fix: refactor mac/mas/mas-dev logic flows within MacPackager

.changeset/six-rice-knock.md

@@ -0,0 +1,5 @@
+---
+"app-builder-lib": patch
+---
+
+fix: properly parse and pass through `mas` configs to overwrite `mac` config when target is `mas` or `mas-dev`

packages/app-builder-lib/src/codeSign/macCodeSign.ts

@@ -11,6 +11,7 @@ import * as path from "path"
 import { getTempName } from "temp-file"
 import { isAutoDiscoveryCodeSignIdentity } from "../util/flags"
 import { importCertificate } from "./codesign"
+import { isMacOsHighSierra as isNewerThanHighSierra } from "../util/macosVersion"
 
 export const appleCertificatePrefixes = ["Developer ID Application:", "Developer ID Installer:", "3rd Party Mac Developer Application:", "3rd Party Mac Developer Installer:"]
 
@@ -35,11 +36,11 @@ export function isSignAllowed(isPrintWarn = true): boolean {
     return false
   }
 
-  const buildForPrWarning =
-    "There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)" +
-    "\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you."
-
   if (isPullRequest()) {
+    const buildForPrWarning =
+      "There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)" +
+      "\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you."
+
     if (isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {
       if (isPrintWarn) {
         log.warn(buildForPrWarning)
@@ -54,6 +55,11 @@ export function isSignAllowed(isPrintWarn = true): boolean {
       return false
     }
   }
+
+  if (!isNewerThanHighSierra()) {
+    throw new InvalidConfigurationError("macOS High Sierra 10.13.6 is required to sign")
+  }
+
   return true
 }