Merge pull request #16 from ilammy/configure-min-sdk

Accurate version bookkeeping

assets/AppleTV/Info.plist

@@ -15,10 +15,10 @@
 	<key>CFBundlePackageType</key>
 	<string>FMWK</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
+	<string>$(OPENSSL_VERSION)</string>
 	<key>CFBundleVersion</key>
 	<string>1</string>
 	<key>MinimumOSVersion</key>
-	<string>11.0</string>
+	<string>$(MIN_SDK_VERSION)</string>
 </dict>
 </plist>

assets/MacOSX/Info.plist

@@ -15,10 +15,10 @@
 	<key>CFBundlePackageType</key>
 	<string>FMWK</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
+	<string>$(OPENSSL_VERSION)</string>
 	<key>CFBundleVersion</key>
 	<string>1</string>
 	<key>MinimumOSVersion</key>
-	<string>10.11</string>
+	<string>$(MIN_SDK_VERSION)</string>
 </dict>
 </plist>

assets/WatchOS/Info.plist

@@ -15,10 +15,10 @@
 	<key>CFBundlePackageType</key>
 	<string>FMWK</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
+	<string>$(OPENSSL_VERSION)</string>
 	<key>CFBundleVersion</key>
 	<string>1</string>
 	<key>MinimumOSVersion</key>
-	<string>4.0</string>
+	<string>$(MIN_SDK_VERSION)</string>
 </dict>
 </plist>

assets/iPhone/Info.plist

@@ -15,10 +15,10 @@
 	<key>CFBundlePackageType</key>
 	<string>FMWK</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0</string>
+	<string>$(OPENSSL_VERSION)</string>
 	<key>CFBundleVersion</key>
 	<string>1</string>
 	<key>MinimumOSVersion</key>
-	<string>11.0</string>
+	<string>$(MIN_SDK_VERSION)</string>
 </dict>
 </plist>

build-libssl.sh

@@ -53,8 +53,13 @@ echo_help()
   echo " -h, --help                        Print help (this message)"
   echo "     --macos-sdk=SDKVERSION        Override macOS SDK version"
   echo "     --ios-sdk=SDKVERSION          Override iOS SDK version"
-  echo "     --noparallel                  Disable running make with parallel jobs (make -j)"
   echo "     --tvos-sdk=SDKVERSION         Override tvOS SDK version"
+  echo "     --watchos-sdk=SDKVERSION      Override watchOS SDK version"
+  echo "     --min-macos-sdk=SDKVERSION    Set minimum macOS SDK version (default: $MACOS_MIN_SDK_VERSION)"
+  echo "     --min-ios-sdk=SDKVERSION      Set minimum iOS SDK version (default: $IOS_MIN_SDK_VERSION)"
+  echo "     --min-tvos-sdk=SDKVERSION     Set minimum tvOS SDK version (default: $TVOS_MIN_SDK_VERSION)"
+  echo "     --min-watchos-sdk=SDKVERSION  Set minimum watchOS SDK version (default: $WATCHOS_MIN_SDK_VERSION)"
+  echo "     --noparallel                  Disable running make with parallel jobs (make -j)"
   echo "     --disable-bitcode             Disable embedding Bitcode"
   echo " -v, --verbose                     Enable verbose logging"
   echo "     --verbose-on-error            Dump last 500 lines from log file if an error occurs (for Travis builds)"
@@ -265,6 +270,22 @@ case $i in
     WATCHOS_SDKVERSION="${i#*=}"
     shift
     ;;
+  --min-macos-sdk=*)
+    MACOS_MIN_SDK_VERSION="${i#*=}"
+    shift
+    ;;
+  --min-ios-sdk=*)
+    IOS_MIN_SDK_VERSION="${i#*=}"
+    shift
+    ;;
+  --min-tvos-sdk=*)
+    TVOS_MIN_SDK_VERSION="${i#*=}"
+    shift
+    ;;
+  --min-watchos-sdk=*)
+    WATCHOS_MIN_SDK_VERSION="${i#*=}"
+    shift
+    ;;
   -v|--verbose)
     LOG_VERBOSE="verbose"
     ;;
@@ -413,10 +434,10 @@ if [ "${BUILD_TYPE}" == "archs" ]; then
 else
   echo "  Targets: ${TARGETS}"
 fi
-echo "  macOS SDK: ${MACOS_SDKVERSION}"
+echo "  macOS SDK: ${MACOS_SDKVERSION} (min ${MACOS_MIN_SDK_VERSION})"
-echo "  iOS SDK: ${IOS_SDKVERSION}"
+echo "  iOS SDK: ${IOS_SDKVERSION} (min ${IOS_MIN_SDK_VERSION})"
-echo "  tvOS SDK: ${TVOS_SDKVERSION}"
+echo "  tvOS SDK: ${TVOS_SDKVERSION} (min ${TVOS_MIN_SDK_VERSION})"
-echo "  watchOS SDK: ${WATCHOS_SDKVERSION}"
+echo "  watchOS SDK: ${WATCHOS_SDKVERSION} (min ${WATCHOS_MIN_SDK_VERSION})"
 if [ "${CONFIG_DISABLE_BITCODE}" == "true" ]; then
   echo "  Bitcode embedding disabled"
 fi

create-openssl-framework.sh

@@ -39,6 +39,80 @@ function check_bitcode() {
 	fi
 }
 
+# Inspect Mach-O load commands to get minimum SDK version.
+#
+# Depending on the actual minimum SDK version it may look like this
+# (for modern SDKs):
+#
+#     Load command 1
+#            cmd LC_BUILD_VERSION
+#        cmdsize 24
+#       platform 8
+#            sdk 13.2                   <-- target SDK
+#          minos 12.0                   <-- minimum SDK
+#         ntools 0
+#
+# Or like this for older versions, with a platform-dependent tag:
+#
+#     Load command 1
+#           cmd LC_VERSION_MIN_WATCHOS
+#       cmdsize 16
+#       version 4.0                     <-- minimum SDK
+#           sdk 6.1                     <-- target SDK
+function get_min_sdk() {
+    local file=$1
+    set +o pipefail
+    otool -l "$file" | awk "
+        /^Load command/ {
+            last_command = \"\"
+        }
+        \$1 == \"cmd\" {
+            last_command = \$2
+        }
+        (last_command ~ /LC_BUILD_VERSION/ && \$1 == \"minos\") ||
+        (last_command ~ /^LC_VERSION_MIN_/ && \$1 == \"version\") {
+            print \$2
+            exit
+        }
+    "
+    set -o pipefail
+}
+
+# Read OpenSSL version from opensslv.h file.
+#
+# In modern OpenSSL releases the version line looks like this:
+#
+#     # define OPENSSL_VERSION_TEXT    "OpenSSL 1.1.1g  21 Apr 2020"
+#
+# But for older versions with FIPS module it may look like this:
+#
+#     # ifdef OPENSSL_FIPS
+#     #  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2u-fips  20 Dec 2019"
+#     # else
+#     #  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2u  20 Dec 2019"
+#     # endif
+#
+# For App Store validation purposes, replace trailing letter with
+# 2-digit offset from 'a' (ASCII 97), plus 1 for 1-based
+#
+#   1.0.2u
+#   'u' = 117 -> 20 + 1 = 21
+#   1.0.221
+#
+#   1.1.1g
+#   'g' = 103 -> 6 + 1 = 07 (zero-padded)
+#   1.1.107
+#
+function get_openssl_version() {
+    local opensslv=$1
+    local std_version=$(awk '/define OPENSSL_VERSION_TEXT/ && !/-fips/ {print $5}' "$opensslv")
+    local generic_version=${std_version%?}
+    local subpatch=${std_version: -1}
+    local subpatch_number=$(($(printf '%d' \'$subpatch) - 97 + 1))
+    local normalized_version="${generic_version}$(printf '%02d' $subpatch_number)"
+    echo $normalized_version
+}
+
 if [ $FWTYPE == "dynamic" ]; then
     DEVELOPER=`xcode-select -print-path`
     FW_EXEC_NAME="${FWNAME}.framework/${FWNAME}"
@@ -62,20 +136,21 @@ if [ $FWTYPE == "dynamic" ]; then
         CROSS_SDK="${PLATFORM}${SDKVERSION}.sdk"
         SDK="${CROSS_TOP}/SDKs/${CROSS_SDK}"
 
+        MIN_SDK_VERSION=$(get_min_sdk "${TARGETDIR}/lib/libcrypto.a")
         if [[ $PLATFORM == AppleTVSimulator* ]]; then
-            MIN_SDK="-tvos_simulator_version_min 11.0"
+            MIN_SDK="-tvos_simulator_version_min $MIN_SDK_VERSION"
         elif [[ $PLATFORM == AppleTV* ]]; then
-            MIN_SDK="-tvos_version_min 11.0"
+            MIN_SDK="-tvos_version_min $MIN_SDK_VERSION"
         elif [[ $PLATFORM == MacOSX* ]]; then
-            MIN_SDK="-macosx_version_min 10.11"
+            MIN_SDK="-macosx_version_min $MIN_SDK_VERSION"
         elif [[ $PLATFORM == iPhoneSimulator* ]]; then
-            MIN_SDK="-ios_simulator_version_min 11.0"
+            MIN_SDK="-ios_simulator_version_min $MIN_SDK_VERSION"
         elif [[ $PLATFORM == WatchOS* ]]; then
-            MIN_SDK="-watchos_version_min 4.0"
+            MIN_SDK="-watchos_version_min $MIN_SDK_VERSION"
         elif [[ $PLATFORM == WatchSimulator* ]]; then
-            MIN_SDK="-watchos_simulator_version_min 4.0"
+            MIN_SDK="-watchos_simulator_version_min $MIN_SDK_VERSION"
         else
-            MIN_SDK="-ios_version_min 11.0"
+            MIN_SDK="-ios_version_min $MIN_SDK_VERSION"
         fi
 
         #cd $TARGETDIR
@@ -117,6 +192,11 @@ if [ $FWTYPE == "dynamic" ]; then
             lipo -create ${DYLIBS[@]} -output $FWDIR/$FWNAME
             cp -r include/$FWNAME/* $FWDIR/Headers/
             cp -L assets/$SYS/Info.plist $FWDIR/Info.plist
+            MIN_SDK_VERSION=$(get_min_sdk "$FWDIR/$FWNAME")
+            OPENSSL_VERSION=$(get_openssl_version "$FWDIR/Headers/opensslv.h")
+            sed -e "s/\\\$(MIN_SDK_VERSION)/$MIN_SDK_VERSION/g" \
+                -e "s/\\\$(OPENSSL_VERSION)/$OPENSSL_VERSION/g" \
+                -i '' "$FWDIR/Info.plist"
             echo "Created $FWDIR"
             check_bitcode $FWDIR
         else
@@ -136,6 +216,11 @@ else
             libtool -static -o $FWDIR/$FWNAME lib/libcrypto-$SYS.a lib/libssl-$SYS.a
             cp -r include/$FWNAME/* $FWDIR/Headers/
             cp -L assets/$SYS/Info.plist $FWDIR/Info.plist
+            MIN_SDK_VERSION=$(get_min_sdk "$FWDIR/$FWNAME")
+            OPENSSL_VERSION=$(get_openssl_version "$FWDIR/Headers/opensslv.h")
+            sed -e "s/\\\$(MIN_SDK_VERSION)/$MIN_SDK_VERSION/g" \
+                -e "s/\\\$(OPENSSL_VERSION)/$OPENSSL_VERSION/g" \
+                -i '' "$FWDIR/Info.plist"
             echo "Created $FWDIR"
             check_bitcode $FWDIR
         else