macOS binary distribution (both AMD64 and ARM64)

.github/workflows/ci.yml

@@ -233,6 +233,9 @@ jobs:
         shell: bash
         working-directory: nim-beacon-chain
         run: |
+          if [[ "${{ runner.os }}" == "macOS" ]]; then
+            ulimit -n 1024
+          fi
           make -j$ncpu ARCH_OVERRIDE=$PLATFORM CI_CACHE=NimBinaries QUICK_AND_DIRTY_COMPILER=1 update
 
       - name: Get latest fixtures commit hash
@@ -268,6 +271,9 @@ jobs:
         shell: bash
         working-directory: nim-beacon-chain
         run: |
+          if [[ "${{ runner.os }}" == "macOS" ]]; then
+            ulimit -n 1024
+          fi
           make -j$ncpu ARCH_OVERRIDE=$PLATFORM LOG_LEVEL=TRACE NIMFLAGS="-d:testnet_servers_image" nimbus_beacon_node nimbus_validator_client
 
       - name: Run nim-beacon-chain tests
@@ -275,6 +281,9 @@ jobs:
         shell: bash
         working-directory: nim-beacon-chain
         run: |
+          if [[ "${{ runner.os }}" == "macOS" ]]; then
+            ulimit -n 1024
+          fi
           make -j$ncpu ARCH_OVERRIDE=$PLATFORM DISABLE_TEST_FIXTURES_SCRIPT=1 test
 
       # The upload creates a combined report that gets posted as a comment on the PR

.github/workflows/release.yml

@@ -178,9 +178,63 @@ jobs:
           name: Windows_amd64_checksum
           path: ./dist/${{ steps.make_dist.outputs.archive_dir }}/build/nimbus_beacon_node.sha512sum
           retention-days: 2
+  build-macos-amd64:
+    name: macOS AMD64 release asset
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - name: Build project
+        id: make_dist
+        run: |
+          make dist-macos
+          cd dist
+          ARCHIVE=$(echo nimbus-eth2_macOS_amd64_*.tar.gz)
+          echo "::set-output name=archive::"${ARCHIVE}
+          echo "::set-output name=archive_dir::"${ARCHIVE%.tar.gz}
+          tar -xzf ${ARCHIVE} ${ARCHIVE%.tar.gz}/build/nimbus_beacon_node.sha512sum
+      - name: Upload archive artefact
+        uses: actions/upload-artifact@v2
+        with:
+          name: macOS_amd64_archive
+          path: ./dist/${{ steps.make_dist.outputs.archive }}
+          retention-days: 2
+      - name: Upload checksum artefact
+        uses: actions/upload-artifact@v2
+        with:
+          name: macOS_amd64_checksum
+          path: ./dist/${{ steps.make_dist.outputs.archive_dir }}/build/nimbus_beacon_node.sha512sum
+          retention-days: 2
+  build-macos-arm64:
+    name: macOS ARM64 release asset
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - name: Build project
+        id: make_dist
+        run: |
+          make dist-macos-arm64
+          cd dist
+          ARCHIVE=$(echo nimbus-eth2_macOS_arm64_*.tar.gz)
+          echo "::set-output name=archive::"${ARCHIVE}
+          echo "::set-output name=archive_dir::"${ARCHIVE%.tar.gz}
+          tar -xzf ${ARCHIVE} ${ARCHIVE%.tar.gz}/build/nimbus_beacon_node.sha512sum
+      - name: Upload archive artefact
+        uses: actions/upload-artifact@v2
+        with:
+          name: macOS_arm64_archive
+          path: ./dist/${{ steps.make_dist.outputs.archive }}
+          retention-days: 2
+      - name: Upload checksum artefact
+        uses: actions/upload-artifact@v2
+        with:
+          name: macOS_arm64_checksum
+          path: ./dist/${{ steps.make_dist.outputs.archive_dir }}/build/nimbus_beacon_node.sha512sum
+          retention-days: 2
   prepare-release:
     name: Prepare release draft
-    needs: [build-amd64, build-arm64, build-arm, build-win64]
+    needs: [build-amd64, build-arm64, build-arm, build-win64, build-macos-amd64, build-macos-arm64]
     runs-on: ubuntu-latest
     steps:
       - name: Download artefacts
@@ -202,6 +256,10 @@ jobs:
           cat Linux_arm_checksum/* >> release_notes.md
           echo '# Windows AMD64' >> release_notes.md
           cat Windows_amd64_checksum/* >> release_notes.md
+          echo '# macOS AMD64' >> release_notes.md
+          cat macOS_amd64_checksum/* >> release_notes.md
+          echo '# macOS ARM64' >> release_notes.md
+          cat macOS_arm64_checksum/* >> release_notes.md
           echo '```' >> release_notes.md
       - name: Create release
         id: create_release
@@ -217,6 +275,8 @@ jobs:
             Linux_arm64_archive/*
             Linux_arm_archive/*
             Windows_amd64_archive/*
+            macOS_amd64_archive/*
+            macOS_arm64_archive/*
       - name: Delete artefacts
         uses: geekyeggo/delete-artifact@v1
         with:
@@ -230,4 +290,8 @@ jobs:
             Linux_arm_checksum
             Windows_amd64_archive
             Windows_amd64_checksum
+            macOS_amd64_archive
+            macOS_amd64_checksum
+            macOS_arm64_archive
+            macOS_arm64_checksum
 

CHANGELOG.md

@@ -1,37 +1,37 @@
 2021-05-17 v1.3.0
 =================
 
-A new release offering safer and easier options for migrating to Nimbus from
-other clients and bringing further performance optimizations.
+This release offers safer and easier options to migrate to Nimbus from other clients.
+It also brings further performance optimizations.
 
-**New features:**
+**We've added:**
 
-* A new `slashingdb` sub-command offering import and export options for the
-  EIP-3076 slashing protection interchange format. Please see the the prepared
-  [migration guides](https://nimbus.guide/migrate.html) outlining the safest
-  way to migrate to Nimbus from other clients.
+* A new `slashingdb` sub-command with `import` and `export` options. This allows for
+  safely migrating to Nimbus from another client (as per the [EIP-3076](https://eips.ethereum.org/EIPS/eip-3076) slashing
+  protection interchange format).
+  Please see the the newly prepared [migration guides](https://nimbus.guide/migrate.html) for the details.
 
-* Pruning of the slashing protection database and transition to more optimal
-  queries *->* significant reduction of disk and CPU usage on nodes running
-  large number of validators.
+* Pruning of the slashing protection database and a transition to more optimal
+  queries. This results in a significant reduction in both disk and CPU usage
+  on nodes running a large number of validators.
 
 * More consistent level of validation for the attestations received from
-  third-party sources and the JSON-RPC and REST APIs, preventing invalid
-  attestations to be broadcasted to the network.
+  third-party sources and the JSON-RPC and REST APIs. This prevents invalid
+  attestations from being broadcasted to the network.
 
 * Performance tuning of attestation subnet transition timings and state
-  snapshotting intervals *->* improved CPU and bandwidth usage.
+  snapshotting intervals. This results in improved CPU and bandwidth usage.
+
+* A new `ncli_db validatorPerf` command. This can be used to perform a textual
+  report for the attestation performance of a particular validator
+  (please note that `ncli_db` is available only when compiling from source).
+
+* Official binaries for macOS (AMD64 and ARM64).
 
 **We've fixed:**
 
-* Problems in the GossipSub subnet walking logic leading to unnecessary
-  bandwidth and CPU costs.
-
-**New tools:**
-
-* A new `ncli_db validatorPerf` command for producing a textual report for the
-  attestation performance of a particular validator (please note that `ncli_db`
-  is available only when compiling from source).
+* Problems in the GossipSub subnet walking logic leading to unnecessary bandwidth
+  and CPU costs.
 
 
 2021-05-03 v1.2.2

Makefile

@@ -85,6 +85,8 @@ TOOLS_CSV := $(subst $(SPACE),$(COMMA),$(TOOLS))
 	dist-arm64 \
 	dist-arm \
 	dist-win64 \
+	dist-macos \
+	dist-macos-arm64 \
 	dist \
 	benchmarks
 
@@ -582,11 +584,21 @@ dist-win64:
 	+ MAKE="$(MAKE)" \
 		scripts/make_dist.sh win64
 
+dist-macos:
+	+ MAKE="$(MAKE)" \
+		scripts/make_dist.sh macos
+
+dist-macos-arm64:
+	+ MAKE="$(MAKE)" \
+		scripts/make_dist.sh macos-arm64
+
 dist:
 	+ $(MAKE) dist-amd64
 	+ $(MAKE) dist-arm64
 	+ $(MAKE) dist-arm
 	+ $(MAKE) dist-win64
+	+ $(MAKE) dist-macos
+	+ $(MAKE) dist-macos-arm64
 
 #- this simple test will show any missing dynamically-linked Glibc symbols in the target distro
 dist-test:

config.nims

@@ -1,3 +1,5 @@
+import strutils
+
 const nimCachePathOverride {.strdefine.} = ""
 when nimCachePathOverride == "":
   when defined(release):
@@ -79,8 +81,7 @@ switch("define", "withoutPCRE")
 
 switch("import", "testutils/moduletests")
 
-const useLibStackTrace = not defined(macosx) and
-                         not defined(windows) and
+const useLibStackTrace = not defined(windows) and
                          not defined(disable_libbacktrace)
 
 when useLibStackTrace:
@@ -90,9 +91,25 @@ else:
   --stacktrace:on
   --linetrace:on
 
-# the default open files limit is too low on macOS (512), breaking the
-# "--debugger:native" build. It can be increased with `ulimit -n 1024`.
-if not defined(macosx):
+var canEnableDebuggingSymbols = true
+if defined(macosx):
+  # The default open files limit is too low on macOS (512), breaking the
+  # "--debugger:native" build. It can be increased with `ulimit -n 1024`.
+  let openFilesLimitTarget = 1024
+  var openFilesLimit = 0
+  try:
+    openFilesLimit = staticExec("ulimit -n").strip(chars = Whitespace + Newlines).parseInt()
+    if openFilesLimit < openFilesLimitTarget:
+      echo "Open files limit too low to enable debugging symbols and lightweight stack traces."
+      echo "Increase it with \"ulimit -n " & $openFilesLimitTarget & "\""
+      canEnableDebuggingSymbols = false
+  except:
+    echo "ulimit error"
+# We ignore this resource limit on Windows, where a default `ulimit -n` of 256
+# in Git Bash is apparently ignored by the OS, and on Linux where the default of
+# 1024 is good enough for us.
+
+if canEnableDebuggingSymbols:
   # add debugging symbols and original files and line numbers
   --debugger:native
 

docker/dist/Dockerfile.macos

@@ -0,0 +1,18 @@
+# The build is reproducible only if this base image stays the same.
+FROM statusteam/nimbus_beacon_node:dist_base_20210513160553_macos@sha256:eef4aff594307c0ff615160aa7184b3660648ce929bb670a409428fc32bd04ed
+
+SHELL ["/bin/bash", "-c"]
+
+ARG USER_ID
+ARG GROUP_ID
+
+RUN addgroup --gid ${GROUP_ID} user; \
+	adduser --disabled-password --gecos '' --uid ${USER_ID} --gid ${GROUP_ID} user;
+
+USER user
+
+STOPSIGNAL SIGINT
+
+COPY "entry_point.sh" "/home/user/"
+ENTRYPOINT ["/home/user/entry_point.sh", "macOS_amd64"]
+

docker/dist/Dockerfile.macos-arm64

@@ -0,0 +1,18 @@
+# The build is reproducible only if this base image stays the same.
+FROM statusteam/nimbus_beacon_node:dist_base_20210513160553_macos@sha256:eef4aff594307c0ff615160aa7184b3660648ce929bb670a409428fc32bd04ed
+
+SHELL ["/bin/bash", "-c"]
+
+ARG USER_ID
+ARG GROUP_ID
+
+RUN addgroup --gid ${GROUP_ID} user; \
+	adduser --disabled-password --gecos '' --uid ${USER_ID} --gid ${GROUP_ID} user;
+
+USER user
+
+STOPSIGNAL SIGINT
+
+COPY "entry_point.sh" "/home/user/"
+ENTRYPOINT ["/home/user/entry_point.sh", "macOS_arm64"]
+

docker/dist/README.md

@@ -1,7 +1,7 @@
 # Binary Nimbus beacon node distribution
 
 This binary distribution of the Nimbus eth2 package is compiled
-in [reproducible way](https://reproducible-builds.org/) from source files
+in a [reproducible way](https://reproducible-builds.org/) from source files
 hosted at https://github.com/status-im/nimbus-eth2.
 
 The tarball containing this README uses the following naming scheme:

docker/dist/base_image/Dockerfile.macos

@@ -0,0 +1,24 @@
+# This Docker image can change from one build to another, because the upstream
+# Debian/Ubuntu package index is continuously updated and we have to run
+# `apt-get update` in here.
+#
+# The only way to make this a part of our reproducible build system is to build
+# it once, upload it to Docker Hub and make sure it's being pulled regularly so
+# it's not deleted after 6 months of inactivity.
+
+FROM ubuntu:20.04
+
+SHELL ["/bin/bash", "-c"]
+
+ENV DEBIAN_FRONTEND=noninteractive TZ="Etc/UTC"
+RUN apt-get -qq update \
+ && apt-get -qq -y install build-essential git clang-11 llvm-11-dev cmake curl libssl-dev lzma-dev libxml2-dev &>/dev/null \
+ && update-alternatives --install /usr/bin/clang clang /usr/bin/clang-11 100 \
+ && update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-11 100 \
+ && apt-get -qq clean \
+ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+COPY "build_osxcross.sh" "/root/"
+RUN cd /root \
+ && ./build_osxcross.sh
+

docker/dist/base_image/Makefile

@@ -8,10 +8,12 @@ IMAGE_NAME := statusteam/nimbus_beacon_node:$(IMAGE_TAG)
 	build-arm64 \
 	build-arm \
 	build-win64 \
+	build-macos \
 	push-amd64 \
 	push-arm64 \
 	push-arm \
-	push-win64
+	push-win64 \
+	push-macos
 
 build-amd64:
 	$(CURDIR)/make_base_image.sh amd64 "$(IMAGE_NAME)"
@@ -25,6 +27,9 @@ build-arm:
 build-win64:
 	$(CURDIR)/make_base_image.sh win64 "$(IMAGE_NAME)_win64"
 
+build-macos:
+	$(CURDIR)/make_base_image.sh macos "$(IMAGE_NAME)_macos"
+
 # You probably don't want to recreate and push these base images to Docker Hub,
 # because when older images expire and get deleted, it will no longer be possible
 # to reproduce old releases.
@@ -41,3 +46,6 @@ build-win64:
 #push-win64: build-win64
 #	docker push $(IMAGE_NAME)_win64
 
+#push-macos: build-macos
+	#docker push $(IMAGE_NAME)_macos
+

docker/dist/base_image/build_osxcross.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -e
+
+
+git clone https://github.com/tpoechtrager/osxcross.git
+
+# macOS SDK
+cd osxcross/tarballs
+MACOS_SDK_VER="11.3"
+MACOS_SDK_TARBALL="MacOSX${MACOS_SDK_VER}.sdk.tar.xz"
+curl -OLsS https://github.com/phracker/MacOSX-SDKs/releases/download/${MACOS_SDK_VER}/${MACOS_SDK_TARBALL}
+cd ..
+
+# build OSXCross toolchain
+export TARGET_DIR="/opt/osxcross"
+UNATTENDED=1 ./build.sh
+# "tools/osxcross_conf.sh" ignores TARGET_DIR and uses "target" instead, so do a symlink
+ln -s ${TARGET_DIR} target
+./build_llvm_dsymutil.sh
+# ridiculous amount of uncompressed man pages
+rm -rf ${TARGET_DIR}/SDK/MacOSX${MACOS_SDK_VER}.sdk/usr/share
+
+# cleanup
+cd ..
+rm -rf osxcross
+

docker/dist/entry_point.sh

@@ -90,6 +90,66 @@ elif [[ "${PLATFORM}" == "Linux_arm64v8" ]]; then
     NIMFLAGS="-d:disableMarchNative -d:chronicles_sinks=textlines -d:chronicles_colors=none --cpu:arm64 --gcc.exe=${CC} --gcc.linkerexe=${CC}" \
     PARTIAL_STATIC_LINKING=1 \
     ${BINARIES}
+elif [[ "${PLATFORM}" == "macOS_amd64" ]]; then
+  export PATH="/opt/osxcross/bin:${PATH}"
+  export OSXCROSS_MP_INC=1 # sets up include and library paths
+  export ZERO_AR_DATE=1 # avoid timestamps in binaries
+  DARWIN_VER="20.4"
+  CC="o64-clang"
+  make \
+    -j$(nproc) \
+    USE_LIBBACKTRACE=0 \
+    QUICK_AND_DIRTY_COMPILER=1 \
+    deps-common build/generate_makefile
+  make \
+    -j$(nproc) \
+    CC="${CC}" \
+    LIBTOOL="x86_64-apple-darwin${DARWIN_VER}-libtool" \
+    OS="darwin" \
+    NIMFLAGS="-d:disableMarchNative -d:chronicles_sinks=textlines -d:chronicles_colors=none --os:macosx --clang.exe=${CC}" \
+    nat-libs
+  make \
+    -j$(nproc) \
+    LOG_LEVEL="TRACE" \
+    CC="${CC}" \
+    AR="x86_64-apple-darwin${DARWIN_VER}-ar" \
+    RANLIB="x86_64-apple-darwin${DARWIN_VER}-ranlib" \
+    CMAKE="x86_64-apple-darwin${DARWIN_VER}-cmake" \
+    DSYMUTIL="x86_64-apple-darwin${DARWIN_VER}-dsymutil" \
+    FORCE_DSYMUTIL=1 \
+    USE_VENDORED_LIBUNWIND=1 \
+    NIMFLAGS="-d:disableMarchNative -d:chronicles_sinks=textlines -d:chronicles_colors=none --os:macosx --clang.exe=${CC} --clang.linkerexe=${CC}" \
+    ${BINARIES}
+elif [[ "${PLATFORM}" == "macOS_arm64" ]]; then
+  export PATH="/opt/osxcross/bin:${PATH}"
+  export OSXCROSS_MP_INC=1 # sets up include and library paths
+  export ZERO_AR_DATE=1 # avoid timestamps in binaries
+  DARWIN_VER="20.4"
+  CC="oa64-clang"
+  make \
+    -j$(nproc) \
+    USE_LIBBACKTRACE=0 \
+    QUICK_AND_DIRTY_COMPILER=1 \
+    deps-common build/generate_makefile
+  make \
+    -j$(nproc) \
+    CC="${CC}" \
+    LIBTOOL="arm64-apple-darwin${DARWIN_VER}-libtool" \
+    OS="darwin" \
+    NIMFLAGS="-d:disableMarchNative -d:chronicles_sinks=textlines -d:chronicles_colors=none --os:macosx --cpu:arm64 --clang.exe=${CC}" \
+    nat-libs
+  make \
+    -j$(nproc) \
+    LOG_LEVEL="TRACE" \
+    CC="${CC}" \
+    AR="arm64-apple-darwin${DARWIN_VER}-ar" \
+    RANLIB="arm64-apple-darwin${DARWIN_VER}-ranlib" \
+    CMAKE="arm64-apple-darwin${DARWIN_VER}-cmake" \
+    DSYMUTIL="arm64-apple-darwin${DARWIN_VER}-dsymutil" \
+    FORCE_DSYMUTIL=1 \
+    USE_VENDORED_LIBUNWIND=1 \
+    NIMFLAGS="-d:disableMarchNative -d:chronicles_sinks=textlines -d:chronicles_colors=none --os:macosx --cpu:arm64 --clang.exe=${CC} --clang.linkerexe=${CC}" \
+    ${BINARIES}
 else
   make \
     -j$(nproc) \
@@ -119,6 +179,10 @@ mkdir "${DIST_PATH}/build"
 # copy and checksum binaries, copy scripts and docs
 for BINARY in ${BINARIES}; do
   cp -a "./build/${BINARY}" "${DIST_PATH}/build/"
+  if [[ "${PLATFORM}" =~ macOS ]]; then
+    # debug info
+    cp -a "./build/${BINARY}.dSYM" "${DIST_PATH}/build/"
+  fi
   cd "${DIST_PATH}/build"
   sha512sum "${BINARY}" > "${BINARY}.sha512sum"
   if [[ "${PLATFORM}" == "Windows_amd64" ]]; then
@@ -137,6 +201,10 @@ elif [[ "${PLATFORM}" == "Linux_arm64v8" ]]; then
 elif [[ "${PLATFORM}" == "Windows_amd64" ]]; then
   sed -i -e 's/^make dist$/make dist-win64/' "${DIST_PATH}/README.md"
   cp -a docker/dist/README-Windows.md "${DIST_PATH}/"
+elif [[ "${PLATFORM}" == "macOS_amd64" ]]; then
+  sed -i -e 's/^make dist$/make dist-macos/' "${DIST_PATH}/README.md"
+elif [[ "${PLATFORM}" == "macOS_arm64" ]]; then
+  sed -i -e 's/^make dist$/make dist-macos-arm64/' "${DIST_PATH}/README.md"
 fi
 
 cp -a scripts/run-beacon-node.sh "${DIST_PATH}/scripts"

scripts/compile_nim_program.sh

@@ -26,3 +26,7 @@ build/generate_makefile "nimcache/release/${BINARY}/${PROJECT_NAME}.json" "nimca
 [[ "$V" == "0" ]] && exec &>/dev/null
 "${MAKE}" -f "nimcache/release/${BINARY}/${BINARY}.makefile" --no-print-directory build
 
+if uname | grep -qi darwin || [[ -n "${FORCE_DSYMUTIL}" ]]; then
+  [[ -z "${DSYMUTIL}" ]] && DSYMUTIL="dsymutil"
+  "${DSYMUTIL}" build/${BINARY}
+fi

scripts/make_dist.sh

@@ -30,7 +30,8 @@ DOCKER_BUILDKIT=1 \
   --build-arg GROUP_ID=$(id -g) \
   -f Dockerfile.${ARCH} .
 
-docker run --rm --name ${DOCKER_TAG} -v ${REPO_DIR}:/home/user/nimbus-eth2 ${DOCKER_TAG}
+# seccomp can have some serious overhead, so we disable it with "--privileged" - https://pythonspeed.com/articles/docker-performance-overhead/
+docker run --privileged --rm --name ${DOCKER_TAG} -v ${REPO_DIR}:/home/user/nimbus-eth2 ${DOCKER_TAG}
 
 cd - &>/dev/null
 

vendor/nim-libbacktrace

@@ -1 +1 @@
-Subproject commit ce966b1c469dda179b54346feaaf1a62202c984f
+Subproject commit 63196b0628fd6742a9467842f771d3b1ed1fb803