refactor: electron-notarize-dmg for CLI notarization

electron-notarize-dmg is electron-notarize but supports DMG without
stapling (which is what we want for now)

License: MIT
Signed-off-by: Marcin Rataj <lidel@lidel.org>

package.json

@@ -62,6 +62,7 @@
     "electron": "^7.1.14",
     "electron-builder": "^22.4.0",
     "electron-notarize": "^0.2.1",
+    "electron-notarize-dmg": "1.0.0",
     "mocha": "^6.2.2",
     "npm-run-all": "^4.1.5",
     "pre-commit": "^1.2.2",

pkgs/macos/notarize-cli.js

@@ -1,5 +1,5 @@
 require('dotenv').config()
-const { notarize } = require('electron-notarize')
+const { notarize } = require('electron-notarize-dmg')
 
 // Manual online notarization (no stapling) via CLI
 // ================================================
@@ -9,19 +9,28 @@ const { notarize } = require('electron-notarize')
 // Usage:
 // 1. Define APPLEID and APPLEIDPASS
 // 2. node ./notarize.js path/to/IPFS-Desktop.dmg
+//
+// Note on stapling and this script:
+// We disable stapling of the dmg file, as it changes its contents.  It
+// would break auto update files.  It is perfectly okay to notarize and not
+// staple to keep the file intact. This requires end users to have connectivity
+// to validate the file, but they had it to get .dmg in the first place.
+
 ;(async () => {
   const artifactPath = process.argv[2]
-  if (!artifactPath) {
-    console.log('Missing artifact path: pass it as CLI argument')
+  if (!artifactPath || !artifactPath.endsWith('.dmg')) {
+    console.log('Missing artifact path: pass .dmg file as CLI argument')
     process.exit(1)
   }
   if (!process.env.APPLEID || !process.env.APPLEIDPASS) {
     console.log('Define APPLEID and APPLEIDPASS as env variables or in .env file')
     process.exit(1)
   }
+  console.log(`Initializing notarization of DMG at ${artifactPath}`)
   await notarize({
     appBundleId: 'io.ipfs.desktop',
-    appPath: artifactPath,
+    dmgPath: artifactPath,
+    staple: false,
     appleId: process.env.APPLEID,
     appleIdPassword: process.env.APPLEIDPASS
   })