forked from atom/atom
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathcode-sign-on-mac.js
More file actions
153 lines (144 loc) · 4.29 KB
/
Copy pathcode-sign-on-mac.js
File metadata and controls
153 lines (144 loc) · 4.29 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
const downloadFileFromGithub = require('./download-file-from-github');
const CONFIG = require('../config');
const fs = require('fs-extra');
const os = require('os');
const path = require('path');
const spawnSync = require('./spawn-sync');
const osxSign = require('electron-osx-sign');
const macEntitlementsPath = path.join(
CONFIG.repositoryRootPath,
'resources',
'mac',
'entitlements.plist'
);
module.exports = async function(packagedAppPath) {
if (
!process.env.ATOM_MAC_CODE_SIGNING_CERT_DOWNLOAD_URL &&
!process.env.ATOM_MAC_CODE_SIGNING_CERT_PATH
) {
console.log(
'Skipping code signing because the ATOM_MAC_CODE_SIGNING_CERT_DOWNLOAD_URL environment variable is not defined'
.gray
);
return;
}
let certPath = process.env.ATOM_MAC_CODE_SIGNING_CERT_PATH;
if (!certPath) {
certPath = path.join(os.tmpdir(), 'mac.p12');
downloadFileFromGithub(
process.env.ATOM_MAC_CODE_SIGNING_CERT_DOWNLOAD_URL,
certPath
);
}
try {
console.log(
`Ensuring keychain ${process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN} exists`
);
try {
spawnSync(
'security',
['show-keychain-info', process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN],
{ stdio: 'inherit' }
);
} catch (err) {
console.log(
`Creating keychain ${process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN}`
);
// The keychain doesn't exist, try to create it
spawnSync(
'security',
[
'create-keychain',
'-p',
process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN_PASSWORD,
process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN
],
{ stdio: 'inherit' }
);
// List the keychain to "activate" it. Somehow this seems
// to be needed otherwise the signing operation fails
spawnSync(
'security',
['list-keychains', '-s', process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN],
{ stdio: 'inherit' }
);
// Make sure it doesn't time out before we use it
spawnSync(
'security',
[
'set-keychain-settings',
'-t',
'3600',
'-u',
process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN
],
{ stdio: 'inherit' }
);
}
console.log(
`Unlocking keychain ${process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN}`
);
const unlockArgs = ['unlock-keychain'];
// For signing on local workstations, password could be entered interactively
if (process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN_PASSWORD) {
unlockArgs.push(
'-p',
process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN_PASSWORD
);
}
unlockArgs.push(process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN);
spawnSync('security', unlockArgs, { stdio: 'inherit' });
console.log(
`Importing certificate at ${certPath} into ${
process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN
} keychain`
);
spawnSync('security', [
'import',
certPath,
'-P',
process.env.ATOM_MAC_CODE_SIGNING_CERT_PASSWORD,
'-k',
process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN,
'-T',
'/usr/bin/codesign'
]);
console.log(
'Running incantation to suppress dialog when signing on macOS Sierra'
);
try {
spawnSync('security', [
'set-key-partition-list',
'-S',
'apple-tool:,apple:',
'-s',
'-k',
process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN_PASSWORD,
process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN
]);
} catch (e) {
console.log("Incantation failed... maybe this isn't Sierra?");
}
console.log(`Code-signing application at ${packagedAppPath}`);
try {
await osxSign.signAsync({
app: packagedAppPath,
entitlements: macEntitlementsPath,
'entitlements-inherit': macEntitlementsPath,
identity: 'Developer ID Application: GitHub',
keychain: process.env.ATOM_MAC_CODE_SIGNING_KEYCHAIN,
platform: 'darwin',
hardenedRuntime: true
});
console.info('Application signing complete');
} catch (err) {
console.error('Applicaiton singing failed');
console.error(err);
}
} finally {
if (!process.env.ATOM_MAC_CODE_SIGNING_CERT_PATH) {
console.log(`Deleting certificate at ${certPath}`);
fs.removeSync(certPath);
}
}
};