Action required by Apple: Transition to the notarytool command-line utility

[targos]

Build got this by email:

We’re reaching out because you recently used the altool command-line utility to notarize your macOS software with Apple. As announced last year at WWDC22, if you’re still using altool with the Apple notary service, you should transition to the notarytool command-line utility as soon as possible. Notarizing software with altool was deprecated in Xcode 13, and the Apple notary service will no longer accept uploads from altool as of November 1, 2023. Existing notarized software will continue to function properly.

For information on notarizing your apps, read TechNote TN3147: Migrating to the latest notarization tool.

[targos]

According to the above TechNote:

If xcrun can’t find the tool, make sure you have Xcode 13 or later selected:

This means we will have to migrate to Xcode>=13 for all releases by the end of the year. v16.x will be EoL but v18.x won't and is currently built on macOS 10.15 (Xcode 13 doesn't support it)

[targos]

We use gon to notarize the pkg. The tool doesn't support notarytool and doesn't seem to be maintained anymore.

https://github.com/nodejs/node/blob/b0e08d178ed3fcb4442324f70154d5f36f8dfcc2/tools/osx-notarize.sh#L3

[richardlau]

For background, we implemented notarization using gon in nodejs/node#31459 and #2199, with discussion in nodejs/node#29216.

Another tool, electron-notarize-cli, was mentioned in the context of OpenJDK -- this one looks like it has an option to use notarytool.

I guess another question is whether we need another tool at all or whether we can directly use notarytool. https://developer.apple.com/videos/play/wwdc2021/10261/ suggests that notarytool can now wait for the notarization to succeed (or I guess fail) whereas previously with altool there needed to be a polling loop (which for us was provided by gon).

@UlisesGascon is this something you're interested in/have the time to look at?

[mhdawson]

I'd be +1 in getting @UlisesGascon more access if that's needed to do this work and he's interested.

[UlisesGascon]

First approach to integrate notarytool is here: nodejs/node#48701 🎉

[UlisesGascon]

Next steps

• Merge and test tools: added support for notarytool for osx notarization node#48701
• Remove support for macOS 10.x in the Jenkins Release CI jenkins: remove macOS 10.x release machines #3531
• Remove the macOS 10.x machines from the Jenkins Release CI Inventory Remove macOS 10.x release machines from inventory #3532
• Remove the macOS 10.x machines from the Jenkins Release CI Inventory (secrets) https://github.com/nodejs-private/secrets/pull/289
• Refactor the script tools/osx-notarize.sh to remove support for gon tools: drop support for osx notarization with gon node#50291
• Refactor the script tools/osx-notarize.sh to use --keychain-profile and include an Ansible step to store the credentials. See: Add --keychain-profile to notarytool #3545
• Add --verbose flag to staple. See: tools: add staple to macOS notarized binaries node#50625 (comment)
• Add step for staple. tools: add staple to macOS notarized binaries node#50625
• Add step for binaries verification tools: add macOS notarization verification step node#50628

[richardlau]

• Remove the gon installation from Ansible

? We don't install gon via Ansible. It get installed (if not already present) via https://github.com/nodejs/node/blob/718a1cf0ceb098748d8b1c01e2c3f81259d7d0e3/tools/osx-notarize.sh#L26-L29 (which is a risk as it means potential interference with the macOS release binaries if the upstream URL being fetched ever gets compromised).

[UlisesGascon]

Great catch @richardlau! I updated the next steps

[mistic]

@UlisesGascon I believe the latest node releases (including v18.18.2) are not being correctly notarised.

When I download that release into a arm mac running Sonoma 14.0 and then try to run ./bin/node using the terminal I'm getting a security notice that you can check in the following image

[richardlau]

18.18.2 shouldn't have transitioned to the new notarization workflow -- we should still be using gon there 😕.

[richardlau]

This link won't be visible to people outside of build-infra and releasers, but https://ci-release.nodejs.org/job/iojs+release/9700/nodes=osx11-release-pkg/console shows the installer was notarized 🤷 :

15:42:18 2023-10-13T07:42:18.176-0700 [INFO]  staple: executing stapler: file=node-v18.18.2.pkg command_path=/usr/bin/xcrun command_args=[xcrun, stapler, staple, node-v18.18.2.pkg]
15:42:18 2023-10-13T07:42:18.740-0700 [INFO]  staple: stapling complete: file=node-v18.18.2.pkg
15:42:18     File notarized and stapled!
15:42:18 
15:42:18 Notarization complete! Notarized files:
15:42:18   - node-v18.18.2.pkg (notarized and stapled)

[mistic]

@richardlau the asset I'm using is this one https://nodejs.org/download/release/v18.18.2/node-v18.18.2-darwin-arm64.tar.gz and not the pkg

[targos]

Notarization changes only affects the pkg.

[targos]

I can't reproduce:

$ wget https://nodejs.org/download/release/v18.18.2/node-v18.18.2-darwin-arm64.tar.gz
$ tar xf node-v18.18.2-darwin-arm64.tar.gz
$ ./node-v18.18.2-darwin-arm64/bin/node
Welcome to Node.js v18.18.2.
Type ".help" for more information.
>

[mistic]

@targos I cannot replicate this, even on macOS 14.0, in case I use wget or curl -OL to download the .tar.gz file.

However when I download it through the browser from for example https://nodejs.org/download/release/v19.9.0/ this is easily replicated. Are you able to replicate it this way too?

[targos]

I can reproduce if the archive is downloaded using a web browser.

[targos]

Is it documented somewhere that plain executables must be notarized since macOS 14 ?

[targos]

I created #3538 because it's not related to the notarytool migration. All releases are affected by the issue.

[UlisesGascon]

I think that this task is achieved, so I will close it 🥳 🚀

So I will create a separate issue for --keychain-profile as is the only task pending related to notarytool.