Surround SCM 2015.02 on macOS 10.12

Life is not easy for any of us. But what of that? We must have perseverance and above all confidence in ourselves. We must believe that we are gifted for something and that this thing must be attained.
    - Marie Curie

Surround SCM is an enterprise level configuration management tool.  I'm not a huge fan, but we use it at work and my new machine is a 2016 MBP.  After properly configuring our VPN (another blog post, perhaps), I needed to get access to SCM. We don't have a current license, so we are stuck with using 2015.02.  Seapine's instruction aren't really that helpful because they tell you to disable SIP. In this post, I've outlined exactly what you need to do to get it installed and running without disabling SIP.


tl;dr: Install Surround SCM, build and install patched version of Qt 4.8.6, update lib paths in Surround SCM binary using install_name_tool, edit Surround SCM Client.app/Info.plist, and you're done.

Initial SCM Installation

A copy of the installer for macOS should be in the install directory for the SCM server: sscm.osx.2015000218.zip, which contains one file sscmosxclientinstaller.app.

In order to run the installer, you have to first install JSE 6... It took me a while to find an installer, but I eventually stumbled onto this support site: https://support.apple.com/kb/DL1572. Once you've installed the JSE 6 from that support page, you can install Surround SCM.

Run the installer as root:

sudo ./sscmosxclientinstaller.app

You should now see a Surround SCM folder in your /Applications directory.  At this point, you could attempt to run it, and you would be met by a fun error dialog telling you that the program failed to run!

Fixup #1

Turns out, that the software package attempts to install QT 4.8 into /usr/lib/seapine/scm/Frameworks.  Well, on macOS Sierra, a little something called SIP (System Integrity Protection) prevents anyone, including you as sudo, from writing to certain areas of the file system, /usr/lib/ included (you can write to /usr/local, though). This isn't necessarily a bad things for regular users... but it's a bit of an issue for us when trying to install legacy packages that would otherwise work!

SIP can be disabled and re-enabled in the Recovery OS.  I decided not to do this because I wanted to see if it was possible to fix the installation without going around SIP.
Luckily, we have the tools necessary to change the Surround SCM executable so that it attempts to find the Qt4 framework from another location!

cd /Applications/Surround\ SCM/Surround\ SCM\ Client.app/Content/MacOS/

for f in $(otool -L Surround\ SCM | grep /usr/lib/seapine | awk '{print $1}')
do
 new=$(echo $f | sed 's|/usr/lib/seapine/scm|/usr/local/Trolltech/Qt-4.8.6/lib/|')
 install_name_tool -change $f $new Surround\ SCM
done

This bash loop will iterate over all the library paths that _should_ have been in /usr/lib/seapine/scm and it will rework the path to point to a user library installed into /usr/local/Trolltech/Qt-4.8.6/lib/.  Originally, this was going to be a cake-walk, but unfortunately, Seapine seems to be shipping a modified Qt 4.8.6... so we have to apply a few patches for compatibility.

Qt 4.8.6 source tarball can be found here: https://download.qt.io/archive/qt/4.8/4.8.6/qt-everywhere-opensource-src-4.8.6.tar.gz

There is one compile error when configured properly with -no-phonon if you try to build it straight.  So, make sure you apply the patches first. The path adds two library exports (QT_GUI_EXPORT) that Seapine apparently uses... The other change is a deprecated system API (the code for the deprecated API can be found several places on the web).

--- a/./src/gui/kernel/qcocoaapplication_mac_p.h        2014-04-10 13:37:12.000000000 -0500
+++ b/./src/gui/kernel/qcocoaapplication_mac_p.h        2017-04-13 12:46:59.000000000 -0500
@@ -104,6 +104,7 @@
 - (BOOL)QT_MANGLE_NAMESPACE(qt_filterEvent):(NSEvent *)event;
 @end

+Q_GUI_EXPORT
 @interface QT_MANGLE_NAMESPACE(QNSApplication) : NSApplication {
 }
 @end
--- a/./src/gui/kernel/qcocoawindow_mac_p.h     2014-04-10 13:37:12.000000000 -0500
+++ b/./src/gui/kernel/qcocoawindow_mac_p.h     2017-04-12 10:31:06.000000000 -0500
@@ -81,6 +81,8 @@
 - (BOOL)performDragOperation:(id )sender;
 @end

+
+Q_GUI_EXPORT
 @interface QT_MANGLE_NAMESPACE(QCocoaWindow) : NSWindow {
     QStringList *currentCustomDragTypes;
     QCocoaDropData *dropData;
--- a/./src/gui/painting/qpaintengine_mac.cpp   2014-04-10 13:37:12.000000000 -0500
+++ b/./src/gui/painting/qpaintengine_mac.cpp   2017-04-12 01:25:07.000000000 -0500
@@ -340,13 +340,7 @@
     }

     // Get the color space from the display profile.
-    CGColorSpaceRef colorSpace = 0;
-    CMProfileRef displayProfile = 0;
-    CMError err = CMGetProfileByAVID((CMDisplayIDType)displayID, &displayProfile);
-    if (err == noErr) {
-        colorSpace = CGColorSpaceCreateWithPlatformColorSpace(displayProfile);
-        CMCloseProfile(displayProfile);
-    }
+    CGColorSpaceRef colorSpace = CGDisplayCopyColorSpace(displayID);

     // Fallback: use generic DeviceRGB
     if (colorSpace == 0)

Simple enough.  So, now to patch, configure, compile, and install Qt 4.8.6:

tar xf qt-everywhere-opensource-src-4.8.6.tar.gz
cd qt-everywhere-opensource-src-4.8.6/

# Grab the patch-set. Fixups for deprecation and some missing exports.
curl https://gist.githubusercontent.com/zv1n/5e1f19bcf5bd5d502d5737ce2a03ba05/raw/4de311e35214d1dfa0dd31262b28231b6745163b/qt_surroundscm_exports.patch > qt_486_scm.patch
patch -p1 < qt_486_scm.patch

# Disable phonon - it fails to build due to QTKit being remove from Frameworks in macOS 10.12.
./configure -no-phonon -no-phonon-backend -release

make -j9
sudo make install

Voila!

Now, if you try to run Surround SCM it'll still fail to run! Seriously, this is getting old.  Check out the error report and it indicates that the system libs are the wrong architecture!

Fixup #2

Okay, let's see why it's trying to run as a 32bit application. Open /Applications/Surround\ SCM/Surround\ SCM\ Client.app/Contents/Info.plist.  Find the key LSArchitecturePriority, under the key you should see i386 listed before x86_64.   I removed i386 altogether, but I'm pretty sure just reordering the items would fix the issue as well (see the update below; this is a fat binary).

Alright, now that we're configured for 64bit, lets try to kick-off Surround SCM Client.app again.

Boom!

Update 4/17:

A friend on the FLARE team at FireEye, strictlymike, asked if it was a fat binary. To check this, run:

xxd -l 4 /Applications/Surround\ SCM/Surround\ SCM\ Client.app/Contents/MacOS/Surround\ SCM

In this case, yes the Surround SCM executable is a fat binary:

00000000: cafe babe                                                      ....

This means that you may be able to get away with compiling Qt 4.8.6 for 32bit if you wanted, provided macOS Sierra still has system dependencies in fat binary format with both i386 and x86_64. Thanks, Mike!