Notarize app in afterSign script on macOS. Fixes #129

.travis.env.example

@@ -1,2 +1,4 @@
 export CSC_LINK="base64 encoded data for a Developer ID Application cert and key in .p12 format"
 export CSC_KEY_PASSWORD="passphrase for the .p12 package"
+export APPLEID="[email protected]"
+export APPLEIDPASS="needed-for-notarizing"

build/entitlements.mac.plist

@@ -2,8 +2,12 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
+    <!-- https://github.com/electron/electron-notarize#prerequisites -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
     <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
     <true/>
+    <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
   </dict>

docs/SigningConfig.md

@@ -1,9 +1,6 @@
 Signing on macOS is a bit in flux atm. 
 
 https://github.com/electron-userland/electron-builder/issues/3870
-https://github.com/electron-userland/electron-builder/issues/3940
-https://github.com/electron-userland/electron-builder/issues/3828
-https://github.com/electron-userland/electron-builder/issues/3908
 https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/
 
 Config settings related to this are in electron-builder.json
@@ -12,11 +9,10 @@ Config settings related to this are in electron-builder.json
     "mac": {
         "hardenedRuntime" : true,
         "gatekeeperAssess": false,
-        "entitlements": {
-          "entitlements": "build/entitlements.mac.plist",
-          "entitlementsInherit": "build/entitlements.mac.plist"
-        }
+        "entitlements": "build/entitlements.mac.plist",
+        "entitlementsInherit": "build/entitlements.mac.plist"
     },
+    "afterSign": "./scripts/notarize.js",
     "dmg": {
         "sign": false
     }

electron-builder.json

@@ -15,6 +15,11 @@
     "entitlements": "build/entitlements.mac.plist",
     "entitlementsInherit": "build/entitlements.mac.plist"
   },
+  "afterSign": "./scripts/notarize.js",
+  "dmg": {
+    "icon": null,
+    "sign": false
+  },
   "mas": {
     "publish": null
   },
@@ -44,10 +49,6 @@
   "nsisWeb": {
     "artifactName": "${productName}.${ext}"
   },
-  "dmg": {
-    "icon": null,
-    "sign": false
-  },
   "protocols": [
     {
       "name": "IRC server URL",

package.json

@@ -48,6 +48,7 @@
     "electron-dl": "^3.0.0",
     "electron-is": "^3.0.0",
     "electron-log": "^4.0.6",
+    "electron-notarize": "^0.2.1",
     "electron-store": "^5.1.0",
     "electron-updater": "^4.2.0",
     "getos": "^3.1.4",

scripts/notarize.js

@@ -0,0 +1,17 @@
+const { notarize } = require('electron-notarize');
+
+exports.default = async function notarizing(context) {
+  const { electronPlatformName, appOutDir } = context;  
+  if (electronPlatformName !== 'darwin') {
+    return;
+  }
+
+  const appName = context.packager.appInfo.productFilename;
+
+  return await notarize({
+    appBundleId: 'com.irccloud.desktop',
+    appPath: `${appOutDir}/${appName}.app`,
+    appleId: process.env.APPLEID,
+    appleIdPassword: process.env.APPLEIDPASS,
+  });
+};

yarn.lock

@@ -1115,6 +1115,14 @@ electron-log@^4.0.6:
   resolved "https://registry.yarnpkg.com/electron-log/-/electron-log-4.0.6.tgz#7d4244082a6f5ae3838f3fa4cd7271f8dd610bf1"
   integrity sha512-inoIFKld98aRAp/l5IzLFx8Oc9sp+SKlTCrVgZKWK+qcI92rT574Ybgcah5dU8G3485vc7ClFIEfCf/IERyBJA==
 
+electron-notarize@^0.2.1:
+  version "0.2.1"
+  resolved "https://registry.yarnpkg.com/electron-notarize/-/electron-notarize-0.2.1.tgz#759e8006decae19134f82996ed910db26d9192cc"
+  integrity sha512-oZ6/NhKeXmEKNROiFmRNfytqu3cxqC95sjooG7kBXQVEUSQkZnbiAhxVh5jXngL881G197pbwpeVPJyM7Ikmxw==
+  dependencies:
+    debug "^4.1.1"
+    fs-extra "^8.1.0"
+
 [email protected]:
   version "22.3.2"
   resolved "https://registry.yarnpkg.com/electron-publish/-/electron-publish-22.3.2.tgz#d2e60caf7a9643fe57e501c20acaf32c737b1c50"