Makefile.toml

# Multi-target build tasks for notema

[config]
default_to_workspace = false
main_project_member = "."

# Default environment variables
[env]
ANDROID_API = "24"
ANDROID_SDK_ROOT = "/opt/homebrew/share/android-commandlinetools"
TERMUX_TARGET = "aarch64-linux-android"
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER = "aarch64-unknown-linux-musl-gcc"
CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER = "aarch64-unknown-linux-gnu-gcc"
CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER = "x86_64-unknown-linux-gnu-gcc"
CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER = "x86_64-unknown-linux-musl-gcc"
CARGO_TARGET_I686_UNKNOWN_LINUX_MUSL_LINKER = "i686-unknown-linux-musl-gcc"
CARGO_TARGET_I686_UNKNOWN_LINUX_GNU_LINKER = "i686-unknown-linux-gnu-gcc"
# i586 (x87 float ABI) baseline for iSH; links with the i686 musl gcc.
CARGO_TARGET_I586_UNKNOWN_LINUX_MUSL_LINKER = "i686-unknown-linux-musl-gcc"
CARGO_TARGET_ARMV7_UNKNOWN_LINUX_MUSLEABIHF_LINKER = "armv7-unknown-linux-musleabihf-gcc"
CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER = "armv7-unknown-linux-gnueabihf-gcc"
CARGO_TARGET_ARM_UNKNOWN_LINUX_MUSLEABIHF_LINKER = "arm-unknown-linux-musleabihf-gcc"
CARGO_TARGET_ARM_UNKNOWN_LINUX_GNUEABIHF_LINKER = "arm-unknown-linux-gnueabihf-gcc"
CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER = "x86_64-w64-mingw32-gcc"
# The aarch64 FreeBSD slice is Tier 3 (no rustup std); this nightly must match
# the pin in .github/workflows/release.yml.
FREEBSD_NIGHTLY = "nightly-2026-07-15"

# Android / Termux targets
[tasks.build-termux]
description = "Cross-compile for native Termux on 64-bit ARM Android"
dependencies = ["install-termux-target"]
script = '''
TARGET="${TERMUX_TARGET:-aarch64-linux-android}"
API="${ANDROID_API:-24}"

case "$(uname -s)" in
    Darwin)
        HOST_TAG="darwin-x86_64"
        ;;
    Linux)
        HOST_TAG="linux-x86_64"
        ;;
    *)
        echo "Unsupported host OS for Android NDK cross-compilation: $(uname -s)" >&2
        exit 1
        ;;
esac

SDK_ROOT="${ANDROID_SDK_ROOT:-${ANDROID_HOME:-}}"
if [ -z "$SDK_ROOT" ] && [ -d "$HOME/Library/Android/sdk" ]; then
    SDK_ROOT="$HOME/Library/Android/sdk"
fi
if [ -z "$SDK_ROOT" ] && [ -d "/opt/homebrew/share/android-commandlinetools" ]; then
    SDK_ROOT="/opt/homebrew/share/android-commandlinetools"
fi

NDK_HOME="${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-${ANDROID_NDK:-}}}"
if [ -z "$NDK_HOME" ] && [ -n "$SDK_ROOT" ] && [ -d "${SDK_ROOT}/ndk" ]; then
    NDK_HOME=$(find "${SDK_ROOT}/ndk" -mindepth 1 -maxdepth 1 -type d | sort | tail -n 1)
fi
if [ -z "$NDK_HOME" ]; then
    echo "ANDROID_NDK_HOME, ANDROID_NDK_ROOT, ANDROID_NDK, or ANDROID_SDK_ROOT with an ndk directory must point to an Android NDK install." >&2
    exit 1
fi

TOOLCHAIN_BIN="${NDK_HOME}/toolchains/llvm/prebuilt/${HOST_TAG}/bin"
LINKER="${TOOLCHAIN_BIN}/aarch64-linux-android${API}-clang"
if [ ! -x "$LINKER" ]; then
    echo "Android NDK linker not found or not executable: $LINKER" >&2
    exit 1
fi

if [ -x "${TOOLCHAIN_BIN}/llvm-ar" ]; then
    export CARGO_TARGET_AARCH64_LINUX_ANDROID_AR="${TOOLCHAIN_BIN}/llvm-ar"
    export AR_aarch64_linux_android="${TOOLCHAIN_BIN}/llvm-ar"
fi
export CARGO_TARGET_AARCH64_LINUX_ANDROID_LINKER="$LINKER"
# cc-rs (used by ring and other -sys crates) defaults to a non-existent
# aarch64-linux-android-clang; point it at the API-versioned NDK clang.
export CC_aarch64_linux_android="$LINKER"
export CXX_aarch64_linux_android="${TOOLCHAIN_BIN}/aarch64-linux-android${API}-clang++"
cargo build --release --target "$TARGET"
'''

[tasks.install-termux-target]
description = "Install the Rust target used for Termux ARM64 Android builds"
command = "rustup"
args = ["target", "add", "aarch64-linux-android"]

# ARM64 targets
[tasks.build-arm64-musl]
description = "Build for ARM64 with musl"
command = "cargo"
args = ["build", "--release", "--target", "aarch64-unknown-linux-musl"]

[tasks.build-arm64-gnu]
description = "Build for ARM64 with glibc"
command = "cargo"
args = ["build", "--release", "--target", "aarch64-unknown-linux-gnu"]

# x86_64 Linux targets
[tasks.build-x86-gnu]
description = "Build for x86_64 Linux with glibc"
command = "cargo"
args = ["build", "--release", "--target", "x86_64-unknown-linux-gnu"]

[tasks.build-x86-musl]
description = "Build for x86_64 Linux with musl"
command = "cargo"
args = ["build", "--release", "--target", "x86_64-unknown-linux-musl"]

# 32-bit x86 Linux targets
[tasks.build-i686-musl]
description = "Build for 32-bit x86 Linux with musl"
command = "cargo"
args = ["build", "--release", "--target", "i686-unknown-linux-musl"]

# Rust's prebuilt i586 musl target uses an x87 baseline that does not require
# SSE. HTTPS uses a static, no-assembly i586 OpenSSL because ring requires SSE2
# on 32-bit x86.
[tasks.build-i586-musl]
description = "Build the i586-baseline 32-bit x86 musl artifact"
script = '''
set -eu
OPENSSL_VERSION="3.5.7"
OPENSSL_SHA256="a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8"
I586_DIR="$PWD/target/i586-musl"
ARCHIVE="$I586_DIR/sources/openssl-$OPENSSL_VERSION.tar.gz"
SOURCE="$I586_DIR/sources/openssl-$OPENSSL_VERSION"
OPENSSL_DIR="$I586_DIR/openssl-$OPENSSL_VERSION-i586"
mkdir -p "$I586_DIR/sources" "$SOURCE" "$OPENSSL_DIR"
if [ ! -f "$ARCHIVE" ]; then
    curl --fail --location \
        "https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSION/openssl-$OPENSSL_VERSION.tar.gz" \
        --output "$ARCHIVE"
fi
if command -v sha256sum >/dev/null 2>&1; then
    ACTUAL_SHA256="$(sha256sum "$ARCHIVE")"
else
    ACTUAL_SHA256="$(shasum -a 256 "$ARCHIVE")"
fi
ACTUAL_SHA256="${ACTUAL_SHA256%% *}"
if [ "$ACTUAL_SHA256" != "$OPENSSL_SHA256" ]; then
    echo "OpenSSL archive checksum mismatch" >&2
    exit 1
fi
if [ ! -f "$SOURCE/Configure" ]; then
    tar -xzf "$ARCHIVE" -C "$SOURCE" --strip-components=1
fi
if [ ! -f "$OPENSSL_DIR/lib/libssl.a" ]; then
    cd "$SOURCE"
    CC=i686-unknown-linux-musl-gcc \
    AR=i686-unknown-linux-musl-ar \
    RANLIB=i686-unknown-linux-musl-ranlib \
    CFLAGS="-O2 -march=i586 -mno-mmx -mno-3dnow -mno-sse -mno-sse2 -mfpmath=387" \
        perl ./Configure linux-elf no-shared no-module no-tests no-asm \
        --prefix="$OPENSSL_DIR" --libdir=lib
    make -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 2)" build_libs
    make install_sw
    cd "$CARGO_MAKE_WORKING_DIRECTORY"
fi
export OPENSSL_DIR
export OPENSSL_STATIC=1
export OPENSSL_NO_VENDOR=1
cargo build --release --locked \
    --target i586-unknown-linux-musl \
    --target-dir target/i586-musl \
    --no-default-features --features tls-native
'''

[tasks.build-i686-gnu]
description = "Build for 32-bit x86 Linux with glibc"
command = "cargo"
args = ["build", "--release", "--target", "i686-unknown-linux-gnu"]

# 32-bit ARMv7 Linux targets (hard-float)
[tasks.build-armv7-musl]
description = "Build for 32-bit ARMv7 Linux with musl (hard-float)"
command = "cargo"
args = ["build", "--release", "--target", "armv7-unknown-linux-musleabihf"]

[tasks.build-armv7-gnu]
description = "Build for 32-bit ARMv7 Linux with glibc (hard-float)"
command = "cargo"
args = ["build", "--release", "--target", "armv7-unknown-linux-gnueabihf"]

# 32-bit ARMv6 Linux targets (hard-float, Pi Zero compatible)
[tasks.build-armv6-musl]
description = "Build for 32-bit ARMv6 Linux with musl (hard-float, Pi Zero compatible)"
command = "cargo"
args = ["build", "--release", "--target", "arm-unknown-linux-musleabihf"]

[tasks.build-armv6-gnu]
description = "Build for 32-bit ARMv6 Linux with glibc (hard-float, Pi Zero compatible)"
command = "cargo"
args = ["build", "--release", "--target", "arm-unknown-linux-gnueabihf"]

# riscv64 Linux targets. The macOS cross-toolchain tap has no riscv64 gcc, so
# both slices link with cargo-zigbuild instead. The `.2.27` suffix pins the
# glibc floor to match the release workflow — riscv64 support starts there.
[tasks.build-riscv64-gnu]
description = "Cross-compile for riscv64 Linux with glibc (zigbuild, 2.27 floor)"
command = "cargo"
args = ["zigbuild", "--release", "--target", "riscv64gc-unknown-linux-gnu.2.27"]

[tasks.build-riscv64-musl]
description = "Cross-compile for riscv64 Linux with musl (zigbuild, static)"
command = "cargo"
args = ["zigbuild", "--release", "--target", "riscv64gc-unknown-linux-musl"]

# FreeBSD targets, cross-compiled with cargo-zigbuild (zig >= 0.15.1 ships the
# FreeBSD 14+ libc stubs and headers, so no BSD host is needed). aarch64 is
# Tier 3: no rustup std, so it builds std from source on the pinned nightly,
# which needs `rustup toolchain install $FREEBSD_NIGHTLY --component rust-src`.
[tasks.build-freebsd-x86]
description = "Cross-compile for x86_64 FreeBSD 14+ with cargo-zigbuild"
command = "cargo"
args = ["zigbuild", "--release", "--locked", "--target", "x86_64-unknown-freebsd"]

# RUSTUP_TOOLCHAIN selects the nightly; a `+toolchain` argument would trip
# cargo-make's unknown-subcommand auto-install.
[tasks.build-freebsd-arm64]
description = "Cross-compile for aarch64 FreeBSD 14+ (Tier 3, nightly + build-std)"
command = "cargo"
args = [
    "zigbuild",
    "--release",
    "--locked",
    "--target",
    "aarch64-unknown-freebsd",
    "-Z",
    "build-std=std,panic_abort",
]
env = { RUSTUP_TOOLCHAIN = "${FREEBSD_NIGHTLY}" }

# Windows targets
[tasks.build-windows-gnu]
description = "Build for Windows x86_64 (MinGW)"
command = "cargo"
args = ["build", "--release", "--target", "x86_64-pc-windows-gnu"]

# macOS targets
# .env carries APPLE_DEVELOPER_ID, which notema-context's build.rs reads to sign
# the location helper, and APPLE_NOTARY_PROFILE, the notarytool keychain profile
# notarization runs off. Missing .env falls back to ad-hoc signing.
[tasks.build-macos-intel]
description = "Build for Intel macOS 10.12 and newer"
command = "cargo"
args = ["build", "--release", "--locked", "--target", "x86_64-apple-darwin"]
env = { MACOSX_DEPLOYMENT_TARGET = "10.12" }
env_files = ["./.env"]

[tasks.build-macos-silicon]
description = "Build for Apple Silicon macOS 11 and newer"
command = "cargo"
args = ["build", "--release", "--locked", "--target", "aarch64-apple-darwin"]
env = { MACOSX_DEPLOYMENT_TARGET = "11.0" }
env_files = ["./.env"]

[tasks.build-macos-universal]
description = "Build universal macOS binary (Intel + Apple Silicon)"
dependencies = ["build-macos-intel", "build-macos-silicon"]
script = '''
mkdir -p target/universal-apple-darwin/release
lipo -create \
    target/x86_64-apple-darwin/release/notema \
    target/aarch64-apple-darwin/release/notema \
    -output target/universal-apple-darwin/release/notema
'''

# Combined build tasks
[tasks.build-all]
description = "Build for all supported platforms"
dependencies = [
    "build-termux",
    "build-arm64-musl",
    "build-arm64-gnu",
    "build-x86-gnu",
    "build-x86-musl",
    "build-i686-musl",
    "build-i686-gnu",
    "build-i586-musl",
    "build-armv7-musl",
    "build-armv7-gnu",
    "build-armv6-musl",
    "build-armv6-gnu",
    "build-riscv64-musl",
    "build-riscv64-gnu",
    "build-freebsd-x86",
    "build-freebsd-arm64",
    "build-windows-gnu",
    "build-macos-intel",
    "build-macos-silicon",
    "build-macos-universal"
]

[tasks.build-arm64-all]
description = "Build for both ARM64 targets"
dependencies = [
    "build-termux",
    "build-arm64-musl",
    "build-arm64-gnu"
]

[tasks.build-linux-all]
description = "Build for all Linux targets"
dependencies = [
    "build-arm64-musl",
    "build-arm64-gnu",
    "build-x86-gnu",
    "build-x86-musl",
    "build-i686-musl",
    "build-i686-gnu",
    "build-i586-musl",
    "build-armv7-musl",
    "build-armv7-gnu",
    "build-armv6-musl",
    "build-armv6-gnu",
    "build-riscv64-musl",
    "build-riscv64-gnu"
]

[tasks.build-windows-all]
description = "Build for all Windows targets"
dependencies = [
    "build-windows-gnu"
]

[tasks.build-macos-all]
description = "Build for all macOS targets"
dependencies = [
    "build-macos-intel",
    "build-macos-silicon",
    "build-macos-universal"
]

[tasks.run-tests]
description = "Execute the full test suite before building releases"
command = "cargo"
args = ["test", "--workspace"]

[tasks.clean-all]
description = "Clean all build artifacts"
command = "cargo"
args = ["clean"]

# Packaging tasks
[tasks.create-release-dir]
description = "Create release directory"
script = '''
mkdir -p release
'''

[tasks.package-termux]
description = "Package native Termux ARM64 Android binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="${TERMUX_TARGET:-aarch64-linux-android}"
PLATFORM="android-aarch64-termux"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-arm64-musl]
description = "Package ARM64 musl binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="aarch64-unknown-linux-musl"
PLATFORM="linux-musl-aarch64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-arm64-gnu]
description = "Package ARM64 gnu binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="aarch64-unknown-linux-gnu"
PLATFORM="linux-gnu-aarch64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-x86-gnu]
description = "Package x86_64 gnu binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="x86_64-unknown-linux-gnu"
PLATFORM="linux-gnu-x86_64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-x86-musl]
description = "Package x86_64 musl binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="x86_64-unknown-linux-musl"
PLATFORM="linux-musl-x86_64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-i686-musl]
description = "Package 32-bit x86 musl binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="i686-unknown-linux-musl"
PLATFORM="linux-musl-i686"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-i586-musl]
description = "Package the i586-baseline 32-bit x86 musl binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="i586-unknown-linux-musl"
PLATFORM="linux-musl-i586"
cp "target/i586-musl/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-i686-gnu]
description = "Package 32-bit x86 gnu binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="i686-unknown-linux-gnu"
PLATFORM="linux-gnu-i686"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-armv7-musl]
description = "Package 32-bit ARMv7 musl binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="armv7-unknown-linux-musleabihf"
PLATFORM="linux-musl-armv7"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-armv7-gnu]
description = "Package 32-bit ARMv7 gnu binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="armv7-unknown-linux-gnueabihf"
PLATFORM="linux-gnu-armv7"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-armv6-musl]
description = "Package 32-bit ARMv6 musl binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="arm-unknown-linux-musleabihf"
PLATFORM="linux-musl-armv6"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-armv6-gnu]
description = "Package 32-bit ARMv6 gnu binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="arm-unknown-linux-gnueabihf"
PLATFORM="linux-gnu-armv6"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-riscv64-gnu]
description = "Package riscv64 gnu binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="riscv64gc-unknown-linux-gnu"
PLATFORM="linux-gnu-riscv64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-riscv64-musl]
description = "Package riscv64 musl binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="riscv64gc-unknown-linux-musl"
PLATFORM="linux-musl-riscv64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-freebsd-x86]
description = "Package x86_64 FreeBSD binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="x86_64-unknown-freebsd"
PLATFORM="freebsd-x86_64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-freebsd-arm64]
description = "Package aarch64 FreeBSD binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema"
TARGET="aarch64-unknown-freebsd"
PLATFORM="freebsd-aarch64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-windows-gnu]
description = "Package Windows gnu binary"
dependencies = ["create-release-dir"]
script = '''
BINARY_NAME="notema.exe"
TARGET="x86_64-pc-windows-gnu"
PLATFORM="windows-gnu-x86_64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-macos-intel]
description = "Package Intel macOS binary"
dependencies = ["create-release-dir", "sign-macos-intel"]
script = '''
BINARY_NAME="notema"
TARGET="x86_64-apple-darwin"
PLATFORM="apple-darwin-x86_64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-macos-silicon]
description = "Package Apple Silicon macOS binary"
dependencies = ["create-release-dir", "sign-macos-silicon"]
script = '''
BINARY_NAME="notema"
TARGET="aarch64-apple-darwin"
PLATFORM="apple-darwin-aarch64"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-macos-universal]
description = "Package Universal macOS binary"
dependencies = ["create-release-dir", "sign-macos-universal"]
script = '''
BINARY_NAME="notema"
TARGET="universal-apple-darwin"
PLATFORM="apple-darwin-universal"
cp "target/${TARGET}/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

# Combined packaging tasks
[tasks.package-all]
description = "Package all platform binaries into zip files"
dependencies = [
    "package-termux",
    "package-arm64-musl",
    "package-arm64-gnu",
    "package-x86-gnu",
    "package-x86-musl",
    "package-i686-musl",
    "package-i686-gnu",
    "package-i586-musl",
    "package-armv7-musl",
    "package-armv7-gnu",
    "package-armv6-musl",
    "package-armv6-gnu",
    "package-riscv64-musl",
    "package-riscv64-gnu",
    "package-freebsd-x86",
    "package-freebsd-arm64",
    "package-windows-gnu",
    "package-macos-intel",
    "package-macos-silicon",
    "package-macos-universal"
]

# The release command: every artifact buildable on a Mac — all standard platform
# binaries plus the signed+notarized macOS FUSE builds. The Linux FUSE artifacts
# are built by the release workflow; every other platform builds FUSE natively
# (see the FUSE section).
[tasks.release]
description = "Build, sign, package and notarize every release artifact buildable on a Mac"
dependencies = [
    "check-apple-credentials",
    "run-tests",
    "build-all",
    "package-all",
    "notarize-macos-intel",
    "notarize-macos-silicon",
    "notarize-macos-universal",
    "notarize-fuse-macos-intel",
    "notarize-fuse-macos-silicon",
    "notarize-fuse-macos-universal"
]

# A release is signed and notarized, so refuse to start one without the signing
# identity (.env) and the notarization keychain profile. Local, unsigned builds
# use `cargo build --release` instead.
[tasks.check-apple-credentials]
description = "Fail early unless the signing identity and notarization keychain profile are set up"
script = '''
if [ -f ./.env ]; then
    set -a
    # shellcheck disable=SC1091
    . ./.env
    set +a
fi
if [ -z "$APPLE_DEVELOPER_ID" ]; then
    echo "release needs APPLE_DEVELOPER_ID for signing; set it in ./.env," >&2
    echo "or use \`cargo build --release\` for an unsigned local build." >&2
    exit 1
fi
if [ -z "$APPLE_NOTARY_PROFILE" ]; then
    echo "release needs APPLE_NOTARY_PROFILE — the name of a notarytool keychain profile; set it in ./.env." >&2
    echo "One profile can be shared across projects; create it once with" >&2
    echo "  xcrun notarytool store-credentials <name> --apple-id <apple-id> --team-id <team-id>" >&2
    exit 1
fi
if ! xcrun notarytool history --keychain-profile "$APPLE_NOTARY_PROFILE" >/dev/null 2>&1; then
    echo "the \"$APPLE_NOTARY_PROFILE\" keychain profile does not work; create it with" >&2
    echo "  xcrun notarytool store-credentials \"$APPLE_NOTARY_PROFILE\" --apple-id <apple-id> --team-id <team-id>" >&2
    exit 1
fi
echo "Signing identity and notarization profile present."
'''

[tasks.sign-macos-intel]
description = "Sign Intel macOS binary if APPLE_DEVELOPER_ID is set"
dependencies = ["build-macos-intel"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
BINARY_PATH="target/x86_64-apple-darwin/release/notema"
if [ -z "$APPLE_DEVELOPER_ID" ]; then
    echo "APPLE_DEVELOPER_ID not set, cannot sign Intel macOS binary." >&2
    exit 1
fi
codesign --sign "$APPLE_DEVELOPER_ID" --timestamp --options runtime "$BINARY_PATH"
'''

[tasks.sign-macos-silicon]
description = "Sign Apple Silicon macOS binary if APPLE_DEVELOPER_ID is set"
dependencies = ["build-macos-silicon"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
BINARY_PATH="target/aarch64-apple-darwin/release/notema"
if [ -z "$APPLE_DEVELOPER_ID" ]; then
    echo "APPLE_DEVELOPER_ID not set, cannot sign Apple Silicon macOS binary." >&2
    exit 1
fi
codesign --sign "$APPLE_DEVELOPER_ID" --timestamp --options runtime "$BINARY_PATH"
'''

[tasks.sign-macos-universal]
description = "Sign Universal macOS binary if APPLE_DEVELOPER_ID is set"
dependencies = ["build-macos-universal"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
BINARY_PATH="target/universal-apple-darwin/release/notema"
if [ -z "$APPLE_DEVELOPER_ID" ]; then
    echo "APPLE_DEVELOPER_ID not set, cannot sign Universal macOS binary." >&2
    exit 1
fi
codesign --sign "$APPLE_DEVELOPER_ID" --timestamp --options runtime "$BINARY_PATH"
'''

# Notarization (macOS zips): credentials come from the notarytool keychain
# profile named by APPLE_NOTARY_PROFILE in ./.env — a one-time
# `xcrun notarytool store-credentials` per machine, shareable across projects
# (see docs/RELEASING.md) — so no secret ever sits in ./.env or on argv.
# check-apple-credentials verifies the profile works before a release starts.
[tasks.notarize-macos-intel]
description = "Notarize Intel macOS zip via the notarytool keychain profile"
dependencies = ["package-macos-intel"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
xcrun notarytool submit "release/apple-darwin-x86_64.zip" --keychain-profile "$APPLE_NOTARY_PROFILE" --wait
'''

[tasks.notarize-macos-silicon]
description = "Notarize Apple Silicon macOS zip via the notarytool keychain profile"
dependencies = ["package-macos-silicon"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
xcrun notarytool submit "release/apple-darwin-aarch64.zip" --keychain-profile "$APPLE_NOTARY_PROFILE" --wait
'''

[tasks.notarize-macos-universal]
description = "Notarize Universal macOS zip via the notarytool keychain profile"
dependencies = ["package-macos-universal"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
xcrun notarytool submit "release/apple-darwin-universal.zip" --keychain-profile "$APPLE_NOTARY_PROFILE" --wait
'''

# ------------------------------------------------------------------------------
# macOS FUSE builds
#
# The same `notema` binary built with `--features fuse` (mounts an encrypted
# journal as a decrypted filesystem). Links libfuse3, so it needs macFUSE or
# fuse-t installed to build and run. Zips are `<platform>-fuse.zip`; builds go to
# `target/fuse/` so they don't clobber the standard artifacts.
#
# `release` builds all three macOS FUSE artifacts (Intel, Apple Silicon,
# universal); the release workflow adds the two 64-bit linux-gnu ones. Every
# other platform builds FUSE natively with `cargo build --release --features fuse`.
# ------------------------------------------------------------------------------

[tasks.build-fuse-macos-intel]
description = "Build Intel macOS 10.12 and newer with FUSE"
command = "cargo"
args = ["build", "--release", "--locked", "--features", "fuse", "--target", "x86_64-apple-darwin"]
# Cross-compiling the Intel slice on an Apple Silicon host: the pkg-config crate
# refuses cross builds unless PKG_CONFIG_ALLOW_CROSS is set. The host's fuse3.pc
# is valid for the x86_64 slice too, since fuse-t ships universal dylibs.
env = { CARGO_TARGET_DIR = "target/fuse", PKG_CONFIG_ALLOW_CROSS = "1", MACOSX_DEPLOYMENT_TARGET = "10.12" }
env_files = ["./.env"]

[tasks.build-fuse-macos-silicon]
description = "Build Apple Silicon macOS 11 and newer with FUSE"
command = "cargo"
args = ["build", "--release", "--locked", "--features", "fuse", "--target", "aarch64-apple-darwin"]
env = { CARGO_TARGET_DIR = "target/fuse", MACOSX_DEPLOYMENT_TARGET = "11.0" }
env_files = ["./.env"]

[tasks.build-fuse-macos-universal]
description = "Build universal macOS FUSE binary (Intel + Apple Silicon)"
dependencies = ["build-fuse-macos-intel", "build-fuse-macos-silicon"]
script = '''
mkdir -p target/fuse/universal-apple-darwin/release
lipo -create \
    target/fuse/x86_64-apple-darwin/release/notema \
    target/fuse/aarch64-apple-darwin/release/notema \
    -output target/fuse/universal-apple-darwin/release/notema
'''

# Signing (macOS FUSE binaries)
[tasks.sign-fuse-macos-intel]
description = "Sign Intel macOS FUSE binary if APPLE_DEVELOPER_ID is set"
dependencies = ["build-fuse-macos-intel"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
BINARY_PATH="target/fuse/x86_64-apple-darwin/release/notema"
if [ -z "$APPLE_DEVELOPER_ID" ]; then
    echo "APPLE_DEVELOPER_ID not set, cannot sign Intel macOS FUSE binary." >&2
    exit 1
fi
# Disable library validation so hardened runtime allows loading fuse-t/macFUSE's
# libfuse3, which is signed by a different vendor's Team ID. Notarization still
# passes; the entitlement is on Apple's allowed list.
codesign --sign "$APPLE_DEVELOPER_ID" --timestamp --options runtime \
    --entitlements crates/notema-fuse/fuse.entitlements "$BINARY_PATH"
'''

[tasks.sign-fuse-macos-silicon]
description = "Sign Apple Silicon macOS FUSE binary if APPLE_DEVELOPER_ID is set"
dependencies = ["build-fuse-macos-silicon"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
BINARY_PATH="target/fuse/aarch64-apple-darwin/release/notema"
if [ -z "$APPLE_DEVELOPER_ID" ]; then
    echo "APPLE_DEVELOPER_ID not set, cannot sign Apple Silicon macOS FUSE binary." >&2
    exit 1
fi
# Disable library validation so hardened runtime allows loading fuse-t/macFUSE's
# libfuse3, which is signed by a different vendor's Team ID. Notarization still
# passes; the entitlement is on Apple's allowed list.
codesign --sign "$APPLE_DEVELOPER_ID" --timestamp --options runtime \
    --entitlements crates/notema-fuse/fuse.entitlements "$BINARY_PATH"
'''

[tasks.sign-fuse-macos-universal]
description = "Sign Universal macOS FUSE binary if APPLE_DEVELOPER_ID is set"
dependencies = ["build-fuse-macos-universal"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
BINARY_PATH="target/fuse/universal-apple-darwin/release/notema"
if [ -z "$APPLE_DEVELOPER_ID" ]; then
    echo "APPLE_DEVELOPER_ID not set, cannot sign Universal macOS FUSE binary." >&2
    exit 1
fi
# Disable library validation so hardened runtime allows loading fuse-t/macFUSE's
# libfuse3, which is signed by a different vendor's Team ID. Notarization still
# passes; the entitlement is on Apple's allowed list.
codesign --sign "$APPLE_DEVELOPER_ID" --timestamp --options runtime \
    --entitlements crates/notema-fuse/fuse.entitlements "$BINARY_PATH"
'''

# Packaging (FUSE): same `notema` binary, `<platform>-fuse.zip` name.
[tasks.package-fuse-macos-intel]
description = "Package Intel macOS FUSE binary"
dependencies = ["create-release-dir", "sign-fuse-macos-intel"]
script = '''
BINARY_NAME="notema"
PLATFORM="apple-darwin-x86_64-fuse"
cp "target/fuse/x86_64-apple-darwin/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-fuse-macos-silicon]
description = "Package Apple Silicon macOS FUSE binary"
dependencies = ["create-release-dir", "sign-fuse-macos-silicon"]
script = '''
BINARY_NAME="notema"
PLATFORM="apple-darwin-aarch64-fuse"
cp "target/fuse/aarch64-apple-darwin/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

[tasks.package-fuse-macos-universal]
description = "Package Universal macOS FUSE binary"
dependencies = ["create-release-dir", "sign-fuse-macos-universal"]
script = '''
BINARY_NAME="notema"
PLATFORM="apple-darwin-universal-fuse"
cp "target/fuse/universal-apple-darwin/release/${BINARY_NAME}" "release/"
cd release
zip "${PLATFORM}.zip" "${BINARY_NAME}"
rm "${BINARY_NAME}"
'''

# Notarization (macOS FUSE zips): same APPLE_NOTARY_PROFILE keychain profile as
# the standard notarize tasks above.
[tasks.notarize-fuse-macos-intel]
description = "Notarize Intel macOS FUSE zip via the notarytool keychain profile"
dependencies = ["package-fuse-macos-intel"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
xcrun notarytool submit "release/apple-darwin-x86_64-fuse.zip" --keychain-profile "$APPLE_NOTARY_PROFILE" --wait
'''

[tasks.notarize-fuse-macos-silicon]
description = "Notarize Apple Silicon macOS FUSE zip via the notarytool keychain profile"
dependencies = ["package-fuse-macos-silicon"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
xcrun notarytool submit "release/apple-darwin-aarch64-fuse.zip" --keychain-profile "$APPLE_NOTARY_PROFILE" --wait
'''

[tasks.notarize-fuse-macos-universal]
description = "Notarize Universal macOS FUSE zip via the notarytool keychain profile"
dependencies = ["package-fuse-macos-universal"]
env_files = ["./.env"]
condition = { files_exist = ["./.env"] }
script = '''
xcrun notarytool submit "release/apple-darwin-universal-fuse.zip" --keychain-profile "$APPLE_NOTARY_PROFILE" --wait
'''

# Combined FUSE build/package/release
[tasks.build-fuse-macos-all]
description = "Build all macOS FUSE targets"
dependencies = [
    "build-fuse-macos-intel",
    "build-fuse-macos-silicon",
    "build-fuse-macos-universal"
]

[tasks.package-fuse-macos-all]
description = "Package all macOS FUSE binaries"
dependencies = [
    "package-fuse-macos-intel",
    "package-fuse-macos-silicon",
    "package-fuse-macos-universal"
]

# Build and package the macOS FUSE release: signed + notarized `-fuse` zips.
[tasks.release-fuse-macos]
description = "Build, sign, package and notarize the macOS FUSE artifacts"
dependencies = [
    "check-apple-credentials",
    "run-tests",
    "build-fuse-macos-all",
    "package-fuse-macos-all",
    "notarize-fuse-macos-intel",
    "notarize-fuse-macos-silicon",
    "notarize-fuse-macos-universal"
]