Haxe binaries for ceramic, put in a git repository to fetch it as a submodule of ceramic
After dropping in a new Haxe/Neko release, run both scripts. They are idempotent, so re-running them on an already-correct tree is a no-op.
./fix-linux-binaries.sh # RUNPATH -> $ORIGIN/../neko (needs patchelf)
./fix-mac-binaries.sh # @rpath -> @executable_path/../neko + Developer ID signingfix-linux-binaries.sh runs on Linux and macOS (patchelf edits ELF files
from any host). fix-mac-binaries.sh must run on macOS, on a machine holding
the "Developer ID Application" certificate and its private key; override the
identity with SIGN_IDENTITY=... if you sign for a different team.
Upstream ships haxelib binary without a usable library search path, on every platform:
| shipped RPATH/RUNPATH | correct? | |
|---|---|---|
mac/haxe/haxelib-bin |
/usr/local/lib only |
no |
linux-*/haxe/haxelib-bin |
none at all | no |
every neko/* tool |
@executable_path/ / $ORIGIN first |
yes |
So haxelib finds libneko only if a matching one happens to be installed
system-wide. On macOS that is worse than a missing library: haxelib-bin is
signed with the hardened runtime, and library validation rejects any dylib
whose Team ID differs from the process's, so a Homebrew libneko makes it
abort outright.
The wrapper scripts also export LD_LIBRARY_PATH/DYLD_FALLBACK_LIBRARY_PATH
as a second line of defence. Note that DYLD_* variables are stripped for
hardened-runtime binaries, which is why the macOS fix has to be baked into the
binary itself.