Build universal2 if Python running is universal.

.github/workflows/macos.yml

@@ -6,11 +6,6 @@ jobs:
   build:
 
     runs-on: macos-latest
-    env:
-      MACOSX_DEPLOYMENT_TARGET: "10.15"
-      CFLAGS: -arch x86_64 -arch arm64
-      ARCHFLAGS: -arch x86_64 -arch arm64
-      CMAKE_OSX_ARCHITECTURES: arm64;x86_64
 
     steps:
     - uses: actions/checkout@v3

build-helper.sh

@@ -27,6 +27,9 @@ if [ "$OS" = "macos" ]; then
 	echo "Using Python: $PYTHON"
 	if [ $(lipo -archs $PYTHON | grep -c 'x86_64 arm64') -ne 0 ]; then
 		echo "Fixing single-arch dependencies..."
+		export MACOSX_DEPLOYMENT_TARGET="10.15"
+		export CFLAGS="-arch x86_64 -arch arm64"
+		export ARCHFLAGS="-arch x86_64 -arch arm64"
 		HELPER="../$OUTPUT/helper"
 		rm -rf $HELPER
 		mkdir -p $HELPER

helper/authenticator-helper.spec

@@ -1,4 +1,6 @@
 # -*- mode: python ; coding: utf-8 -*-
+import sys
+import subprocess
 
 
 block_cipher = None
@@ -21,6 +23,13 @@ a = Analysis(
 )
 pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
 
+target_arch = None
+# MacOS: If the running Python process is "universal", build a univeral2 binary.
+if sys.platform == "darwin":
+    r = subprocess.run(['lipo', '-archs', sys.executable], capture_output=True).stdout
+    if b"x86_64" in r and b"arm64" in r:
+        target_arch = "universal2"
+
 exe = EXE(
     pyz,
     a.scripts,
@@ -36,7 +45,7 @@ exe = EXE(
     manifest="authenticator-helper.exe.manifest",
     version="version_info.txt",
     disable_windowed_traceback=False,
-    target_arch="universal2",
+    target_arch=target_arch,
     codesign_identity=None,
     entitlements_file=None,
 )