add Apple SDK download to gitian-build.py #14539

Add Apple SDK to macos build stage. This would provide easier approach to the builds.

Concept ACK. I didn't even know we were hosting this file.

It's a lot easier than the instructions here: https://github.com/bitcoin-core/docs/blob/master/gitian-building/gitian-building-mac-os-sdk.md#macos-host

macOS doesn't have sha256sum by default, so it's better to use shashum -a 256. It also needs a double space:

echo 'bec9d089ebf2e2dd59b1a811a38ec78ebd5da18cbbcd6ab39d1e59f64ac5033f  inputs/MacOSX10.11.sdk.tar.gz' | shasum -a 256 -c

The checksum bec9d089ebf2e2dd59b1a811a38ec78ebd5da18cbbcd6ab39d1e59f64ac5033f matches the download from bitcoincore.org, but it does not match the version I obtained from Apple and extracted some time ago (3df21687a963d46e2356f6df2ab4ec72b05a993a132a797884aaefe7d924e3ed). Maybe that process wasn't deterministic.

NACK. People need to download the SDK from Apple and convert it to the tar.gz themselves. This is for two reasons: 1) security, not trusting some opaque blob provided by the project, and 2) we don't even have a license to distribute this file last I checked (it's full of Apple-copyrighted stuff).

We're not hosting the file for people to download, only as an internal thing for Travis to run with it. If people start downloading it, we might need to rename or IP-lock fetches.

The process of converting the SDK to a tar.gz is not intended to be deterministic.

(Also, if it turns out people are using someone else's SDK, we should probably check their gitian signatures and reject them, since reused SDKs defeat the point of the process...)

NACK. Agree with @luke-jr

@luke-jr I had the same feeling about the SDK, but then I spotted it on the server and thought maybe something is changed along with clang

@luke-jr: your point 1): is there a different (on security) compared to download the clang compiler?

@jonasschnelli Downloading from a vendor vs downloading from someone involved in Bitcoin.

@jonasschnelli there is a point here since you can not really verify how tar was packed, besides the fact that it is hosted on official project domain. think it would be right to close this for now.

Sorry for the duplicate posts; Github was giving me error messages.

Agree with @luke-jr.

We could however make it marginally easier to automatically download and extract the thing from Apple. Dealing with their 2FA in a Python script is not a good idea, but the script could pause and tell the user "Login to your Apple account and download the following URL to [here]"

@Sjors theres xcode-install, but apple has no method for authentication on their website that could fit in a script, and they not planning to change that