Notarize macOS app (Jigsaw-Code#584)

rogervaas · Feb 21, 2020 · 64b3d85 · 64b3d85
1 parent 565a5d9
commit 64b3d85
Show file tree

Hide file tree

Showing 4 changed files with 63 additions and 0 deletions.
diff --git a/src/server_manager/electron_app/release/macos.entitlements b/src/server_manager/electron_app/release/macos.entitlements
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.network.client</key>
+    <true/>
+    <key>com.apple.security.network.server</key>
+    <true/>
+  </dict>
+</plist>
diff --git a/src/server_manager/electron_app/release/notarize.js b/src/server_manager/electron_app/release/notarize.js
@@ -0,0 +1,34 @@
+// Copyright 2020 The Outline Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+const {notarize} = require('electron-notarize');
+
+// Notarizes the macOS app through an Apple Developer Account when building for release.
+// Must set environment variables: `APPLE_ID`, the account's Apple ID;
+// and `APPLE_PASSWORD`, the password to the account.
+exports.default = async function(context) {
+  const {electronPlatformName, appOutDir} = context;
+  if (electronPlatformName !== 'darwin') {
+    return;
+  }
+
+  const appName = context.packager.appInfo.productFilename;
+  console.log(`Notarizing ${appName}. This may take a few minutes.`);
+  await notarize({
+    appBundleId: 'com.electron.outline-manager',
+    appPath: `${appOutDir}/${appName}.app`,
+    appleId: process.env.APPLE_ID,
+    appleIdPassword: process.env.APPLE_PASSWORD,
+  });
+};
diff --git a/src/server_manager/package.json b/src/server_manager/package.json
@@ -8,6 +8,14 @@
     "name": "The Outline authors",
     "email": "info@getoutline.org"
   },
+  "build": {
+    "afterSign": "src/server_manager/electron_app/release/notarize.js",
+    "mac": {
+      "hardenedRuntime": true,
+      "entitlements": "src/server_manager/electron_app/release/macos.entitlements",
+      "entitlementsInherit": "src/server_manager/electron_app/release/macos.entitlements"
+    }
+  },
   "dependencies": {
     "@sentry/electron": "^0.8.1",
     "body-parser": "^1.18.3",
@@ -31,6 +39,7 @@
     "electron": "7.0.0",
     "electron-builder": "^21.2.0",
     "electron-icon-maker": "^0.0.4",
+    "electron-notarize": "^0.2.1",
     "gulp": "^4.0.0",
     "gulp-posthtml": "^3.0.4",
     "gulp-replace": "^1.0.0",

diff --git a/yarn.lock b/yarn.lock
@@ -2205,6 +2205,14 @@ electron-icon-maker@^0.0.4:
     icon-gen "1.0.7"
     jimp "^0.2.27"
 
+electron-notarize@^0.2.1:
+  version "0.2.1"
+  resolved "https://registry.yarnpkg.com/electron-notarize/-/electron-notarize-0.2.1.tgz#759e8006decae19134f82996ed910db26d9192cc"
+  integrity sha512-oZ6/NhKeXmEKNROiFmRNfytqu3cxqC95sjooG7kBXQVEUSQkZnbiAhxVh5jXngL881G197pbwpeVPJyM7Ikmxw==
+  dependencies:
+    debug "^4.1.1"
+    fs-extra "^8.1.0"
+
 electron-publish@21.2.0:
   version "21.2.0"
   resolved "https://registry.yarnpkg.com/electron-publish/-/electron-publish-21.2.0.tgz#cc225cb46aa62e74b899f2f7299b396c9802387d"