Skip to content

Commit 80c1a35

Browse files
vijaythecodervijaythecoder
committed
feat: implement open source security setup
- Add comprehensive .env.example template with security documentation - Update .gitignore to exclude certificates, keys, and sensitive files - Make build-swift-audio.sh generic with automatic certificate detection - Add code signing security guidelines to CONTRIBUTING.md - Create entitlements.plist for native binary signing - Remove hardcoded certificate names for open source safety This enables safe open source publication while maintaining production signing capabilities for maintainers.
1 parent b9f7226 commit 80c1a35

File tree

5 files changed

+150
-6
lines changed

5 files changed

+150
-6
lines changed

‎.env.example‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,11 +64,28 @@ AWS_USE_PATH_STYLE_ENDPOINT=false
6464

6565
VITE_APP_NAME="${APP_NAME}"
6666

67-
# AI Provider Keys
68-
OPENAI_API_KEY=
69-
ANTHROPIC_API_KEY=
70-
GEMINI_API_KEY=
67+
# AI Provider Keys (Required for functionality)
68+
# Get your API keys from the respective providers:
69+
# OpenAI: https://platform.openai.com/api-keys
70+
# Anthropic: https://console.anthropic.com/
71+
# Google AI: https://ai.google.dev/
72+
OPENAI_API_KEY=your-openai-api-key-here
73+
ANTHROPIC_API_KEY=your-anthropic-api-key-here
74+
GEMINI_API_KEY=your-gemini-api-key-here
7175

7276
# Realtime API Configuration
7377
VITE_OPENAI_API_KEY="${OPENAI_API_KEY}"
7478
VITE_REALTIME_RELAY_URL=wss://localhost:8080/realtime
79+
80+
# NativePHP/Electron Configuration
81+
# Change this to your own app identifier (reverse domain format)
82+
NATIVEPHP_APP_ID=com.yourcompany.yourapp
83+
# NATIVEPHP_APP_VERSION=DEBUG
84+
85+
# Apple Developer Code Signing (Required for macOS distribution)
86+
# Only needed if you want to build signed, distributable macOS apps
87+
# Get these from your Apple Developer Account: https://developer.apple.com/account/
88+
# IMPORTANT: Never commit real values to version control!
89+
NATIVEPHP_APPLE_ID=[email protected]
90+
NATIVEPHP_APPLE_ID_PASS=your-app-specific-password
91+
NATIVEPHP_APPLE_TEAM_ID=YOUR_10_CHAR_TEAM_ID

‎.gitignore‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,24 @@ yarn-error.log
2424
/.zed
2525
/dist
2626
.DS_Store
27+
28+
# Security & Certificates - Never commit these!
29+
*.cer
30+
*.p12
31+
*.mobileprovision
32+
*.keychain
33+
*.keychain-db
34+
**/certificates/
35+
**/signing/
36+
.env.local
37+
.env.*.local
38+
*.pem
39+
*.key.pub
40+
keychain_password.txt
41+
apple_certificates/
42+
43+
# Build artifacts that may contain sensitive data
44+
/build/certificates/
45+
/build/signing/
46+
/build/*.cer
47+
/build/*.p12

‎CONTRIBUTING.md‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,16 +87,54 @@ Unsure where to begin contributing? You can start by looking through these issue
8787
php artisan migrate --database=nativephp
8888
```
8989

90-
5. **Add your OpenAI API key to `.env`:**
90+
5. **Add your API keys to `.env`:**
9191
```
92-
OPENAI_API_KEY=your-api-key-here
92+
OPENAI_API_KEY=your-openai-api-key-here
93+
ANTHROPIC_API_KEY=your-anthropic-api-key-here
94+
GEMINI_API_KEY=your-gemini-api-key-here
95+
NATIVEPHP_APP_ID=com.yourcompany.yourapp
9396
```
9497

9598
6. **Run the development server:**
9699
```bash
97100
composer dev
98101
```
99102

103+
## 🔐 Code Signing & Security
104+
105+
### For Contributors (Development)
106+
107+
**You don't need Apple Developer certificates for contributing!** The project automatically creates unsigned builds for development, which are perfect for testing your changes.
108+
109+
If you see warnings like this, it's completely normal:
110+
```
111+
⚠️ No code signing certificate found - creating unsigned build
112+
💡 To create signed builds, install an Apple Developer certificate in Keychain
113+
```
114+
115+
### Security Guidelines
116+
117+
**❌ NEVER commit these:**
118+
- `.env` file with real credentials
119+
- Certificate files (`.cer`, `.p12`)
120+
- Apple Developer credentials
121+
- Real API keys
122+
123+
**✅ SAFE to commit:**
124+
- `.env.example` (template only)
125+
- Source code
126+
- Build scripts (auto-detect certificates)
127+
- Documentation
128+
129+
### Before Committing
130+
131+
Always verify no sensitive data:
132+
```bash
133+
git status
134+
git diff --cached
135+
grep -r "your-actual-api-key" . --exclude-dir=vendor
136+
```
137+
100138
## Pull Request Process
101139

102140
1. **Before submitting:**

‎build-swift-audio.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,56 @@ if [ $? -eq 0 ]; then
2323
echo "Executable location: build/native/macos-audio-capture"
2424
# Make sure it's executable
2525
chmod +x build/native/macos-audio-capture
26+
27+
# Attempt to sign the binary with available certificate
28+
echo "🔐 Attempting to sign Swift audio capture binary..."
29+
30+
# Try to find a Developer ID Application certificate first (for distribution)
31+
DIST_CERT=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | cut -d'"' -f2)
32+
33+
# If no distribution cert, try Development certificate (for local testing)
34+
if [ -z "$DIST_CERT" ]; then
35+
DEV_CERT=$(security find-identity -v -p codesigning | grep "Apple Development" | head -1 | cut -d'"' -f2)
36+
CERT_NAME="$DEV_CERT"
37+
CERT_TYPE="Development"
38+
else
39+
CERT_NAME="$DIST_CERT"
40+
CERT_TYPE="Distribution"
41+
fi
42+
43+
if [ -n "$CERT_NAME" ]; then
44+
echo "📋 Using $CERT_TYPE certificate: $CERT_NAME"
45+
codesign --force --sign "$CERT_NAME" \
46+
--options runtime \
47+
--entitlements native/macos-audio-capture/entitlements.plist \
48+
build/native/macos-audio-capture
49+
50+
if [ $? -eq 0 ]; then
51+
echo "✅ Swift audio capture signed successfully with $CERT_TYPE certificate"
52+
53+
# Also sign the extras directory binary if it exists
54+
if [ -f "extras/macos-audio-capture" ]; then
55+
echo "🔐 Signing extras audio capture binary..."
56+
codesign --force --sign "$CERT_NAME" \
57+
--options runtime \
58+
--entitlements native/macos-audio-capture/entitlements.plist \
59+
extras/macos-audio-capture
60+
61+
if [ $? -eq 0 ]; then
62+
echo "✅ Extras audio capture signed successfully"
63+
else
64+
echo "⚠️ Warning: Failed to sign extras audio capture (continuing anyway)"
65+
fi
66+
fi
67+
else
68+
echo "⚠️ Warning: Failed to sign Swift audio capture (continuing anyway)"
69+
fi
70+
else
71+
echo "⚠️ No code signing certificate found - creating unsigned build"
72+
echo "💡 To create signed builds, install an Apple Developer certificate in Keychain"
73+
echo " For distribution: 'Developer ID Application' certificate"
74+
echo " For development: 'Apple Development' certificate"
75+
fi
2676
else
2777
echo "❌ Failed to build Swift audio capture"
2878
exit 1

‎native/macos-audio-capture/entitlements.plist‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.allow-jit</key>
6+
<true/>
7+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
8+
<true/>
9+
<key>com.apple.security.cs.disable-executable-page-protection</key>
10+
<true/>
11+
<key>com.apple.security.cs.disable-library-validation</key>
12+
<true/>
13+
<key>com.apple.security.device.audio-input</key>
14+
<true/>
15+
<key>com.apple.security.device.microphone</key>
16+
<true/>
17+
</dict>
18+
</plist>

0 commit comments

Comments
 (0)