jitsi-meet-electron/notarize.js

43 lines
1.4 KiB
JavaScript
Raw Normal View History

mac: Enable autoupdate by sign and notarize via github action (#581) mac: Enable autoupdate by sign and notarize via github action Signed and notarized binaries are the precondition for autoupdates on mac. Additionally Gatekeeper on 10.15+ is happy and allows to open the app instead of blocking it. The notarize step is added unconditionally, as it only emits a warning if the notarization API key is not set, but it does not break the build. This is an upstreaming of https://github.com/csett86/jitsi-meet-electron where it worked since March 2020. On CI, only sign if not triggered by pull request, as these will fail (as secrets are not available to pull request builds). The required github secrets (signing key, cert and notarize API login, password and team id) are: Signing Open the Keychain Access app. Export all certificates (Developer ID Certificate) related to your app into a single file (e.g. certs.p12) and set a strong password. Base64-encode your certificates using the following command: base64 -i certs.p12 -o encoded.txt In the GitHub repository, go to Settings → Secrets and add the following two variables: mac_certs: Your base64 encoded certificates, i.e. the content of the encoded.txt file you created before mac_certs_password: The password you set when exporting the certificates Notarization Create an app-specific password for your apple id: https://support.apple.com/de-de/HT204397 In the GitHub repository, go to Settings → Secrets and add the following three variables: apple_id: your apple id apple_id_password: the just created app-specific password for your apple id team_id: your team short name: https://github.com/electron/electron-notarize#notes-on-your-team-short-name Co-authored-by: Saúl Ibarra Corretgé <s@saghul.net>
2021-11-04 22:29:34 +01:00
const { notarize } = require('electron-notarize');
const process = require('process');
const pkgJson = require('./package.json');
exports.default = async function notarizing(context) {
const { electronPlatformName, appOutDir } = context;
if (electronPlatformName !== 'darwin') {
return;
}
const appName = context.packager.appInfo.productFilename;
const appPath = `${appOutDir}/${appName}.app`;
mac: Enable autoupdate by sign and notarize via github action (#581) mac: Enable autoupdate by sign and notarize via github action Signed and notarized binaries are the precondition for autoupdates on mac. Additionally Gatekeeper on 10.15+ is happy and allows to open the app instead of blocking it. The notarize step is added unconditionally, as it only emits a warning if the notarization API key is not set, but it does not break the build. This is an upstreaming of https://github.com/csett86/jitsi-meet-electron where it worked since March 2020. On CI, only sign if not triggered by pull request, as these will fail (as secrets are not available to pull request builds). The required github secrets (signing key, cert and notarize API login, password and team id) are: Signing Open the Keychain Access app. Export all certificates (Developer ID Certificate) related to your app into a single file (e.g. certs.p12) and set a strong password. Base64-encode your certificates using the following command: base64 -i certs.p12 -o encoded.txt In the GitHub repository, go to Settings → Secrets and add the following two variables: mac_certs: Your base64 encoded certificates, i.e. the content of the encoded.txt file you created before mac_certs_password: The password you set when exporting the certificates Notarization Create an app-specific password for your apple id: https://support.apple.com/de-de/HT204397 In the GitHub repository, go to Settings → Secrets and add the following three variables: apple_id: your apple id apple_id_password: the just created app-specific password for your apple id team_id: your team short name: https://github.com/electron/electron-notarize#notes-on-your-team-short-name Co-authored-by: Saúl Ibarra Corretgé <s@saghul.net>
2021-11-04 22:29:34 +01:00
if (process.env.APPLE_ID && process.env.APPLE_ID_PASSWORD && process.env.TEAM_ID) {
console.log(`Notarizing ${appPath} with user & password`);
return await notarize({
tool: 'notarytool',
appBundleId: pkgJson.build.appId,
appPath,
appleId: process.env.APPLE_ID,
appleIdPassword: process.env.APPLE_ID_PASSWORD,
teamId: process.env.TEAM_ID
});
} else if (process.env.API_KEY_FILE && process.env.API_KEY_ID && process.env.API_KEY_ISSUER_ID) {
console.log(`Notarizing ${appPath} with API key`);
return await notarize({
tool: 'notarytool',
appBundleId: pkgJson.build.appId,
appPath,
appleApiKey: process.env.API_KEY_FILE,
appleApiKeyId: process.env.API_KEY_ID,
appleApiIssuer: process.env.API_KEY_ISSUER_ID
});
mac: Enable autoupdate by sign and notarize via github action (#581) mac: Enable autoupdate by sign and notarize via github action Signed and notarized binaries are the precondition for autoupdates on mac. Additionally Gatekeeper on 10.15+ is happy and allows to open the app instead of blocking it. The notarize step is added unconditionally, as it only emits a warning if the notarization API key is not set, but it does not break the build. This is an upstreaming of https://github.com/csett86/jitsi-meet-electron where it worked since March 2020. On CI, only sign if not triggered by pull request, as these will fail (as secrets are not available to pull request builds). The required github secrets (signing key, cert and notarize API login, password and team id) are: Signing Open the Keychain Access app. Export all certificates (Developer ID Certificate) related to your app into a single file (e.g. certs.p12) and set a strong password. Base64-encode your certificates using the following command: base64 -i certs.p12 -o encoded.txt In the GitHub repository, go to Settings → Secrets and add the following two variables: mac_certs: Your base64 encoded certificates, i.e. the content of the encoded.txt file you created before mac_certs_password: The password you set when exporting the certificates Notarization Create an app-specific password for your apple id: https://support.apple.com/de-de/HT204397 In the GitHub repository, go to Settings → Secrets and add the following three variables: apple_id: your apple id apple_id_password: the just created app-specific password for your apple id team_id: your team short name: https://github.com/electron/electron-notarize#notes-on-your-team-short-name Co-authored-by: Saúl Ibarra Corretgé <s@saghul.net>
2021-11-04 22:29:34 +01:00
}
console.log('Skipping notarization');
mac: Enable autoupdate by sign and notarize via github action (#581) mac: Enable autoupdate by sign and notarize via github action Signed and notarized binaries are the precondition for autoupdates on mac. Additionally Gatekeeper on 10.15+ is happy and allows to open the app instead of blocking it. The notarize step is added unconditionally, as it only emits a warning if the notarization API key is not set, but it does not break the build. This is an upstreaming of https://github.com/csett86/jitsi-meet-electron where it worked since March 2020. On CI, only sign if not triggered by pull request, as these will fail (as secrets are not available to pull request builds). The required github secrets (signing key, cert and notarize API login, password and team id) are: Signing Open the Keychain Access app. Export all certificates (Developer ID Certificate) related to your app into a single file (e.g. certs.p12) and set a strong password. Base64-encode your certificates using the following command: base64 -i certs.p12 -o encoded.txt In the GitHub repository, go to Settings → Secrets and add the following two variables: mac_certs: Your base64 encoded certificates, i.e. the content of the encoded.txt file you created before mac_certs_password: The password you set when exporting the certificates Notarization Create an app-specific password for your apple id: https://support.apple.com/de-de/HT204397 In the GitHub repository, go to Settings → Secrets and add the following three variables: apple_id: your apple id apple_id_password: the just created app-specific password for your apple id team_id: your team short name: https://github.com/electron/electron-notarize#notes-on-your-team-short-name Co-authored-by: Saúl Ibarra Corretgé <s@saghul.net>
2021-11-04 22:29:34 +01:00
return;
mac: Enable autoupdate by sign and notarize via github action (#581) mac: Enable autoupdate by sign and notarize via github action Signed and notarized binaries are the precondition for autoupdates on mac. Additionally Gatekeeper on 10.15+ is happy and allows to open the app instead of blocking it. The notarize step is added unconditionally, as it only emits a warning if the notarization API key is not set, but it does not break the build. This is an upstreaming of https://github.com/csett86/jitsi-meet-electron where it worked since March 2020. On CI, only sign if not triggered by pull request, as these will fail (as secrets are not available to pull request builds). The required github secrets (signing key, cert and notarize API login, password and team id) are: Signing Open the Keychain Access app. Export all certificates (Developer ID Certificate) related to your app into a single file (e.g. certs.p12) and set a strong password. Base64-encode your certificates using the following command: base64 -i certs.p12 -o encoded.txt In the GitHub repository, go to Settings → Secrets and add the following two variables: mac_certs: Your base64 encoded certificates, i.e. the content of the encoded.txt file you created before mac_certs_password: The password you set when exporting the certificates Notarization Create an app-specific password for your apple id: https://support.apple.com/de-de/HT204397 In the GitHub repository, go to Settings → Secrets and add the following three variables: apple_id: your apple id apple_id_password: the just created app-specific password for your apple id team_id: your team short name: https://github.com/electron/electron-notarize#notes-on-your-team-short-name Co-authored-by: Saúl Ibarra Corretgé <s@saghul.net>
2021-11-04 22:29:34 +01:00
};