fix workflow

Author: jasonzh0

.github/workflows/release.yml

@@ -43,25 +43,83 @@ jobs:
       - name: Build application
         run: npm run build
 
+      - name: Sign native binaries
+        if: env.APPLE_CERTIFICATE != ''
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+        run: |
+          # Find the signing identity
+          IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
+          echo "Using identity: $IDENTITY"
+
+          # Sign the native mouse-telemetry binary with hardened runtime
+          if [ -f "native/mouse-telemetry" ]; then
+            codesign --force --options runtime --timestamp --sign "$IDENTITY" native/mouse-telemetry
+            echo "Signed native/mouse-telemetry"
+            codesign -vv native/mouse-telemetry
+          fi
+
       - name: Package application
         env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          CSC_KEYCHAIN: build.keychain
         run: npm run package:mac -- --publish never
 
+      - name: Verify code signatures
+        run: |
+          echo "=== Verifying app bundle signature ==="
+          APP_PATH=$(find release -name "*.app" -type d | head -1)
+          echo "App path: $APP_PATH"
+
+          # Verify the main app signature
+          codesign -vv --deep "$APP_PATH" || echo "Deep verification failed"
+
+          # List all Mach-O binaries and their signing status
+          echo "=== Checking all binaries ==="
+          find "$APP_PATH" -type f \( -perm +111 -o -name "*.dylib" -o -name "*.so" -o -name "*.node" \) 2>/dev/null | while read binary; do
+            echo "Checking: $binary"
+            codesign -vv "$binary" 2>&1 || echo "  UNSIGNED or INVALID"
+          done
+
+          # Show the main executable info
+          echo "=== Main executable info ==="
+          codesign -dvv "$APP_PATH"
+
       - name: Notarize application
         if: env.APPLE_ID != '' && env.APPLE_APP_SPECIFIC_PASSWORD != ''
         env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: |
-          xcrun notarytool submit release/*.zip \
+          # Submit for notarization and capture output
+          SUBMIT_OUTPUT=$(xcrun notarytool submit release/*.zip \
             --apple-id "$APPLE_ID" \
             --password "$APPLE_APP_SPECIFIC_PASSWORD" \
             --team-id "$APPLE_TEAM_ID" \
-            --wait
+            --wait 2>&1) || true
+
+          echo "$SUBMIT_OUTPUT"
+
+          # Extract submission ID
+          SUBMISSION_ID=$(echo "$SUBMIT_OUTPUT" | grep -m1 "id:" | awk '{print $2}')
+          echo "Submission ID: $SUBMISSION_ID"
+
+          # Check if notarization was successful
+          if echo "$SUBMIT_OUTPUT" | grep -q "status: Accepted"; then
+            echo "Notarization successful!"
+          else
+            echo "Notarization failed. Fetching detailed log..."
+            xcrun notarytool log "$SUBMISSION_ID" \
+              --apple-id "$APPLE_ID" \
+              --password "$APPLE_APP_SPECIFIC_PASSWORD" \
+              --team-id "$APPLE_TEAM_ID" \
+              notarization-log.json
+            cat notarization-log.json
+            exit 1
+          fi
 
       - name: Staple notarization
         if: env.APPLE_ID != '' && env.APPLE_APP_SPECIFIC_PASSWORD != ''

package.json

@@ -53,10 +53,10 @@
         "zip"
       ],
       "hardenedRuntime": true,
-      "gatekeeperAssess": true,
-      "identity": null,
+      "gatekeeperAssess": false,
       "entitlements": "build/entitlements.mac.plist",
       "entitlementsInherit": "build/entitlements.mac.plist",
+      "signIgnore": [],
       "extendInfo": {
         "NSMicrophoneUsageDescription": "This app needs microphone access for screen recording with audio.",
         "NSHighResolutionCapable": true