From fe32d96f5249a880dd1aabfe1e01f9a095620d9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20J=C3=B3=C5=BAwiak?= Date: Mon, 1 Jun 2020 21:53:41 +0200 Subject: [PATCH] Code signing and Notarization (#2794) * Add configuration signing fields in github-actions * Add test github workflow * wip * wip * Change release name steps for releasing and remove test workflow * Add test gh workflow * Add electron app notarization * Remove test-release gh workflow * Remove category in mac build config * fix packElectron:mac script * Change case for all secrets to uppercase * [WIP] Temporary commit to verify signing on PR branch. * Revert temporary changes. * Update version in changelog. Co-authored-by: Krzysztof Jelski --- .github/workflows/push-master.yml | 25 ++++++++++++++++++- CHANGELOG.md | 2 +- package.json | 9 ++++++- .../appleEntitlements/entitlements.mac.plist | 12 +++++++++ yarn.lock | 25 ++++++++++++++++++- 5 files changed, 69 insertions(+), 4 deletions(-) create mode 100644 packages/apps-electron/appleEntitlements/entitlements.mac.plist diff --git a/.github/workflows/push-master.yml b/.github/workflows/push-master.yml index 5a8d4ef1ea..271d601f72 100644 --- a/.github/workflows/push-master.yml +++ b/.github/workflows/push-master.yml @@ -43,13 +43,36 @@ jobs: - uses: actions/checkout@v1 with: token: ${{ secrets.GH_PAT }} + + - name: Prepare for app notarization (macOS) + if: startsWith(matrix.os, 'macos') + # Import Apple API key for app notarization on macOS + run: | + mkdir -p ~/private_keys/ + echo '${{ secrets.API_KEY }}' > ~/private_keys/AuthKey_${{ secrets.API_KEY_ID }}.p8 + - name: Build/release Electron app uses: samuelmeuli/action-electron-builder@v1 with: + # Base64-encoded code signing certificate for macOS + mac_certs: ${{ secrets.MAC_CERTS }} + # Password for decrypting `mac_certs` + mac_certs_password: ${{ secrets.MAC_CERTS_PASSWORD }} + # Base64-encoded code signing certificate for Windows + windows_certs: ${{ secrets.WINDOWS_CERTS }} + # Password for decrypting `windows_certs` + windows_certs_password: ${{ secrets.WINDOWS_CERTS_PASSWORD }} # GitHub token, automatically provided to the action # (No need to define this secret in the repo settings) - github_token: ${{ secrets.github_token }} + github_token: ${{ secrets.GITHUB_TOKEN }} build_script_name: build:release:electron + # If the commit is tagged with a version (e.g. "v1.0.0"), + # release the app after building + release: ${{ startsWith(github.ref, 'refs/tags/v') }} + env: + # macOS notarization API key + API_KEY_ID: ${{ secrets.API_KEY_ID }} + API_KEY_ISSUER_ID: ${{ secrets.API_KEY_ISSUER_ID }} # dummy, GH actions fails outright when all steps are skipped (like it can be above) dummy: diff --git a/CHANGELOG.md b/CHANGELOG.md index 350c296539..db306f9422 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # CHANGELOG -## 0.44.0-beta.30 +## 0.44.0-beta.37 Jun 1, 2020 - Publish electron images on release (Thanks to https://github.com/EthWorks) - Adjust with latest Arcardia types (Thanks to https://github.com/ETeissonniere) diff --git a/package.json b/package.json index b0b18f445e..19a32607f8 100644 --- a/package.json +++ b/package.json @@ -16,7 +16,8 @@ "artifactName": "Polkadot-JS-Apps-${version}.${ext}", "files": [ "./packages/apps-electron/build", - "./packages/apps-electron/assets" + "./packages/apps-electron/assets", + "./packages/apps-electron/appleEntitlements" ], "appId": "com.polkadotjs.polkadotjs-apps", "mac": { @@ -26,6 +27,11 @@ "directories": { "buildResources": "./packages/apps-electron/assets", "output": "./packages/apps-electron/release" + }, + "afterSign": "electron-builder-notarize", + "mac": { + "hardenedRuntime": true, + "entitlements": "./packages/apps-electron/appleEntitlements/entitlements.mac.plist" } }, "resolutions": { @@ -95,6 +101,7 @@ "dnslink-cloudflare": "^2.0.4", "electron": "8.3.0", "electron-builder": "^22.7.0", + "electron-builder-notarize": "^1.1.2", "i18next-scanner": "^2.11.0", "react": "^16.13.1", "react-dom": "^16.13.1", diff --git a/packages/apps-electron/appleEntitlements/entitlements.mac.plist b/packages/apps-electron/appleEntitlements/entitlements.mac.plist new file mode 100644 index 0000000000..46f43d4a07 --- /dev/null +++ b/packages/apps-electron/appleEntitlements/entitlements.mac.plist @@ -0,0 +1,12 @@ + + + + + com.apple.security.cs.allow-jit + + com.apple.security.cs.allow-unsigned-executable-memory + + com.apple.security.cs.allow-dyld-environment-variables + + + diff --git a/yarn.lock b/yarn.lock index f8e77dc964..f380c92e0d 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9424,6 +9424,18 @@ __metadata: languageName: node linkType: hard +"electron-builder-notarize@npm:^1.1.2": + version: 1.1.2 + resolution: "electron-builder-notarize@npm:1.1.2" + dependencies: + electron-notarize: ^0.2.0 + read-pkg-up: ^7.0.0 + peerDependencies: + electron-builder: ">= 20.44.4" + checksum: 3/c12bad5083fe41f44b5bfa57484316bf40f12a8158704af4e9d312e16dab3d742b89b69ee2064924992f468a4959e4f977d3c0f1e02d1d34e87bb07cc440aab4 + languageName: node + linkType: hard + "electron-builder@npm:^22.7.0": version: 22.7.0 resolution: "electron-builder@npm:22.7.0" @@ -9449,6 +9461,16 @@ __metadata: languageName: node linkType: hard +"electron-notarize@npm:^0.2.0": + version: 0.2.1 + resolution: "electron-notarize@npm:0.2.1" + dependencies: + debug: ^4.1.1 + fs-extra: ^8.1.0 + checksum: 3/884d282a0b515f8ae6bba56d4b0871f335bbf5a1016cdfac4c74e4f0a77f0c92d05483d717b51fb659597b879191f55a7b9600d0f50c2eae8b309cdc1aa8578f + languageName: node + linkType: hard + "electron-publish@npm:22.7.0": version: 22.7.0 resolution: "electron-publish@npm:22.7.0" @@ -17970,6 +17992,7 @@ __metadata: dnslink-cloudflare: ^2.0.4 electron: 8.3.0 electron-builder: ^22.7.0 + electron-builder-notarize: ^1.1.2 i18next-scanner: ^2.11.0 react: ^16.13.1 react-dom: ^16.13.1 @@ -19387,7 +19410,7 @@ __metadata: languageName: node linkType: hard -"read-pkg-up@npm:^7.0.1": +"read-pkg-up@npm:^7.0.0, read-pkg-up@npm:^7.0.1": version: 7.0.1 resolution: "read-pkg-up@npm:7.0.1" dependencies: