Merge pull request #1352 from session-foundation/ci/fix-mac-build

fix: notarizing macos legacy support got dropped

Author: Bilb

build/notarize.js

@@ -1,5 +1,3 @@
-const { notarize } = require('@electron/notarize');
-
 /*
  Pre-requisites: https://github.com/electron/electron-notarize#prerequisites
     1. Generate an app specific password
@@ -8,35 +6,80 @@ const { notarize } = require('@electron/notarize');
 
 /*
   Notarizing: https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/
+  This script is heavily inspired by https://github.com/electron/notarize/issues/193#issuecomment-2466569367
+  For up to date official mac information, see https://developer.apple.com/documentation/security/customizing-the-notarization-workflow
 */
 
 const log = msg => console.log(`\n${msg}`);
 const isEmpty = v => !v || v.length === 0;
 
+const { execSync } = require('node:child_process');
+
+function runCommandWithExitCode(command) {
+  try {
+    const output = execSync(command, { stdio: 'pipe' });
+    return { success: true, output: output.toString().trim() };
+  } catch (error) {
+    return { success: false, code: error.status, message: error.stderr.toString().trim() };
+  }
+}
+
 exports.default = async function notarizing(context) {
   const { electronPlatformName, appOutDir } = context;
   if (electronPlatformName !== 'darwin') {
     return;
   }
-  log('Notarizing mac application');
 
   const appName = context.packager.appInfo.productFilename;
+
+  const appPath = `${appOutDir}/${appName}.app`;
+  const zipPath = `${appOutDir}/${appName}.zip`;
+
+  const verifyCheck = runCommandWithExitCode(`codesign --verify --deep --strict "${appPath}"`);
+  if (!verifyCheck.success) {
+    if (verifyCheck.code === 1) {
+      console.error(`Signature is invalid for app "${appPath}".`);
+    } else if (verifyCheck.code === 2) {
+      console.error(`"${appPath}" is not signed.`);
+    } else {
+      console.error(`Error (${verifyCheck.code}): ${verifyCheck.message} for app: "${appPath}"`);
+    }
+    console.warn('skipping notarization step');
+    return;
+  }
+
+  log(`"${appPath}" signature is valid.`);
+  log('Notarizing mac application');
+
   const { SIGNING_APPLE_ID, SIGNING_APP_PASSWORD, SIGNING_TEAM_ID } = process.env;
 
-  if (isEmpty(SIGNING_APPLE_ID) || isEmpty(SIGNING_APP_PASSWORD)) {
-    log('SIGNING_APPLE_ID or SIGNING_APP_PASSWORD not set.\nTerminating noratization.');
+  if (isEmpty(SIGNING_APPLE_ID)) {
+    log('SIGNING_APPLE_ID not set.\nTerminating notarization.');
     return;
   }
 
-  const options = {
-    appBundleId: 'com.loki-project.messenger-desktop',
-    appPath: `${appOutDir}/${appName}.app`,
-    appleId: SIGNING_APPLE_ID,
-    appleIdPassword: SIGNING_APP_PASSWORD,
-  };
-  if (!isEmpty(SIGNING_TEAM_ID)) {
-    options.ascProvider = SIGNING_TEAM_ID;
-    options.teamId = SIGNING_TEAM_ID;
+  if (isEmpty(SIGNING_APP_PASSWORD)) {
+    log('SIGNING_APP_PASSWORD not set.\nTerminating notarization.');
+    return;
   }
-  return notarize(options);
+
+  if (isEmpty(SIGNING_TEAM_ID)) {
+    log(' SIGNING_TEAM_ID not set.\nTerminating notarization.');
+    return;
+  }
+
+  console.log(
+    execSync(`ditto -c -k  --sequesterRsrc --keepParent "${appPath}" "${zipPath}"`, {
+      encoding: 'utf8',
+    })
+  );
+
+  console.log(
+    execSync(
+      `xcrun notarytool submit "${zipPath}" --team-id "${SIGNING_TEAM_ID}" --apple-id "${SIGNING_APPLE_ID}" --password "${SIGNING_APP_PASSWORD}" --verbose --wait`,
+      { encoding: 'utf8' }
+    )
+  );
+
+  console.log(execSync(`xcrun stapler staple "${appPath}"`, { encoding: 'utf8' }));
 };

package.json

@@ -120,7 +120,6 @@
   "devDependencies": {
     "@commitlint/cli": "^19.8.0",
     "@commitlint/config-conventional": "^19.8.0",
-    "@electron/notarize": "^2.5.0",
     "@testing-library/jest-dom": "^6.4.6",
     "@testing-library/react": "^15.0.7",
     "@testing-library/user-event": "^14.6.1",
@@ -207,6 +206,7 @@
         "dmg",
         "zip"
       ],
+      "notarize": false,
       "bundleVersion": "1",
       "hardenedRuntime": true,
       "gatekeeperAssess": false,

yarn.lock

@@ -272,7 +272,7 @@
     tar "^6.2.1"
     which "^2.0.2"
 
-"@electron/[email protected]", "@electron/notarize@^2.5.0":
+"@electron/[email protected]":
   version "2.5.0"
   resolved "https://registry.yarnpkg.com/@electron/notarize/-/notarize-2.5.0.tgz#d4d25356adfa29df4a76bd64a8bd347237cd251e"
   integrity sha512-jNT8nwH1f9X5GEITXaQ8IF/KdskvIkOFfB2CvwumsveVidzpSc+mvhhTMdAGSYF3O+Nq49lJ7y+ssODRXu06+A==