Code signing and Notarization (#2794)

* Add configuration signing fields in github-actions

* Add test github workflow

* wip

* wip

* Change release name steps for releasing and remove test workflow

* Add test gh workflow

* Add electron app notarization

* Remove test-release gh workflow

* Remove category in mac build config

* fix packElectron:mac script

* Change case for all secrets to uppercase

* [WIP] Temporary commit to verify signing on PR branch.

* Revert temporary changes.

* Update version in changelog.

Co-authored-by: Krzysztof Jelski <krzysztof@ethworks.io>

.github/workflows/push-master.yml

@@ -43,13 +43,36 @@ jobs:
       - uses: actions/checkout@v1
         with:
           token: ${{ secrets.GH_PAT }}
+
+      - name: Prepare for app notarization (macOS)
+          if: startsWith(matrix.os, 'macos')
+          # Import Apple API key for app notarization on macOS
+          run: |
+            mkdir -p ~/private_keys/
+            echo '${{ secrets.API_KEY }}' > ~/private_keys/AuthKey_${{ secrets.API_KEY_ID }}.p8
+
       - name: Build/release Electron app
         uses: samuelmeuli/action-electron-builder@v1
         with:
+          # Base64-encoded code signing certificate for macOS
+          mac_certs: ${{ secrets.MAC_CERTS }}
+          # Password for decrypting `mac_certs`
+          mac_certs_password: ${{ secrets.MAC_CERTS_PASSWORD }}
+          # Base64-encoded code signing certificate for Windows
+          windows_certs: ${{ secrets.WINDOWS_CERTS }}
+          # Password for decrypting `windows_certs`
+          windows_certs_password: ${{ secrets.WINDOWS_CERTS_PASSWORD }}
           # GitHub token, automatically provided to the action
           # (No need to define this secret in the repo settings)
-          github_token: ${{ secrets.github_token }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           build_script_name: build:release:electron
+          # If the commit is tagged with a version (e.g. "v1.0.0"),
+          # release the app after building
+          release: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        env:
+          # macOS notarization API key
+          API_KEY_ID: ${{ secrets.API_KEY_ID }}
+          API_KEY_ISSUER_ID: ${{ secrets.API_KEY_ISSUER_ID }}
 
   # dummy, GH actions fails outright when all steps are skipped (like it can be above)
   dummy:

CHANGELOG.md

@@ -1,6 +1,6 @@
 # CHANGELOG
 
-## 0.44.0-beta.30
+## 0.44.0-beta.37 Jun 1, 2020
 
 - Publish electron images on release (Thanks to https://github.com/EthWorks)
 - Adjust with latest Arcardia types (Thanks to https://github.com/ETeissonniere)

package.json

@@ -16,7 +16,8 @@
     "artifactName": "Polkadot-JS-Apps-${version}.${ext}",
     "files": [
       "./packages/apps-electron/build",
-      "./packages/apps-electron/assets"
+      "./packages/apps-electron/assets",
+      "./packages/apps-electron/appleEntitlements"
     ],
     "appId": "com.polkadotjs.polkadotjs-apps",
     "mac": {
@@ -26,6 +27,11 @@
     "directories": {
       "buildResources": "./packages/apps-electron/assets",
       "output": "./packages/apps-electron/release"
+    },
+    "afterSign": "electron-builder-notarize",
+    "mac": {
+      "hardenedRuntime": true,
+      "entitlements": "./packages/apps-electron/appleEntitlements/entitlements.mac.plist"
     }
   },
   "resolutions": {
@@ -95,6 +101,7 @@
     "dnslink-cloudflare": "^2.0.4",
     "electron": "8.3.0",
     "electron-builder": "^22.7.0",
+    "electron-builder-notarize": "^1.1.2",
     "i18next-scanner": "^2.11.0",
     "react": "^16.13.1",
     "react-dom": "^16.13.1",

packages/apps-electron/appleEntitlements/entitlements.mac.plist

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+	<dict>
+		<key>com.apple.security.cs.allow-jit</key>
+		<true/>
+		<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+		<true/>
+		<key>com.apple.security.cs.allow-dyld-environment-variables</key>
+		<true/>
+	</dict>
+</plist>

yarn.lock

@@ -9424,6 +9424,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"electron-builder-notarize@npm:^1.1.2":
+  version: 1.1.2
+  resolution: "electron-builder-notarize@npm:1.1.2"
+  dependencies:
+    electron-notarize: ^0.2.0
+    read-pkg-up: ^7.0.0
+  peerDependencies:
+    electron-builder: ">= 20.44.4"
+  checksum: 3/c12bad5083fe41f44b5bfa57484316bf40f12a8158704af4e9d312e16dab3d742b89b69ee2064924992f468a4959e4f977d3c0f1e02d1d34e87bb07cc440aab4
+  languageName: node
+  linkType: hard
+
 "electron-builder@npm:^22.7.0":
   version: 22.7.0
   resolution: "electron-builder@npm:22.7.0"
@@ -9449,6 +9461,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"electron-notarize@npm:^0.2.0":
+  version: 0.2.1
+  resolution: "electron-notarize@npm:0.2.1"
+  dependencies:
+    debug: ^4.1.1
+    fs-extra: ^8.1.0
+  checksum: 3/884d282a0b515f8ae6bba56d4b0871f335bbf5a1016cdfac4c74e4f0a77f0c92d05483d717b51fb659597b879191f55a7b9600d0f50c2eae8b309cdc1aa8578f
+  languageName: node
+  linkType: hard
+
 "electron-publish@npm:22.7.0":
   version: 22.7.0
   resolution: "electron-publish@npm:22.7.0"
@@ -17970,6 +17992,7 @@ __metadata:
     dnslink-cloudflare: ^2.0.4
     electron: 8.3.0
     electron-builder: ^22.7.0
+    electron-builder-notarize: ^1.1.2
     i18next-scanner: ^2.11.0
     react: ^16.13.1
     react-dom: ^16.13.1
@@ -19387,7 +19410,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"read-pkg-up@npm:^7.0.1":
+"read-pkg-up@npm:^7.0.0, read-pkg-up@npm:^7.0.1":
   version: 7.0.1
   resolution: "read-pkg-up@npm:7.0.1"
   dependencies: