which produced the build.
+
 [emacs-mirror/emacs]: https://github.com/emacs-mirror/emacs
 
 ## Issues / To-Do