ci(macos): add ad-hoc codesigning and signature verification to macOS workflow

Merge pull request 'Merge development into main (v3.5.0-ICCery.1.4)' (#31) from development into main

.github/workflows/build-macos.yml

@@ -43,6 +43,16 @@ jobs:
           export CCOPTFLAG="-O0"
           jam -q -d2 -fJambase -j1 -sBUILTIN_TIFF=true -sBUILTIN_JPEG=true -sBUILTIN_PNG=true -sBUILTIN_Z=true -sBUILTIN_SSL=true install
           
+      - name: Ad-hoc Sign & Verify Binaries
+        run: |
+          for f in bin/*; do
+            if [ -f "$f" ] && file "$f" | grep -q "Mach-O"; then
+              echo "Ad-hoc signing $f"
+              codesign -f -s - "$f"
+              codesign -dvv "$f"
+            fi
+          done
+
       - name: Smoke Tests
         env:
           ARGYLL_NOT_INTERACTIVE: "1"
@@ -64,6 +74,12 @@ jobs:
           echo "SHORT_SHA=${SHORT_SHA}" >> $GITHUB_ENV
           mv Argyll_V*_${{ matrix.artifact }}.tgz "Argyll_${TAG}_${SHORT_SHA}_${{ matrix.artifact }}.tgz"
           
+      - name: Upload Raw Binaries
+        uses: actions/upload-artifact@v4
+        with:
+          name: raw-bin-${{ matrix.arch }}
+          path: bin/
+          
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
         with:
@@ -77,3 +93,103 @@ jobs:
           name: Release ${{ github.ref_name }}
           body: "Release ${{ github.ref_name }} built from commit ${{ github.sha }}"
           files: Argyll_*_${{ matrix.artifact }}.tgz
+
+  universal:
+    needs: build
+    runs-on: macos-15
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download x86_64 binaries
+        uses: actions/download-artifact@v4
+        with:
+          name: raw-bin-x86_64
+          path: raw-bin-x86_64
+
+      - name: Download arm64 binaries
+        uses: actions/download-artifact@v4
+        with:
+          name: raw-bin-arm64
+          path: raw-bin-arm64
+
+      - name: Create Universal Binaries
+        run: |
+          mkdir -p bin
+          for file in raw-bin-arm64/*; do
+            bin_name=$(basename "$file")
+            if [ -f "raw-bin-x86_64/$bin_name" ]; then
+              if file "raw-bin-arm64/$bin_name" | grep -q "Mach-O" && file "raw-bin-x86_64/$bin_name" | grep -q "Mach-O"; then
+                echo "Creating universal binary with lipo: $bin_name"
+                lipo -create "raw-bin-x86_64/$bin_name" "raw-bin-arm64/$bin_name" -output "bin/$bin_name"
+                chmod +x "bin/$bin_name"
+                codesign -f -s - "bin/$bin_name"
+              else
+                echo "Non Mach-O file, copying directly: $bin_name"
+                cp "$file" "bin/$bin_name"
+              fi
+            else
+              echo "Warning: $bin_name not found in raw-bin-x86_64, copying arm64 version"
+              cp "$file" "bin/$bin_name"
+              if file "bin/$bin_name" | grep -q "Mach-O"; then
+                codesign -f -s - "bin/$bin_name"
+              fi
+            fi
+          done
+          for file in raw-bin-x86_64/*; do
+            bin_name=$(basename "$file")
+            if [ ! -f "bin/$bin_name" ]; then
+              echo "Warning: $bin_name only found in raw-bin-x86_64, copying x86_64 version"
+              cp "$file" "bin/$bin_name"
+              if file "bin/$bin_name" | grep -q "Mach-O"; then
+                codesign -f -s - "bin/$bin_name"
+              fi
+            fi
+          done
+
+      - name: Verify Architecture & Code Signatures
+        env:
+          ARGYLL_NOT_INTERACTIVE: "1"
+          ARGYLL_EXCLUDE_SERIAL_SCAN: "1"
+        run: |
+          echo "=== Binary Architecture & Signature Verification ==="
+          for file in bin/*; do
+            if [ -f "$file" ] && file "$file" | grep -q "Mach-O"; then
+              file "$file"
+              codesign -dvv "$file"
+            fi
+          done
+          echo "=== Smoke Tests ==="
+          ./bin/dispcal -? || true
+          ./bin/chartread -? || true
+          ./bin/colprof -? || true
+          ./bin/targen -? || true
+
+      - name: Package Universal Release
+        run: |
+          export OSTYPE=darwin
+          export MACHTYPE=universal-apple-darwin
+          export HOSTTYPE=universal
+          export NO_BUILD=1
+          ./makepackagebin.sh
+          TAG="${{ github.ref_name }}"
+          SHORT_SHA="$(git rev-parse --short HEAD)"
+          echo "SHORT_SHA=${SHORT_SHA}" >> $GITHUB_ENV
+          mv Argyll_V*_macOS_universal_bin.tgz "Argyll_${TAG}_${SHORT_SHA}_macOS_universal_bin.tgz"
+
+      - name: Upload Universal Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: Argyll_${{ github.ref_name }}_${{ env.SHORT_SHA }}_macOS_universal_bin
+          path: Argyll_*_macOS_universal_bin.tgz
+
+      - name: Upload Universal Release Asset
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v2
+        with:
+          name: Release ${{ github.ref_name }}
+          body: "Release ${{ github.ref_name }} built from commit ${{ github.sha }}"
+          files: Argyll_*_macOS_universal_bin.tgz

doc/ChangesSummary.html

@@ -19,6 +19,8 @@
     <h1>[V3.4.1 -&gt; V3.5.0] 4th February 2026<br>
     </h1>
     <ul>
+      <li>Added macOS Universal Binary release archive (Intel x86_64 + Apple Silicon arm64).</li>
+      <li>Fixed non-blocking stdin polling deadlock on MSWindows anonymous pipes when running interactive measurement tools in subprocess mode.</li>
       <li>Added -d switch to printtarg to allow custom chart label strings or omit labelling entirely.</li>
       <li>Added MSWindows ARM release.</li>
       <li>Added Mac ARM release.</li>

makepackagebin.sh

@@ -7,7 +7,7 @@ echo "Script to invoke Jam and then package the binary release."
 PRODUCT=Argyll
 
 # Set the environment string VERSION from the #define, ie 1.0.0
-VERSION=`grep ARGYLL_VERSION_STR h/aconfig.h | head -1 | sed 's/# define ARGYLL_VERSION_STR //' | sed 's/"//g'`
+VERSION=`grep ARGYLL_VERSION_STR h/aconfig.h | head -1 | sed 's/# define ARGYLL_VERSION_STR //' | sed 's/\"//g'`
 
 #   Typical environment variables:
 #   (NOTE some systems don't export these ENV vars. by default !!!)
@@ -113,6 +113,13 @@ else if [ "${OSTYPE#*darwin*}" != "$OSTYPE" ] ; then
 		echo "We're on MacOS arm64!"
 		PACKAGE=${PRODUCT}_V${VERSION}_macOS_arm64_bin.tgz
 		export MACOSX_DEPLOYMENT_TARGET="11.0"	# Minimum target platform version
+	else if [ X$HOSTTYPE = "Xuniversal" \
+		  -o X$MACHTYPE = "Xuniversal-apple-darwin" \
+		  -o X$COMPILER = "XUNIVERSAL" ] ; then
+		echo "We're on MacOS Universal!"
+		PACKAGE=${PRODUCT}_V${VERSION}_macOS_universal_bin.tgz
+		export MACOSX_DEPLOYMENT_TARGET="10.15"	# Minimum target platform version
+	fi
 	fi
 	fi
 	fi
@@ -145,23 +152,36 @@ fi
 
 echo "Making GNU $PRODUCT binary distribution $PACKAGE for Version $VERSION"
 
-# Clean up so we get a solid build
+if [ X$NO_BUILD = "X" ] ; then
-# .sp come from profile, .cht from scanin and .ti3 from spectro
+	# Clean up so we get a solid build
-rm -f bin/*.exe bin/*.dll
+	# .sp come from profile, .cht from scanin and .ti3 from spectro
-rm -f ref/*.sp ref/*.cht ref/*.ti2
+	rm -f bin/*.exe bin/*.dll
+	rm -f ref/*.sp ref/*.cht ref/*.ti2
 
-if [ X$CROSS_COMPILE = "X" ] ; then		# If not cross compiling
+	if [ X$CROSS_COMPILE = "X" ] ; then		# If not cross compiling
-  echo "Cleaning before build ..."
+	  echo "Cleaning before build ..."
-  if ! jam -fJambase -sBUILTIN_TIFF=true -sBUILTIN_JPEG=true -sBUILTIN_PNG=true -sBUILTIN_Z=true -sBUILTIN_SSL=true clean ; then
+	  if ! jam -fJambase -sBUILTIN_TIFF=true -sBUILTIN_JPEG=true -sBUILTIN_PNG=true -sBUILTIN_Z=true -sBUILTIN_SSL=true clean ; then
-    	echo "Clean failed!"
+	    	echo "Clean failed!"
-  	exit 1
+	  	exit 1
-  fi 
+	  fi 
+	fi
+
+	# Make sure it's built and installed
+	if ! jam -q -fJambase -j${NUMBER_OF_PROCESSORS:-1} -sBUILTIN_TIFF=true -sBUILTIN_JPEG=true -sBUILTIN_PNG=true -sBUILTIN_Z=true -sBUILTIN_SSL=true install ; then
+		echo "Build failed!"
+		exit 1
+	fi 
 fi 
 
-# Make sure it's built and installed
+# Apply ad-hoc code signatures to macOS Mach-O binaries before staging
-if ! jam -q -fJambase -j${NUMBER_OF_PROCESSORS:-1} -sBUILTIN_TIFF=true -sBUILTIN_JPEG=true -sBUILTIN_PNG=true -sBUILTIN_Z=true -sBUILTIN_SSL=true install ; then
+if [ "${OSTYPE#*darwin*}" != "$OSTYPE" ] ; then
-	echo "Build failed!"
+	echo "=== Applying ad-hoc code signatures to macOS Mach-O binaries ==="
-	exit 1
+	for f in bin/* ; do
+		if [ -f "$f" ] && file "$f" | grep -q "Mach-O" ; then
+			echo "Signing $f..."
+			codesign -f -s - "$f" || true
+		fi
+	done
 fi
 
 rm -rf $TOPDIR

spectro/conv.c

@@ -203,36 +203,37 @@ static int con_char(int wait) {
 		/* We assume pipe has been set to NOWAIT mode. */
 		} else if (stdin_type == FILE_TYPE_PIPE) {
 			int i, bib;
-//fprintf(stderr,"~1  top of pipe\n");
+			DWORD bytes_avail = 0;
+
+			/* Check available bytes in pipe before blocking */
+			if (!PeekNamedPipe(stdinh, NULL, 0, NULL, &bytes_avail, NULL) || bytes_avail == 0) {
+				if (!wait) {
+					return 0;
+				}
+			}
 
 			for (bib = 0; bib < 10;) {
-//fprintf(stderr,"~1  got %d in buf\n",bib);
+				if (!wait) {
+					if (!PeekNamedPipe(stdinh, NULL, 0, NULL, &bytes_avail, NULL) || bytes_avail == 0) {
+						break;
+					}
+				}
 				if ((!ReadFile(stdinh, buf + bib, 10 - bib, &bread, NULL) || bread == 0)
 				 && !wait) {
-//fprintf(stderr,"~1  no chars waiting\n");
 					break;
 				}
 				bib += bread;
 
 				for (i = 0; i < bib; i++) {
 					if (buf[i] == '\n' || buf[i] == '\r' || buf[i] == 0x3) {
-//fprintf(stderr,"~1  found lf at ix %d\n",i);
 						break;
 					}
 				}
 				if (i < bib) {
-//fprintf(stderr,"~1  found lf\n");
 					break;		/* Found '\n' */
 				}
 				Sleep(100);		/* Wait for a line ending in '\n' */
 			}
-
-//if (bread > 0) {
-//fprintf(stderr,"~1  read %d: ",bread);
-//for (i = 0; i < bread; i++)
-//fprintf(stderr," 0x%x",buf[i]);
-//fprintf(stderr,"\n//");
-//}
 			rv = buf[0];
 
 		/* Assume a file. This will have very limited functionality. */