Update macOS build pipeline

This update lowers system requirements from 10.13 to 10.11 and has
massive improvements regarding Python integration. Also lots
of minor improvements.

Based on https://github.com/dehesselle/mibap v0.12.

12 files changed, 314 insertions, 122 deletions

diff --git a/packaging/macos/020-vars.sh b/packaging/macos/020-vars.sh
index 3a82cbbd6..59e2e49df 100644
--- a/packaging/macos/020-vars.sh
+++ b/packaging/macos/020-vars.sh
@@ -21,12 +21,28 @@
 ### name #######################################################################
 
 SELF_NAME=$(basename $0)
+SELF_DIR=$(cd $(dirname "$0"); pwd -P)
 
 ### multithreading #############################################################
 
 CORES=$(sysctl -n hw.ncpu)   # use all available cores
 export MAKEFLAGS="-j $CORES"
 
+### target OS version ##########################################################
+
+# There are a lot of ways to appraoch this. I recommend:
+#   - OS X El Capitan (10.11)
+#   - Xcode 8.2.1 (latest Xcode to support 10.11) for its clang 8.x
+#   - MacOSX10.11.sdk from Xcode 7.3.1
+
+export MACOSX_DEPLOYMENT_TARGET=10.11   # minimum version Mavericks
+
+FLAG_MMACOSXVERSIONMIN="-mmacosx-version-min=$MACOSX_DEPLOYMENT_TARGET"
+
+export CFLAGS="$CFLAGS $FLAG_MMACOSXVERSIONMIN"
+export CXXFLAGS="$CXXFLAGS $FLAG_MMACOSXVERSIONMIN"
+export CPPFLAGS="$CPPFLAGS $FLAG_MMACOSXVERSIONMIN"
+
 ### ramdisk ####################################################################
 
 RAMDISK_ENABLE=true   # mount ramdisk to $WRK_DIR
@@ -98,6 +114,17 @@ LIB_DIR=$OPT_DIR/lib
 SRC_DIR=$OPT_DIR/src
 TMP_DIR=$OPT_DIR/tmp
 
+### Inkscape Git repository directory ##########################################
+
+# Location is different when run as GitLab CI job.
+
+if [ -z $CI_JOB_ID ]; then
+  INK_DIR=$SRC_DIR/inkscape
+else
+  INK_DIR=$SELF_DIR/../..
+  INK_DIR=$(cd $INK_DIR; pwd -P)   # make path canoncial
+fi
+
 ### artifact path ##############################################################
 
 # This is the location where the final product - like application bundle or
@@ -110,6 +137,7 @@ ARTIFACT_DIR=$WRK_DIR/artifacts
 APP_DIR=$ARTIFACT_DIR/Inkscape.app
 APP_CON_DIR=$APP_DIR/Contents
 APP_RES_DIR=$APP_CON_DIR/Resources
+APP_FRA_DIR=$APP_CON_DIR/Frameworks
 APP_BIN_DIR=$APP_RES_DIR/bin
 APP_ETC_DIR=$APP_RES_DIR/etc
 APP_EXE_DIR=$APP_CON_DIR/MacOS
@@ -123,6 +151,7 @@ APP_PLIST=$APP_CON_DIR/Info.plist
 
 URL_BOOST=https://dl.bintray.com/boostorg/release/1.69.0/source/boost_1_69_0.tar.bz2
 URL_CPPUNIT=https://dev-www.libreoffice.org/src/cppunit-1.14.0.tar.gz
+URL_CURL_CACERT=https://curl.haxx.se/ca/cacert.pem
 URL_DOUBLE_CONVERSION=https://github.com/google/double-conversion/archive/v3.1.4.tar.gz
 URL_FREETYPE=https://download.savannah.gnu.org/releases/freetype/freetype-2.10.0.tar.bz2
 URL_GC=https://github.com/ivmai/bdwgc/releases/download/v8.0.4/gc-8.0.4.tar.gz
@@ -135,14 +164,6 @@ URL_GTK_OSX_MODULESET=$URL_GTK_OSX/modulesets-stable/gtk-osx.modules
 URL_IMAGEMAGICK=https://github.com/ImageMagick/ImageMagick6/archive/6.9.7-10.tar.gz
 # Inkscape Git repository
 URL_INKSCAPE=https://gitlab.com/inkscape/inkscape
-# TODO icon in icns format
-# This is the only binary file in the build pipeline and it's roughly 1 MiB in
-# size. I do not want to merge that to Inkscape because it's a temporary
-# workarond: a future version of the build pipeline will generate the icns from
-# an already present png file on-the-fly. But until that's been implemented,
-# download the icns from the original "macOS Inkscape build and package"
-# repository.
-URL_INKSCAPE_ICNS=https://github.com/dehesselle/mibap/raw/master/inkscape.icns
 URL_LCMS2=https://netcologne.dl.sourceforge.net/project/lcms/lcms/2.9/lcms2-2.9.tar.gz
 URL_LIBCDR=https://github.com/LibreOffice/libcdr/archive/libcdr-0.1.5.tar.gz
 URL_LIBPSL=https://github.com/rockdaboot/libpsl/releases/download/libpsl-0.20.2/libpsl-0.20.2.tar.gz
@@ -152,9 +173,12 @@ URL_LIBVISIO=https://github.com/LibreOffice/libvisio/archive/libvisio-0.1.6.tar.
 URL_LIBWPG=https://netcologne.dl.sourceforge.net/project/libwpg/libwpg/libwpg-0.3.3/libwpg-0.3.3.tar.xz
 URL_OPENJPEG=https://github.com/uclouvain/openjpeg/archive/v2.3.0.tar.gz
 URL_OPENMP=https://github.com/llvm/llvm-project/releases/download/llvmorg-7.1.0/openmp-7.1.0.src.tar.xz
-URL_OPENSSL=https://www.openssl.org/source/openssl-1.1.1b.tar.gz
+# use OpenSSL version as in gtk-osx moduleset
+URL_OPENSSL=https://www.openssl.org/source/old/1.1.0/openssl-1.1.0g.tar.gz
+URL_PNG2ICNS=https://github.com/bitboss-ca/png2icns/archive/v0.1.tar.gz
 URL_POPPLER=https://gitlab.freedesktop.org/poppler/poppler/-/archive/poppler-0.74.0/poppler-poppler-0.74.0.tar.gz
 URL_POTRACE=http://potrace.sourceforge.net/download/1.15/potrace-1.15.tar.gz
+URL_PYTHON3=https://github.com/dehesselle/py3framework/releases/download/py368.4/py368_framework_4.tar.xz
 # A pre-built version of the complete toolset.
-URL_TOOLSET_CACHE=https://github.com/dehesselle/mibap/releases/download/v0.10/mibap_v0.10.tar.xz
+URL_TOOLSET_CACHE=https://github.com/dehesselle/mibap/releases/download/v0.11/mibap_v0.11.tar.xz
 
diff --git a/packaging/macos/030-funcs.sh b/packaging/macos/030-funcs.sh
index 74210470d..e44fc7034 100644
--- a/packaging/macos/030-funcs.sh
+++ b/packaging/macos/030-funcs.sh
@@ -22,6 +22,27 @@ function get_repo_version
   echo $(git -C $repo log --pretty=format:'%h' -n 1)
 }
 
+### get Inkscape version from CMakeLists.txt ###################################
+
+function get_inkscape_version
+{
+  local file=$SRC_DIR/inkscape/CMakeLists.txt
+  local ver_major=$(grep INKSCAPE_VERSION_MAJOR $file | head -n 1 | awk '{ print $2+0 }')
+  local ver_minor=$(grep INKSCAPE_VERSION_MINOR $file | head -n 1 | awk '{ print $2+0 }')
+  local ver_patch=$(grep INKSCAPE_VERSION_PATCH $file | head -n 1 | awk '{ print $2+0 }')
+  local ver_suffix=$(grep INKSCAPE_VERSION_SUFFIX $file | head -n 1 | awk '{ print $2 }')
+  
+  ver_suffix=${ver_suffix%\"*}   # remove "double quote and everything after" from end
+  ver_suffix=${ver_suffix#\"}   # remove "double quote" from beginning
+ 
+  # If there is a suffix, add the dot to it. Otherwise the suffix stays an
+  # empty string and resolves to "nothing" down below (as intended in that
+  # case).
+  [ ${#ver_suffix} -gt 0 ] && ver_suffix=.$ver_suffix
+
+  echo $ver_major.$ver_minor.$ver_patch$ver_suffix
+}
+
 ### get compression flag by filename extension #################################
 
 function get_comp_flag
@@ -59,6 +80,23 @@ function get_source
   [ $? -eq 0 ] && rm $log || echo "$FUNCNAME: check $log"
 }
 
+### download a file and save to disk ###########################################
+
+function save_file
+{
+  local url=$1
+  local target_dir=$2   # optional argument, defaults to $SRC_DIR
+
+  [ -z $target_dir ] && target_dir=$SRC_DIR
+
+  local file=$SRC_DIR/$(basename $url)
+  if [ -f $file ]; then
+    echo "$FUNCNAME: file $file exists"
+  else
+    curl -o $file -L $url
+  fi
+}
+
 ### make, make install in jhbuild environment ##################################
 
 function make_makeinstall
@@ -119,3 +157,16 @@ function insert_before
   rm $file_tmp
 }
 
+### relocate a library dependency ##############################################
+
+function relocate_dependency
+{
+  local target=$1    # fully qualified path and library name to new location
+  local library=$2   # library where 'source' get changed to 'target'
+
+  local source_lib=${target##*/}   # get library filename from target location
+  local source=$(otool -L $library | grep $source_lib | awk '{ print $1 }')
+
+  install_name_tool -change $source $target $library
+}
+
diff --git a/packaging/macos/110-jhbuild-install.sh b/packaging/macos/110-jhbuild-install.sh
index cf6cdaea0..cff2ef39e 100755
--- a/packaging/macos/110-jhbuild-install.sh
+++ b/packaging/macos/110-jhbuild-install.sh
@@ -61,3 +61,7 @@ echo "quiet_mode = True"                    >> $JHBUILDRC    # suppress output
 echo "progress_bar = True"                  >> $JHBUILDRC
 echo "moduleset = '$URL_GTK_OSX_MODULESET'" >> $JHBUILDRC    # custom moduleset
 
+# configure SDK
+sed -i "" "s/^setup_sdk/#setup_sdk/" $JHBUILDRC   # comment out existing setting
+echo "setup_sdk(target=\"$MACOSX_DEPLOYMENT_TARGET\")" >> $JHBUILDRC
+
diff --git a/packaging/macos/120-jhbuild-bootstrap.sh b/packaging/macos/120-jhbuild-bootstrap.sh
index 199148c6b..3fbf82689 100755
--- a/packaging/macos/120-jhbuild-bootstrap.sh
+++ b/packaging/macos/120-jhbuild-bootstrap.sh
@@ -11,6 +11,17 @@
 SELF_DIR=$(cd $(dirname "$0"); pwd -P)
 for script in $SELF_DIR/0??-*.sh; do source $script; done
 
+### install OpenSSL ############################################################
+
+# We install OpenSSL first so this version gets used instead instead of the
+# system one. (El Capitan uses 0.98)
+
+get_source $URL_OPENSSL
+./config --prefix=$OPT_DIR --openssldir=$OPT_DIR/etc/ssl $FLAG_MMACOSXVERSIONMIN
+make_makeinstall
+
+curl -o $OPT_DIR/etc/ssl/cert.pem $URL_CURL_CACERT
+
 ### bootstrap jhbuild environment ##############################################
 
 jhbuild bootstrap
diff --git a/packaging/macos/130-jhbuild-python.sh b/packaging/macos/130-jhbuild-python.sh
index b488633b6..4229bb2da 100755
--- a/packaging/macos/130-jhbuild-python.sh
+++ b/packaging/macos/130-jhbuild-python.sh
@@ -11,16 +11,6 @@
 SELF_DIR=$(cd $(dirname "$0"); pwd -P)
 for script in $SELF_DIR/0??-*.sh; do source $script; done
 
-### install OpenSSL ############################################################
-
-# Build OpenSSL as dedicated step because we need to link our system
-# configuration and certs (/etc/ssl) to it. Otherwise https downloads
-# will fail with certification validation issues.
-
-jhbuild build openssl
-mkdir -p $OPT_DIR/etc
-ln -sf /etc/ssl $OPT_DIR/etc   # link system config to our OpenSSL
-
 ### install Python 2 ###########################################################
 
 # Some packages complain about non-exiting development headers when you rely
@@ -34,27 +24,3 @@ curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
 jhbuild run python get-pip.py
 jhbuild run pip install six   # required for a package in meta-gtk-osx-bootstrap
 
-### install Python 3 ###########################################################
-
-# Since enabling the Framework build ('--enable-framework'), 'install' fails
-# on multi-threaded build ('$MAKEFLAGS')
-
-unset MAKEFLAGS   # 'install' step would fail otherwise
-
-jhbuild build python3
-
-# make library link paths relative
-install_name_tool -change $OPT_DIR/Frameworks/Python.framework/Versions/3.6/Python @executable_path/../../../Versions/3.6/Python $OPT_DIR/Frameworks/Python.framework/Versions/3.6/bin/python3.6
-install_name_tool -change $OPT_DIR/Frameworks/Python.framework/Versions/3.6/Python @executable_path/../../../Versions/3.6/Python $OPT_DIR/Frameworks/Python.framework/Versions/3.6/bin/python3.6m
-install_name_tool -change $OPT_DIR/Frameworks/Python.framework/Versions/3.6/Python @executable_path/../../../../Python $OPT_DIR/Frameworks/Python.framework/Versions/3.6/Resources/Python.app/Contents/MacOS/Python
-
-# replace hard-coded interpreter path in shebang with an environment lookup
-PYTHON_BIN_DIR=$OPT_DIR/Frameworks/Python.framework/Versions/3.6/bin
-sed -i "" "1s/.*/#!\/usr\/bin\/env python3.6/" $PYTHON_BIN_DIR/2to3-3.6
-sed -i "" "1s/.*/#!\/usr\/bin\/env python3.6/" $PYTHON_BIN_DIR/easy_install-3.6
-sed -i "" "1s/.*/#!\/usr\/bin\/env python3.6/" $PYTHON_BIN_DIR/idle3.6
-sed -i "" "1s/.*/#!\/usr\/bin\/env python3.6/" $PYTHON_BIN_DIR/pip3
-sed -i "" "1s/.*/#!\/usr\/bin\/env python3.6/" $PYTHON_BIN_DIR/pip3.6
-sed -i "" "1s/.*/#!\/usr\/bin\/env python3.6/" $PYTHON_BIN_DIR/pydoc3.6
-sed -i "" "1s/.*/#!\/usr\/bin\/env python3.6/" $PYTHON_BIN_DIR/python3.6m-config
-sed -i "" "1s/.*/#!\/usr\/bin\/env python3.6/" $PYTHON_BIN_DIR/pyvenv-3.6
diff --git a/packaging/macos/210-inkscape-build.sh b/packaging/macos/210-inkscape-build.sh
index d2f054630..feb404bca 100755
--- a/packaging/macos/210-inkscape-build.sh
+++ b/packaging/macos/210-inkscape-build.sh
@@ -15,23 +15,17 @@ set -e
 
 ### build Inkscape #############################################################
 
-INKSCAPE_SRC_DIR=..
-
 if [ -z $CI_JOB_ID ]; then   # running standalone
-  cd $SRC_DIR
-  git clone --recurse-submodules --depth 10 $URL_INKSCAPE
-  #git clone --recurse-submodules $URL_INKSCAPE   # this is a >1.6 GiB download
-  mkdir inkscape_build
-  cd inkscape_build
-  INKSCAPE_SRC_DIR=$INKSCAPE_SRC_DIR/inkscape
-else   # running as CI job
-  if [ -d $SELF_DIR/../../build ]; then   # cleanup previous run
-    rm -rf $SELF_DIR/../../build
-  fi
-  mkdir $SELF_DIR/../../build
-  cd $SELF_DIR/../../build
+  git clone --recurse-submodules --depth 10 $URL_INKSCAPE $INK_DIR
+  #git clone --recurse-submodules $URL_INKSCAPE $INK_DIR   # >1.6 GiB download
 fi
 
+[ -d $INK_DIR.build ] && rm -rf $INK_DIR.build   # cleanup previous run
+
+mkdir -p $INK_DIR.build
+cd $INK_DIR.build
+
+# about the '-DOpenMP_*' arguments:
 # All the settings for OpenMP are to trigger the detection during 'cmake'.
 # Experimenting with a "Hello World"-style example shows that linking with
 # '-lomp' would suffice, no '-fopenmp' required.
@@ -45,18 +39,18 @@ cmake \
   -DOpenMP_CXX_LIB_NAMES="omp" \
   -DOpenMP_C_LIB_NAMES="omp" \
   -DOpenMP_omp_LIBRARY=$LIB_DIR/libomp.dylib \
-  $INKSCAPE_SRC_DIR
+  $INK_DIR
 
 make
 make install
 
-# patch library locations before packaging
-#   poppler
+# patch Poppler library locations
 install_name_tool -change @rpath/libpoppler.85.dylib $LIB_DIR/libpoppler.85.dylib $BIN_DIR/inkscape
 install_name_tool -change @rpath/libpoppler-glib.8.dylib $LIB_DIR/libpoppler-glib.8.dylib $BIN_DIR/inkscape
 install_name_tool -change @rpath/libpoppler.85.dylib $LIB_DIR/libpoppler.85.dylib $LIB_DIR/inkscape/libinkscape_base.dylib
 install_name_tool -change @rpath/libpoppler-glib.8.dylib $LIB_DIR/libpoppler-glib.8.dylib $LIB_DIR/inkscape/libinkscape_base.dylib
-#   OpenMP
+
+# patch OpenMP library locations
 install_name_tool -change @rpath/libomp.dylib $LIB_DIR/libomp.dylib $BIN_DIR/inkscape
 install_name_tool -change @rpath/libomp.dylib $LIB_DIR/libomp.dylib $LIB_DIR/inkscape/libinkscape_base.dylib
 
diff --git a/packaging/macos/220-inkscape-package.sh b/packaging/macos/220-inkscape-package.sh
index 426852ca1..3bef7a6e6 100755
--- a/packaging/macos/220-inkscape-package.sh
+++ b/packaging/macos/220-inkscape-package.sh
@@ -24,24 +24,24 @@ jhbuild run gtk-mac-bundler inkscape.bundle
 
 # patch library locations
 install_name_tool -change @rpath/libinkscape_base.dylib @executable_path/../Resources/lib/inkscape/libinkscape_base.dylib $APP_EXE_DIR/Inkscape-bin
+
 install_name_tool -change @rpath/libpoppler.85.dylib @executable_path/../Resources/lib/libpoppler.85.dylib $APP_LIB_DIR/libpoppler-glib.8.dylib
 install_name_tool -change @rpath/libpoppler.85.dylib @executable_path/../Resources/lib/libpoppler.85.dylib $APP_LIB_DIR/inkscape/libinkscape_base.dylib
 install_name_tool -change @rpath/libpoppler-glib.8.dylib @executable_path/../Resources/lib/libpoppler-glib.8.dylib $APP_LIB_DIR/inkscape/libinkscape_base.dylib
 
 install_name_tool -change @executable_path/../Resources/lib/libcrypto.1.1.dylib @loader_path/libcrypto.1.1.dylib $APP_LIB_DIR/libssl.1.1.dylib
 
-
-# patch the launch script
+# set Inkscape's data directory via environment variables
 # TODO: as follow-up to https://gitlab.com/inkscape/inkscape/merge_requests/612,
 # it should not be necessary to rely on $INKSCAPE_DATADIR. Paths in
-# 'path-prefix.h' are supposed to work. Needs to be looked into with @ede123.
+# 'path-prefix.h' are supposed to work. Needs to be looked into.
 
 insert_before $APP_EXE_DIR/Inkscape '\$EXEC' 'export INKSCAPE_DATADIR=$bundle_data'
 insert_before $APP_EXE_DIR/Inkscape '\$EXEC' 'export INKSCAPE_LOCALEDIR=$bundle_data/locale'
 
 # add XDG paths to use native locations on macOS
 insert_before $APP_EXE_DIR/Inkscape 'export XDG_CONFIG_DIRS' '\
-export XDG_DATA_HOME=\"$HOME/Library/Application Support/Inkscape/data\"\
+export XDG_DATA_HOME=\"$HOME/Library/Application\\ Support/Inkscape/data\"\
 export XDG_CONFIG_HOME=\"$HOME/Library/Application Support/Inkscape/config\"\
 export XDG_CACHE_HOME=\"$HOME/Library/Application Support/Inkscape/cache\"\
 mkdir -p $XDG_DATA_HOME\
@@ -49,56 +49,174 @@ mkdir -p $XDG_CONFIG_HOME\
 mkdir -p $XDG_CACHE_HOME\
 '
 
-# add icon
-# TODO: create from Inkscape assets on-the-fly
-curl -L -o $APP_RES_DIR/inkscape.icns $URL_INKSCAPE_ICNS
+# update Inkscape version information
+/usr/libexec/PlistBuddy -c "Set CFBundleShortVersionString '$(get_inkscape_version) ($(get_repo_version $INK_DIR))'" $APP_PLIST
+/usr/libexec/PlistBuddy -c "Set CFBundleVersion '$(get_inkscape_version) ($(get_repo_version $INK_DIR))'" $APP_PLIST
 
-if [ -z $CI_JOB_ID ]; then   # running standalone
-  # update version information
-  /usr/libexec/PlistBuddy -c "Set CFBundleShortVersionString '1.0alpha2-g$(get_repo_version $SRC_DIR/inkscape)'" $APP_PLIST
-  /usr/libexec/PlistBuddy -c "Set CFBundleVersion '1.0alpha2-g$(get_repo_version $SRC_DIR/inkscape)'" $APP_PLIST
-else   # running as CI job
-  # update version information
-  /usr/libexec/PlistBuddy -c "Set CFBundleShortVersionString '1.0alpha2-g$(get_repo_version $SELF_DIR)'" $APP_PLIST
-  /usr/libexec/PlistBuddy -c "Set CFBundleVersion '1.0alpha2-g$(get_repo_version $SELF_DIR)'" $APP_PLIST
-fi
+# update minimum OS version
+/usr/libexec/PlistBuddy -c "Set LSMinimumSystemVersion '$MACOSX_DEPLOYMENT_TARGET'" $APP_PLIST
 
-### copy Python.framework ######################################################
+### generate application icon ##################################################
 
-# This section deals with bundling Python.framework into the application
-# and making it portable.
+# svg to png
 
-# Link Python executable version-less for the extensions to find it.
-# This will shadow the system's Python interpreter for Inkscape.
-mkdir -p $APP_BIN_DIR
-cd $APP_BIN_DIR
-ln -s ../../Frameworks/Python.framework/Versions/3.6/bin/python3.6 python
-# add '$APP_BIN_DIR' to paths
-insert_before $APP_EXE_DIR/Inkscape '\$EXEC' 'export PATH=$bundle_bin:$PATH'
+jhbuild run pip3 install cairosvg==2.4.0
+jhbuild run pip3 install cairocffi==1.0.2
+
+(
+  export DYLD_FALLBACK_LIBRARY_PATH=/work/opt/lib
+  jhbuild run cairosvg -f png -s 8 -o $SRC_DIR/inkscape.png $INK_DIR/share/branding/inkscape.svg
+)
+
+# png to icns
+
+get_source $URL_PNG2ICNS
+./png2icns.sh $SRC_DIR/inkscape.png
+mv inkscape.icns $APP_RES_DIR
+
+### bundle Python.framework ####################################################
+
+# This section deals with bundling Python.framework into the application.
+
+save_file $URL_PYTHON3   # download a pre-built Python.framework
+
+mkdir $APP_FRA_DIR
+get_source file://$SRC_DIR/$(basename $URL_PYTHON3) $APP_FRA_DIR
+
+# add it to '$PATH' in launch script
+insert_before $APP_EXE_DIR/Inkscape '\$EXEC' 'export PATH=$bundle_contents/Frameworks/Python.framework/Versions/Current/bin:$PATH'
+# add it to '$PATH' here and now (for package installation below)
+export PATH=$APP_FRA_DIR/Python.framework/Versions/Current/bin:$PATH
+
+# create '.pth' file inside Framework to include our site-packages directory
+echo "./../../../../../../../Resources/lib/python3.6/site-packages" > $APP_FRA_DIR/Python.framework/Versions/Current/lib/python3.6/site-packages/inkscape.pth
+
+### install Python package: lxml ###############################################
 
-# Copy Python framework to app bundle
-rsync -a $OPT_DIR/Frameworks $APP_CON_DIR
+(
+  export CFLAGS=-I$OPT_DIR/include/libxml2   # This became necessary when switching
+  export LDFLAGS=-L/$LIB_DIR                 # from builing on 10.13 to 10.11.
+  pip3 install --install-option="--prefix=$APP_RES_DIR" --ignore-installed lxml==4.3.3
+)
 
-P36_DIR=$APP_CON_DIR/Frameworks/Python.framework/Versions/3.6
+# patch 'etree'
+relocate_dependency @loader_path/../../../libxml2.2.dylib $APP_LIB_DIR/python3.6/site-packages/lxml/etree.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libz.1.dylib $APP_LIB_DIR/python3.6/site-packages/lxml/etree.cpython-36m-darwin.so
+# patch 'objectify'
+relocate_dependency @loader_path/../../../libxml2.2.dylib $APP_LIB_DIR/python3.6/site-packages/lxml/objectify.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libz.1.dylib $APP_LIB_DIR/python3.6/site-packages/lxml/objectify.cpython-36m-darwin.so
 
-# patch various binaries and libraries to use relative library locations
-# main library
-chmod 644 $APP_CON_DIR/Frameworks/Python.framework/Versions/3.6/Python
-install_name_tool -change $LIB_DIR/libintl.9.dylib @loader_path/../../../../Resources/lib/libintl.9.dylib $P36_DIR/Python
-# Python.app inside the framework
-install_name_tool -change $LIB_DIR/libintl.9.dylib @executable_path/../../../../../../../../Resources/lib/libintl.9.dylib  $APP_CON_DIR/Frameworks/Python.framework/Resources/Python.app/Contents/MacOS/Python
-# dynamic loader for SSL libraries
-install_name_tool -change $LIB_DIR/libssl.1.1.dylib @loader_path/../../../../../../../Resources/lib/libssl.1.1.dylib $P36_DIR/lib/python3.6/lib-dynload/_ssl*.so
-install_name_tool -change $LIB_DIR/libcrypto.1.1.dylib @loader_path/../../../../../../../Resources/lib/libcrypto.1.1.dylib $P36_DIR/lib/python3.6/lib-dynload/_ssl*.so
+# patch libxml2.dylib to use '@loader_path' to find neighbouring libraries
+relocate_dependency @loader_path/libz.1.dylib $APP_LIB_DIR/libxml2.2.dylib
+relocate_dependency @loader_path/liblzma.5.dylib $APP_LIB_DIR/libxml2.2.dylib
 
-### install Python packages ####################################################
+### install Python package: NumPy ##############################################
 
-# Install Python packages required by default Inkscape extensions.
+pip3 install --install-option="--prefix=$APP_RES_DIR" --ignore-installed numpy==1.16.4
 
-export PATH=$P36_DIR/bin:$PATH   # use Python interpreter from inside the app
+### install Python package: Pycairo ############################################
 
-$P36_DIR/bin/pip3 install lxml
-$P36_DIR/bin/pip3 install numpy
+pip3 install --install-option="--prefix=$APP_RES_DIR" --ignore-installed pycairo==1.18.1
+
+# patch '_cairo'
+relocate_dependency @loader_path/../../../libcairo.2.dylib $APP_LIB_DIR/python3.6/site-packages/cairo/_cairo.cpython-36m-darwin.so
+
+# patch libcairo.2.dylib to use '@loader_path' to find neighbouring libraries
+relocate_dependency @loader_path/libpixman-1.0.dylib $APP_LIB_DIR/libcairo.2.dylib
+relocate_dependency @loader_path/libfontconfig.1.dylib $APP_LIB_DIR/libcairo.2.dylib
+relocate_dependency @loader_path/libfreetype.6.dylib $APP_LIB_DIR/libcairo.2.dylib
+relocate_dependency @loader_path/libpng16.16.dylib $APP_LIB_DIR/libcairo.2.dylib
+relocate_dependency @loader_path/libz.1.dylib $APP_LIB_DIR/libcairo.2.dylib
+
+### install Python package: PyGObject ##########################################
+
+pip3 install --install-option="--prefix=$APP_RES_DIR" --ignore-installed PyGObject==3.32.1
+
+# patch '_gi'
+relocate_dependency @loader_path/../../../libglib-2.0.0.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libintl.9.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libgio-2.0.0.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libgobject-2.0.0.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libgirepository-1.0.1.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libffi.6.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi.cpython-36m-darwin.so
+
+# patch libglib-2.0.0.dylib to find neighbouring libraries
+relocate_dependency @loader_path/libintl.9.dylib $APP_LIB_DIR/libglib-2.0.0.dylib
+
+# patch libgio-2.0.0.dylib to find neighbouring libraries
+relocate_dependency @loader_path/libgobject-2.0.0.dylib $APP_LIB_DIR/libgio-2.0.0.dylib
+relocate_dependency @loader_path/libffi.6.dylib $APP_LIB_DIR/libgio-2.0.0.dylib
+relocate_dependency @loader_path/libgmodule-2.0.0.dylib $APP_LIB_DIR/libgio-2.0.0.dylib
+relocate_dependency @loader_path/libglib-2.0.0.dylib $APP_LIB_DIR/libgio-2.0.0.dylib
+relocate_dependency @loader_path/libz.1.dylib $APP_LIB_DIR/libgio-2.0.0.dylib
+relocate_dependency @loader_path/libintl.9.dylib $APP_LIB_DIR/libgio-2.0.0.dylib
+
+# patch libgobject-2.0.0.dylib to find neighbouring libraries
+relocate_dependency @loader_path/libglib-2.0.0.dylib $APP_LIB_DIR/libgobject-2.0.0.dylib
+relocate_dependency @loader_path/libffi.6.dylib $APP_LIB_DIR/libgobject-2.0.0.dylib
+relocate_dependency @loader_path/libintl.9.dylib $APP_LIB_DIR/libgobject-2.0.0.dylib
+
+# patch libgirepository-1.0.1.dylib to find neighbouring libraries
+relocate_dependency @loader_path/libgmodule-2.0.0.dylib $APP_LIB_DIR/libgirepository-1.0.1.dylib
+relocate_dependency @loader_path/libgio-2.0.0.dylib $APP_LIB_DIR/libgirepository-1.0.1.dylib
+relocate_dependency @loader_path/libgobject-2.0.0.dylib $APP_LIB_DIR/libgirepository-1.0.1.dylib
+relocate_dependency @loader_path/libglib-2.0.0.dylib $APP_LIB_DIR/libgirepository-1.0.1.dylib
+relocate_dependency @loader_path/libintl.9.dylib $APP_LIB_DIR/libgirepository-1.0.1.dylib
+relocate_dependency @loader_path/libffi.6.dylib $APP_LIB_DIR/libgirepository-1.0.1.dylib
+
+# patch '_gi_cairo'
+relocate_dependency @loader_path/../../../libglib-2.0.0.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi_cairo.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libintl.9.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi_cairo.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libgio-2.0.0.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi_cairo.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libgobject-2.0.0.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi_cairo.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libgirepository-1.0.1.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi_cairo.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libffi.6.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi_cairo.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libcairo.2.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi_cairo.cpython-36m-darwin.so
+relocate_dependency @loader_path/../../../libcairo-gobject.2.dylib $APP_LIB_DIR/python3.6/site-packages/gi/_gi_cairo.cpython-36m-darwin.so
+
+# patch libcairo-gobject.2.dylib
+relocate_dependency @loader_path/libcairo.2.dylib $APP_LIB_DIR/libcairo-gobject.2.dylib
+relocate_dependency @loader_path/libpixman-1.0.dylib $APP_LIB_DIR/libcairo-gobject.2.dylib
+relocate_dependency @loader_path/libfontconfig.1.dylib $APP_LIB_DIR/libcairo-gobject.2.dylib
+relocate_dependency @loader_path/libfreetype.6.dylib $APP_LIB_DIR/libcairo-gobject.2.dylib
+relocate_dependency @loader_path/libpng16.16.dylib $APP_LIB_DIR/libcairo-gobject.2.dylib
+relocate_dependency @loader_path/libz.1.dylib $APP_LIB_DIR/libcairo-gobject.2.dylib
+relocate_dependency @loader_path/libgobject-2.0.0.dylib $APP_LIB_DIR/libcairo-gobject.2.dylib
+relocate_dependency @loader_path/libglib-2.0.0.dylib $APP_LIB_DIR/libcairo-gobject.2.dylib
+relocate_dependency @loader_path/libintl.9.dylib $APP_LIB_DIR/libcairo-gobject.2.dylib
+
+# patch libgmodule-2.0.0.dylib
+relocate_dependency @loader_path/libglib-2.0.0.dylib $APP_LIB_DIR/libgmodule-2.0.0.dylib
+relocate_dependency @loader_path/libintl.9.dylib $APP_LIB_DIR/libgmodule-2.0.0.dylib
+
+### install Python package: Scour ##############################################
+
+pip3 install --install-option="--prefix=$APP_RES_DIR" --ignore-installed scour==0.37
+
+### set default Python interpreter #############################################
+
+# If no override is present in 'preferences.xml' (see
+# http://wiki.inkscape.org/wiki/index.php/Extension_Interpreters#Selecting_a_specific_interpreter_version_.28via_preferences_file.29
+# ) we set the bundled Python to be the default one.
+
+# Default interpreter is an unversioned environment lookup for 'python', so
+# we prepar to override it.
+mkdir -p $APP_BIN_DIR
+cd $APP_BIN_DIR
+ln -sf ../../Frameworks/Python.framework/Versions/Current/bin/python3 python
+
+# add override check to launch script
+insert_before $APP_EXE_DIR/Inkscape '\$EXEC' '\
+INKSCAPE_PREFERENCES=$HOME/Library/Application\\ Support/Inkscape/config/inkscape/preferences.xml\
+if [ -f $INKSCAPE_PREFERENCES ]; then   # Has Inkscape been launched before?\
+  PYTHON_INTERPRETER=$\(xmllint --xpath '\''string\(//inkscape/group[@id=\"extensions\"]/@python-interpreter\)'\'' $INKSCAPE_PREFERENCES\)\
+  if [ -z $PYTHON_INTERPRETER ]\; then   # No override for Python interpreter?\
+    export PATH=$bundle_bin:$PATH        # make bundled Python default one\
+  fi\
+else                                     # Inkscape has not been launched before\
+  export PATH=$bundle_bin:$PATH          # make bundled Python default one\
+fi\
+'
 
 ### fontconfig #################################################################
 
diff --git a/packaging/macos/230-inkscape-distrib.sh b/packaging/macos/230-inkscape-distrib.sh
index f1388afec..55013f188 100755
--- a/packaging/macos/230-inkscape-distrib.sh
+++ b/packaging/macos/230-inkscape-distrib.sh
@@ -19,5 +19,5 @@ set -e
 
 if [ ! -z $CI_JOB_ID ]; then   # create build artifcat for CI job
   cd $WRK_DIR
-  mv $ARTIFACT_DIR $SELF_DIR/../../build
+  mv $ARTIFACT_DIR $INK_DIR/artifacts
 fi
diff --git a/packaging/macos/README.md b/packaging/macos/README.md
index ac1cd3c24..1e12b30b0 100644
--- a/packaging/macos/README.md
+++ b/packaging/macos/README.md
@@ -4,14 +4,26 @@ This folder contains the scripts that make up the build pipeline for Inkscape on
 
 ## Requirements
 
-_It would've been more fair if this section was called "recommandations" instead, but that would only encourage carelessness._
+_In some regards it would've been more fair if this section was called "recommendations" instead, but that would only encourage carelessness or deviating from a known-good setup._
 
-- Use a __dedicated, clean macOS installation__ as build machine. "clean" as in "freshly installed + Xcode CLI tools". Nothing more, nothing less.
+- Use a __dedicated, clean macOS installation__ as build machine. "clean" as in "freshly installed + Xcode". Nothing more, nothing less.
   - Especially no MacPorts, no Fink, no Homebrew, ... because they could interfere with the build system we're using.
-  - macOS 10.13.6 with Xcode 10.1.
-    - These scripts are being developed and used using said versions.
-    - Newer versions might work but haven't been tested.
-  - A full Xcode installation won't hurt, but is not required.
+  - macOS 10.11.6 with Xcode 8.2.1.
+  - macOS 10.11 SDK from Xcode 7.3.1
+    - Place it inside your `Xcode.app` and re-symlink to make look as follows:
+
+      ```bash
+      elcapitan:SDKs rene$ pwd
+      /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs
+      elcapitan:SDKs rene$ ls -lah
+      total 8
+      drwxr-xr-x  5 root  wheel   170B 20 Jun 12:23 .
+      drwxr-xr-x  5 root  wheel   170B 15 Dez  2016 ..
+      lrwxr-xr-x  1 root  wheel    15B 20 Jun 12:23 MacOSX.sdk -> MacOSX10.11.sdk
+      drwxr-xr-x  5 root  wheel   170B 21 Okt  2020 MacOSX10.11.sdk
+      drwxr-xr-x  5 root  wheel   170B 17 Sep  2017 MacOSX10.12.sdk.disabled
+      ```
+
 - __Use a dedicated user account__ unless you're prepared that these scripts will delete and overwrite your data in the following locations:  
 _(comments based on default configuration)_
 
@@ -22,7 +34,7 @@ _(comments based on default configuration)_
     ```
 
 - __16 GiB RAM__, since we're using a 9 GiB ramdisk to build everything.
-  - Using a ramdisk speeds up the process significantly and avoids wearing out your ssd.
+  - Using a ramdisk speeds up the process significantly and avoids wearing out your SSD.
   - You can choose to not use a ramdisk by overriding `RAMDISK_ENABLE=false` in a e.g. `021-custom.sh` file.
   - The build environment takes up ~6.1 GiB of disk space, the Inkscape Git repository ~1.6 GiB. Subject to change and YMMV.
 - somewhat decent __internet connection__ for all the downloads
@@ -33,16 +45,18 @@ _(comments based on default configuration)_
 
 > TODO: These scripts were initially designed as part of a dedicated repository, not the Inkscape repository itself. Therefore they contain a step that shallow-clones the Inkscape repository to build. This behaviour will be improved upon in a future version.
 
-Run:
+You can either run all the executable scripts that have a numerical prefix yourself and in the given order (`1nn`, `2nn` - not the `0nn` ones), or, if you're feeling bold, use
 
 ```bash
-./build_everything.sh
+./build_all.sh
 ```
 
-This will run all the `nnn-*.sh` scripts consecutively.
+to have everything run for you. If you are doing this the first time, my advice is to do it manually and step-by-step first to see if you're getting through all of it without errors.
 
 ### GitLab CI
 
+> TODO: configuration examples need to be reworked
+
 #### configuration example `.gitlab-runner/config.toml`
 
 ```toml
@@ -67,4 +81,4 @@ buildmacos:
 
 ## Status
 
-This is still a work in progress and actively being worked on.
+This is based on [mibap](https://github.com/dehesselle/mibap) and still a work in progress.
diff --git a/packaging/macos/build_toolset.sh b/packaging/macos/build_toolset.sh
index b4acededd..12e0d7b8d 100755
--- a/packaging/macos/build_toolset.sh
+++ b/packaging/macos/build_toolset.sh
@@ -19,7 +19,13 @@ if [ -d $OPT_DIR ]; then
   echo "$SELF_NAME: $OPT_DIR exists - not doing anything"
 else
   if $TOOLSET_CACHE_ENABLE &&
-     [ "$WRK_DIR" = "$DEFAULT_SYSTEM_WRK_DIR" ]; then   # we're good to download
+    [ "$WRK_DIR" = "$DEFAULT_SYSTEM_WRK_DIR" ]; then   # we're good to download
+    # Current configuration uses $WRK_DIR for both the toolset ($WRK_DIR/opt) 
+    # and GitLab runner's build directory ($WRK_DIR/build). Creating a ramdisk
+    # in $WRK_DIR during CI would shadow that.
+    # Until a better solution is found, the ramdisk has to be manually created
+    # on the runner and is disabled on CI.
+    [ ! -z $CI_JOB_ID ] && RAMDISK_ENABLE=false
     $SELF_DIR/110-jhbuild-install.sh
     get_source $URL_TOOLSET_CACHE $WRK_DIR
   else  # we need to build from scratch
diff --git a/packaging/macos/inkscape.bundle b/packaging/macos/inkscape.bundle
index 7bed2ea04..fcb04bfeb 100644
--- a/packaging/macos/inkscape.bundle
+++ b/packaging/macos/inkscape.bundle
@@ -83,10 +83,14 @@
   <binary>
     ${prefix}/lib/gio/modules/*.so
   </binary>
-  <!-- fontconfig binaries -->
+  <!-- fontconfig binaries TODO are they really required? -->
   <binary>
     ${prefix}/bin/fc-*
   </binary>
+  <!-- GObject Introspection repository manager -->
+  <binary>
+    ${prefix}/lib/libgirepository-1.0.1.dylib
+  </binary>
   <!-- Translation filenames, one for each program or library that you
        want to copy in to the bundle. The "dest" attribute is
        optional, as usual. Bundler will find all translations of that
diff --git a/packaging/macos/inkscape.plist b/packaging/macos/inkscape.plist
index 457e2f1b6..5ee321db6 100644
--- a/packaging/macos/inkscape.plist
+++ b/packaging/macos/inkscape.plist
@@ -536,17 +536,17 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>1.0alpha2</string>
+    <string>1.0alpha</string>
     <key>CFBundleSignature</key>
     <string>Inks</string>
     <key>CFBundleVersion</key>
-    <string>1.0alpha2</string>
+    <string>1.0alpha</string>
     <key>NSHumanReadableCopyright</key>
     <string>Copyright 2019 Inkscape Developers, GNU General Public License.</string>
     <key>LSApplicationCategoryType</key>
     <string>public.app-category.graphics-design</string>
     <key>LSMinimumSystemVersion</key>
-    <string>10.13</string>
+    <string>10.11</string>
     <key>GtkOSXLaunchScriptFile</key>
     <string>gtk_launcher.py</string>
     <key>NSHighResolutionCapable</key>