(feat) macos code signing, notarization

.github/workflows/release.yml

@@ -0,0 +1,45 @@
+name: Github release workflow
+
+on: workflow_dispatch
+
+jobs:
+  checks:
+    runs-on: macos-latest
+    env:
+      # dont treat warning as error
+      CI: false
+
+    strategy:
+      matrix:
+        node-version: [18.18.x]
+
+    steps:
+      - name: Install sha256sum
+        run:  brew install coreutils
+
+      - name: Checkout Repository
+        uses: actions/checkout@v3
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Pull bfx-hf-ui-core
+        run: npm run fetch-core
+
+      - name: Install
+        run: npm install
+
+      - name: Build for linux/mac/windows
+        env:
+          CSC_KEY_PASSWORD: ${{ secrets.BFX_APPLE_BUILD_CERTIFICATE_B64 }}
+          CSC_LINK: ${{ secrets.BFX_APPLE_BUILD_CERTIFICATE_B64 }}
+          APPLEID: ${{ secrets.BFX_APPLE_ID_USERNAME }}
+          APPLEIDPASS: ${{ secrets.BFX_APPLE_ID_HONEY_PASSWORD }}
+        run: npm run deploy
+
+      - name: Results
+        run: ls -l dist

package.json

@@ -23,17 +23,21 @@
     "directories": {
       "buildResources": "public"
     },
+    "afterSign": "scripts/notarize.js",
     "mac": {
-      "type": "development",
       "icon": "build/icon.png",
+      "category": "public.app-category.productivity",
       "hardenedRuntime": true,
       "gatekeeperAssess": false,
+      "entitlements": "build/entitlements.mac.plist",
+      "entitlementsInherit": "build/entitlements.mac.plist",
       "artifactName": "${productName}-${version}-${arch}-${os}.${ext}",
-      "category": "public.app-category.productivity",
-      "target": [
-        "dir",
-        "zip"
-      ]
+      "target": {
+        "target": "default",
+        "arch": [
+          "x64"
+        ]
+      }
     },
     "win": {
       "icon": "build/icon.png",
@@ -127,6 +131,7 @@
     "browserslist": "^4.22.0",
     "electron": "^26.2.3",
     "electron-builder": "^24.6.4",
+    "electron-notarize": "^1.2.2",
     "electron-packager": "17.1.2",
     "eslint": "^8.50.0",
     "eslint-config-airbnb-base": "^15.0.0",

public/entitlements.mac.plist

@@ -1,24 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
-    <key>com.apple.security.app-sandbox</key>
-    <true/>
-    <key>com.apple.security.network.client</key>
-    <true/>
-    <key>com.apple.security.network.server</key>
-    <true/>
-    <key>com.apple.security.files.user-selected.read-only</key>
-    <true/>
-    <key>com.apple.security.files.user-selected.read-write</key>
-    <true/>
-    <key>com.apple.security.files.user-selected.executable</key>
-    <true/>
-    <key>com.apple.security.device.audio-video-bridging</key>
-    <true/>
-    <key>com.apple.security.personal-information.location</key>
-    <true/>
     <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
     <true/>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
   </dict>

public/lib/app.js

@@ -14,12 +14,6 @@ const windowStateKeeper = require('electron-window-state')
 const os = require('os')
 const { appendFile, mkdir } = require('fs/promises')
 const { existsSync } = require('fs')
-const enforceMacOSAppLocation = require('../../scripts/enforce-macos-app-location')
-const BfxMacUpdater = require('../../scripts/auto-updater/bfx.mac.updater')
-const {
-  showLoadingWindow,
-  hideLoadingWindow,
-} = require('../../scripts/change-loading-win-visibility-state')
 const { createAppMenu } = require('../utils/appMenu')
 const { createAppTray } = require('../utils/tray')
 const syncReadUserSettings = require('../utils/syncReadUserSettings')
@@ -29,19 +23,7 @@ const { ELECTRON_CONTEXT_ALLOWED_URLS } = require('../constants')
 const LOG_DIR_PATH = `${os.tmpdir()}/bfx-hf-ui-logs`
 const APP_LOG_PATH = `${LOG_DIR_PATH}/app.log`
 
-const isElectronDebugMode = process.env.REACT_APP_ELECTRON_DEBUG === 'true'
-
-let autoUpdater = _autoUpdater
-
-if (process.platform === 'darwin') {
-  autoUpdater = new BfxMacUpdater()
-  autoUpdater.addInstallingUpdateEventHandler(() => {
-    return showLoadingWindow({
-      description: 'Updating...',
-      isRequiredToCloseAllWins: true,
-    })
-  })
-}
+const autoUpdater = _autoUpdater
 
 autoUpdater.allowPrerelease = false
 autoUpdater.logger = logger
@@ -269,11 +251,6 @@ module.exports = class HFUIApplication {
     })
 
     autoUpdater.on('update-downloaded', (info) => {
-      const { downloadedFile } = { ...info }
-      if (autoUpdater instanceof BfxMacUpdater) {
-        autoUpdater.setDownloadedFilePath(downloadedFile)
-      }
-
       this.mainWindow.webContents.send('update_downloaded', info)
     })
 
@@ -289,7 +266,6 @@ module.exports = class HFUIApplication {
         }
 
         this.mainWindow.webContents.send('update_error')
-        await hideLoadingWindow({ isRequiredToShowMainWin: false })
       } catch (_err) {
         logger.error('autoUpdater error: ', _err)
       }
@@ -319,10 +295,6 @@ module.exports = class HFUIApplication {
       },
     )
 
-    if (!isElectronDebugMode) {
-      await enforceMacOSAppLocation()
-    }
-
     createAppMenu({
       app: this.app,
       sendOpenSettingsModalMessage: this.sendOpenSettingsModalMessage,