Delete .github/workflows/openbsd-build.yml

Updated the gtk-mac-bundler bundle translation roots for both gtk30 and zoitechat to ${prefix}/share/locale (from ${prefix}/locale).

.github/workflows/macos-build.yml

@@ -0,0 +1,359 @@
+name: macOS Build
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  macos_build_arm64:
+    runs-on: macos-15-arm64
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Install build dependencies
+        run: |
+          set -eux
+          brew update
+          brew install \
+            meson ninja pkg-config gettext perl \
+            gtk+3 gdk-pixbuf pango adwaita-icon-theme \
+            hicolor-icon-theme glib dbus \
+            enchant gtk-mac-integration
+
+          if ! command -v gtk-mac-bundler >/dev/null 2>&1 && ! python3 -c 'import gtk_mac_bundler' >/dev/null 2>&1; then
+            curl -fsSL https://codeload.github.com/jralls/gtk-mac-bundler/tar.gz/refs/heads/master -o /tmp/gtk-mac-bundler.tar.gz
+            rm -rf /tmp/gtk-mac-bundler
+            mkdir -p /tmp/gtk-mac-bundler
+            tar -xzf /tmp/gtk-mac-bundler.tar.gz -C /tmp/gtk-mac-bundler --strip-components=1
+            (cd /tmp/gtk-mac-bundler && make install)
+          fi
+
+      - name: Configure and build (arm64)
+        run: |
+          set -eux
+          rm -rf build-macos-arm64 stage/arm64
+
+          CFLAGS="-arch arm64" LDFLAGS="-arch arm64" meson setup build-macos-arm64 \
+            --prefix="$PWD/stage/arm64" \
+            -Dgtk3=true \
+            -Dtext-frontend=true \
+            -Dlibcanberra=disabled \
+            -Dwith-perl=perl \
+            -Dwith-python=python3 \
+            -Dauto_features=enabled
+
+          CFLAGS="-arch arm64" LDFLAGS="-arch arm64" meson compile -C build-macos-arm64
+          meson install -C build-macos-arm64
+
+      - name: Stage runtime dependencies for bundling (arm64)
+        run: |
+          set -eux
+          STAGE_PREFIX="$PWD/stage/arm64"
+          BREW_PREFIX="$(brew --prefix)"
+          ENCHANT_PREFIX="$(brew --prefix enchant)"
+
+          mkdir -p "$STAGE_PREFIX/lib" "$STAGE_PREFIX/share"
+          rsync -a "$BREW_PREFIX/lib/gtk-3.0" "$STAGE_PREFIX/lib/"
+          rsync -a "$BREW_PREFIX/lib/gdk-pixbuf-2.0" "$STAGE_PREFIX/lib/"
+          rsync -a "$BREW_PREFIX/share/locale/" "$STAGE_PREFIX/share/locale/"
+
+          mkdir -p "$STAGE_PREFIX/opt"
+          rm -rf "$STAGE_PREFIX/opt/enchant"
+          rsync -aL "$ENCHANT_PREFIX/" "$STAGE_PREFIX/opt/enchant/"
+
+      - name: Package unsigned .app (arm64)
+        run: |
+          set -eux
+          VERSION="$(git describe --tags --always)"
+          export VERSION
+
+          (
+            cd osx
+            BUNDLE_PREFIX="$PWD/../stage/arm64/" \
+            ENCHANT_PREFIX="$PWD/../stage/arm64/opt/enchant" \
+            TARGET_ARCHES="arm64" \
+            ./makebundle.sh
+          )
+
+          mv osx/ZoiteChat-*.app.zip ./ZoiteChat-arm64.app.zip
+
+      - name: Upload arm64 macOS app artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: zoitechat-macos-arm64
+          path: ZoiteChat-arm64.app.zip
+          if-no-files-found: error
+          retention-days: 14
+
+  macos_build_x86_64:
+    runs-on: macos-15-intel
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Install build dependencies
+        run: |
+          set -eux
+          brew update
+          brew install \
+            meson ninja pkg-config gettext perl \
+            gtk+3 gdk-pixbuf pango adwaita-icon-theme \
+            hicolor-icon-theme glib dbus \
+            enchant gtk-mac-integration
+
+          if ! command -v gtk-mac-bundler >/dev/null 2>&1 && ! python3 -c 'import gtk_mac_bundler' >/dev/null 2>&1; then
+            curl -fsSL https://codeload.github.com/jralls/gtk-mac-bundler/tar.gz/refs/heads/master -o /tmp/gtk-mac-bundler.tar.gz
+            rm -rf /tmp/gtk-mac-bundler
+            mkdir -p /tmp/gtk-mac-bundler
+            tar -xzf /tmp/gtk-mac-bundler.tar.gz -C /tmp/gtk-mac-bundler --strip-components=1
+            (cd /tmp/gtk-mac-bundler && make install)
+          fi
+
+      - name: Configure and build (x86_64)
+        run: |
+          set -eux
+          rm -rf build-macos-x86_64 stage/x86_64
+
+          CFLAGS="-arch x86_64" LDFLAGS="-arch x86_64" meson setup build-macos-x86_64 \
+            --prefix="$PWD/stage/x86_64" \
+            -Dgtk3=true \
+            -Dtext-frontend=true \
+            -Dlibcanberra=disabled \
+            -Ddarwin-arch-sanity-check=true \
+            -Dwith-perl=perl \
+            -Dwith-python=python3 \
+            -Dauto_features=enabled
+
+          CFLAGS="-arch x86_64" LDFLAGS="-arch x86_64" meson compile -C build-macos-x86_64
+          meson install -C build-macos-x86_64
+
+
+      - name: Stage runtime dependencies for bundling (x86_64)
+        run: |
+          set -eux
+          STAGE_PREFIX="$PWD/stage/x86_64"
+          BREW_PREFIX="$(brew --prefix)"
+          ENCHANT_PREFIX="$(brew --prefix enchant)"
+
+          mkdir -p "$STAGE_PREFIX/lib" "$STAGE_PREFIX/share"
+          rsync -a "$BREW_PREFIX/lib/gtk-3.0" "$STAGE_PREFIX/lib/"
+          rsync -a "$BREW_PREFIX/lib/gdk-pixbuf-2.0" "$STAGE_PREFIX/lib/"
+          rsync -a "$BREW_PREFIX/share/locale/" "$STAGE_PREFIX/share/locale/"
+
+          mkdir -p "$STAGE_PREFIX/opt"
+          rm -rf "$STAGE_PREFIX/opt/enchant"
+          rsync -aL "$ENCHANT_PREFIX/" "$STAGE_PREFIX/opt/enchant/"
+
+      - name: Package unsigned .app (x86_64)
+        run: |
+          set -eux
+          VERSION="$(git describe --tags --always)"
+          export VERSION
+
+          (
+            cd osx
+            BUNDLE_PREFIX="$PWD/../stage/x86_64/" \
+            ENCHANT_PREFIX="$PWD/../stage/x86_64/opt/enchant" \
+            TARGET_ARCHES="x86_64" \
+            ./makebundle.sh
+          )
+
+          mv osx/ZoiteChat-*.app.zip ./ZoiteChat-x86_64.app.zip
+
+      - name: Upload x86_64 macOS app artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: zoitechat-macos-x86_64
+          path: ZoiteChat-x86_64.app.zip
+          if-no-files-found: error
+          retention-days: 14
+
+  macos_assemble_universal_unsigned:
+    needs:
+      - macos_build_arm64
+      - macos_build_x86_64
+    runs-on: macos-latest
+
+    steps:
+      - name: Download arm64 app artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: zoitechat-macos-arm64
+          path: dist/arm64
+
+      - name: Download x86_64 app artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: zoitechat-macos-x86_64
+          path: dist/x86_64
+
+      - name: Merge app bundles into universal
+        run: |
+          set -eux
+          unzip -q dist/arm64/ZoiteChat-arm64.app.zip -d dist/arm64
+          unzip -q dist/x86_64/ZoiteChat-x86_64.app.zip -d dist/x86_64
+
+          ARM_APP="$(find dist/arm64 -maxdepth 2 -name 'ZoiteChat.app' -type d | head -n 1)"
+          X86_APP="$(find dist/x86_64 -maxdepth 2 -name 'ZoiteChat.app' -type d | head -n 1)"
+          UNIVERSAL_APP="dist/universal/ZoiteChat.app"
+
+          rm -rf "$UNIVERSAL_APP"
+          mkdir -p dist/universal
+          cp -a "$ARM_APP" "$UNIVERSAL_APP"
+
+          while IFS= read -r relpath; do
+            arm_file="$ARM_APP/$relpath"
+            x86_file="$X86_APP/$relpath"
+            out_file="$UNIVERSAL_APP/$relpath"
+
+            if [ -f "$x86_file" ] && file -b "$arm_file" | grep -q 'Mach-O'; then
+              mkdir -p "$(dirname "$out_file")"
+              lipo -create "$arm_file" "$x86_file" -output "$out_file"
+            fi
+          done < <(cd "$ARM_APP" && find . -type f | sed 's|^./||')
+
+          while IFS= read -r macho_path; do
+            archs="$(lipo -archs "$macho_path")"
+            echo "$macho_path -> $archs"
+            echo " $archs " | grep -q ' arm64 '
+            echo " $archs " | grep -q ' x86_64 '
+          done < <(find "$UNIVERSAL_APP" -type f -exec sh -c 'file -b "$1" | grep -q "Mach-O" && printf "%s\n" "$1"' _ {} \;)
+
+          VERSION="$(git -C "$GITHUB_WORKSPACE" describe --tags --always)"
+          ditto -c -k --sequesterRsrc --keepParent "$UNIVERSAL_APP" "dist/ZoiteChat-$VERSION.app.zip"
+      - name: Upload unsigned macOS app artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: zoitechat-macos-unsigned
+          
+          path: dist/ZoiteChat-*.app.zip
+          if-no-files-found: error
+          retention-days: 14
+
+  macos_release_signed:
+    needs: macos_assemble_universal_unsigned
+    runs-on: macos-latest
+    if: >-
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/master'
+
+    steps:
+      - name: Check signing secrets availability
+        id: signing_secrets
+        env:
+          APPLE_DEVELOPER_ID_APPLICATION: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION }}
+          APPLE_DEVELOPER_ID_CERT_P12: ${{ secrets.APPLE_DEVELOPER_ID_CERT_P12 }}
+          APPLE_DEVELOPER_ID_CERT_P12_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERT_P12_PASSWORD }}
+          APPLE_NOTARY_API_KEY: ${{ secrets.APPLE_NOTARY_API_KEY }}
+          APPLE_NOTARY_API_KEY_ID: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
+          APPLE_NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }}
+        run: |
+          set -eu
+          required_secrets=(
+            APPLE_DEVELOPER_ID_APPLICATION
+            APPLE_DEVELOPER_ID_CERT_P12
+            APPLE_DEVELOPER_ID_CERT_P12_PASSWORD
+            APPLE_NOTARY_API_KEY
+            APPLE_NOTARY_API_KEY_ID
+            APPLE_NOTARY_ISSUER_ID
+          )
+
+          missing=0
+          for key in "${required_secrets[@]}"; do
+            if [ -z "${!key:-}" ]; then
+              echo "Missing secret: $key"
+              missing=1
+            fi
+          done
+
+          if [ "$missing" -eq 1 ]; then
+            echo "ready=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Skip signing because required secrets are missing
+        if: steps.signing_secrets.outputs.ready != 'true'
+        run: echo "Signing and notarization skipped due to missing required secrets."
+
+      - name: Download unsigned app artifact
+        if: steps.signing_secrets.outputs.ready == 'true'
+        uses: actions/download-artifact@v4
+        with:
+          name: zoitechat-macos-unsigned
+          path: dist
+
+      - name: Import Developer ID certificate
+        if: steps.signing_secrets.outputs.ready == 'true'
+        env:
+          CERT_P12_BASE64: ${{ secrets.APPLE_DEVELOPER_ID_CERT_P12 }}
+          CERT_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERT_P12_PASSWORD }}
+        run: |
+          set -eux
+          echo "$CERT_P12_BASE64" | base64 --decode > certificate.p12
+
+          security create-keychain -p "" build.keychain
+          security set-keychain-settings -lut 21600 build.keychain
+          security unlock-keychain -p "" build.keychain
+          security import certificate.p12 -k build.keychain -P "$CERT_PASSWORD" -A -T /usr/bin/codesign
+          security list-keychains -d user -s build.keychain $(security list-keychains -d user | tr -d '"')
+          security set-key-partition-list -S apple-tool:,apple: -s -k "" build.keychain
+
+      - name: Codesign app bundle
+        if: steps.signing_secrets.outputs.ready == 'true'
+        env:
+          CODESIGN_IDENTITY: ${{ secrets.APPLE_DEVELOPER_ID_APPLICATION }}
+        run: |
+          set -eux
+          unzip -q dist/ZoiteChat-*.app.zip -d dist
+          APP_PATH="$(find dist -maxdepth 1 -name 'ZoiteChat.app' -type d | head -n 1)"
+
+          codesign --force --deep --options runtime --timestamp \
+            --sign "$CODESIGN_IDENTITY" "$APP_PATH"
+
+          codesign --verify --deep --strict --verbose=2 "$APP_PATH"
+          spctl --assess --type execute --verbose "$APP_PATH"
+
+      - name: Notarize and staple
+        if: steps.signing_secrets.outputs.ready == 'true'
+        env:
+          NOTARY_API_KEY_BASE64: ${{ secrets.APPLE_NOTARY_API_KEY }}
+          NOTARY_KEY_ID: ${{ secrets.APPLE_NOTARY_API_KEY_ID }}
+          NOTARY_ISSUER_ID: ${{ secrets.APPLE_NOTARY_ISSUER_ID }}
+        run: |
+          set -eux
+          APP_PATH="$(find dist -maxdepth 1 -name 'ZoiteChat.app' -type d | head -n 1)"
+          NOTARY_ZIP="dist/ZoiteChat-notarize.zip"
+          SIGNED_ZIP="dist/ZoiteChat-signed.app.zip"
+
+          echo "$NOTARY_API_KEY_BASE64" | base64 --decode > AuthKey_${NOTARY_KEY_ID}.p8
+          ditto -c -k --keepParent "$APP_PATH" "$NOTARY_ZIP"
+
+          xcrun notarytool submit "$NOTARY_ZIP" \
+            --key "AuthKey_${NOTARY_KEY_ID}.p8" \
+            --key-id "$NOTARY_KEY_ID" \
+            --issuer "$NOTARY_ISSUER_ID" \
+            --wait
+
+          xcrun stapler staple "$APP_PATH"
+          xcrun stapler validate "$APP_PATH"
+
+          ditto -c -k --sequesterRsrc --keepParent "$APP_PATH" "$SIGNED_ZIP"
+
+      - name: Upload signed macOS app artifact
+        if: steps.signing_secrets.outputs.ready == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: zoitechat-macos-signed
+          path: dist/ZoiteChat-signed.app.zip
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/openbsd-build.yml

@@ -1,118 +0,0 @@
-name: OpenBSD Build
-
-on:
-  push:
-    branches: [master]
-  pull_request:
-    branches: [master]
-
-jobs:
-  openbsd_package:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: true
-
-      - name: Build OpenBSD package
-        uses: vmactions/openbsd-vm@v1
-        with:
-          release: '7.5'
-          usesh: true
-          sync: rsync
-          run: |
-            set -eux
-
-            rdate -n pool.ntp.org
-            export PKG_PATH="https://ftp.openbsd.org/pub/OpenBSD/7.5/packages/$(uname -m)/"
-
-            pkg_add -U \
-              git \
-              meson ninja pkgconf gmake \
-              gettext-tools \
-              glib2 gtk+3 dbus-glib libcanberra \
-              luajit mono libgdiplus openssl
-
-            work="$(mktemp -d /tmp/zoitechat.XXXXXX)"
-            trap 'rm -rf "$work"' EXIT
-
-            rsync -a --delete "$GITHUB_WORKSPACE"/ "$work/src/"
-            cd "$work/src"
-
-            rm -rf build
-            meson setup build \
-              --prefix=/usr/local \
-              -Dtext-frontend=true \
-              -Dgtk3=true \
-              -Dplugin=false \
-              -Dauto_features=enabled
-
-            ninja -C build
-
-            staging="$work/staging"
-            rm -rf "$staging"
-            mkdir -p "$staging"
-
-            # Staged install
-            DESTDIR="$staging" meson install -C build --no-rebuild
-
-            # If these exist, something ignored DESTDIR (install scripts are leaking)
-            ls -l /usr/local/bin/zoitechat /usr/local/bin/thememan 2>/dev/null || true
-
-            sync
-            sleep 1
-            sync
-
-            # Freeze staged tree so pkg_create doesn't see moving targets
-            snap="$work/staging-snap"
-            rm -rf "$snap"
-            mkdir -p "$snap"
-            (cd "$staging" && pax -rw -pe . "$snap")
-
-            version="$(meson introspect --projectinfo build | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
-            pkg_name="zoitechat-${version}"
-            pkg_file="${pkg_name}.tgz"
-            plist="$work/openbsd-plist"
-            desc="$work/DESCR"
-
-            cat >"$desc" <<'EOF'
-            ZoiteChat is an IRC client (HexChat-derived) with a GTK UI and optional tools.
-            EOF
-
-            {
-              echo "@cwd /usr/local"
-
-              # Files + symlinks
-              find "$snap/usr/local" \( -type f -o -type l \) -print \
-                | LC_ALL=C sort \
-                | sed "s#^$snap/usr/local/##"
-
-              # Directories (reverse so children removed first)
-              find "$snap/usr/local" -mindepth 1 -type d -print \
-                | LC_ALL=C sort -r \
-                | sed "s#^$snap/usr/local/##" \
-                | sed 's#^#@dir #'
-            } > "$plist"
-
-            # OpenBSD pkg_create: COMMENT is set via -D COMMENT=... (mandatory), no -c flag exists.
-            # Create the .tgz in $work so we can copy it back out.
-            cd "$work"
-            pkg_create \
-              -B "$snap" \
-              -p /usr/local \
-              -f "$plist" \
-              -d "$desc" \
-              -D "COMMENT=ZoiteChat IRC client" \
-              -D "FULLPKGPATH=net/zoitechat" \
-              "$pkg_file"
-
-            mkdir -p "$GITHUB_WORKSPACE/artifacts"
-            cp "$work/$pkg_file" "$GITHUB_WORKSPACE/artifacts/"
-
-      - name: Upload OpenBSD package
-        uses: actions/upload-artifact@v4
-        with:
-          name: openbsd-package
-          path: artifacts/*.tgz

meson.build

@@ -10,6 +10,7 @@ project('zoitechat', 'c',
 
 i18n = import('i18n')
 gnome = import('gnome')
+fs = import('fs')
 cc = meson.get_compiler('c')
 
 
@@ -18,7 +19,14 @@ libgmodule_dep = dependency('gmodule-2.0')
 
 libcanberra_dep = dependency('libcanberra', version: '>= 0.22',
                              required: get_option('libcanberra'))
-dbus_glib_dep = dependency('dbus-glib-1', required: get_option('dbus'))
+dbus_required = get_option('dbus')
+if host_machine.system() == 'darwin'
+  if dbus_required.enabled()
+    warning('dbus-glib is not available on macOS; disabling DBus support')
+  endif
+  dbus_required = false
+endif
+dbus_glib_dep = dependency('dbus-glib-1', required: dbus_required)
 
 global_deps = []
 if cc.get_id() == 'msvc'
@@ -28,6 +36,82 @@ else
                           required: get_option('tls'))
 endif
 
+darwin_arch_sanity_check = get_option('darwin-arch-sanity-check')
+if host_machine.system() == 'darwin' and darwin_arch_sanity_check
+  darwin_arch_sanity_check_env = run_command('sh', '-c', 'printf %s "$ZOITECHAT_DARWIN_ARCH_SANITY_CHECK"', check: false).stdout().strip().to_lower()
+  if ['0', 'false', 'no', 'off'].contains(darwin_arch_sanity_check_env)
+    darwin_arch_sanity_check = false
+  endif
+endif
+
+if host_machine.system() == 'darwin' and darwin_arch_sanity_check
+  cflags_env = run_command('sh', '-c', 'printf %s "$CFLAGS"', check: false).stdout().strip()
+  ldflags_env = run_command('sh', '-c', 'printf %s "$LDFLAGS"', check: false).stdout().strip()
+  c_args_opt = ' ' + ' '.join(get_option('c_args')) + ' '
+  c_link_args_opt = ' ' + ' '.join(get_option('c_link_args')) + ' '
+  all_cflags = cflags_env + ' ' + c_args_opt
+  all_ldflags = ldflags_env + ' ' + c_link_args_opt
+  pkgconfig_glib = run_command('pkg-config', '--libs-only-L', 'glib-2.0', check: false)
+
+  targeting_x86_64 = all_cflags.contains('-arch x86_64') or all_ldflags.contains('-arch x86_64')
+  targeting_arm64 = all_cflags.contains('-arch arm64') or all_ldflags.contains('-arch arm64')
+  targeting_universal = targeting_x86_64 and targeting_arm64
+  using_arm_homebrew = pkgconfig_glib.returncode() == 0 and pkgconfig_glib.stdout().contains('/opt/homebrew/')
+
+  if targeting_x86_64 and not targeting_universal and using_arm_homebrew
+    error('Detected x86_64 build flags (-arch x86_64) while pkg-config resolves glib from /opt/homebrew (arm64). ' +
+          'Use arm64 build flags with /opt/homebrew, use a universal build (-arch arm64 -arch x86_64) with universal dependencies, or run an x86_64/Rosetta environment with an x86_64 dependency stack (typically /usr/local). ' +
+          'To bypass this safety check, configure with -Ddarwin-arch-sanity-check=false or set ZOITECHAT_DARWIN_ARCH_SANITY_CHECK=0.')
+  endif
+
+  if targeting_x86_64
+    # When building x86_64-only or universal binaries on Apple Silicon,
+    # pkg-config can still resolve arm64-only Homebrew libraries.
+    # Detect this at configure time and fail fast with a clear message.
+    macos_link_deps = [
+      ['gio-2.0', 'libgio-2.0.dylib'],
+      ['gobject-2.0', 'libgobject-2.0.dylib'],
+      ['glib-2.0', 'libglib-2.0.dylib'],
+      ['gmodule-2.0', 'libgmodule-2.0.dylib'],
+      ['openssl', 'libssl.dylib'],
+      ['openssl', 'libcrypto.dylib'],
+      ['libintl', 'libintl.dylib'],
+    ]
+
+    foreach dep_spec : macos_link_deps
+      dep_pkg = dep_spec[0]
+      dep_lib = dep_spec[1]
+      dep_libdir_cmd = run_command('pkg-config', '--libs-only-L', dep_pkg, check: false)
+      if dep_libdir_cmd.returncode() != 0
+        continue
+      endif
+
+      foreach dep_libdir_arg : dep_libdir_cmd.stdout().strip().split()
+        if not dep_libdir_arg.startswith('-L')
+          continue
+        endif
+
+        dep_lib_path = join_paths(dep_libdir_arg.substring(2), dep_lib)
+        if not fs.exists(dep_lib_path)
+          continue
+        endif
+
+        dep_archs = run_command('lipo', '-archs', dep_lib_path, check: false)
+        if dep_archs.returncode() != 0
+          continue
+        endif
+
+        if not dep_archs.stdout().contains('x86_64')
+          error('Detected x86_64 build flags, but dependency ' + dep_lib_path +
+                ' does not contain x86_64 architecture (archs: ' + dep_archs.stdout().strip() + '). ' +
+                'Use dependencies that include x86_64 (or universal) slices, or build only arm64. ' +
+                'To bypass this safety check, configure with -Ddarwin-arch-sanity-check=false or set ZOITECHAT_DARWIN_ARCH_SANITY_CHECK=0.')
+        endif
+      endforeach
+    endforeach
+  endif
+endif
+
 config_h = configuration_data()
 config_h.set_quoted('PACKAGE_VERSION', meson.project_version())
 config_h.set_quoted('PACKAGE_NAME', meson.project_name())

meson_options.txt

@@ -22,6 +22,9 @@ option('dbus', type: 'feature', value: 'auto',
 option('libcanberra', type: 'feature', value: 'auto',
   description: 'Support for sound alerts, Unix only'
 )
+option('darwin-arch-sanity-check', type: 'boolean', value: true,
+  description: 'Fail fast when macOS build flags and Homebrew dependency architectures are mixed'
+)
 
 # Install options
 option('dbus-service-use-appid', type: 'boolean', value: false,

meson_post_install.py

@@ -3,16 +3,24 @@
 import os
 import sys
 import subprocess
+import shutil
 
 prefix = os.environ.get('MESON_INSTALL_PREFIX', '/usr/local')
 datadir = os.path.join(prefix, 'share')
 
 # Packaging tools define DESTDIR and this isn't needed for them
 if 'DESTDIR' not in os.environ:
+    def run_if_available(command, *args):
+        if shutil.which(command) is None:
+            print(f'Skipping {command}: command not found')
+            return
+
+        subprocess.call([command, *args])
+
     print('Updating icon cache...')
-    subprocess.call(['gtk-update-icon-cache', '-qtf',
-                     os.path.join(datadir, 'icons', 'hicolor')])
+    run_if_available('gtk-update-icon-cache', '-qtf',
+                     os.path.join(datadir, 'icons', 'hicolor'))
 
     print('Updating desktop database...')
-    subprocess.call(['update-desktop-database', '-q',
-                     os.path.join(datadir, 'applications')])
+    run_if_available('update-desktop-database', '-q',
+                     os.path.join(datadir, 'applications'))

osx/DEBUGGING.md

@@ -0,0 +1,207 @@
+# Debugging ZoiteChat on macOS (Xcode + CLI)
+
+If the unsigned `.app` launches but does nothing (or immediately exits), use the steps below to get actionable logs and a debugger session.
+
+## 1) Build with debug symbols
+
+ZoiteChat uses Meson. Build a debug configuration first so LLDB can show useful backtraces.
+
+```bash
+meson setup build-macos-debug --buildtype=debug
+meson compile -C build-macos-debug
+```
+
+This project default is `debugoptimized`, but a full `debug` build is better while diagnosing crashes/startup issues.
+
+## 2) Bundle the app and verify deployment target
+
+Use the existing bundle script:
+
+```bash
+cd osx
+./makebundle.sh
+```
+
+The generated `Info.plist` should keep:
+
+- `LSMinimumSystemVersion = 11.0`
+
+That is the project’s explicit minimum runtime target for macOS 11+.
+
+## 3) Sanity-check the Mach-O binary in the bundle
+
+Confirm architecture(s), deployment target, and linked libraries:
+
+```bash
+file ZoiteChat.app/Contents/MacOS/ZoiteChat-bin
+otool -l ZoiteChat.app/Contents/MacOS/ZoiteChat-bin | rg -n "LC_BUILD_VERSION|minos|sdk"
+otool -L ZoiteChat.app/Contents/MacOS/ZoiteChat-bin
+```
+
+For widest compatibility, build universal (`arm64` + `x86_64`) or build separately per arch and test each on matching hosts.
+
+## 4) Ad-hoc sign for local debugging
+
+Unsigned GUI binaries can fail in unhelpful ways because of hardened runtime/quarantine/Gatekeeper interactions. For local debugging, ad-hoc sign the app:
+
+```bash
+xattr -dr com.apple.quarantine ZoiteChat.app
+codesign --force --deep --sign - ZoiteChat.app
+codesign --verify --deep --strict --verbose=2 ZoiteChat.app
+```
+
+## 5) Launch from Terminal first (before Xcode)
+
+Direct launch exposes stdout/stderr and validates the launcher environment:
+
+```bash
+./ZoiteChat.app/Contents/MacOS/ZoiteChat
+```
+
+The launcher script sets GTK/Pango/GDK environment variables. If direct launch fails, capture that output first.
+
+## 6) Debug with LLDB (reliable baseline)
+
+Debug the real executable inside the bundle:
+
+```bash
+lldb -- ZoiteChat.app/Contents/MacOS/ZoiteChat-bin
+(lldb) run
+(lldb) bt
+```
+
+If it exits instantly, set breakpoints on startup entry points (for example `main`) and re-run.
+
+## 7) Debug with Xcode (if you prefer GUI)
+
+Xcode works best when opening the executable directly instead of importing build scripts.
+
+1. **File → Open…** and select `ZoiteChat.app/Contents/MacOS/ZoiteChat-bin`.
+2. In **Product → Scheme → Edit Scheme…**
+   - Executable: `ZoiteChat-bin`
+   - Working directory: repo root (or `osx/`)
+   - Add environment variables equivalent to the launcher if needed.
+3. Run under debugger.
+
+If Xcode “runs” but no UI appears, compare its environment to `osx/launcher.sh` and copy missing GTK-related variables into the scheme.
+
+## 8) Capture macOS crash diagnostics
+
+Even if no dialog appears, macOS usually logs termination reasons:
+
+```bash
+log stream --style compact --predicate 'process == "ZoiteChat-bin"'
+```
+
+Also check:
+
+- `~/Library/Logs/DiagnosticReports/`
+
+## 9) Frequent root causes for “silent” startup failures
+
+- Missing GTK runtime libraries in app bundle (`otool -L` shows unresolved paths).
+- Incorrect `@rpath`/install names after bundling.
+- Running under Rosetta mismatch (x86_64 binary with arm64-only deps or vice versa).
+- Quarantine/signature issues on unsigned artifacts.
+- Missing `GDK_PIXBUF_MODULE_FILE`, `GTK_IM_MODULE_FILE`, or schema paths.
+
+
+### "Bad CPU type in executable"
+
+This means the bundled `ZoiteChat-bin` architecture does not match the Mac you are running on.
+
+- Intel Mac requires `x86_64`
+- Apple Silicon requires `arm64` (or Rosetta + `x86_64`)
+
+Check the binary quickly:
+
+```bash
+file ZoiteChat.app/Contents/MacOS/ZoiteChat-bin
+```
+
+Build for Intel explicitly when needed:
+
+```bash
+export CFLAGS="-arch x86_64"
+export LDFLAGS="-arch x86_64"
+meson setup build-macos-intel --buildtype=debug
+meson compile -C build-macos-intel
+```
+
+If your dependency stack supports it, build universal (`arm64` + `x86_64`) and verify with `lipo -info`.
+
+### Linker says `found architecture 'arm64', required architecture 'x86_64'`
+
+If you see warnings like this during `meson compile`:
+
+```text
+ld: warning: ignoring file '/opt/homebrew/.../libgio-2.0.dylib': found architecture 'arm64', required architecture 'x86_64'
+Undefined symbols for architecture x86_64: ...
+```
+
+your compile target architecture and dependency architecture do not match.
+
+On Apple Silicon, this usually means you are trying to build `x86_64` while linking against ARM Homebrew libraries from `/opt/homebrew`.
+
+Quick checks:
+
+```bash
+echo "$CFLAGS" "$LDFLAGS"
+pkg-config --libs glib-2.0
+lipo -info "$(brew --prefix glib)/lib/libglib-2.0.dylib"
+```
+
+Use one of these consistent setups:
+
+- Native Apple Silicon build (`arm64`) with `/opt/homebrew` dependencies.
+- Intel build (`x86_64`) with an x86_64 dependency stack (typically Homebrew under `/usr/local` run under Rosetta).
+
+Example x86_64 setup on Apple Silicon:
+
+```bash
+# Open a Rosetta shell first (or prefix commands with `arch -x86_64`)
+arch -x86_64 /bin/bash -lc '
+  export PATH="/usr/local/bin:$PATH"
+  export PKG_CONFIG_PATH="/usr/local/lib/pkgconfig:/usr/local/share/pkgconfig"
+  export CFLAGS="-arch x86_64"
+  export LDFLAGS="-arch x86_64"
+  meson setup build-macos-x86_64 --prefix="/usr/local"
+  meson compile -C build-macos-x86_64
+'
+```
+
+If you do not specifically need Intel compatibility, remove any forced `-arch x86_64` flags and build native `arm64`.
+
+Example with this repo's scripts:
+
+```bash
+PREFIX="$(brew --prefix)"
+
+CFLAGS="-arch arm64" LDFLAGS="-arch arm64" meson setup build-macos-arm64 --prefix="$PREFIX"
+CFLAGS="-arch x86_64" LDFLAGS="-arch x86_64" meson setup build-macos-x86_64 --prefix="$PREFIX"
+
+CFLAGS="-arch arm64" LDFLAGS="-arch arm64" meson compile -C build-macos-arm64
+CFLAGS="-arch x86_64" LDFLAGS="-arch x86_64" meson compile -C build-macos-x86_64
+
+sudo meson install -C build-macos-arm64
+
+cd osx
+UNIVERSAL=1 \
+UNIVERSAL_BINARIES="../build-macos-arm64/src/fe-gtk/zoitechat ../build-macos-x86_64/src/fe-gtk/zoitechat" \
+./makebundle.sh
+```
+
+## 10) Recommended compatibility settings for macOS 11+
+
+- Keep `LSMinimumSystemVersion` at `11.0`.
+- Build on the oldest macOS SDK/toolchain that still supports your dependencies, or explicitly set:
+
+```bash
+export MACOSX_DEPLOYMENT_TARGET=11.0
+```
+
+- Verify with `otool -l` that `minos` is actually `11.0` in the final executable.
+
+---
+
+If you want, we can add an Xcode scheme file to this repo that mirrors `osx/launcher.sh` so “Run” in Xcode behaves exactly like launching the app bundle from Finder/Terminal.

osx/Info.plist.in

@@ -11,7 +11,7 @@
     <key>CFBundleIconFile</key>
     <string>zoitechat.icns</string>
     <key>CFBundleIdentifier</key>
-    <string>org.zoitechat</string>
+    <string>net.zoite.Zoitechat</string>
     <key>CFBundleInfoDictionaryVersion</key>
     <string>6.0</string>
     <key>CFBundlePackageType</key>
@@ -41,6 +41,6 @@
     <key>NSHumanReadableCopyright</key>
     <string></string>
     <key>LSMinimumSystemVersion</key>
-    <string>10.4</string>
+    <string>11.0</string>
 </dict>
 </plist>

osx/launcher.sh

@@ -1,13 +1,13 @@
-#!/bin/sh
+#!/usr/bin/env bash
 
 if test "x$GTK_DEBUG_LAUNCHER" != x; then
     set -x
 fi
 
 if test "x$GTK_DEBUG_GDB" != x; then
-    EXEC="gdb --args"
+    EXEC_PREFIX=(gdb --args)
 else
-    EXEC=exec
+    EXEC_PREFIX=()
 fi
 
 name=`basename "$0"`
@@ -23,24 +23,34 @@ bundle_data="$bundle_res"/share
 bundle_etc="$bundle_res"/etc
 
 export PREFIX="$bundle_res"
-export DYLD_LIBRARY_PATH="$bundle_lib"
+
+# launcher-script: runtime environment for bundled GTK3 on macOS.
+# Expected package prefixes when building the app bundle:
+#   Homebrew: /opt/homebrew (Apple Silicon) or /usr/local (Intel)
+#   MacPorts: /opt/local
+# Required libraries include GTK3, Pango, GDK-Pixbuf and enchant.
+
+# Keep DYLD path hacks to a minimum; install_name_tool should resolve most libs.
+if test -n "${DYLD_LIBRARY_PATH:-}"; then
+    export DYLD_LIBRARY_PATH="$bundle_lib:$DYLD_LIBRARY_PATH"
+fi
+
 export XDG_CONFIG_DIRS="$bundle_etc"/xdg
 export XDG_DATA_DIRS="$bundle_data"
 export GTK_DATA_PREFIX="$bundle_res"
 export GTK_EXE_PREFIX="$bundle_res"
-export GTK_PATH="$bundle_res"
 
-export GTK2_RC_FILES="$bundle_etc/gtk-2.0/gtkrc"
-export GTK_IM_MODULE_FILE="$bundle_etc/gtk-2.0/gtk.immodules"
-export GDK_PIXBUF_MODULE_FILE="$bundle_etc/gtk-2.0/gdk-pixbuf.loaders"
+export GTK_IM_MODULE_FILE="$bundle_etc/gtk-3.0/gtk.immodules"
+export GDK_PIXBUF_MODULE_FILE="$bundle_etc/gtk-3.0/gdk-pixbuf.loaders"
 export PANGO_LIBDIR="$bundle_lib"
 export PANGO_SYSCONFDIR="$bundle_etc"
+export GSETTINGS_SCHEMA_DIR="$bundle_data/glib-2.0/schemas"
 
 export OPENSSL_CONF="/System/Library/OpenSSL/openssl.cnf"
 
 export ZOITECHAT_LIBDIR="$bundle_lib/zoitechat/plugins"
 
-APP=name
+APP=zoitechat
 I18NDIR="$bundle_data/locale"
 # Set the locale-related variables appropriately:
 unset LANG LC_MESSAGES LC_MONETARY LC_COLLATE
@@ -48,7 +58,7 @@ unset LANG LC_MESSAGES LC_MONETARY LC_COLLATE
 # Has a language ordering been set?
 # If so, set LC_MESSAGES and LANG accordingly; otherwise skip it.
 # First step uses sed to clean off the quotes and commas, to change - to _, and change the names for the chinese scripts from "Hans" to CN and "Hant" to TW.
-APPLELANGUAGES=`defaults read .GlobalPreferences AppleLanguages | sed -En   -e 's/\-/_/' -e 's/Hant/TW/' -e 's/Hans/CN/' -e 's/[[:space:]]*\"?([[:alnum:]_]+)\"?,?/\1/p' `
+APPLELANGUAGES=`defaults read .GlobalPreferences AppleLanguages 2>/dev/null | sed -En   -e 's/\-/_/' -e 's/Hant/TW/' -e 's/Hans/CN/' -e 's/[[:space:]]*\"?([[:alnum:]_]+)\"?,?/\1/p' `
 if test "$APPLELANGUAGES"; then
     # A language ordering exists.
     # Test, item per item, to see whether there is an corresponding locale.
@@ -79,26 +89,26 @@ fi
 unset APPLELANGUAGES L
 
 # If we didn't get a language from the language list, try the Collation preference, in case it's the only setting that exists.
-APPLECOLLATION=`defaults read .GlobalPreferences AppleCollationOrder`
-if test -z ${LANG} -a -n $APPLECOLLATION; then
+APPLECOLLATION=`defaults read .GlobalPreferences AppleCollationOrder 2>/dev/null || true`
+if test -z "${LANG:-}" -a -n "${APPLECOLLATION:-}"; then
     if test -f "$I18NDIR/${APPLECOLLATION:0:2}/LC_MESSAGES/$APP.mo"; then
 	export LANG=${APPLECOLLATION:0:2}
     fi
 fi
-if test ! -z $APPLECOLLATION; then
+if test -n "${APPLECOLLATION:-}"; then
     export LC_COLLATE=$APPLECOLLATION
 fi
 unset APPLECOLLATION
 
 # Continue by attempting to find the Locale preference.
-APPLELOCALE=`defaults read .GlobalPreferences AppleLocale`
+APPLELOCALE=`defaults read .GlobalPreferences AppleLocale 2>/dev/null || true`
 
 if test -f "$I18NDIR/${APPLELOCALE:0:5}/LC_MESSAGES/$APP.mo"; then
-    if test -z $LANG; then 
+    if test -z "${LANG:-}"; then 
         export LANG="${APPLELOCALE:0:5}"
     fi
 
-elif test -z $LANG -a -f "$I18NDIR/${APPLELOCALE:0:2}/LC_MESSAGES/$APP.mo"; then
+elif test -z "${LANG:-}" -a -f "$I18NDIR/${APPLELOCALE:0:2}/LC_MESSAGES/$APP.mo"; then
     export LANG="${APPLELOCALE:0:2}"
 fi
 
@@ -106,20 +116,20 @@ fi
 #5-character locale to avoid the "Locale not supported by C library"
 #warning from Gtk -- even though Gtk will translate with a
 #two-character code.
-if test -n $LANG; then 
+if test -n "${LANG:-}"; then 
 #If the language code matches the applelocale, then that's the message
 #locale; otherwise, if it's longer than two characters, then it's
 #probably a good message locale and we'll go with it.
-    if test $LANG == ${APPLELOCALE:0:5} -o $LANG != ${LANG:0:2}; then
+    if test "$LANG" = "${APPLELOCALE:0:5}" -o "$LANG" != "${LANG:0:2}"; then
 	export LC_MESSAGES=$LANG
 #Next try if the Applelocale is longer than 2 chars and the language
 #bit matches $LANG
-    elif test $LANG == ${APPLELOCALE:0:2} -a $APPLELOCALE > ${APPLELOCALE:0:2}; then
+    elif test "$LANG" = "${APPLELOCALE:0:2}" -a "$APPLELOCALE" \> "${APPLELOCALE:0:2}"; then
 	export LC_MESSAGES=${APPLELOCALE:0:5}
 #Fail. Get a list of the locales in $PREFIX/share/locale that match
 #our two letter language code and pick the first one, special casing
 #english to set en_US
-    elif test $LANG == "en"; then
+    elif test "$LANG" = "en"; then
 	export LC_MESSAGES="en_US"
     else
 	LOC=`find $PREFIX/share/locale -name $LANG???`
@@ -171,4 +181,18 @@ if /bin/expr "x$1" : '^x-psn_' > /dev/null; then
     shift 1
 fi
 
-$EXEC "$bundle_contents/MacOS/$name-bin" "$@" $EXTRA_ARGS
+BIN_PATH="$bundle_contents/MacOS/$name-bin"
+if test ${#EXEC_PREFIX[@]} -gt 0; then
+    "${EXEC_PREFIX[@]}" "$BIN_PATH" "$@" $EXTRA_ARGS
+else
+    "$BIN_PATH" "$@" $EXTRA_ARGS
+fi
+status=$?
+if test "$status" -eq 126; then
+    echo "error: $BIN_PATH could not execute on this Mac (possible architecture mismatch)." >&2
+    if command -v file >/dev/null 2>&1; then
+        file "$BIN_PATH" >&2 || true
+    fi
+    echo "hint: build ZoiteChat for this architecture (x86_64 on Intel, arm64 on Apple Silicon) or as a universal binary." >&2
+fi
+exit "$status"

osx/makebundle.sh

@@ -1,11 +1,210 @@
 #!/bin/sh
 
-rm -rf ZoiteChat.app
-rm -f *.app.zip
+set -eu
 
-python $HOME/.local/bin/gtk-mac-bundler zoitechat.bundle
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+cd "$SCRIPT_DIR"
+
+BUNDLE_DEF="zoitechat.bundle"
+APP_NAME="ZoiteChat.app"
+
+HOST_ARCH="$(uname -m 2>/dev/null || echo unknown)"
+if [ -z "${TARGET_ARCHES+x}" ]; then
+    TARGET_ARCHES="$HOST_ARCH"
+fi
+UNIVERSAL_BINARIES="${UNIVERSAL_BINARIES:-}"
+UNIVERSAL_BUILD_DIRS="${UNIVERSAL_BUILD_DIRS:-../build-macos-arm64 ../build-macos-x86_64}"
+
+if [ "${UNIVERSAL:-0}" = "1" ]; then
+    TARGET_ARCHES="arm64 x86_64"
+fi
+
+# Expected prefixes for macOS GTK dependencies:
+# - Homebrew: /opt/homebrew (Apple Silicon) or /usr/local (Intel)
+# - MacPorts: /opt/local
+# Required runtime stack includes GTK3, Pango, GDK-Pixbuf and enchant.
+
+if command -v gtk-mac-bundler >/dev/null 2>&1; then
+    BUNDLER_CMD="gtk-mac-bundler"
+elif command -v python3 >/dev/null 2>&1 && python3 -c 'import gtk_mac_bundler' >/dev/null 2>&1; then
+    BUNDLER_CMD="python3 -m gtk_mac_bundler"
+else
+    cat >&2 <<'MSG'
+error: gtk-mac-bundler not found.
+Install one of the following before running osx/makebundle.sh:
+  - executable: gtk-mac-bundler
+  - python module: gtk_mac_bundler (invoked via: python3 -m gtk_mac_bundler)
+MSG
+    exit 1
+fi
+
+rm -rf "$APP_NAME"
+rm -f ./*.app.zip
+
+# Enchant packaging changed between releases/package managers:
+# - some installs provide share/enchant
+# - others provide share/enchant-2
+# - some have no share-level config dir at all
+# Keep the bundle definition in sync with what's actually available so
+# gtk-mac-bundler doesn't fail on a missing source path.
+
+# Resolve package-manager prefix dynamically so Intel (/usr/local) and
+# Apple Silicon (/opt/homebrew) hosts both bundle correctly.
+BUNDLE_PREFIX="${BUNDLE_PREFIX:-}"
+if [ -z "$BUNDLE_PREFIX" ] && command -v brew >/dev/null 2>&1; then
+    BUNDLE_PREFIX="$(brew --prefix 2>/dev/null || true)"
+fi
+if [ -z "$BUNDLE_PREFIX" ]; then
+    BUNDLE_PREFIX="/usr/local"
+fi
+
+# Keep a caller-provided trailing slash so gtk-mac-bundler path concatenation
+# does not produce malformed locale paths like ".../x86_64locale/...".
+# CI explicitly sets BUNDLE_PREFIX with a trailing slash.
+BUNDLE_PREFIX_XML="$BUNDLE_PREFIX"
+
+ENCHANT_PREFIX_DEFAULT="${BUNDLE_PREFIX}/opt/enchant"
+ENCHANT_PREFIX_PATH="${ENCHANT_PREFIX:-$ENCHANT_PREFIX_DEFAULT}"
+
+perl -0pi -e 's|(<prefix\s+name="default">)[^<]+(</prefix>)|$1'"$BUNDLE_PREFIX_XML"'$2|s' "$BUNDLE_DEF"
+perl -0pi -e 's|(<prefix\s+name="enchant">)[^<]+(</prefix>)|$1'"$ENCHANT_PREFIX_PATH"'$2|s' "$BUNDLE_DEF"
+
+if command -v brew >/dev/null 2>&1; then
+    BREW_ENCHANT_PREFIX="$(brew --prefix enchant 2>/dev/null || true)"
+    if [ -n "$BREW_ENCHANT_PREFIX" ]; then
+        ENCHANT_PREFIX_PATH="$BREW_ENCHANT_PREFIX"
+        perl -0pi -e 's|(<prefix\s+name="enchant">)[^<]+(</prefix>)|$1'"$ENCHANT_PREFIX_PATH"'$2|s' "$BUNDLE_DEF"
+    fi
+fi
+
+if [ -n "$ENCHANT_PREFIX_PATH" ]; then
+    if [ -d "$ENCHANT_PREFIX_PATH/share/enchant" ]; then
+        perl -0pi -e 's|(<data>\s*)\$\{prefix:enchant\}/share/enchant(?:-2)?(\s*</data>)|$1\$\{prefix:enchant\}/share/enchant$2|s' "$BUNDLE_DEF"
+    elif [ -d "$ENCHANT_PREFIX_PATH/share/enchant-2" ]; then
+        perl -0pi -e 's|(<data>\s*)\$\{prefix:enchant\}/share/enchant(?:-2)?(\s*</data>)|$1\$\{prefix:enchant\}/share/enchant-2$2|s' "$BUNDLE_DEF"
+    else
+        perl -0pi -e 's|\n\s*<data>\s*\$\{prefix:enchant\}/share/enchant(?:-2)?\s*</data>\n|\n|s' "$BUNDLE_DEF"
+    fi
+fi
+
+# GTK module extension differs across package manager builds:
+# - Homebrew commonly installs .dylib modules
+# - Some environments still ship .so modules
+# Detect what exists in the staged prefix and rewrite the bundle definition
+# so gtk-mac-bundler does not fail on a missing glob.
+GTK_MODULE_EXT="so"
+if find "$BUNDLE_PREFIX/lib/gtk-3.0" -type f \( -path '*/immodules/*.dylib' -o -path '*/printbackends/*.dylib' \) -print -quit 2>/dev/null | grep -q . \
+    || find "$BUNDLE_PREFIX/lib/gdk-pixbuf-2.0" -type f -path '*/loaders/*.dylib' -print -quit 2>/dev/null | grep -q .; then
+    GTK_MODULE_EXT="dylib"
+fi
+if [ "$GTK_MODULE_EXT" = "dylib" ]; then
+    perl -0pi -e 's|(/immodules/)\*\.so|$1*.dylib|g; s|(/printbackends/)\*\.so|$1*.dylib|g; s|(/loaders/)\*\.so|$1*.dylib|g' "$BUNDLE_DEF"
+else
+    perl -0pi -e 's|(/immodules/)\*\.dylib|$1*.so|g; s|(/printbackends/)\*\.dylib|$1*.so|g; s|(/loaders/)\*\.dylib|$1*.so|g' "$BUNDLE_DEF"
+fi
+
+# Some staged builds omit GTK runtime module directories entirely
+# (for example stripped-down CI artifacts). Remove bundle entries for
+# missing globs so gtk-mac-bundler does not abort.
+if ! find "$BUNDLE_PREFIX/lib/gtk-3.0" -type f -path "*/immodules/*.${GTK_MODULE_EXT}" -print -quit 2>/dev/null | grep -q .; then
+    perl -0pi -e 's#\n\s*<binary>\s*\$\{prefix\}/lib/\$\{gtkdir\}/\$\{pkg:\$\{gtk\}:gtk_binary_version\}/immodules/\*\.(?:so|dylib)\s*</binary>\n#\n#g' "$BUNDLE_DEF"
+fi
+if ! find "$BUNDLE_PREFIX/lib/gtk-3.0" -type f -path "*/printbackends/*.${GTK_MODULE_EXT}" -print -quit 2>/dev/null | grep -q .; then
+    perl -0pi -e 's#\n\s*<binary>\s*\$\{prefix\}/lib/\$\{gtkdir\}/\$\{pkg:\$\{gtk\}:gtk_binary_version\}/printbackends/\*\.(?:so|dylib)\s*</binary>\n#\n#g' "$BUNDLE_DEF"
+fi
+if ! find "$BUNDLE_PREFIX/lib/gdk-pixbuf-2.0" -type f -path "*/loaders/*.${GTK_MODULE_EXT}" -print -quit 2>/dev/null | grep -q .; then
+    perl -0pi -e 's#\n\s*<binary>\s*\$\{prefix\}/lib/gdk-pixbuf-2\.0/\$\{pkg:gdk-pixbuf-2\.0:gdk_pixbuf_binary_version\}/loaders/\*\.(?:so|dylib)\s*</binary>\n#\n#g' "$BUNDLE_DEF"
+fi
+
+
+# Keep Info.plist generation deterministic by always rendering from template
+# using a single, explicit version source.
+VERSION_STRING="${VERSION:-$(sed -n "s/^  version: '\([^']*\)',$/\1/p" ../meson.build | head -n1)}"
+if [ -z "$VERSION_STRING" ]; then
+    echo "error: unable to determine VERSION_STRING for Info.plist" >&2
+    exit 1
+fi
+
+TMP_PLIST="Info.plist.tmp"
+LC_ALL=C sed "s/@VERSION@/$VERSION_STRING/g" Info.plist.in > "$TMP_PLIST"
+mv -f "$TMP_PLIST" Info.plist
+
+# shellcheck disable=SC2086
+$BUNDLER_CMD "$BUNDLE_DEF"
+
+if [ ! -d "$APP_NAME" ]; then
+    echo "error: bundler finished but $APP_NAME was not created" >&2
+    exit 1
+fi
+
+BIN_PATH="$APP_NAME/Contents/MacOS/ZoiteChat-bin"
+
+if [ "${UNIVERSAL:-0}" = "1" ] && [ -z "$UNIVERSAL_BINARIES" ]; then
+    for build_dir in $UNIVERSAL_BUILD_DIRS; do
+        candidate="$build_dir/src/fe-gtk/zoitechat"
+        if [ -f "$candidate" ]; then
+            UNIVERSAL_BINARIES="${UNIVERSAL_BINARIES:+$UNIVERSAL_BINARIES }$candidate"
+        fi
+    done
+
+    if [ -z "$UNIVERSAL_BINARIES" ]; then
+        cat >&2 <<'MSG'
+error: UNIVERSAL=1 requested, but no source binaries were found.
+Set UNIVERSAL_BINARIES to one or more architecture-specific zoitechat binaries,
+or place builds at:
+  ../build-macos-arm64/src/fe-gtk/zoitechat
+  ../build-macos-x86_64/src/fe-gtk/zoitechat
+MSG
+        exit 1
+    fi
+fi
+
+if [ -n "$UNIVERSAL_BINARIES" ]; then
+    if ! command -v lipo >/dev/null 2>&1; then
+        echo "error: UNIVERSAL_BINARIES requires lipo, but lipo is unavailable" >&2
+        exit 1
+    fi
+
+    for binary in $UNIVERSAL_BINARIES; do
+        if [ ! -f "$binary" ]; then
+            echo "error: universal source binary not found: $binary" >&2
+            exit 1
+        fi
+    done
+
+    echo "Creating universal ZoiteChat-bin from: $UNIVERSAL_BINARIES"
+    # shellcheck disable=SC2086
+    lipo -create $UNIVERSAL_BINARIES -output "$BIN_PATH"
+fi
+
+if command -v lipo >/dev/null 2>&1; then
+    BIN_ARCHS="$(lipo -archs "$BIN_PATH" 2>/dev/null || true)"
+    if [ -z "$BIN_ARCHS" ]; then
+        echo "error: unable to detect architectures for $BIN_PATH" >&2
+        exit 1
+    fi
+
+    for required_arch in $TARGET_ARCHES; do
+        if ! echo " $BIN_ARCHS " | grep -q " $required_arch "; then
+            cat >&2 <<MSG
+error: bundled binary architecture mismatch.
+  required: $TARGET_ARCHES
+  actual:   $BIN_ARCHS
+hint: rebuild ZoiteChat-bin with matching architecture(s) before bundling.
+MSG
+            exit 1
+        fi
+    done
+fi
+
+if command -v file >/dev/null 2>&1; then
+    echo "Bundled binary architecture:"
+    file "$BIN_PATH" || true
+fi
 
 echo "Compressing bundle"
-#hdiutil create -format UDBZ -srcdir ZoiteChat.app -quiet ZoiteChat-2.9.6.1-$(git rev-parse --short master).dmg
-zip -9rXq ./ZoiteChat-$(git describe --tags).app.zip ./ZoiteChat.app
-
+ARCHIVE_VERSION="$(git describe --tags --always 2>/dev/null || true)"
+if [ -z "$ARCHIVE_VERSION" ]; then
+    ARCHIVE_VERSION="$VERSION_STRING"
+fi
+zip -9rXq "./ZoiteChat-$ARCHIVE_VERSION.app.zip" "./$APP_NAME"

osx/zoitechat.bundle

@@ -2,13 +2,16 @@
 <app-bundle>
 
   <meta>
+    <!-- Expected prefixes:
+         Homebrew: /opt/homebrew (Apple Silicon) or /usr/local (Intel)
+         MacPorts: /opt/local -->
     <prefix name="default">/usr/local</prefix>
-    <prefix name="enchant">/usr/local/opt/enchant-applespell</prefix>
+    <prefix name="enchant">/usr/local/opt/enchant</prefix>
     <destination overwrite="yes">${project}</destination>
 
-    <run-install-name-tool/>
-    <launcher-script>${project}/launcher.sh</launcher-script >
-    <gtk>gtk+-2.0</gtk>
+    <run-install-name-tool>yes</run-install-name-tool>
+    <launcher-script>${project}/launcher.sh</launcher-script>
+    <gtk>gtk+-3.0</gtk>
   </meta>
 
   <plist>${project}/Info.plist</plist>
@@ -21,46 +24,38 @@
     ${prefix}/lib/zoitechat/plugins/*.so
   </binary>
 
+  <!-- Enchant 2 runtime layout (Homebrew/MacPorts):
+       - core dylib in lib/
+       - provider modules in lib/enchant-2/ loaded via dlopen()
+       - config files in share/enchant/ -->
   <binary>
-    ${prefix:enchant}/lib/libenchant.dylib
+    ${prefix:enchant}/lib/libenchant-2*.dylib
   </binary>
   <binary>
-    ${prefix:enchant}/lib/enchant/libenchant_applespell.so
+    ${prefix:enchant}/lib/enchant-2
   </binary>
+  <data>
+    ${prefix:enchant}/share/enchant
+  </data>
 
+  <!-- GTK3 runtime modules: ${prefix}/lib/${gtkdir} -->
   <binary>
-    ${prefix}/lib/${gtkdir}/modules/*.so
-  </binary>
-  <binary>
-    ${prefix}/lib/${gtkdir}/${pkg:${gtk}:gtk_binary_version}/engines/libquartz.so
-  </binary>
-  <binary>
-    ${prefix}/lib/${gtkdir}/${pkg:${gtk}:gtk_binary_version}/engines/libxamarin.so
+    ${prefix}/lib/${gtkdir}/${pkg:${gtk}:gtk_binary_version}/immodules/*.so
   </binary>
   <binary>
     ${prefix}/lib/${gtkdir}/${pkg:${gtk}:gtk_binary_version}/printbackends/*.so
   </binary>
-  <binary>
-    ${prefix}/lib/gdk-pixbuf-2.0/${pkg:${gtk}:gtk_binary_version}/loaders/*.so
-  </binary>
-  <binary>
-    ${prefix}/lib/pango/${pkg:pango:pango_module_version}/modules/
-  </binary>
-  <data>
-    ${prefix}/share/themes/Mac/gtk-2.0-key/gtkrc
-  </data>
 
-  <translations name="gtk20">
+  <binary>
+    ${prefix}/lib/gdk-pixbuf-2.0/${pkg:gdk-pixbuf-2.0:gdk_pixbuf_binary_version}/loaders/*.so
+  </binary>
+  <translations name="gtk30">
     ${prefix}/share/locale
   </translations>
   <translations name="zoitechat">
     ${prefix}/share/locale
   </translations>
 
-  <data dest="${bundle}/Contents/Resources/etc/${gtkdir}/gtkrc">
-    ${project}/gtkrc
-  </data>
-
   <data dest="${bundle}/Contents/Resources">
     ${project}/zoitechat.icns
   </data>

plugins/fishlim/dh1080.c

@@ -75,7 +75,7 @@ dh1080_init (void)
 
 		BN_set_word (g, 2);
 
-#ifndef HAVE_DH_SET0_PQG
+#if OPENSSL_VERSION_NUMBER < 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 		g_dh->p = p;
 		g_dh->g = g;
 #else
@@ -163,7 +163,7 @@ dh1080_generate_key (char **priv_key, char **pub_key)
 		return 0;
 	}
 
-#ifndef HAVE_DH_GET0_KEY
+#if OPENSSL_VERSION_NUMBER < 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	dh_pub_key = dh->pub_key;
 	dh_priv_key = dh->priv_key;
 #else
@@ -190,9 +190,6 @@ dh1080_compute_key (const char *priv_key, const char *pub_key, char **secret_key
 	gsize pub_key_len;
 	BIGNUM *pk;
 	DH *dh;
-#ifdef HAVE_DH_SET0_KEY
-	BIGNUM *temp_pub_key = BN_new();
-#endif
 
 	g_assert (secret_key != NULL);
 
@@ -217,10 +214,10 @@ dh1080_compute_key (const char *priv_key, const char *pub_key, char **secret_key
 
 		priv_key_data = dh1080_decode_b64 (priv_key, &priv_key_len);
 		priv_key_num = BN_bin2bn(priv_key_data, priv_key_len, NULL);
-#ifndef HAVE_DH_SET0_KEY
+	#if OPENSSL_VERSION_NUMBER < 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 		dh->priv_key = priv_key_num;
 #else
-		DH_set0_key (dh, temp_pub_key, priv_key_num);
+		DH_set0_key (dh, NULL, priv_key_num);
 #endif
 
 		shared_len = DH_compute_key (shared_key, pk, dh);

plugins/meson.build

@@ -22,7 +22,31 @@ if get_option('with-fishlim')
   subdir('fishlim')
 endif
 
-if get_option('with-lua') != 'false'
+lua_option = get_option('with-lua')
+if lua_option == 'auto' or lua_option == 'luajit'
+  lua_auto_dep = dependency('luajit', required: false)
+  if not lua_auto_dep.found()
+    lua_auto_dep = dependency('lua-5.4', required: false)
+  endif
+  if not lua_auto_dep.found()
+    lua_auto_dep = dependency('lua5.4', required: false)
+  endif
+  if not lua_auto_dep.found()
+    lua_auto_dep = dependency('lua-5.3', required: false)
+  endif
+  if not lua_auto_dep.found()
+    lua_auto_dep = dependency('lua5.3', required: false)
+  endif
+  if not lua_auto_dep.found()
+    lua_auto_dep = dependency('lua', required: false)
+  endif
+
+  if lua_auto_dep.found()
+    subdir('lua')
+  else
+    warning('LuaJIT/Lua development files not found, disabling Lua plugin')
+  endif
+elif lua_option != 'false'
   subdir('lua')
 endif
 

plugins/perl/meson.build

@@ -27,9 +27,10 @@ endif
 
 perl = find_program(get_option('with-perl'))
 
-ret = run_command([perl, '-MExtUtils::Embed', '-e', 'ccopts'])
+ret = run_command([perl, '-MExtUtils::Embed', '-e', 'ccopts'], check: false)
 if ret.returncode() != 0
-  error('perl: Failed to get cflags')
+  warning('Perl development files not found, disabling Perl plugin')
+  subdir_done()
 endif
 foreach flag : ret.stdout().strip().split(' ')
   if flag.startswith('-I') or flag.startswith('-D')
@@ -37,9 +38,10 @@ foreach flag : ret.stdout().strip().split(' ')
   endif
 endforeach
 
-ret = run_command([perl, '-MExtUtils::Embed', '-e', 'ldopts'])
+ret = run_command([perl, '-MExtUtils::Embed', '-e', 'ldopts'], check: false)
 if ret.returncode() != 0
-  error('perl: Failed to get ldflags')
+  warning('Perl development files not found, disabling Perl plugin')
+  subdir_done()
 endif
 perl_ldflags = []
 perl_rpath = ''
@@ -73,7 +75,8 @@ int main(void) {
   return 0;
 }
 ''', args: perl_cflags + perl_ldflags)
-  error('found perl not suitable for plugin')
+  warning('Found perl is not suitable for plugin, disabling Perl plugin')
+  subdir_done()
 endif
 
 perl_dep = declare_dependency(

readme.md

@@ -52,3 +52,7 @@ provide binary packages linked to the OpenSSL libraries, provided that
 all other requirements of the GPL are met.
 See file COPYING for details.
 </sub>
+
+## macOS debugging
+
+If you are troubleshooting local macOS build/run/debug issues (including Xcode setup), see `osx/DEBUGGING.md`.

src/common/meson.build

@@ -103,7 +103,7 @@ zoitechat_common_dep = declare_dependency(
   link_with: zoitechat_common,
   include_directories: common_includes,
   compile_args: common_cflags,
-  dependencies: libgio_dep,
+  dependencies: common_deps,
 )
 
 zoitechat_plugin_dep = declare_dependency(

src/common/ssl.c

@@ -154,6 +154,7 @@ _SSL_get_cert_info (struct cert_info *cert_info, SSL * ssl)
 	X509 *peer_cert;
 	X509_PUBKEY *key;
 	X509_ALGOR *algor = NULL;
+	const ASN1_OBJECT *algor_obj = NULL;
 	EVP_PKEY *peer_pkey;
 	char notBefore[64];
 	char notAfter[64];
@@ -175,11 +176,19 @@ _SSL_get_cert_info (struct cert_info *cert_info, SSL * ssl)
 	if (!X509_PUBKEY_get0_param(NULL, NULL, 0, &algor, key))
 		return 1;
 
-	alg = OBJ_obj2nid (algor->algorithm);
-#ifndef HAVE_X509_GET_SIGNATURE_NID
-	sign_alg = OBJ_obj2nid (peer_cert->sig_alg->algorithm);
-#else
+	X509_ALGOR_get0 (&algor_obj, NULL, NULL, algor);
+	alg = OBJ_obj2nid (algor_obj);
+#ifdef HAVE_X509_GET_SIGNATURE_NID
 	sign_alg = X509_get_signature_nid (peer_cert);
+#else
+	{
+		const X509_ALGOR *signature_algor = NULL;
+		const ASN1_OBJECT *signature_algor_obj = NULL;
+
+		X509_get0_signature (NULL, &signature_algor, peer_cert);
+		X509_ALGOR_get0 (&signature_algor_obj, NULL, NULL, signature_algor);
+		sign_alg = OBJ_obj2nid (signature_algor_obj);
+	}
 #endif
 	ASN1_TIME_snprintf (notBefore, sizeof (notBefore),
 							  X509_get_notBefore (peer_cert));
@@ -298,7 +307,10 @@ SSL *
 _SSL_socket (SSL_CTX *ctx, int sd)
 {
 	SSL *ssl;
+	
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	const SSL_METHOD *method;
+#endif
 
 	if (!(ssl = SSL_new (ctx)))
 		/* FATAL */
@@ -306,6 +318,12 @@ _SSL_socket (SSL_CTX *ctx, int sd)
 
 	SSL_set_fd (ssl, sd);
 
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+	if (SSL_is_server (ssl))
+		SSL_set_accept_state (ssl);
+	else
+		SSL_set_connect_state (ssl);
+#else
 #ifndef HAVE_SSL_CTX_GET_SSL_METHOD
 	method = ctx->method;
 #else
@@ -314,7 +332,8 @@ _SSL_socket (SSL_CTX *ctx, int sd)
 	if (method == SSLv23_client_method())
 		SSL_set_connect_state (ssl);
 	else
-	        SSL_set_accept_state(ssl);
+		SSL_set_accept_state (ssl);
+#endif
 
 	return (ssl);
 }

src/fe-gtk/meson.build

@@ -85,6 +85,14 @@ if host_machine.system() == 'windows'
   #  sources: 'notifications/notification-winrt.cpp'
   #)
 
+elif host_machine.system() == 'darwin'
+  zoitechat_gtk_sources += 'notifications/notification-osx.m'
+  add_languages('objc')
+
+  gtk_mac_dep = dependency('gtk-mac-integration', required: true)
+  zoitechat_gtk_deps += gtk_mac_dep
+  zoitechat_gtk_cflags += '-DHAVE_GTK_MAC'
+
 else
   zoitechat_gtk_sources += 'notifications/notification-freedesktop.c'
 endif