Change build OS and target

We no longer user El Capitan (10.11) as build platform. We now use
Mojave (10.14) in combination with the Mavericks SDK (10.9). This
simplifies the build process as we can use a current platform
and gives backward compatibility down to Mavericks (10.9).

Use a newer Python build that we turn non-relocatable for JHBuild,
avoiding to build it ourselves (time consuming!) in 120-python3.sh.

New default build location is /Users/Shared/work. This is a user-
independent location and user-writable and simplifies WKR_DIR
handling.

8 files changed, 81 insertions, 107 deletions

diff --git a/packaging/macos/010-defaults.sh b/packaging/macos/010-defaults.sh
index 95efff69f..31464c4fa 100644
--- a/packaging/macos/010-defaults.sh
+++ b/packaging/macos/010-defaults.sh
@@ -16,16 +16,12 @@
 ### path for pre-built build environment #######################################
 
 # This is the path the pre-built build environment has been built in. Therefore,
-# all binaries and libraries have hard-coded library locations relative to this
+# all binaries and libraries have hard-coded absolute library locations to this
 # path. If you decide to not build the build environment yourself and want to
-# use the pre-built one, it is essential that the $WRK_DIR you are using is the
-# same as $DEFAULT_SYSTEM_WRK_DIR, otherwise it doesn't work.
+# use the pre-built one, it is essential that the WRK_DIR you are using is the
+# same as DEFAULT_WRK_DIR, otherwise it doesn't work.
 # The scripts will make their decision if the pre-built build environment can be
-# used based on comparing values between $WRK_DIR and $DEFAULT_SYSTEM_WRK_DIR.
+# used based on comparing values between WRK_DIR and DEFAULT_WRK_DIR.
 
-DEFAULT_SYSTEM_WRK_DIR=/work
+DEFAULT_WRK_DIR=/Users/Shared/work
 
-# If using $DEFAULT_SYSTEM_WRK_DIR is not on option, use there is a default
-# user-based location.
-
-DEFAULT_USER_WRK_DIR=$HOME/work
diff --git a/packaging/macos/020-vars.sh b/packaging/macos/020-vars.sh
index d5e8c7123..32a0b1f9d 100644
--- a/packaging/macos/020-vars.sh
+++ b/packaging/macos/020-vars.sh
@@ -29,29 +29,24 @@ export MAKEFLAGS="-j $CORES"
 
 ### target OS version ##########################################################
 
-# There are a lot of ways to appraoch this. Recommendation:
-#   - OS X El Capitan (10.11)
-#   - Xcode 8.2.1 (latest Xcode to support 10.11) for its clang 8.x
-#   - MacOSX10.11.sdk from Xcode 7.3.1
+# You can build an macOS Mojave 10.14 using Xcode 10.3 using the SDK
+# from OS X Mavericks 10.9 (part of Xcode 6.3).
 
-export MACOSX_DEPLOYMENT_TARGET=10.11   # minimum version El Capitan
-
-FLAG_MMACOSXVERSIONMIN="-mmacosx-version-min=$MACOSX_DEPLOYMENT_TARGET"
-
-export CFLAGS="$CFLAGS $FLAG_MMACOSXVERSIONMIN"
-export CXXFLAGS="$CXXFLAGS $FLAG_MMACOSXVERSIONMIN"
-export CPPFLAGS="$CPPFLAGS $FLAG_MMACOSXVERSIONMIN"
+export MACOSX_DEPLOYMENT_TARGET=10.9   # OS X Mavericks
+export SDKROOT=/Library/Developer/CommandLineTools/SDKs/MacOSX${MACOSX_DEPLOYMENT_TARGET}.sdk
 
 ### ramdisk ####################################################################
 
-RAMDISK_ENABLE=true   # mount ramdisk to $WRK_DIR
+# 9 GiB to build toolset, 5 GiB when using pre-built toolset
+
+RAMDISK_ENABLE=true   # mount ramdisk to WRK_DIR
 RAMDISK_SIZE=9        # unit is GiB
 
 ### try to use pre-built toolset ###############################################
 
 # In order to just download and extract a pre-built toolset
 #   - it has to be enabled ('TOOLSET_CACHE_ENABLE=true')
-#   - you have to use $DEFAULT_SYSTEM_WRK_DIR as your $WRK_DIR
+#   - you have to use DEFAULT_SYSTEM_WRK_DIR as your WRK_DIR
 #     (see commentary in the section below for explanation)
 #
 # It does not hurt to have it enabled by default, because if it cannot be
@@ -59,51 +54,16 @@ RAMDISK_SIZE=9        # unit is GiB
 
 TOOLSET_CACHE_ENABLE=true
 
-### workspace/build environment paths ##########################################
+### work directory and subdirectories ##########################################
 
-# The current behavior of selecting a $WRK_DIR:
-#   1. If there IS a pre-existing value (user configuration), use that.
-#     a. If it IS NOT writable, exit with error.
-#   2. If there IS NOT a pre-existing value, try to use $DEFAULT_SYSTEM_WRK_DIR.
-#     a. If it DOES exist and IS writable, continue using that.
-#     b. If it DOES exist and IS NOT writable, exit with error.
-#     c. If it DOES NOT exist, use $DEFAULT_USER_WRK_DIR.
-#
-# The reasoning behind this:
-# In regards to (1), if the user configured a directory, it has to be used. If
-# it can't be used, exit with error (as a user would expect).
-# In regards to (2), using an arbitrary system-level location like
-# $DEFAULT_SYSTEM_WRK_DIR is considered optional as in "you have to opt-in"
-# (and not mandatory at all). You can tell us that you "opted-in" by creating
-# that directory beforehand and ensuring it's writable (2a). Then it's going to
-# be used. (I don't like writing scripts that write to arbitrary locations on
-# their own. Also, that would require 'sudo' permission.)
-# If $DEFAULT_SYSTEM_WRK_DIR does not exist, it means that you did not
-# "opt-in" (2c) and we're going to use the user-based default location,
-# $DEFAULT_USER_WRK_DIR. If $DEFAULT_SYSTEM_WRK_DIR does exist but is not
-# writable, the situation is unclear and we exit in error (2b).
-#
-# But why bother with a $DEFAULT_SYSTEM_WRK_DIR at all? Because that's the only
-# way a pre-built build environment can be used (hard-coded library locations).
-
-if [ -z $WRK_DIR ]; then     # no pre-existing value
-  WRK_DIR=$DEFAULT_SYSTEM_WRK_DIR   # try default first
-
-  if [ -d $WRK_DIR ]; then      # needs to exist and
-    if [ ! -w $WRK_DIR ]; then  # must be writable
-      echo "directory exists but not writable: $WRK_DIR"
-      exit 1
-    fi
-  else   # use work directory below user's home (writable for sure)
-    WRK_DIR=$DEFAULT_USER_WRK_DIR
-  fi
-fi
+[ -z $WRK_DIR ] && WRK_DIR=/Users/Shared/work
 
 if [ $(mkdir -p $WRK_DIR 2>/dev/null; echo $?) -eq 0 ] &&
-   [ -w $WRK_DIR ]; then
+   [ -w $WRK_DIR ] &&
+   [ "$(stat -f '%Su' $WRK_DIR)" = "$(whoami)" ] ; then
   echo "using build directory: $WRK_DIR"
 else
-  echo "directory not writable: $WRK_DIR"
+  echo "directory not usable: $WRK_DIR"
   exit 1
 fi
 
@@ -125,7 +85,7 @@ export DEVROOT=$WRK_DIR/gtk-osx
 export DEVPREFIX=$DEVROOT/local
 export PYTHONUSERBASE=$DEVPREFIX
 export DEV_SRC_ROOT=$DEVROOT/source
-DEVCONFIG=$DEVROOT/config   # no export because this is a made-up variable
+DEVCONFIG=$DEVROOT/config   # no export because this is an intermediate variable
 export PIP_CONFIG_DIR=$DEVCONFIG/pip
 
 ### Inkscape Git repository directory ##########################################
@@ -169,7 +129,7 @@ URL_DOUBLE_CONVERSION=https://github.com/google/double-conversion/archive/v3.1.4
 URL_GC=https://github.com/ivmai/bdwgc/releases/download/v8.0.4/gc-8.0.4.tar.gz
 URL_GDL=https://github.com/GNOME/gdl/archive/GDL_3_28_0.tar.gz
 URL_GSL=http://ftp.fau.de/gnu/gsl/gsl-2.5.tar.gz
-URL_GTK_MAC_BUNDLER=https://gitlab.gnome.org/GNOME/gtk-mac-bundler/-/archive/727793cfae08dec0e1e2621078d53a02ec5f7fb3.tar.gz
+URL_GTK_MAC_BUNDLER=https://gitlab.gnome.org/GNOME/gtk-mac-bundler/-/archive/93edee7e2d0ec8230aaf5acb21452202b10cd678.tar.gz
 URL_GTK_OSX=https://raw.githubusercontent.com/dehesselle/gtk-osx/inkscape
 URL_GTK_OSX_SETUP=$URL_GTK_OSX/gtk-osx-setup.sh
 URL_GTK_OSX_MODULESET=$URL_GTK_OSX/modulesets-stable/gtk-osx.modules
@@ -187,10 +147,10 @@ URL_PNG2ICNS=https://github.com/bitboss-ca/png2icns/archive/v0.1.tar.gz
 URL_POPPLER=https://gitlab.freedesktop.org/poppler/poppler/-/archive/poppler-0.74.0/poppler-poppler-0.74.0.tar.gz
 URL_POTRACE=http://potrace.sourceforge.net/download/1.15/potrace-1.15.tar.gz
 # This is the relocatable framework to be bundled with the app.
-URL_PYTHON3_BIN=https://github.com/dehesselle/py3framework/releases/download/py374.1/py374_framework_1.tar.xz
-# This is for the jhbuild toolset only. This cannot be updated to 3.7 because
-# 'Plist' class got removed in 'plistlib' and 'gtk-mac-bundler' needs that.
-URL_PYTHON3_SRC=https://github.com/dehesselle/py3framework/archive/py369.2.tar.gz
+URL_PYTHON3_BIN=https://github.com/dehesselle/py3framework/releases/download/py374.3/py374_framework_3.tar.xz
+# This is for JHBuild only.
+URL_PYTHON36_SRC=https://github.com/dehesselle/py3framework/archive/py369.3.tar.gz
+URL_PYTHON36_BIN=https://github.com/dehesselle/py3framework/releases/download/py369.3/py369_framework_3.tar.xz
 # A pre-built version of the complete toolset.
 URL_TOOLSET_CACHE=https://github.com/dehesselle/mibap/releases/download/v0.17/mibap_v0.17.tar.xz
 
diff --git a/packaging/macos/120-python3.sh b/packaging/macos/120-python3.sh
index 5dbbda27b..3d5b31528 100755
--- a/packaging/macos/120-python3.sh
+++ b/packaging/macos/120-python3.sh
@@ -16,16 +16,17 @@ run_annotated
 
 ### install Python 3 ###########################################################
 
-get_source $URL_PYTHON3_SRC
+get_source $URL_PYTHON36_BIN $WRK_DIR
+get_source $URL_PYTHON36_SRC
 
+sed -i "" "/^WRK_DIR/s/.*/WRK_DIR=$(escape_sed $WRK_DIR)/" 020-vars.sh
 sed -i "" '/^FRA_DIR/s/.*/FRA_DIR=$WRK_DIR/' 020-vars.sh
 
-./110-build.sh
-./310-package-fixed.sh
+# Using the relocatable version of the framework as starting point,
+# we're going to turn the link paths into fixed (non-relocatable) ones.
+grep -v "cp " 310-package-fixed.sh > 311-package-fixed-nocp.sh
+chmod 755 311-package-fixed-nocp.sh
+./311-package-fixed-nocp.sh
 
-cd $SELF_DIR
-rm -rf $OPT_DIR
-mkdir -p $BIN_DIR
-mkdir -p $TMP_DIR
 ln -sf $WRK_DIR/Python.framework/Versions/Current/bin/python3 $BIN_DIR
 
diff --git a/packaging/macos/130-jhbuild-bootstrap.sh b/packaging/macos/130-jhbuild-bootstrap.sh
index 81409a438..e9d0227df 100755
--- a/packaging/macos/130-jhbuild-bootstrap.sh
+++ b/packaging/macos/130-jhbuild-bootstrap.sh
@@ -35,6 +35,9 @@ ln -sf $DEVCONFIG/jhbuild* $HOME/.config
   # configure SDK
   sed -i "" "s/^setup_sdk/#setup_sdk/" $JHBUILDRC   # disable existing setting
   echo "setup_sdk(target=\"$MACOSX_DEPLOYMENT_TARGET\")" >> $JHBUILDRC
+  echo "os.environ[\"SDKROOT\"]=\"$SDKROOT\"" >> $JHBUILDRC
+  echo "if \"openssl\" in skip:" >> $JHBUILDRC
+  echo "  skip.remove(\"openssl\")" >> $JHBUILDRC
 )
 
 ### bootstrap JHBuild ##########################################################
diff --git a/packaging/macos/140-jhbuild-gtk3.sh b/packaging/macos/140-jhbuild-gtk3.sh
index 8d3f7fee5..18d0ead1f 100755
--- a/packaging/macos/140-jhbuild-gtk3.sh
+++ b/packaging/macos/140-jhbuild-gtk3.sh
@@ -13,6 +13,15 @@ for script in $SELF_DIR/0??-*.sh; do source $script; done
 
 #run_annotated   disabled for now, breaks jhbuild interactive mode
 
+### install prerequisites ######################################################
+
+# We're doing this to get Python.h, because gobject-introspection fails
+# otherwise.
+
+jhbuild build \
+  openssl \
+  python3
+
 ### install GTK3 libraries #####################################################
 
 jhbuild build \
diff --git a/packaging/macos/150-jhbuild-inkdeps.sh b/packaging/macos/150-jhbuild-inkdeps.sh
index 6c56f35c8..aac06eee4 100755
--- a/packaging/macos/150-jhbuild-inkdeps.sh
+++ b/packaging/macos/150-jhbuild-inkdeps.sh
@@ -80,6 +80,17 @@ configure_make_makeinstall
 ### install ImageMagick 6 ######################################################
 
 get_source $URL_IMAGEMAGICK
+
+# Recently a new issue manifested out of thin air: linking to pango fails with
+# missing symbols like '_g_object_unref'. Pango requires '-lgobject-2.0',
+# but this does not appear in the linker flags (check invocation with
+# 'make V=1'). Easiest way for a quick & dirty fix is to configure with
+# PANGO_LIBS set accordingly, but the configure scripts deletes the setting
+# although claiming to respect it. Therefore we patch the configure
+# script first.
+
+sed -i "" 's/^  pkg_cv_PANGO_LIBS=`$PKG_CONFIG --libs "pangocairo.*/  pkg_cv_PANGO_LIBS="$($PKG_CONFIG --libs pangocairo) -lgobject-2.0"/' configure
+
 configure_make_makeinstall
 
 ### install Poppler ############################################################
diff --git a/packaging/macos/README.md b/packaging/macos/README.md
index bd755d941..a0d5dff6a 100644
--- a/packaging/macos/README.md
+++ b/packaging/macos/README.md
@@ -4,49 +4,43 @@ This folder contains the scripts that make up the build pipeline for Inkscape on
 
 ## Requirements
 
-_In some regards it would've been more fair if this section was called "recommendations" instead, but that would only encourage carelessness or deviating from a known-good setup._
-
-- Use a __dedicated, clean macOS installation__ as build machine. "clean" as in "freshly installed + Xcode". Nothing more, nothing less.
-  - Especially no MacPorts, no Fink, no Homebrew, ... because they could interfere with the build system we're using.
-  - macOS 10.11.6 with Xcode 8.2.1.
-  - macOS 10.11 SDK from Xcode 7.3.1
-    - Place it inside your `Xcode.app` and re-symlink to make look as follows:
-
-      ```bash
-      elcapitan:SDKs rene$ pwd
-      /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs
-      elcapitan:SDKs rene$ ls -lah
-      total 8
-      drwxr-xr-x  5 root  wheel   170B 20 Jun 12:23 .
-      drwxr-xr-x  5 root  wheel   170B 15 Dez  2016 ..
-      lrwxr-xr-x  1 root  wheel    15B 20 Jun 12:23 MacOSX.sdk -> MacOSX10.11.sdk
-      drwxr-xr-x  5 root  wheel   170B 21 Okt  2020 MacOSX10.11.sdk
-      drwxr-xr-x  5 root  wheel   170B 17 Sep  2017 MacOSX10.12.sdk.disabled
-      ```
+_These requirements have changed a few times over the course of development. So it would be more fair to call them "recommendations" instead, but I want to emphasize the importance of sticking to a known-good setup because of the huge number of moving parts involved._
+
+- __A clean environment is key__. Ideally, you'd have a __dedicated, clean macOS installation__ (as in "freshly installed + Xcode") available as build machine.
+  - Make sure there are no remnants from other build environments (e.g. MacPorts, Fink, Homebrew) on your system. Rule of thumb: clear out `/usr/local`.
+  - macOS 10.14.6 with Xcode 10.3.
+  - OS X Mavericks 10.9 SDK from Xcode 6.4
+    `/Library/Developer/CommandLineTools/SDKs/MacOSX10.9.sdk`
 
 - __Use a dedicated user account__ unless you're prepared that these scripts will delete and overwrite your data in the following locations:  
 _(based on default configuration)_
 
     ```bash
-    $HOME/.cache               # will be linked to $TMP_DIR
-    $HOME/.config/jhbuildrc*   # will be overwritten
-    $HOME/.local               # will be linked to $OPT_DIR
+    $HOME/.cache               # will be removed, then linked to $TMP_DIR
+    $HOME/.config/jhbuildrc*   # will be removed, then linked to $DEVCONFIG
+    $HOME/.local               # will be removed, then linked to $OPT_DIR
     $HOME/.profile             # will be overwritten
     ```
 
 - __16 GiB RAM__, since we're using a 9 GiB ramdisk to build everything.
   - Using a ramdisk speeds up the process significantly and avoids wearing out your SSD.
-  - You can choose to not use a ramdisk by overriding `RAMDISK_ENABLE=false` in a e.g. `021-custom.sh` file.
-  - The build environment takes up ~6.1 GiB of disk space, the Inkscape Git repository ~1.6 GiB. Subject to change and YMMV.
+  - You can choose to not use a ramdisk by overriding the configuration.
+
+    ```bash
+    echo "RAMDISK_ENABLE=false" > 021-vars-custom.sh
+    ```
+
+  - The build environment takes up ~6.1 GiB of disk space, the rest is buffer to be used during compilation and packaging. Subject to change and YMMV.
+
+  - If you only want to build Inkscape and not the build environment itself, a 5 GiB ramdisk is sufficient.
+
 - somewhat decent __internet connection__ for all the downloads
 
 ## Usage
 
 ### standalone
 
-> TODO: These scripts were initially designed as part of a dedicated repository, not the Inkscape repository itself. Therefore they contain a step that shallow-clones the Inkscape repository to build. This behaviour will be improved upon in a future version.
-
-You can either run all the executable scripts that have a numerical prefix yourself and in the given order (`1nn`, `2nn` - not the `0nn` ones), or, if you're feeling bold, use
+You can either run all the executable scripts that have a numerical prefix (>100) yourself and in the given order, or, if you're feeling bold, use
 
 ```bash
 ./build_all.sh
@@ -56,7 +50,7 @@ to have everything run for you. If you are doing this the first time, my advice
 
 ### GitLab CI
 
-> TODO: configuration examples need to be updated!
+> TODO: this section needs to be updated!
 
 #### configuration example `.gitlab-runner/config.toml`
 
diff --git a/packaging/macos/build_toolset.sh b/packaging/macos/build_toolset.sh
index 7dad48f53..b5870ca65 100755
--- a/packaging/macos/build_toolset.sh
+++ b/packaging/macos/build_toolset.sh
@@ -20,10 +20,10 @@ if [ -d $OPT_DIR ]; then
   echo "$SELF_NAME: $OPT_DIR exists - not doing anything"
 else
   if $TOOLSET_CACHE_ENABLE &&
-    [ "$WRK_DIR" = "$DEFAULT_SYSTEM_WRK_DIR" ]; then   # we're good to download
-    # Current configuration uses $WRK_DIR for both the toolset ($WRK_DIR/opt) 
-    # and GitLab runner's build directory ($WRK_DIR/build). Creating a ramdisk
-    # in $WRK_DIR during CI would shadow that.
+    [ "$WRK_DIR" = "$DEFAULT_WRK_DIR" ]; then   # we're good to download
+    # Current configuration uses WRK_DIR for both the toolset (WRK_DIR/opt) 
+    # and GitLab runner's build directory (WRK_DIR/build). Creating a ramdisk
+    # in WRK_DIR during CI would shadow that.
     # Until a better solution is found, the ramdisk has to be manually created
     # on the runner and is disabled on CI.
     [ ! -z $CI_JOB_ID ] && RAMDISK_ENABLE=false