chrome/installer/mac/pkg-dmg

#!/usr/bin/perl
# ***** BEGIN LICENSE BLOCK *****
# Version: MPL 1.1/GPL 2.0/LGPL 2.1
#
# The contents of this file are subject to the Mozilla Public License Version
# 1.1 (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
# http://www.mozilla.org/MPL/
#
# Software distributed under the License is distributed on an "AS IS" basis,
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
# for the specific language governing rights and limitations under the
# License.
#
# The Original Code is pkg-dmg, a Mac OS X disk image (.dmg) packager
#
# The Initial Developer of the Original Code is
# Mark Mentovai <mark@moxienet.com>.
# Portions created by the Initial Developer are Copyright (C) 2005
# the Initial Developer. All Rights Reserved.
#
# Contributor(s):
#
# Alternatively, the contents of this file may be used under the terms of
# either the GNU General Public License Version 2 or later (the "GPL"), or
# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
# in which case the provisions of the GPL or the LGPL are applicable instead
# of those above. If you wish to allow use of your version of this file only
# under the terms of either the GPL or the LGPL, and not to allow others to
# use your version of this file under the terms of the MPL, indicate your
# decision by deleting the provisions above and replace them with the notice
# and other provisions required by the GPL or the LGPL. If you do not delete
# the provisions above, a recipient may use your version of this file under
# the terms of any one of the MPL, the GPL or the LGPL.
#
# ***** END LICENSE BLOCK *****

use strict;
use warnings;

=pod

=head1 NAME

B<pkg-dmg> - Mac OS X disk image (.dmg) packager

=head1 SYNOPSIS

B<pkg-dmg>
B<--source> I<source-folder>
B<--target> I<target-image>
[B<--format> I<format>]
[B<--volname> I<volume-name>]
[B<--tempdir> I<temp-dir>]
[B<--mkdir> I<directory>]
[B<--copy> I<source>[:I<dest>]]
[B<--symlink> I<source>[:I<dest>]]
[B<--license> I<file>]
[B<--resource> I<file>]
[B<--icon> I<icns-file>]
[B<--attribute> I<a>:I<file>[:I<file>...]
[B<--idme>]
[B<--sourcefile>]
[B<--verbosity> I<level>]
[B<--dry-run>]

=head1 DESCRIPTION

I<pkg-dmg> takes a directory identified by I<source-folder> and transforms
it into a disk image stored as I<target-image>.  The disk image will
occupy the least space possible for its format, or the least space that the
authors have been able to figure out how to achieve.

=head1 OPTIONS

=over 5

==item B<--source> I<source-folder>

Identifies the directory that will be packaged up.  This directory is not
touched, a copy will be made in a temporary directory for staging purposes.
See B<--tempdir>.

==item B<--target> I<target-image>

The disk image to create.  If it exists and is not in use, it will be
overwritten.  If I<target-image> already contains a suitable extension,
it will be used unmodified.  If no extension is present, or the extension
is incorrect for the selected format, the proper extension will be added.
See B<--format>.

==item B<--format> I<format>

The format to create the disk image in.  Valid values for I<format> are:
     - UDZO - zlib-compressed, read-only; extension I<.dmg>
     - UDBZ - bzip2-compressed, read-only; extension I<.dmg>;
              create and use on 10.4 ("Tiger") and later only
     - UDRO - uncompressed, read-only; extension I<.dmg>
     - UDRW - uncompressed, read-write; extension I<.dmg>
     - UDSP - uncompressed, read-write, sparse; extension I<.sparseimage>
     - ULFO - LZFSE/LZVN-compressed, read-only; extension I<.dmg>;
              create and use on 10.11 ("El Capitan") and later only
     - ULMO - LZMA-compressed, read-only; extension I<.dmg>;
              create and use on 10.15 ("Catalina") and later only

UDZO is the default format.

See L<hdiutil(1)> for a description of these formats.

=item B<--volname> I<volume-name>

The name of the volume in the disk image.  If not specified, I<volume-name>
defaults to the name of the source directory from B<--source>.

=item B<--tempdir> I<temp-dir>

A temporary directory to stage intermediate files in.  I<temp-dir> must
have enough space available to accommodate twice the size of the files
being packaged.  If not specified, defaults to the same directory that
the I<target-image> is to be placed in.  B<pkg-dmg> will remove any
temporary files it places in I<temp-dir>.

=item B<--mkdir> I<directory>

Specifies a directory that should be created in the disk image.
I<directory> and any ancestor directories will be created.  This is
useful in conjunction with B<--copy>, when copying files to directories
that may not exist in I<source-folder>.  B<--mkdir> may appear multiple
times.

=item B<--copy> I<source>[:I<dest>]

Additional files to copy into the disk image.  If I<dest> is
specified, I<source> is copied to the location I<dest> identifies,
otherwise, I<source> is copied to the root of the new volume.  B<--copy>
provides a way to package up a I<source-folder> by adding files to it
without modifying the original I<source-folder>.  B<--copy> may appear
multiple times.

This option is useful for adding .DS_Store files and window backgrounds
to disk images.

=item B<--symlink> I<source>[:I<dest>]

Like B<--copy>, but allows symlinks to point out of the volume. Empty symlink
destinations are interpreted as "like the source path, but inside the dmg"

This option is useful for adding symlinks to external resources,
e.g. to /Applications.

=item B<--license> I<file>

A plain text file containing a license agreement to be displayed before
the disk image is mounted.  English is the only supported language.  To
include license agreements in other languages, in multiple languages,
or to use formatted text, prepare a resource and use L<--resource>.

=item B<--resource> I<file>

A resource file to merge into I<target-image>.  If I<format> is UDZO, UDBZ,
UDRO, ULFO, or ULMO, the disk image will be flattened to a single-fork file
that contains the resource but may be freely transferred without any special
encodings.  I<file> must be in a format suitable for L<Rez(1)>.  See
L<Rez(1)> for a description of the format, and L<hdiutil(1)> for a discussion
on flattened disk images.  B<--resource> may appear multiple times.

This option is useful for adding license agreements and other messages
to disk images.

=item B<--icon> I<icns-file>

Specifies an I<icns> file that will be used as the icon for the root of
the volume.  This file will be copied to the new volume and the custom
icon attribute will be set on the root folder.

=item B<--attribute> I<a>:I<file>[:I<file>...]

Sets the attributes of I<file> to the attribute list in I<a>.  See
L<SetFile(1)>

=item B<--idme>

Enable IDME to make the disk image "Internet-enabled."  The first time
the image is mounted, if IDME processing is enabled on the system, the
contents of the image will be copied out of the image and the image will
be placed in the trash with IDME disabled.

=item B<--sourcefile>

If this option is present, I<source-folder> is treated as a file, and is
placed as a file within the volume's root folder.  Without this option,
I<source-folder> is treated as the volume root itself.

=item B<--verbosity> I<level>

Adjusts the level of loudness of B<pkg-dmg>.  The possible values for
I<level> are:
     0 - Only error messages are displayed.
     1 - Print error messages and command invocations.
     2 - Print everything, including command output.
     3 - Additionally, configure some external commands to be more verbose.
     4 - Additionally, configure some external commands to be extremely verbose.

The default I<level> is 2.

=item B<--dry-run>

When specified, the commands that would be executed are printed, without
actually executing them.  When commands depend on the output of previous
commands, dummy values are displayed.

=back

=head1 NON-OPTIONS

=over 5

=item

Resource forks aren't copied.

=item

The root folder of the created volume is designated as the folder
to open when the volume is mounted.  See L<bless(8)>.

=item

All files in the volume are set to be world-readable, only writable
by the owner, and world-executable when appropriate.  All other
permissions bits are cleared.

=item

When possible, disk images are created without any partition tables.  This
is what L<hdiutil(1)> refers to as I<-layout NONE>, and saves a handful of
kilobytes.  The alternative, I<SPUD>, contains a partition table that
is not terribly handy on disk images that are not intended to represent any
physical disk.

=item

Read-write images are created with journaling off.  Any read-write image
created by this tool is expected to be transient, and the goal of this tool
is to create images which consume a minimum of space.

=back

=head1 EXAMPLE

pkg-dmg --source /Applications/DeerPark.app --target ~/DeerPark.dmg
  --sourcefile --volname DeerPark --icon ~/DeerPark.icns
  --mkdir /.background
  --copy DeerParkBackground.png:/.background/background.png
  --copy DeerParkDSStore:/.DS_Store
  --symlink /Applications:"/Drag to here"

=head1 LICENSE

MPL 1.1/GPL 2.0/LGPL 2.1.  Your choice.

=head1 AUTHOR

Mark Mentovai

=head1 SEE ALSO

L<bless(8)>, L<diskutil(8)>, L<hdid(8)>, L<hdiutil(1)>, L<Rez(1)>,
L<rsync(1)>, L<SetFile(1)>

=cut

use Fcntl;
use POSIX;
use Getopt::Long;

sub argumentEscape(@);
sub cleanupDie($);
sub command(@);
sub commandInternal($@);
sub commandInternalVerbosity($$@);
sub commandOutput(@);
sub commandOutputVerbosity($@);
sub commandVerbosity($@);
sub copyFiles($@);
sub diskImageMaker($$$$$$$$);
sub giveExtension($$);
sub hdidMountImage($@);
sub invokeRsync($$);
sub joinRel($$);
sub isFormatReadOnly($);
sub licenseMaker($$);
sub makeSymlinks($@);
sub pathSplit($);
sub setAttributes($@);
sub trapSignal($);
sub usage();

# Variables used as globals
my(@gCleanup, %gConfig, $gDryRun, @gHdiutilVerbosityFlags, @gRmVerbosityFlags,
 $gVerbosity);

# Use the commands by name if they're expected to be in the user's
# $PATH (/bin:/sbin:/usr/bin:/usr/sbin).  Otherwise, go by absolute
# path.  These may be overridden with --config.
%gConfig = ('cmd_bless'          => 'bless',
            'cmd_chmod'          => 'chmod',
            'cmd_diskutil'       => 'diskutil',
            'cmd_du'             => 'du',
            'cmd_hdid'           => 'hdid',
            'cmd_hdiutil'        => 'hdiutil',
            'cmd_mkdir'          => 'mkdir',
            'cmd_mktemp'         => 'mktemp',
            'cmd_Rez'            => '/usr/bin/Rez',
            'cmd_rm'             => 'rm',
            'cmd_rsync'          => 'rsync',
            'cmd_SetFile'        => '/usr/bin/SetFile',

            # hdiutil create doesn't allow specifying a folder to open
            # at volume mount time, so those images are mounted and
            # their root folders made holy with bless -openfolder. Not all
            # users of pkg-dmg want this behavior.
            'openfolder_bless'   => 1);

# --verbosity
$gVerbosity = 2;

# --dry-run
$gDryRun = 0;

# %gConfig fix-ups based on features and bugs present in certain releases.
my($ignore, $uname_r, $uname_s);
($uname_s, $ignore, $uname_r, $ignore, $ignore) = POSIX::uname();
if($uname_s ne 'Darwin') {
  print STDERR ($0.": warning, not running on Mac OS X, ".
   "this could be interesting.\n");
}

# Non-global variables used in Getopt
my(@attributes, @copyFiles, @createSymlinks, $iconFile, $idme, $licenseFile,
 @makeDirs, $outputFormat, @resourceFiles, $sourceFile, $sourceFolder,
 $targetImage, $tempDir, $volumeName);

# --format
$outputFormat = 'UDZO';

# --idme
$idme = 0;

# --sourcefile
$sourceFile = 0;

# Leaving this might screw up the Apple tools.
delete $ENV{'NEXT_ROOT'};

# This script can get pretty messy, so trap a few signals.
$SIG{'INT'} = \&trapSignal;
$SIG{'HUP'} = \&trapSignal;
$SIG{'TERM'} = \&trapSignal;

Getopt::Long::Configure('pass_through');
GetOptions('source=s'    => \$sourceFolder,
           'target=s'    => \$targetImage,
           'volname=s'   => \$volumeName,
           'format=s'    => \$outputFormat,
           'tempdir=s'   => \$tempDir,
           'mkdir=s'     => \@makeDirs,
           'copy=s'      => \@copyFiles,
           'symlink=s'   => \@createSymlinks,
           'license=s'   => \$licenseFile,
           'resource=s'  => \@resourceFiles,
           'icon=s'      => \$iconFile,
           'attribute=s' => \@attributes,
           'idme'        => \$idme,
           'sourcefile'  => \$sourceFile,
           'verbosity=i' => \$gVerbosity,
           'dry-run'     => \$gDryRun,
           'config=s'    => \%gConfig); # "hidden" option not in usage()

if(@ARGV) {
  # All arguments are parsed by Getopt
  usage();
  exit(1);
}

if($gVerbosity<0 || $gVerbosity>4) {
  usage();
  exit(1);
}

if ($gVerbosity == 3) {
  @gHdiutilVerbosityFlags = ('-verbose');
  @gRmVerbosityFlags = ('-v');
}
if ($gVerbosity == 4) {
  # -debug automatically activates -verbose.
  @gHdiutilVerbosityFlags = ('-debug');
  @gRmVerbosityFlags = ('-v');
}

if(!defined($sourceFolder) || $sourceFolder eq '' ||
 !defined($targetImage) || $targetImage eq '') {
  # --source and --target are required arguments
  usage();
  exit(1);
}

# Make sure $sourceFolder doesn't contain trailing slashes.  It messes with
# rsync.
while(substr($sourceFolder, -1) eq '/') {
  chop($sourceFolder);
}

if(!defined($volumeName)) {
  # Default volumeName is the name of the source directory.
  my(@components);
  @components = pathSplit($sourceFolder);
  $volumeName = pop(@components);
}

my(@tempDirComponents, $targetImageFilename);
@tempDirComponents = pathSplit($targetImage);
$targetImageFilename = pop(@tempDirComponents);

if(defined($tempDir)) {
  @tempDirComponents = pathSplit($tempDir);
}
else {
  # Default tempDir is the same directory as what is specified for
  # targetImage
  $tempDir = join('/', @tempDirComponents);
}

# Ensure that the path of the target image has a suitable extension.  If
# it didn't, hdiutil would add one, and we wouldn't be able to find the
# file.
#
# Note that $targetImageFilename is not being reset.  This is because it's
# used to build other names below, and we don't need to be adding all sorts
# of extra unnecessary extensions to the name.
my($originalTargetImage, $requiredExtension);
$originalTargetImage = $targetImage;
if($outputFormat eq 'UDSP') {
  $requiredExtension = '.sparseimage';
}
else {
  $requiredExtension = '.dmg';
}
$targetImage = giveExtension($originalTargetImage, $requiredExtension);

if($targetImage ne $originalTargetImage) {
  print STDERR ($0.": warning: target image extension is being added\n");
  print STDERR ('  The new filename is '.
   giveExtension($targetImageFilename,$requiredExtension)."\n");
}

# Make a temporary directory in $tempDir for our own nefarious purposes.
my(@output, $tempSubdir, $tempSubdirTemplate);
$tempSubdirTemplate=join('/', @tempDirComponents,
 'pkg-dmg.'.$$.'.XXXXXXXX');
if(!(@output = commandOutput($gConfig{'cmd_mktemp'}, '-d',
 $tempSubdirTemplate)) || $#output != 0) {
  cleanupDie('mktemp failed');
}

if($gDryRun) {
  (@output)=($tempSubdirTemplate);
}

($tempSubdir) = @output;

push(@gCleanup,
 sub {commandVerbosity(0, $gConfig{'cmd_rm'}, '-rf', $tempSubdir);});

my($tempMount, $tempRoot, @tempsToMake);
$tempRoot = $tempSubdir.'/stage';
$tempMount = $tempSubdir.'/mount';
push(@tempsToMake, $tempRoot);

if(command($gConfig{'cmd_mkdir'}, @tempsToMake) != 0) {
  cleanupDie('mkdir tempRoot/tempMount failed');
}

# This cleanup object is not strictly necessary, because $tempRoot is inside
# of $tempSubdir, but the rest of the script relies on this object being
# on the cleanup stack and expects to remove it.
push(@gCleanup,
 sub {commandVerbosity(0, $gConfig{'cmd_rm'}, '-rf', $tempRoot);});

# If $sourceFile is true, it means that $sourceFolder is to be treated as
# a file and placed as a file within the volume root, as opposed to being
# treated as the volume root itself.  rsync will do this by default, if no
# trailing '/' is present.  With a trailing '/', $sourceFolder becomes
# $tempRoot, instead of becoming an entry in $tempRoot.
if(invokeRsync($sourceFolder.($sourceFile?'':'/'), $tempRoot) != 0) {
  cleanupDie('rsync failed');
}

if(@makeDirs) {
  my($makeDir, @tempDirsToMake);
  foreach $makeDir (@makeDirs) {
    push(@tempDirsToMake, joinRel($tempRoot, $makeDir));
  }
  if(command($gConfig{'cmd_mkdir'}, '-p', @tempDirsToMake) != 0) {
    cleanupDie('mkdir failed');
  }
}

# copy files and/or create symlinks
copyFiles($tempRoot, @copyFiles);
makeSymlinks($tempRoot, @createSymlinks);
setAttributes($tempRoot, @attributes);

if(defined($iconFile)) {
  if(invokeRsync($iconFile, $tempRoot.'/.VolumeIcon.icns') != 0) {
    cleanupDie('rsync failed for volume icon');
  }

  # It's pointless to set the attributes of the root when diskutil create
  # -srcfolder is being used.  In that case, the attributes will be set
  # later, after the image is already created.
  if(isFormatReadOnly($outputFormat) &&
   (command($gConfig{'cmd_SetFile'}, '-a', 'C', $tempRoot) != 0)) {
    cleanupDie('SetFile failed');
  }
}

if(command($gConfig{'cmd_chmod'}, '-R', 'a+rX,a-st,u+w,go-w',
 $tempRoot) != 0) {
  cleanupDie('chmod failed');
}

my($unflattenable);
if(isFormatReadOnly($outputFormat)) {
  $unflattenable = 1;
}
else {
  $unflattenable = 0;
}

diskImageMaker($tempRoot, $targetImage, $outputFormat, $volumeName,
 $tempSubdir, $tempMount, $targetImageFilename, defined($iconFile));

if(defined($licenseFile) && $licenseFile ne '') {
  my($licenseResource);
  $licenseResource = $tempSubdir.'/license.r';
  if(!licenseMaker($licenseFile, $licenseResource)) {
    cleanupDie('licenseMaker failed');
  }
  push(@resourceFiles, $licenseResource);
  # Don't add a cleanup object because licenseResource is in tempSubdir.
}

if(@resourceFiles) {
  # Add resources, such as a license agreement.

  # Only unflatten read-only and compressed images.  It's not supported
  # on other image times.
  if($unflattenable &&
   (command($gConfig{'cmd_hdiutil'}, 'unflatten', @gHdiutilVerbosityFlags,
   $targetImage)) != 0) {
    cleanupDie('hdiutil unflatten failed');
  }
  # Don't push flatten onto the cleanup stack.  If we fail now, we'll be
  # removing $targetImage anyway.

  # Type definitions come from Carbon.r.
  if(command($gConfig{'cmd_Rez'}, 'Carbon.r', @resourceFiles, '-a', '-o',
   $targetImage) != 0) {
    cleanupDie('Rez failed');
  }

  # Flatten.  This merges the resource fork into the data fork, so no
  # special encoding is needed to transfer the file.
  if($unflattenable &&
   (command($gConfig{'cmd_hdiutil'}, 'flatten', @gHdiutilVerbosityFlags,
   $targetImage)) != 0) {
    cleanupDie('hdiutil flatten failed');
  }
}

# $tempSubdir is no longer needed.  It's buried on the stack below the
# rm of the fresh image file.  Splice in this fashion is equivalent to
# pop-save, pop, push-save.
splice(@gCleanup, -2, 1);
# No need to remove licenseResource separately, it's in tempSubdir.
if(command($gConfig{'cmd_rm'}, @gRmVerbosityFlags, '-rf', $tempSubdir) != 0) {
  cleanupDie('rm -rf tempSubdir failed');
}

if($idme) {
  if(command($gConfig{'cmd_hdiutil'}, 'internet-enable',
   @gHdiutilVerbosityFlags, '-yes', $targetImage) != 0) {
    cleanupDie('hdiutil internet-enable failed');
  }
}

# Done.

exit(0);

# argumentEscape(@arguments)
#
# Takes a list of @arguments and makes them shell-safe.
sub argumentEscape(@) {
  my(@arguments);
  @arguments = @_;
  my($argument, @argumentsOut);
  foreach $argument (@arguments) {
    $argument =~ s%([^A-Za-z0-9_\-/.=+,])%\\$1%g;
    push(@argumentsOut, $argument);
  }
  return @argumentsOut;
}

# cleanupDie($message)
#
# Displays $message as an error message, and then runs through the
# @gCleanup stack, performing any cleanup operations needed before
# exiting.  Does not return, exits with exit status 1.
sub cleanupDie($) {
  my($message);
  ($message) = @_;
  print STDERR ($0.': '.$message.(@gCleanup?' (cleaning up)':'')."\n");
  while(@gCleanup) {
    my($subroutine);
    $subroutine = pop(@gCleanup);
    &$subroutine;
  }
  exit(1);
}

# command(@arguments)
#
# Runs the specified command at the verbosity level defined by $gVerbosity.
# Returns nonzero on failure, returning the exit status if appropriate.
# Discards command output.
sub command(@) {
  my(@arguments);
  @arguments = @_;
  return commandVerbosity($gVerbosity,@arguments);
}

# commandInternal($command, @arguments)
#
# Runs the specified internal command at the verbosity level defined by
# $gVerbosity.
# Returns zero(!) on failure, because commandInternal is supposed to be a
# direct replacement for the Perl system call wrappers, which, unlike shell
# commands and C equivalent system calls, return true (instead of 0) to
# indicate success.
sub commandInternal($@) {
  my(@arguments, $command);
  ($command, @arguments) = @_;
  return commandInternalVerbosity($gVerbosity, $command, @arguments);
}

# commandInternalVerbosity($verbosity, $command, @arguments)
#
# Run an internal command, printing a bogus command invocation message if
# $verbosity is true.
#
# If $command is unlink:
# Removes the files specified by @arguments.  Wraps unlink.
#
# If $command is symlink:
# Creates the symlink specified by @arguments. Wraps symlink.
sub commandInternalVerbosity($$@) {
  my(@arguments, $command, $verbosity);
  ($verbosity, $command, @arguments) = @_;
  if($command eq 'unlink') {
    if($verbosity || $gDryRun) {
      print(join(' ', 'rm', '-f', argumentEscape(@arguments))."\n");
    }
    if($gDryRun) {
      return $#arguments+1;
    }
    return unlink(@arguments);
  }
  elsif($command eq 'symlink') {
    if($verbosity || $gDryRun) {
      print(join(' ', 'ln', '-s', argumentEscape(@arguments))."\n");
    }
    if($gDryRun) {
      return 1;
    }
    my($source, $target);
    ($source, $target) = @arguments;
    return symlink($source, $target);
  }
}

# commandOutput(@arguments)
#
# Runs the specified command at the verbosity level defined by $gVerbosity.
# Output is returned in an array of lines.  undef is returned on failure.
# The exit status is available in $?.
sub commandOutput(@) {
  my(@arguments);
  @arguments = @_;
  return commandOutputVerbosity($gVerbosity, @arguments);
}

# commandOutputVerbosity($verbosity, @arguments)
#
# Runs the specified command at the verbosity level defined by the
# $verbosity argument.  Output is returned in an array of lines.  undef is
# returned on failure.  The exit status is available in $?.
#
# If an error occurs in fork or exec, an error message is printed to
# stderr and undef is returned.
#
# If $verbosity is 0, the command invocation is not printed, and its
# stdout is not echoed back to stdout.
#
# If $verbosity is 1, the command invocation is printed.
#
# If $verbosity is 2, the command invocation is printed and the output
# from stdout is echoed back to stdout.
#
# Regardless of $verbosity, stderr is left connected.
sub commandOutputVerbosity($@) {
  my(@arguments, $verbosity);
  ($verbosity, @arguments) = @_;
  my($pid);
  if($verbosity || $gDryRun) {
    print(join(' ', argumentEscape(@arguments))."\n");
  }
  if($gDryRun) {
    return(1);
  }
  if (!defined($pid = open(*COMMAND, '-|'))) {
    printf STDERR ($0.': fork: '.$!."\n");
    return undef;
  }
  elsif ($pid) {
    # parent
    my(@lines);
    while(!eof(*COMMAND)) {
      my($line);
      chop($line = <COMMAND>);
      if($verbosity > 1) {
        print($line."\n");
      }
      push(@lines, $line);
    }
    close(*COMMAND);
    if ($? == -1) {
      printf STDERR ($0.': fork: '.$!."\n");
      return undef;
    }
    elsif ($? & 127) {
      printf STDERR ($0.': exited on signal '.($? & 127).
       ($? & 128 ? ', core dumped' : '')."\n");
      return undef;
    }
    return @lines;
  }
  else {
    # child; this form of exec is immune to shell games
    if(!exec {$arguments[0]} (@arguments)) {
      printf STDERR ($0.': exec: '.$!."\n");
      exit(-1);
    }
  }
}

# commandVerbosity($verbosity, @arguments)
#
# Runs the specified command at the verbosity level defined by the
# $verbosity argument.  Returns nonzero on failure, returning the exit
# status if appropriate.  Discards command output.
sub commandVerbosity($@) {
  my(@arguments, $verbosity);
  ($verbosity, @arguments) = @_;
  if(!defined(commandOutputVerbosity($verbosity, @arguments))) {
    return -1;
  }
  return $?;
}

# copyFiles($tempRoot, @fileList)
#
# Copies files in the disk image. See --copy description for details.
# Elements of @fileList are interpreted as "source:target".
sub copyFiles($@) {
  my($tempRoot, @fileList) = @_;
  foreach my $file (@fileList) {
    my($source, $target) = split(/:/, $file);
    $target = joinRel($tempRoot, $target);
    my $rsyncCode = invokeRsync($source, $target);
    if($rsyncCode) {
      cleanupDie('copyFiles rsync failed: exit code '.$rsyncCode);
    }
  }
}

# diskImageMaker($source, $destination, $format, $name, $tempDir, $tempMount,
#  $baseName, $setRootIcon)
#
# Creates a disk image in $destination of format $format corresponding to the
# source directory $source.  $name is the volume name.  $tempDir is a good
# place to write temporary files, which should be empty (aside from the other
# things that this script might create there, like stage and mount).
# $tempMount is a mount point for temporary disk images.  $baseName is the
# name of the disk image, and is presently unused.  $setRootIcon is true if
# a volume icon was added to the staged $source and indicates that the
# custom volume icon bit on the volume root needs to be set.
sub diskImageMaker($$$$$$$$) {
  my($baseName, $destination, $format, $name, $setRootIcon, $source,
   $tempDir, $tempMount);
  ($source, $destination, $format, $name, $tempDir, $tempMount,
   $baseName, $setRootIcon) = @_;
  if(isFormatReadOnly($format)) {
    my($uncompressedImage, $hybridImage);

    $hybridImage = giveExtension($tempDir.'/hybrid', '.dmg');

    if(command($gConfig{'cmd_hdiutil'}, 'makehybrid', '-hfs',
      @gHdiutilVerbosityFlags, '-hfs-volume-name', $name,
      ($gConfig{'openfolder_bless'} ? ('-hfs-openfolder', $source) : ()),
      '-ov', $source, '-o', $hybridImage) != 0) {
      cleanupDie('hdiutil makehybrid failed');
    }

    $uncompressedImage = $hybridImage;

    # $source is no longer needed and will be removed before anything
    # else can fail.  splice in this form is the same as pop/push.
    splice(@gCleanup, -1, 1,
      sub {commandInternalVerbosity(0, 'unlink', $hybridImage);});

    if(command($gConfig{'cmd_rm'}, @gRmVerbosityFlags, '-rf', $source) != 0) {
      cleanupDie('rm -rf failed');
    }

    # The uncompressed disk image is now in its final form.  Compress it.
    if(command($gConfig{'cmd_hdiutil'}, 'convert', '-format', $format,
     ($format eq 'UDZO' ? ('-imagekey', 'zlib-level=9') : ()),
     ($format eq 'UDBZ' ? ('-imagekey', 'bzip2-level=9') : ()),
     ($format eq 'ULMO' ? ('-imagekey', 'udif-chunk-size=8192') : ()),
     @gHdiutilVerbosityFlags, '-ov', $uncompressedImage, '-o',
     $destination) != 0) {
      cleanupDie('hdiutil convert failed');
    }

    # $uncompressedImage is going to be unlinked before anything else can
    # fail.  splice in this form is the same as pop/push.
    splice(@gCleanup, -1, 1,
     sub {commandInternalVerbosity(0, 'unlink', $destination);});

    if(commandInternal('unlink', $uncompressedImage) != 1) {
      cleanupDie('unlink uncompressedImage failed: '.$!);
    }

    # At this point, the only thing that the compressed block has added to
    # the cleanup stack is the removal of $destination.  $source has already
    # been removed, and its cleanup entry has been removed as well.
  }
  elsif($format eq 'UDRW' || $format eq 'UDSP') {
    # Use -fs HFS+ to suppress the journal.
    if(command($gConfig{'cmd_hdiutil'}, 'create', '-format', $format,
      @gHdiutilVerbosityFlags, '-fs', 'HFS+', '-volname', $name,
      '-ov', '-srcfolder', $source, $destination) != 0) {
      cleanupDie('hdiutil create failed');
    }

    # $source is no longer needed and will be removed before anything
    # else can fail.  splice in this form is the same as pop/push.
    splice(@gCleanup, -1, 1,
      sub {commandInternalVerbosity(0, 'unlink', $destination);});

    if(command($gConfig{'cmd_rm'}, @gRmVerbosityFlags, '-rf', $source) != 0) {
      cleanupDie('rm -rf failed');
    }

    my($mounted, $rootDevice, $partitionDevice, $partitionMountPoint);

    $mounted=0;
    if($gConfig{'openfolder_bless'} || $setRootIcon) {
      # The disk image only needs to be mounted if:
      #  openfolder_bless is true, because bless -openfolder needs to run
      #  setRootIcon is true, because the root needs its attributes set.
      if(!(($rootDevice, $partitionDevice, $partitionMountPoint) =
       hdidMountImage($tempMount, $destination))) {
        cleanupDie('hdid mount failed');
      }

      $mounted=1;

      push(@gCleanup, sub {commandVerbosity(0,
       $gConfig{'cmd_diskutil'}, 'eject', $rootDevice);});
    }

    if($gConfig{'openfolder_bless'}) {
      # "bless -openfolder" is no longer functional as of macOS 13.0.
      # Historically, on x86_64, it configured a folder Finder should open
      # as soon as the file system was mounted; it was never supported on arm64.
      #
      # Since we care about controlling the auto-open behavior, we use
      # "bless -openfolder" anyway, allowing its unsuccessful exit code to
      # make the entire pkg-dmg script fail.
      if(command($gConfig{'cmd_bless'}, '-openfolder',
       $partitionMountPoint) != 0) {
        cleanupDie('bless failed');
      }
    }

    setAttributes($partitionMountPoint, @attributes);

    if($setRootIcon) {
      # When "hdiutil create -srcfolder" is used, the root folder's
      # attributes are not copied to the new volume.  Fix up.

      if(command($gConfig{'cmd_SetFile'}, '-a', 'C',
       $partitionMountPoint) != 0) {
        cleanupDie('SetFile failed');
      }
    }

    if($mounted) {
      # Pop diskutil eject
      pop(@gCleanup);

      if(command($gConfig{'cmd_diskutil'}, 'eject', $rootDevice) != 0) {
        cleanupDie('diskutil eject failed');
      }
    }

    # End of UDRW/UDSP section.  At this point, $source has been removed
    # and its cleanup entry has been removed from the stack.
  }
  else {
    cleanupDie('unrecognized format');
    print STDERR ($0.": unrecognized format\n");
    exit(1);
  }
}

# giveExtension($file, $extension)
#
# If $file does not end in $extension, $extension is added.  The new
# filename is returned.
sub giveExtension($$) {
  my($extension, $file);
  ($file, $extension) = @_;
  if(substr($file, -length($extension)) ne $extension) {
    return $file.$extension;
  }
  return $file;
}

# hdidMountImage($mountPoint, @arguments)
#
# Runs the hdid command with arguments specified by @arguments.
# @arguments may be a single-element array containing the name of the
# disk image to mount.  Returns a three-element array, with elements
# corresponding to:
#  - The root device of the mounted image, suitable for ejection
#  - The device corresponding to the mounted partition
#  - The mounted partition's mount point
#
# If running on a system that supports easy mounting at points outside
# of the default /Volumes with hdiutil attach, it is used instead of hdid,
# and $mountPoint is used as the mount point.
#
# The root device will differ from the partition device when the disk
# image contains a partition table, otherwise, they will be identical.
#
# If hdid fails, undef is returned.
sub hdidMountImage($@) {
  my($mountPoint, @arguments) = @_;
  my(@output) = commandOutput($gConfig{'cmd_hdid'}, @arguments);

  if(!@output || $? != 0) {
    return undef;
  }

  if($gDryRun) {
    return('/dev/diskX','/dev/diskXsY','/Volumes/'.$volumeName);
  }

  my($line, $restOfLine, $rootDevice);

  foreach $line (@output) {
    my($device, $mountpoint);
    if($line !~ /^\/dev\//) {
      # Consider only lines that correspond to /dev entries
      next;
    }
    ($device, $restOfLine) = split(' ', $line, 2);

    if(!defined($rootDevice) || $rootDevice eq '') {
      # If this is the first device seen, it's the root device to be
      # used for ejection.  Keep it.
      $rootDevice = $device;
    }

    if($restOfLine =~ /(\/.*)/) {
      # The first partition with a mount point is the interesting one.  It's
      # usually Apple_HFS and usually the last one in the list, but beware of
      # the possibility of other filesystem types and the Apple_Free partition.
      # If the disk image contains no partition table, the partition will not
      # have a type, so look for the mount point by looking for a slash.
      $mountpoint = $1;
      return($rootDevice, $device, $mountpoint);
    }
  }

  # No mount point?  This is bad.  If there's a root device, eject it.
  if(defined($rootDevice) && $rootDevice ne '') {
    # Failing anyway, so don't care about failure
    commandVerbosity(0, $gConfig{'cmd_diskutil'}, 'eject', $rootDevice);
  }

  return undef;
}

# invokeRsync($src, $dest)
#
# Invokes the command mapped to 'cmd_rsync' in gConfig to perform recursive
# copying from src to dest, preserving links but excluding most files that
# CVS would exclude; the exception is that files matching "*.so" are copied.
# According to rsync's docs, this exclusion behavior also considers the file
# $HOME/.cvsignore and the "CVSIGNORE" environment variable when determining
# "what CVS would exclude".
#
# Returns the return code from rsync. Thus, this is falsey on success.
sub invokeRsync($$) {
  my($src, $dest) = @_;
  my @verbosity;
  if($gVerbosity == 3) {
    @verbosity = ('--verbose');
  }
  if ($gVerbosity == 4) {
    @verbosity = ('--verbose', '--verbose');
  }
  return command($gConfig{'cmd_rsync'}, @verbosity, '--archive',
  '--copy-unsafe-links', '--cvs-exclude', '--include=*.so', $src, $dest);
}

# isFormatReadOnly($format)
#
# Returns true if $format corresponds to a read-only disk image format.
# Returns false otherwise.
sub isFormatReadOnly($) {
  my($format);
  ($format) = @_;
  return $format eq 'UDZO' || $format eq 'UDBZ' || $format eq 'UDRO' ||
         $format eq 'ULFO' || $format eq 'ULMO';
}

# joinRel($root, $leaf)
#
# Combines $root and $leaf into a single path, interpreting $leaf as relative,
# ignoring any leading '/' that would otherwise suggest it to be absolute.
# Does not do anything clever with the special directory names '.' or '..'.
#
# This only joins exactly two elements. A more ambitious implementor could
# write an equivalent loop to join any number of elements, but the script does
# not need this at time of writing (2025-4-23).
sub joinRel($$) {
  my($root, $leaf);
  ($root, $leaf) = @_;
  if (!defined($leaf)) {
    return $root;
  }
  if ($leaf =~ /^\//) {
    return $root.$leaf;
  }
  return $root.'/'.$leaf;
}

# licenseMaker($text, $resource)
#
# Takes a plain text file at path $text and creates a license agreement
# resource containing the text at path $license.  English-only, and
# no special formatting.  This is the bare-bones stuff.  For more
# intricate license agreements, create your own resource.
#
# ftp://ftp.apple.com/developer/Development_Kits/SLAs_for_UDIFs_1.0.dmg
sub licenseMaker($$) {
  my($resource, $text);
  ($text, $resource) = @_;
  if(!sysopen(*TEXT, $text, O_RDONLY)) {
    print STDERR ($0.': licenseMaker: sysopen text: '.$!."\n");
    return 0;
  }
  if(!sysopen(*RESOURCE, $resource, O_WRONLY|O_CREAT|O_EXCL)) {
    print STDERR ($0.': licenseMaker: sysopen resource: '.$!."\n");
    return 0;
  }
  print RESOURCE << '__EOT__';
// See /System/Library/Frameworks/CoreServices.framework/Frameworks/CarbonCore.framework/Headers/Script.h for language IDs.
data 'LPic' (5000) {
  // Default language ID, 0 = English
  $"0000"
  // Number of entries in list
  $"0001"

  // Entry 1
  // Language ID, 0 = English
  $"0000"
  // Resource ID, 0 = STR#/TEXT/styl 5000
  $"0000"
  // Multibyte language, 0 = no
  $"0000"
};

resource 'STR#' (5000, "English") {
  {
    // Language (unused?) = English
    "English",
    // Agree
    "Agree",
    // Disagree
    "Disagree",
__EOT__
    # This stuff needs double-quotes for interpolations to work.
    print RESOURCE ("    // Print, ellipsis is 0xC9\n");
    print RESOURCE ("    \"Print\xc9\",\n");
    print RESOURCE ("    // Save As, ellipsis is 0xC9\n");
    print RESOURCE ("    \"Save As\xc9\",\n");
    print RESOURCE ('    // Descriptive text, curly quotes are 0xD2 and 0xD3'.
     "\n");
    print RESOURCE ('    "If you agree to the terms of this license '.
     "agreement, click \xd2Agree\xd3 to access the software.  If you ".
     "do not agree, press \xd2Disagree.\xd3\"\n");
print RESOURCE << '__EOT__';
  };
};

// Beware of 1024(?) byte (character?) line length limitation.  Split up long
// lines.
// If straight quotes are used ("), remember to escape them (\").
// Newline is \n, to leave a blank line, use two of them.
// 0xD2 and 0xD3 are curly double-quotes ("), 0xD4 and 0xD5 are curly
//   single quotes ('), 0xD5 is also the apostrophe.
data 'TEXT' (5000, "English") {
__EOT__

  while(!eof(*TEXT)) {
    my($line);
    chop($line = <TEXT>);

    while(defined($line)) {
      my($chunk);

      # Rez doesn't care for lines longer than (1024?) characters.  Split
      # at less than half of that limit, in case everything needs to be
      # backwhacked.
      if(length($line)>500) {
        $chunk = substr($line, 0, 500);
        $line = substr($line, 500);
      }
      else {
        $chunk = $line;
        $line = undef;
      }

      if(length($chunk) > 0) {
        # Unsafe characters are the double-quote (") and backslash (\), escape
        # them with backslashes.
        $chunk =~ s/(["\\])/\\$1/g;

        print RESOURCE '  "'.$chunk.'"'."\n";
      }
    }
    print RESOURCE '  "\n"'."\n";
  }
  close(*TEXT);

  print RESOURCE << '__EOT__';
};

data 'styl' (5000, "English") {
  // Number of styles following = 1
  $"0001"

  // Style 1.  This is used to display the first two lines in bold text.
  // Start character = 0
  $"0000 0000"
  // Height = 16
  $"0010"
  // Ascent = 12
  $"000C"
  // Font family = 1024 (Lucida Grande)
  $"0400"
  // Style bitfield, 0x1=bold 0x2=italic 0x4=underline 0x8=outline
  // 0x10=shadow 0x20=condensed 0x40=extended
  $"00"
  // Style, unused?
  $"02"
  // Size = 12 point
  $"000C"
  // Color, RGB
  $"0000 0000 0000"
};
__EOT__
  close(*RESOURCE);

  return 1;
}

# makeSymlinks($tempRoot, @fileList)
#
# Makes symlinks in the disk image. See --symlink description for details.
# Elements of @fileList are interpreted as "symlink:target".
sub makeSymlinks($@) {
  my($tempRoot, @fileList) = @_;
  foreach my $file (@fileList) {
    my($source, $target) = split(/:/, $file);
    if(!defined($target)) {
      # empty symlink targets would result in an invalid target and fail,
      # but they shall be interpreted as "like source path, but inside dmg"
      $target = $source;
    }
    $target = joinRel($tempRoot, $target);
    if (!commandInternal('symlink', $source, $target)) {
      cleanupDie('makeSymlinks failed');
    }
  }
}

# pathSplit($pathname)
#
# Splits $pathname into an array of path components.
sub pathSplit($) {
  my($pathname);
  ($pathname) = @_;
  return split(/\//, $pathname);
}

# setAttributes($root, @attributeList)
#
# @attributeList is an array, each element of which must be in the form
# <a>:<file>.  <a> is a list of attributes, per SetFile.  <file> is a file
# which is taken as relative to $root (even if it appears as an absolute
# path.)  SetFile is called to set the attributes on each file in
# @attributeList.
sub setAttributes($@) {
  my(@attributes, $root);
  ($root, @attributes) = @_;
  my($attribute);
  foreach $attribute (@attributes) {
    my($attrList, $file, @fileList, @fixedFileList);
    ($attrList, @fileList) = split(/:/, $attribute);
    if(!defined($attrList) || !@fileList) {
      cleanupDie('--attribute requires <attributes>:<file>');
    }
    @fixedFileList=();
    foreach $file (@fileList) {
      push(@fixedFileList, joinRel($root, $file));
    }
    if(command($gConfig{'cmd_SetFile'}, '-a', $attrList, @fixedFileList)) {
      cleanupDie('SetFile failed to set attributes');
    }
  }
  return;
}

sub trapSignal($) {
  my($signalName);
  ($signalName) = @_;
  cleanupDie('exiting on SIG'.$signalName);
}

sub usage() {
  print STDERR (
"usage: pkg-dmg --source <source-folder>\n".
"               --target <target-image>\n".
"              [--format <format>]           (default: UDZO)\n".
"              [--volname <volume-name>]     (default: same name as source)\n".
"              [--tempdir <temp-dir>]        (default: same dir as target)\n".
"              [--mkdir <directory>]         (make directory in image)\n".
"              [--copy <source>[:<dest>]]    (extra files to add)\n".
"              [--symlink <source>[:<dest>]] (extra symlinks to add)\n".
"              [--license <file>]            (plain text license agreement)\n".
"              [--resource <file>]           (flat .r files to merge)\n".
"              [--icon <icns-file>]          (volume icon)\n".
"              [--attribute <a>:<file>]      (set file attributes)\n".
"              [--idme]                      (make Internet-enabled image)\n".
"              [--sourcefile]                (treat --source as a file)\n".
"              [--verbosity <level>]         (0, 1, 2; default=2)\n".
"              [--dry-run]                   (print what would be done)\n");
  return;
}