Add notarize command.
[cdist.git] / cdist
diff --git a/cdist b/cdist
index 6925645b265d6eb69dad18f87d4d32870f1805f5..2354e643151950c92c4e57c3efa96db0f73f428a 100755 (executable)
--- a/cdist
+++ b/cdist
@@ -1,6 +1,6 @@
-#!/usr/bin/python
+#!/usr/bin/python3
 
-#    Copyright (C) 2012-2020 Carl Hetherington <cth@carlh.net>
+#    Copyright (C) 2012-2021 Carl Hetherington <cth@carlh.net>
 #
 #    This program is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU General Public License as published by
 #    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 
 from __future__ import print_function
-import os
-import sys
-import shutil
-import glob
-import tempfile
+
 import argparse
-import datetime
-import subprocess
-import re
 import copy
-import inspect
+import datetime
 import getpass
-import shlex
+import glob
+import inspect
 import multiprocessing
-
-TEMPORARY_DIRECTORY = '/var/tmp'
+import os
+from pathlib import Path
+import platform
+import re
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
 
 class Error(Exception):
     def __init__(self, value):
@@ -68,6 +70,10 @@ class Trees:
         self.trees.append(nt)
         return nt
 
+    def add_built(self, name, specifier, target):
+        self.trees.append(Tree(name, specifier, target, None, built=True))
+
+
 class Globals:
     quiet = False
     command = None
@@ -103,16 +109,22 @@ class Config:
     def __init__(self):
         self.options = [ Option('mxe_prefix'),
                          Option('git_prefix'),
+                         Option('git_reference'),
                          Option('osx_environment_prefix'),
                          Option('osx_sdk_prefix'),
                          Option('osx_sdk'),
+                         Option('osx_intel_deployment'),
+                         Option('osx_arm_deployment'),
+                         Option('osx_keychain_file'),
+                         Option('osx_keychain_password'),
                          Option('apple_id'),
                          Option('apple_password'),
                          BoolOption('docker_sudo'),
                          BoolOption('docker_no_user'),
                          Option('docker_hub_repository'),
                          Option('flatpak_state_dir'),
-                         Option('parallel', multiprocessing.cpu_count()) ]
+                         Option('parallel', multiprocessing.cpu_count()),
+                         Option('temp', '/var/tmp')]
 
         config_dir = '%s/.config' % os.path.expanduser('~')
         if not os.path.exists(config_dir):
@@ -203,7 +215,7 @@ def copytree(a, b):
         command('scp -r %s %s' % (scp_escape(a), scp_escape(b)))
 
 def copyfile(a, b):
-    log_normal('copy %s -> %s' % (scp_escape(a), scp_escape(b)))
+    log_normal('copy %s -> %s with cwd %s' % (scp_escape(a), scp_escape(b), os.getcwd()))
     if b.startswith('s3://'):
         command('s3cmd -P put "%s" "%s"' % (a, b))
     else:
@@ -246,9 +258,12 @@ def rmtree(a):
 
 def command(c):
     log_normal(c)
-    r = os.system(c)
-    if (r >> 8):
-        raise Error('command %s failed' % c)
+    try:
+        r = subprocess.run(c, shell=True)
+        if r.returncode != 0:
+            raise Error('command %s failed (%d)' % (c, r.returncode))
+    except Exception as e:
+        raise Error('command %s failed (%s)' % (c, e))
 
 def command_and_read(c):
     log_normal(c)
@@ -256,7 +271,7 @@ def command_and_read(c):
     (out, err) = p.communicate()
     if p.returncode != 0:
         raise Error('command %s failed (%s)' % (c, err))
-    return out.splitlines()
+    return str(out, 'utf-8').splitlines()
 
 def read_wscript_variable(directory, variable):
     f = open('%s/wscript' % directory, 'r')
@@ -273,45 +288,6 @@ def read_wscript_variable(directory, variable):
     f.close()
     return None
 
-def set_version_in_wscript(version):
-    f = open('wscript', 'rw')
-    o = open('wscript.tmp', 'w')
-    while True:
-        l = f.readline()
-        if l == '':
-            break
-
-        s = l.split()
-        if len(s) == 3 and s[0] == "VERSION":
-            print("VERSION = '%s'" % version, file=o)
-        else:
-            print(l, file=o, end="")
-    f.close()
-    o.close()
-
-    os.rename('wscript.tmp', 'wscript')
-
-def append_version_to_changelog(version):
-    try:
-        f = open('ChangeLog', 'r')
-    except:
-        log_normal('Could not open ChangeLog')
-        return
-
-    c = f.read()
-    f.close()
-
-    f = open('ChangeLog', 'w')
-    now = datetime.datetime.now()
-    f.write('%d-%02d-%02d  Carl Hetherington  <cth@carlh.net>\n\n\t* Version %s released.\n\n' % (now.year, now.month, now.day, version))
-    f.write(c)
-
-def append_version_to_debian_changelog(version):
-    if not os.path.exists('debian'):
-        log_normal('Could not find debian directory')
-        return
-
-    command('dch -b -v %s-1 "New upstream release."' % version)
 
 def devel_to_git(git_commit, filename):
     if git_commit is not None:
@@ -440,31 +416,40 @@ class Target(object):
         self.build_dependencies = True
 
         if directory is None:
-            self.directory = tempfile.mkdtemp('', 'tmp', TEMPORARY_DIRECTORY)
+            self.directory = tempfile.mkdtemp('', 'tmp', config.get('temp'))
             self.rmdir = True
             self.set('CCACHE_BASEDIR', os.path.realpath(self.directory))
             self.set('CCACHE_NOHASHDIR', '')
         else:
-            self.directory = directory
+            self.directory = os.path.realpath(directory)
             self.rmdir = False
 
 
     def setup(self):
         pass
 
-    def package(self, project, checkout, output_dir, options):
-        tree = self.build(project, checkout, options)
-        if len(inspect.getargspec(tree.cscript['package']).args) == 3:
+    def _cscript_package(self, tree, options):
+        """
+        Call package() in the cscript and return what it returns, except that
+        anything not in a list will be put into one.
+        """
+        if len(inspect.getfullargspec(tree.cscript['package']).args) == 3:
             packages = tree.call('package', tree.version, options)
         else:
             log_normal("Deprecated cscript package() method with no options parameter")
             packages = tree.call('package', tree.version)
 
-        if isinstance(packages, (str, unicode)):
-            copyfile(packages, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, packages))))
-        else:
-            for p in packages:
-                copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, p))))
+        return packages if isinstance(packages, list) else [packages]
+
+    def _copy_packages(self, tree, packages, output_dir):
+        for p in packages:
+            copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, p))))
+
+    def package(self, project, checkout, output_dir, options, notarize):
+        tree = self.build(project, checkout, options)
+        tree.add_defaults(options)
+        p = self._cscript_package(tree, options)
+        self._copy_packages(tree, p, output_dir)
 
     def build(self, project, checkout, options):
         tree = globals.trees.get(project, checkout, self)
@@ -473,12 +458,17 @@ class Target(object):
         tree.build(options)
         return tree
 
-    def test(self, tree, test, options):
+    def test(self, project, checkout, target, test, options):
         """test is the test case to run, or None"""
-        if self.build_dependencies:
-            tree.build_dependencies(options)
-        tree.build(options)
-        return tree.call('test', test)
+        tree = globals.trees.get(project, checkout, target)
+
+        tree.add_defaults(options)
+        with TreeDirectory(tree):
+            if len(inspect.getfullargspec(tree.cscript['test']).args) == 3:
+                return tree.call('test', options, test)
+            else:
+                log_normal('Deprecated cscript test() method with no options parameter')
+                return tree.call('test', test)
 
     def set(self, a, b):
         self.variables[a] = b
@@ -540,14 +530,19 @@ class DockerTarget(Target):
             return ''
         return '-u %s' % getpass.getuser()
 
+    def _mount_option(self, d):
+        return '-v %s:%s ' % (os.path.realpath(d), os.path.realpath(d))
+
     def setup(self):
-        opts = '-v %s:%s ' % (self.directory, self.directory)
+        opts = self._mount_option(self.directory)
         for m in self.mounts:
-            opts += '-v %s:%s ' % (m, m)
+            opts += self._mount_option(m)
+        if config.has('git_reference'):
+            opts += self._mount_option(config.get('git_reference'))
         if self.privileged:
             opts += '--privileged=true '
         if self.ccache:
-            opts += "-e CCACHE_DIR=/ccache --volumes-from ccache-%s" % self.image
+            opts += "-e CCACHE_DIR=/ccache/%s-%d --mount source=ccache,target=/ccache" % (self.image, os.getuid())
 
         tag = self.image
         if config.has('docker_hub_repository'):
@@ -595,7 +590,7 @@ class FlatpakTarget(Target):
         return b
 
 
-class WindowsTarget(DockerTarget):
+class WindowsDockerTarget(DockerTarget):
     """
     This target exposes the following additional API:
 
@@ -606,7 +601,7 @@ class WindowsTarget(DockerTarget):
     tool_path: path to 32- and 64-bit tools
     """
     def __init__(self, windows_version, bits, directory, environment_version):
-        super(WindowsTarget, self).__init__('windows', directory)
+        super(WindowsDockerTarget, self).__init__('windows', directory)
         self.version = windows_version
         self.bits = bits
 
@@ -620,8 +615,6 @@ class WindowsTarget(DockerTarget):
         self.set('PKG_CONFIG_LIBDIR', '%s/lib/pkgconfig' % self.environment_prefix)
         self.set('PKG_CONFIG_PATH', '%s/lib/pkgconfig:%s/bin/pkgconfig' % (self.directory, self.directory))
         self.set('PATH', '%s/bin:%s:%s' % (self.environment_prefix, self.tool_path, os.environ['PATH']))
-        self.set('CC', '%s-gcc' % self.name)
-        self.set('CXX', '%s-g++' % self.name)
         self.set('LD', '%s-ld' % self.name)
         self.set('RANLIB', '%s-ranlib' % self.name)
         self.set('WINRC', '%s-windres' % self.name)
@@ -636,6 +629,15 @@ class WindowsTarget(DockerTarget):
         if environment_version is not None:
             self.image += '_%s' % environment_version
 
+    def setup(self):
+        super().setup()
+        if self.ccache:
+            self.set('CC', '"ccache %s-gcc"' % self.name)
+            self.set('CXX', '"ccache %s-g++"' % self.name)
+        else:
+            self.set('CC', '%s-gcc' % self.name)
+            self.set('CXX', '%s-g++' % self.name)
+
     @property
     def library_prefix(self):
         log_normal('Deprecated property library_prefix: use environment_prefix')
@@ -662,6 +664,28 @@ class WindowsTarget(DockerTarget):
         return self.name
 
 
+class WindowsNativeTarget(Target):
+    """
+    This target exposes the following additional API:
+
+    version: Windows version ('xp' or None)
+    bits: bitness of Windows (32 or 64)
+    name: name of our target e.g. x86_64-w64-mingw32.shared
+    environment_prefix: path to Windows environment for the appropriate target (libraries and some tools)
+    """
+    def __init__(self, directory):
+        super().__init__('windows', directory)
+        self.version = None
+        self.bits = 64
+
+        self.environment_prefix = config.get('windows_native_environmnet_prefix')
+
+        self.set('PATH', '%s/bin:%s' % (self.environment_prefix, os.environ['PATH']))
+
+    def command(self, cmd):
+        command(cmd)
+
+
 class LinuxTarget(DockerTarget):
     """
     Build for Linux in a docker container.
@@ -698,54 +722,108 @@ class LinuxTarget(DockerTarget):
             self.set('CC', '"ccache gcc"')
             self.set('CXX', '"ccache g++"')
 
-    def test(self, tree, test, options):
+    def test(self, project, checkout, target, test, options):
         self.append_with_colon('PATH', '%s/bin' % self.directory)
         self.append_with_colon('LD_LIBRARY_PATH', '%s/lib' % self.directory)
-        super(LinuxTarget, self).test(tree, test, options)
+        super(LinuxTarget, self).test(project, checkout, target, test, options)
 
 
 class AppImageTarget(LinuxTarget):
     def __init__(self, work):
-        super(AppImageTarget, self).__init__('ubuntu', '16.04', 64, work)
+        super(AppImageTarget, self).__init__('ubuntu', '18.04', 64, work)
         self.detail = 'appimage'
         self.privileged = True
 
 
+def notarize_dmg(dmg, bundle_id):
+    p = subprocess.run(
+        ['xcrun', 'altool', '--notarize-app', '-t', 'osx', '-f', dmg, '--primary-bundle-id', bundle_id, '-u', config.get('apple_id'), '-p', config.get('apple_password'), '--output-format', 'xml'],
+        capture_output=True
+        )
+
+    def string_after(process, key):
+        lines = p.stdout.decode('utf-8').splitlines()
+        for i in range(0, len(lines)):
+            if lines[i].find(key) != -1:
+                return lines[i+1].strip().replace('<string>', '').replace('</string>', '')
+
+    request_uuid = string_after(p, "RequestUUID")
+    if request_uuid is None:
+        print("Response: %s" % p)
+        raise Error('No RequestUUID found in response from Apple')
+
+    for i in range(0, 30):
+        print('%s: checking up on %s' % (datetime.datetime.now(), request_uuid))
+        p = subprocess.run(['xcrun', 'altool', '--notarization-info', request_uuid, '-u', config.get('apple_id'), '-p', config.get('apple_password'), '--output-format', 'xml'], capture_output=True)
+        status = string_after(p, 'Status')
+        print('%s: got status %s' % (datetime.datetime.now(), status))
+        if status == 'invalid':
+            raise Error("Notarization failed")
+        elif status == 'success':
+            subprocess.run(['xcrun', 'stapler', 'staple', dmg])
+            return
+        elif status != "in progress":
+            print("Could not understand xcrun response")
+            print(p)
+        time.sleep(30)
+
+    raise Error("Notarization timed out")
+
+
 class OSXTarget(Target):
     def __init__(self, directory=None):
         super(OSXTarget, self).__init__('osx', directory)
-        self.sdk = config.get('osx_sdk')
         self.sdk_prefix = config.get('osx_sdk_prefix')
         self.environment_prefix = config.get('osx_environment_prefix')
         self.apple_id = config.get('apple_id')
         self.apple_password = config.get('apple_password')
+        self.osx_keychain_file = config.get('osx_keychain_file')
+        self.osx_keychain_password = config.get('osx_keychain_password')
 
     def command(self, c):
         command('%s %s' % (self.variables_string(False), c))
 
+    def unlock_keychain(self):
+        self.command('security unlock-keychain -p %s %s' % (self.osx_keychain_password, self.osx_keychain_file))
+
+    def _cscript_package_and_notarize(self, tree, options, notarize):
+        """
+        Call package() in the cscript and notarize the .dmgs that are returned, if notarize == True
+        """
+        p = self._cscript_package(tree, options)
+        for x in p:
+            if not isinstance(x, tuple):
+                raise Error('macOS packages must be returned from cscript as tuples of (dmg-filename, bundle-id)')
+            if notarize:
+                notarize_dmg(x[0], x[1])
+            else:
+                with f as f.open(dmg + '.id', 'w'):
+                    print(out=f, x[1])
+        return [x[0] for x in p]
+
 
 class OSXSingleTarget(OSXTarget):
-    def __init__(self, bits, directory=None):
+    def __init__(self, arch, sdk, deployment, directory=None):
         super(OSXSingleTarget, self).__init__(directory)
-        self.bits = bits
+        self.arch = arch
+        self.sdk = sdk
+        self.deployment = deployment
 
-        if bits == 32:
-            arch = 'i386'
-        else:
-            arch = 'x86_64'
+        flags = '-isysroot %s/MacOSX%s.sdk -arch %s' % (self.sdk_prefix, sdk, arch)
+        host_enviro = '%s/x86_64' % config.get('osx_environment_prefix')
+        target_enviro = '%s/%s' % (config.get('osx_environment_prefix'), arch)
 
-        flags = '-isysroot %s/MacOSX%s.sdk -arch %s' % (self.sdk_prefix, self.sdk, arch)
-        enviro = '%s/%d' % (config.get('osx_environment_prefix'), bits)
+        self.bin = '%s/bin' % target_enviro
 
         # Environment variables
-        self.set('CFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, enviro, flags))
+        self.set('CFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, target_enviro, flags))
         self.set('CPPFLAGS', '')
-        self.set('CXXFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, enviro, flags))
-        self.set('LDFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, enviro, flags))
-        self.set('LINKFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, enviro, flags))
-        self.set('PKG_CONFIG_PATH', '%s/lib/pkgconfig:%s/lib/pkgconfig:/usr/lib/pkgconfig' % (self.directory, enviro))
-        self.set('PATH', '$PATH:/usr/bin:/sbin:/usr/local/bin:%s/bin' % enviro)
-        self.set('MACOSX_DEPLOYMENT_TARGET', config.get('osx_sdk'))
+        self.set('CXXFLAGS', '"-I%s/include -I%s/include %s"' % (self.directory, target_enviro, flags))
+        self.set('LDFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, target_enviro, flags))
+        self.set('LINKFLAGS', '"-L%s/lib -L%s/lib %s"' % (self.directory, target_enviro, flags))
+        self.set('PKG_CONFIG_PATH', '%s/lib/pkgconfig:%s/lib/pkgconfig:/usr/lib/pkgconfig' % (self.directory, target_enviro))
+        self.set('PATH', '$PATH:/usr/bin:/sbin:/usr/local/bin:%s/bin' % host_enviro)
+        self.set('MACOSX_DEPLOYMENT_TARGET', self.deployment)
         self.set('CCACHE_BASEDIR', self.directory)
 
     @Target.ccache.setter
@@ -755,29 +833,31 @@ class OSXSingleTarget(OSXTarget):
             self.set('CC', '"ccache gcc"')
             self.set('CXX', '"ccache g++"')
 
+    def package(self, project, checkout, output_dir, options, notarize):
+        tree = self.build(project, checkout, options)
+        tree.add_defaults(options)
+        self.unlock_keychain()
+        p = self._cscript_package_and_notarize(tree, options, notarize)
+        self._copy_packages(tree, p, output_dir)
+
 
 class OSXUniversalTarget(OSXTarget):
     def __init__(self, directory=None):
         super(OSXUniversalTarget, self).__init__(directory)
-        self.bits = None
-
-    def package(self, project, checkout, output_dir, options):
+        self.sdk = config.get('osx_sdk')
 
-        for b in [32, 64]:
-            target = OSXSingleTarget(b, os.path.join(self.directory, '%d' % b))
+    def package(self, project, checkout, output_dir, options, notarize):
+        for arch, deployment in (('x86_64', config.get('osx_intel_deployment')), ('arm64', config.get('osx_arm_deployment'))):
+            target = OSXSingleTarget(arch, self.sdk, deployment, os.path.join(self.directory, arch))
             target.ccache = self.ccache
             tree = globals.trees.get(project, checkout, target)
             tree.build_dependencies(options)
             tree.build(options)
 
+        self.unlock_keychain()
         tree = globals.trees.get(project, checkout, self)
         with TreeDirectory(tree):
-            if len(inspect.getargspec(tree.cscript['package']).args) == 3:
-                packages = tree.call('package', tree.version, options)
-            else:
-                log_normal("Deprecated cscript package() method with no options parameter")
-                packages = tree.call('package', tree.version)
-            for p in packages:
+            for p in self._cscript_package_and_notarize(tree, options, notarize):
                 copyfile(p, os.path.join(output_dir, os.path.basename(devel_to_git(tree.git_commit, p))))
 
 class SourceTarget(Target):
@@ -792,7 +872,7 @@ class SourceTarget(Target):
     def cleanup(self):
         rmtree(self.directory)
 
-    def package(self, project, checkout, output_dir, options):
+    def package(self, project, checkout, output_dir, options, notarize):
         tree = globals.trees.get(project, checkout, self)
         with TreeDirectory(tree):
             name = read_wscript_variable(os.getcwd(), 'APPNAME')
@@ -807,7 +887,7 @@ class SourceTarget(Target):
 #    or centos-version-{32,64}
 #    or fedora-version-{32,64}
 #    or mageia-version-{32,64}
-#    or osx-{32,64}
+#    or osx
 #    or source
 #    or flatpak
 #    or appimage
@@ -817,12 +897,15 @@ def target_factory(args):
     target = None
     if s.startswith('windows-'):
         x = s.split('-')
-        if len(x) == 2:
-            target = WindowsTarget(None, int(x[1]), args.work, args.environment_version)
-        elif len(x) == 3:
-            target = WindowsTarget(x[1], int(x[2]), args.work, args.environment_version)
+        if platform.system() == "Windows":
+            target = WindowsNativeTarget(args.work)
         else:
-            raise Error("Bad Windows target name `%s'")
+            if len(x) == 2:
+                target = WindowsDockerTarget(None, int(x[1]), args.work, args.environment_version)
+            elif len(x) == 3:
+                target = WindowsDockerTarget(x[1], int(x[2]), args.work, args.environment_version)
+            else:
+                raise Error("Bad Windows target name `%s'")
     elif s.startswith('ubuntu-') or s.startswith('debian-') or s.startswith('centos-') or s.startswith('fedora-') or s.startswith('mageia-'):
         p = s.split('-')
         if len(p) != 3:
@@ -835,13 +918,10 @@ def target_factory(args):
         target = LinuxTarget(p[0], None, int(p[1]), args.work)
     elif s == 'raspbian':
         target = LinuxTarget(s, None, None, args.work)
-    elif s.startswith('osx-'):
-        target = OSXSingleTarget(int(s.split('-')[1]), args.work)
     elif s == 'osx':
-        if globals.command == 'build':
-            target = OSXSingleTarget(64, args.work)
-        else:
-            target = OSXUniversalTarget(args.work)
+        target = OSXUniversalTarget(args.work)
+    elif s == 'osx-intel':
+        target = OSXSingleTarget('x86_64', config.get('osx_sdk'), config.get('osx_intel_deployment'), args.work)
     elif s == 'source':
         target = SourceTarget()
     elif s == 'flatpak':
@@ -884,41 +964,56 @@ class Tree(object):
            required_by -- name of the tree that requires this one
     """
 
-    def __init__(self, name, specifier, target, required_by):
+    def __init__(self, name, specifier, target, required_by, built=False):
         self.name = name
         self.specifier = specifier
         self.target = target
         self.version = None
         self.git_commit = None
-        self.built = False
+        self.built = built
         self.required_by = required_by
 
         cwd = os.getcwd()
+        proj = '%s/src/%s' % (target.directory, self.name)
 
-        flags = ''
-        redirect = ''
-        if globals.quiet:
-            flags = '-q'
-            redirect = '>/dev/null'
-        command('git clone %s %s/%s.git %s/src/%s' % (flags, config.get('git_prefix'), self.name, target.directory, self.name))
-        os.chdir('%s/src/%s' % (target.directory, self.name))
-
-        spec = self.specifier
-        if spec is None:
-            spec = 'master'
+        if not built:
+            flags = ''
+            redirect = ''
+            if globals.quiet:
+                flags = '-q'
+                redirect = '>/dev/null'
+            if config.has('git_reference'):
+                ref = '--reference-if-able %s/%s.git' % (config.get('git_reference'), self.name)
+            else:
+                ref = ''
+            command('git clone %s %s %s/%s.git %s/src/%s' % (flags, ref, config.get('git_prefix'), self.name, target.directory, self.name))
+            os.chdir('%s/src/%s' % (target.directory, self.name))
 
-        command('git checkout %s %s %s' % (flags, spec, redirect))
-        self.git_commit = command_and_read('git rev-parse --short=7 HEAD')[0].strip()
+            spec = self.specifier
+            if spec is None:
+                spec = 'master'
 
-        proj = '%s/src/%s' % (target.directory, self.name)
+            command('git checkout %s %s %s' % (flags, spec, redirect))
+            self.git_commit = command_and_read('git rev-parse --short=7 HEAD')[0].strip()
 
         self.cscript = {}
         exec(open('%s/cscript' % proj).read(), self.cscript)
 
-        # cscript can include submodules = False to stop submodules being fetched
-        if not 'submodules' in self.cscript or self.cscript['submodules'] == True:
-            command('git submodule init --quiet')
-            command('git submodule update --quiet')
+        if not built:
+            # cscript can include submodules = False to stop submodules being fetched
+            if (not 'submodules' in self.cscript or self.cscript['submodules'] == True) and os.path.exists('.gitmodules'):
+                command('git submodule --quiet init')
+                paths = command_and_read('git config --file .gitmodules --get-regexp path')
+                urls = command_and_read('git config --file .gitmodules --get-regexp url')
+                for path, url in zip(paths, urls):
+                    ref = ''
+                    if config.has('git_reference'):
+                        url = url.split(' ')[1]
+                        ref_path = os.path.join(config.get('git_reference'), os.path.basename(url))
+                        if os.path.exists(ref_path):
+                            ref = '--reference %s' % ref_path
+                    path = path.split(' ')[1]
+                    command('git submodule --quiet update %s %s' % (ref, path))
 
         if os.path.exists('%s/wscript' % proj):
             v = read_wscript_variable(proj, "VERSION");
@@ -926,8 +1021,13 @@ class Tree(object):
                 try:
                     self.version = Version(v)
                 except:
-                    tag = subprocess.Popen(shlex.split('git -C %s describe --tags' % proj), stdout=subprocess.PIPE).communicate()[0][1:]
-                    self.version = Version.from_git_tag(tag)
+                    try:
+                        tag = command_and_read('git -C %s describe --tags' % proj)[0][1:]
+                        self.version = Version.from_git_tag(tag)
+                    except:
+                        # We'll leave version as None if we can't read it; maybe this is a bad idea
+                        # Should probably just install git on the Windows VM
+                        pass
 
         os.chdir(cwd)
 
@@ -951,13 +1051,13 @@ class Tree(object):
     def dependencies(self, options):
         """
         yield details of the dependencies of this tree.  Each dependency is returned
-        as a tuple of (tree, options).  The 'options' parameter are the options that
+        as a tuple of (tree, options, parent_tree).  The 'options' parameter are the options that
         we want to force for 'self'.
         """
         if not 'dependencies' in self.cscript:
             return
 
-        if len(inspect.getargspec(self.cscript['dependencies']).args) == 2:
+        if len(inspect.getfullargspec(self.cscript['dependencies']).args) == 2:
             self_options = copy.copy(options)
             self.add_defaults(self_options)
             deps = self.call('dependencies', self_options)
@@ -973,7 +1073,7 @@ class Tree(object):
             dep_options = d[2] if len(d) > 2 else {}
             for i in dep.dependencies(dep_options):
                 yield i
-            yield (dep, dep_options)
+            yield (dep, dep_options, self)
 
     def checkout_dependencies(self, options={}):
         for i in self.dependencies(options):
@@ -999,7 +1099,7 @@ class Tree(object):
         self.add_defaults(options)
 
         if not globals.dry_run:
-            if len(inspect.getargspec(self.cscript['build']).args) == 2:
+            if len(inspect.getfullargspec(self.cscript['build']).args) == 2:
                 self.call('build', options)
             else:
                 self.call('build')
@@ -1007,6 +1107,7 @@ class Tree(object):
         self.target.variables = variables
         self.built = True
 
+
 #
 # Command-line parser
 #
@@ -1015,31 +1116,27 @@ def main():
 
     commands = {
         "build": "build project",
-        "package": "package and build project",
-        "release": "release a project using its next version number (changing wscript and tagging)",
+        "package": "build and package the project",
+        "release": "release a project using its next version number (adding a tag)",
         "pot": "build the project's .pot files",
         "manual": "build the project's manual",
         "doxygen": "build the project's Doxygen documentation",
         "latest": "print out the latest version",
-        "test": "run the project's unit tests",
-        "shell": "build the project then start a shell",
+        "test": "build the project and run its unit tests",
+        "shell": "start a shell in the project''s work directory",
         "checkout": "check out the project",
-        "revision": "print the head git revision number"
+        "revision": "print the head git revision number",
+        "dependencies" : "print details of the project's dependencies as a .dot file"
     }
 
-    one_of = "Command is one of:\n"
+    one_of = ""
     summary = ""
     for k, v in commands.items():
-        one_of += "\t%s\t%s\n" % (k, v)
+        one_of += "\t%s%s\n" % (k.ljust(20), v)
         summary += k + " "
 
     parser = argparse.ArgumentParser()
-    parser.add_argument('command', help=summary)
     parser.add_argument('-p', '--project', help='project name')
-    parser.add_argument('--minor', help='minor version number bump', action='store_true')
-    parser.add_argument('--micro', help='micro version number bump', action='store_true')
-    parser.add_argument('--latest-major', help='major version to return with latest', type=int)
-    parser.add_argument('--latest-minor', help='minor version to return with latest', type=int)
     parser.add_argument('-c', '--checkout', help='string to pass to git for checkout')
     parser.add_argument('-o', '--output', help='output directory', default='.')
     parser.add_argument('-q', '--quiet', help='be quiet', action='store_true')
@@ -1049,14 +1146,36 @@ def main():
     parser.add_argument('--debug', help='build with debugging symbols where possible', action='store_true')
     parser.add_argument('-w', '--work', help='override default work directory')
     parser.add_argument('-g', '--git-prefix', help='override configured git prefix')
-    parser.add_argument('--test', help="name of test to run (with `test'), defaults to all")
     parser.add_argument('-n', '--dry-run', help='run the process without building anything', action='store_true')
     parser.add_argument('-e', '--environment', help='pass the value of the named environment variable into the build', action='append')
     parser.add_argument('-m', '--mount', help='mount a given directory in the build environment', action='append')
-    parser.add_argument('--no-version-commit', help="use just tags for versioning, don't modify wscript, ChangeLog etc.", action='store_true')
     parser.add_argument('--option', help='set an option for the build (use --option key:value)', action='append')
     parser.add_argument('--ccache', help='use ccache', action='store_true')
     parser.add_argument('--verbose', help='be verbose', action='store_true')
+
+    subparsers = parser.add_subparsers(help='command to run', dest='command')
+    parser_build = subparsers.add_parser("build", help="build project")
+    parser_package = subparsers.add_parser("package", help="build and package project")
+    parser_package.add_argument('--no-notarize', help='do not notarize .dmg packages', action='store_true')
+    parser_release = subparsers.add_parser("release", help="release a project using its next version number (adding a tag)")
+    parser_release.add_argument('--minor', help='minor version number bump', action='store_true')
+    parser_release.add_argument('--micro', help='micro version number bump', action='store_true')
+    parser_pot = subparsers.add_parser("pot", help="build the project's .pot files")
+    parser_manual = subparsers.add_parser("manual", help="build the project's manual")
+    parser_doxygen = subparsers.add_parser("doxygen", help="build the project's Doxygen documentation")
+    parser_latest = subparsers.add_parser("latest", help="print out the latest version")
+    parser_latest.add_argument('--major', help='major version to return', type=int)
+    parser_latest.add_argument('--minor', help='minor version to return', type=int)
+    parser_test = subparsers.add_parser("test", help="build the project and run its unit tests")
+    parser_test.add_argument('--no-implicit-build', help='do not build first', action='store_true')
+    parser_test.add_argument('--test', help="name of test to run, defaults to all")
+    parser_shell = subparsers.add_parser("shell", help="build the project then start a shell")
+    parser_checkout = subparsers.add_parser("checkout", help="check out the project")
+    parser_revision = subparsers.add_parser("revision", help="print the head git revision number")
+    parser_dependencies = subparsers.add_parser("dependencies", help="print details of the project's dependencies as a .dot file")
+    parser_notarize = subparsers.add_parser("notarize", help="notarize .dmgs in a directory using *.dmg.id files")
+    parser_notarize.add_argument('--dmgs', help='directory containing *.dmg and *.dmg.id')
+
     global args
     args = parser.parse_args()
 
@@ -1091,14 +1210,9 @@ def main():
 
     globals.quiet = args.quiet
     globals.verbose = args.verbose
-    globals.command = args.command
     globals.dry_run = args.dry_run
 
-    if not globals.command in commands:
-        e = 'command must be one of:\n' + one_of
-        raise Error('command must be one of:\n%s' % one_of)
-
-    if globals.command == 'build':
+    if args.command == 'build':
         if args.target is None:
             raise Error('you must specify -t or --target')
 
@@ -1107,7 +1221,7 @@ def main():
         if not args.keep:
             target.cleanup()
 
-    elif globals.command == 'package':
+    elif args.command == 'package':
         if args.target is None:
             raise Error('you must specify -t or --target')
 
@@ -1124,7 +1238,7 @@ def main():
                 output_dir = args.output
 
             makedirs(output_dir)
-            target.package(args.project, args.checkout, output_dir, get_command_line_options(args))
+            target.package(args.project, args.checkout, output_dir, get_command_line_options(args), not args.no_notarize)
         except Error as e:
             if target is not None and not args.keep:
                 target.cleanup()
@@ -1133,7 +1247,7 @@ def main():
         if target is not None and not args.keep:
             target.cleanup()
 
-    elif globals.command == 'release':
+    elif args.command == 'release':
         if args.minor is False and args.micro is False:
             raise Error('you must specify --minor or --micro')
 
@@ -1148,25 +1262,12 @@ def main():
             version.bump_micro()
 
         with TreeDirectory(tree):
-            if not args.no_version_commit:
-                set_version_in_wscript(version)
-                append_version_to_changelog(version)
-                append_version_to_debian_changelog(version)
-                command('git commit -a -m "Bump version"')
-
             command('git tag -m "v%s" v%s' % (version, version))
-
-            if not args.no_version_commit:
-                version.to_devel()
-                set_version_in_wscript(version)
-                command('git commit -a -m "Bump version"')
-                command('git push')
-
             command('git push --tags')
 
         target.cleanup()
 
-    elif globals.command == 'pot':
+    elif args.command == 'pot':
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
 
@@ -1176,7 +1277,7 @@ def main():
 
         target.cleanup()
 
-    elif globals.command == 'manual':
+    elif args.command == 'manual':
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
 
@@ -1189,7 +1290,7 @@ def main():
 
         target.cleanup()
 
-    elif globals.command == 'doxygen':
+    elif args.command == 'doxygen':
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
 
@@ -1202,7 +1303,7 @@ def main():
 
         target.cleanup()
 
-    elif globals.command == 'latest':
+    elif args.command == 'latest':
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
 
@@ -1222,38 +1323,37 @@ def main():
                             t = s[1]
                         if len(t) > 0 and t[0] == 'v':
                             v = Version(t[1:])
-                            if (args.latest_major is None or v.major == args.latest_major) and (args.latest_minor is None or v.minor == args.latest_minor):
+                            if (args.major is None or v.major == args.major) and (args.minor is None or v.minor == args.minor):
                                 latest = v
 
         print(latest)
         target.cleanup()
 
-    elif globals.command == 'test':
+    elif args.command == 'test':
         if args.target is None:
             raise Error('you must specify -t or --target')
 
         target = None
         try:
             target = target_factory(args)
-            tree = globals.trees.get(args.project, args.checkout, target)
-            with TreeDirectory(tree):
-                target.test(tree, args.test, get_command_line_options(args))
-        except Error as e:
+            options = get_command_line_options(args)
+            if args.no_implicit_build:
+                globals.trees.add_built(args.project, args.checkout, target)
+            else:
+                target.build(args.project, args.checkout, options)
+            target.test(args.project, args.checkout, target, args.test, options)
+        finally:
             if target is not None and not args.keep:
                 target.cleanup()
-            raise
 
-        if target is not None and not args.keep:
-            target.cleanup()
-
-    elif globals.command == 'shell':
+    elif args.command == 'shell':
         if args.target is None:
             raise Error('you must specify -t or --target')
 
         target = target_factory(args)
         target.command('bash')
 
-    elif globals.command == 'revision':
+    elif args.command == 'revision':
 
         target = SourceTarget()
         tree = globals.trees.get(args.project, args.checkout, target)
@@ -1261,7 +1361,7 @@ def main():
             print(command_and_read('git rev-parse HEAD')[0].strip()[:7])
         target.cleanup()
 
-    elif globals.command == 'checkout':
+    elif args.command == 'checkout':
 
         if args.output is None:
             raise Error('you must specify -o or --output')
@@ -1272,8 +1372,33 @@ def main():
             shutil.copytree('.', args.output)
         target.cleanup()
 
-    else:
-        raise Error('invalid command %s' % globals.command)
+    elif args.command == 'dependencies':
+        if args.target is None:
+            raise Error('you must specify -t or --target')
+        if args.checkout is None:
+            raise Error('you must specify -c or --checkout')
+
+        target = target_factory(args)
+        tree = globals.trees.get(args.project, args.checkout, target)
+        print("strict digraph {")
+        for d in list(tree.dependencies({})):
+            print("%s -> %s;" % (d[2].name.replace("-", "-"), d[0].name.replace("-", "_")))
+        print("}")
+
+    elif args.command == 'notarize':
+        if args.dmgs is None:
+            raise Error('you must specify ---dmgs')
+        if args.no_notarize:
+            raise Error('it makes no sense to pass --no-notarize with the notarize command')
+
+        for dmg in Path(args.dmgs).iter():
+            id = None
+            try:
+                with open(dmg + '.id') as f:
+                    id = f.getline().strip()
+            catch OSError:
+                raise Error('could not find ID file for %s' % dmg)
+            notarize_dmg(dmg, id)
 
 try:
     main()