fix: implement signApp function for macPackager

[Kilian]

As per #3504, afterSign was called before the sign function was called on mac. I tracked this down to a logic error where signApp wasn't implemented for macPackager and thus immediately resolved. Mac then called the sign function directly, leading to the incorrect behaviour.

I was able to successfully build with this, and have the afterSign function called at the right time, with the changes below. I'm however not familiar with typescript (or electron-builders code standards) so likely I'll need to make some changes. This can serve as a first setup.

[martani]

I'm interested in testing this, how can I fork a local version of electron builder and reference in from my app?

It doesn't seem to work when I simply reference the package this way in package.json:

"devDependencies": {
    "electron-builder": "file:../electron-builder/packages/electron-builder"
}

[delusive]

I tried this and I am still receiving "Unnotarized Developer ID" from this line https://github.com/electron-userland/electron-builder/pull/3912/files#diff-2f245a25ceda557ecf2530ec7e88c805R315, before it even runs the afterSign hook. Maybe I am doing something wrong here.

[delusive]

I tried this and I am still receiving "Unnotarized Developer ID" from this line https://github.com/electron-userland/electron-builder/pull/3912/files#diff-2f245a25ceda557ecf2530ec7e88c805R315, before it even runs the afterSign hook. Maybe I am doing something wrong here.

I believe this might be due to the "hardenedRuntime": true functionality here: #3858

[martani]

@delusive how were you able to test this? I can notarize my app manually but need to test doing it in the afterSign step.

[delusive]

@delusive how were you able to test this? I can notarize my app manually but need to test doing it in the afterSign step.

I cloned Kilian:patch-1, and then compiled the code, I then replaced packages/app-builder-lib/src/macPackager.ts in my local node_modules with the new one. There is probably a better way, but for some reason I could yarn add the package from my local directory where I had it compiled, it wouldn't build the node_modules/.bin/electron-builder in my case. I was probably doing something wrong.

[zaherg]

I tried this and I am still receiving "Unnotarized Developer ID" from this line https://github.com/electron-userland/electron-builder/pull/3912/files#diff-2f245a25ceda557ecf2530ec7e88c805R315, before it even runs the afterSign hook. Maybe I am doing something wrong here.

I believe this might be due to the "hardenedRuntime": true functionality here: #3858

@delusive You will need to use the pre-released version of electron-builder which is version 20.41.0 and add the "hardenedRuntime": true, option to your mac build section.
let me know if it will work with you, am stuck with the rejection all the time now.

Thanks

[develar]

Explanation: sign is removed from the promise chain after doPack, but signApp is called as part of doPack.

[develar]

Our code sign tests not executed locally due to security reasons, buy I set CSC_KEY_PASSWORD and verify it manually in addition to CI tests on Travis.

Thank you! I will prepare release today.

[zaherg]

Hey @Kilian may I ask you to show your afterSign script? for some reason now that am using the prerelease version of electron-builder with your fix, I can't any result from the script, always get :

/Users/zaher/Sites/electron/my app.app: rejected
source=Unnotarized Developer ID

[delusive]

I built the newest version from master and installed from the local filesystem into my project. I have added "afterSign": "./after_sign_hook.js" in the build section of package.json along with "hardenedRuntime": true under the mac build section of package.json. My after_sign hook contains the following code:

const enotarize = require("electron-notarize");

exports.default = async function(context) {
    options = {
        appBundleId: "***",
        appPath: context.appOutDir,
        appleId: "********",
        appleIdPassword: "******"        
    };

    console.log("Notarizing application: " + options)

    await enotarize.notarize(options);

};

When I run electron-builder I get the Unnotarized Developer ID error. The interesting thing is that I don't get my output message "Notarizing application: " in the output, meaning it hasn't tried to notorize the application before returning the error.

Any help/example would be greatly appreciated.

Thanks.

[Kilian]

@delusive your app path needs the actual app in addition to the directory! so something like

AppPath: `${context.appOutDir}/myApp.app`

[martani]

This is the afterSign hook I use for notarization. It works well with the .app output. (Side note: it also appears that notarizing the dmg also notarizes the .app inside.)

const fs = require('fs');
const path = require('path');
var electron_notarize = require('electron-notarize');

module.exports = async function (params) {
    // Only notarize the app on Mac OS only.
    if (process.platform !== 'darwin') {
        return;
    }
    console.log('afterSign hook triggered', params);

    // Same appId in electron-builder.
    let appId = '<Change this to your appId ad defined in your electron-builder config>'

    let appPath = path.join(params.appOutDir, `${params.packager.appInfo.productFilename}.app`);
    if (!fs.existsSync(appPath)) {
        throw new Error(`Cannot find application at: ${appPath}`);
    }

    console.log(`Notarizing ${appId} found at ${appPath}`);

    try {
        await electron_notarize.notarize({
            appBundleId: appId,
            appPath: appPath,
            appleId: process.env.appleId,
            appleIdPassword: process.env.appleIdPassword,
        });
    } catch (error) {
        console.error(error);
    }

    console.log(`Done notarizing ${appId}`);
};

[Kilian]

@martani it does, but I don't think it staples the .app, which means it can't be verified offline. So notarizing the app and stapling it before packaging it into the dmg (and then notarizing that) is probably best.

[martani]

Thanks @Kilian, that's what I ended up doing. This adds a lot of latency to the build process, notarizing the app takes ~10 minutes + an extra ~10 minutes for the dmg.

Unfortunately, that does not seem to fully solve the issue of users not able to open the dmg on macOS 10.14.5 as I reported here: #3828 (comment)

[DuBistKomisch]

I think this has broken our use case of passing electron-builder a pre-built but unsigned .app and turning it into a .pkg, signing both the .app and .pkg. It no longer signs the .app at all now. I guess this is a bit of a dumb use case anyway, I can just run electron-osx-sign and electron-notarize first instead, but just mentioning anyway.

[damianobarbati]

@martani @delusive where did you find the appleId and applePassword?