Merge pull request #640 from nervosnetwork/notarizing

macOS app packaging notarizing

Author: ashchan

azure-pipelines.yml

@@ -134,6 +134,8 @@ jobs:
         CSC_KEY_PASSWORD: $(macSiginingCertificatePassword)
         WIN_CSC_LINK: $(winSiginingCertificate.secureFilePath)
         WIN_CSC_KEY_PASSWORD: $(winSiginingCertificatePassword)
+        APPLE_ID: $(appleId)
+        APPLE_ID_PASSWORD: $(appleIdPassword)
     - task: GitHubRelease@0
       inputs:
         gitHubConnection: nervos-bot

packages/neuron-wallet/.eslintignore

@@ -3,3 +3,4 @@ dist
 src/database/**/migrations
 jest.config.js
 jest.e2e.config.js
+scripts/notarize.js

packages/neuron-wallet/assets/entitlements.plist

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+  </dict>
+</plist>

packages/neuron-wallet/electron-builder.yml

@@ -8,6 +8,8 @@ directories:
   buildResources: .
   output: ../../release
 
+afterSign: scripts/notarize.js
+
 files:
   - from: "../.."
     to: "."
@@ -31,6 +33,9 @@ nsis:
   createDesktopShortcut: always
   createStartMenuShortcut: true
 
+dmg:
+  sign: false
+
 win:
   artifactName: "${productName}-v${version}-${os}-${arch}-installer.${ext}"
   icon: assets/images/icon.ico
@@ -43,6 +48,10 @@ mac:
   artifactName: "${productName}-v${version}-${os}.${ext}"
   category: public.app-category.finance
   icon: assets/images/icon.icns
+  hardenedRuntime: true
+  gatekeeperAssess: false
+  entitlements: assets/entitlements.plist
+  entitlementsInherit: assets/entitlements.plist
   target:
     - dmg
     - zip

packages/neuron-wallet/package.json

@@ -58,6 +58,7 @@
     "electron": "5.0.6",
     "electron-builder": "21.0.14",
     "electron-devtools-installer": "2.2.4",
+    "electron-notarize": "0.1.1",
     "lint-staged": "8.1.7",
     "rimraf": "2.6.3",
     "spectron": "7.0.0"

packages/neuron-wallet/scripts/notarize.js

@@ -0,0 +1,17 @@
+const { notarize } = require('electron-notarize');
+
+exports.default = async function notarizing(context) {
+  const { electronPlatformName, appOutDir } = context;
+  if (electronPlatformName !== 'darwin') {
+    return;
+  }
+
+  const appName = context.packager.appInfo.productFilename;
+
+  return await notarize({
+    appBundleId: 'com.nervos.neuron',
+    appPath: `${appOutDir}/${appName}.app`,
+    appleId: process.env.APPLE_ID,
+    appleIdPassword: process.env.APPLE_ID_PASSWORD,
+  });
+};

yarn.lock

@@ -6936,6 +6936,14 @@ electron-download@^4.1.0, electron-download@^4.1.1:
     semver "^5.4.1"
     sumchecker "^2.0.2"
 
+electron-notarize@0.1.1:
+  version "0.1.1"
+  resolved "https://registry.yarnpkg.com/electron-notarize/-/electron-notarize-0.1.1.tgz#c3563d70c5e7b3315f44e8495b30050a8c408b91"
+  integrity sha512-TpKfJcz4LXl5jiGvZTs5fbEx+wUFXV5u8voeG5WCHWfY/cdgdD8lDZIZRqLVOtR3VO+drgJ9aiSHIO9TYn/fKg==
+  dependencies:
+    debug "^4.1.1"
+    fs-extra "^8.0.1"
+
 electron-osx-sign@0.4.11:
   version "0.4.11"
   resolved "https://registry.yarnpkg.com/electron-osx-sign/-/electron-osx-sign-0.4.11.tgz#8377732fe7b207969f264b67582ee47029ce092f"