6c70d7ccb8
The Windows installer and the pip wheel were both shipping web/yarn.lock, web/package.json and the rest of the JavaScript build configuration into the installed tree, even though none of it is used at runtime: only the webpack output under pgadmin/static/js/generated is. Because node_modules is stripped, the lockfile that remains describes packages that are not present, so vulnerability scanners run against an installation report the whole build-time dependency tree, devDependencies included, as findings that cannot be acted on and will recur on every release no matter how current the versions are. The Linux, macOS and Docker builds already removed these files, so this brings Windows and pip into line with them, and adds webpack.* to the Linux and macOS lists so that all of the packagers now strip the same set. For pip the cleanup runs before syft, so the SBOM describes what actually ships. Verified by assembling a web tree with the cleanup applied and starting pgAdmin from it: /misc/ping and /browser/ both return 200 and every generated bundle is served.
pgAdmin macOS Builds
Required Packages
Either build the sources or get them from macports or similar:
-
Yarn & NodeJS
-
PostgreSQL 12 or above from http://www.postgresql.org/
-
Python 3.6+ (required for building). The build environment should run this version of python in response to the python command.
Building
-
To bundle a different version of Python from the default of 3.14.7, set the PGADMIN_PYTHON_VERSION environment variable, e.g:
export PGADMIN_PYTHON_VERSION=3.13.11 -
If a path different from the default of /usr/local/pgsql for the PostgreSQL installation has been used, set the PGADMIN_POSTGRES_DIR environment variable appropriately, e.g:
export PGADMIN_POSTGRES_DIR=/opt/local/pgsql -
If you want to codesign the appbundle, copy codesign.conf.in to codesign.conf and set the values accordingly.
-
If you want to notarize the appbundle, copy notarization.conf.in to notarization.conf and set the values accordingly. Note that notarization will fail if the code isn't signed.
-
To build only DMG file, go to pgAdmin4 source root directory and execute:
make appbundleTo build both DMG and ZIP files, go to pgAdmin4 source root directory and execute:
make appbundle BUILD_OPTS="--zip"This will create the python virtual environment and install all the required python modules mentioned in the requirements file using pip, build the runtime code and finally create the app bundle and the DMG and/or ZIP in ./dist directory.