| 1 | #!/usr/bin/env node |
| 2 | // Sign the final bundle, after desktop-build.sh adds the Go service and CLI. |
| 3 | // codesign --deep does not discover all code in Resources or nested frameworks. |
| 4 | import { sign } from "@electron/osx-sign"; |
| 5 | import { join, resolve } from "node:path"; |
| 6 | import { fileURLToPath } from "node:url"; |
| 7 | import { PRODUCT } from "./lib.mjs"; |
| 8 | |
| 9 | export async function signMacOS(app, identity) { |
| 10 | if (!app || !identity) throw new Error("app and signing identity are required"); |
| 11 | const adhoc = identity === "-"; |
| 12 | const bundle = resolve(app); |
| 13 | await sign({ |
| 14 | app: bundle, |
| 15 | identity, |
| 16 | identityValidation: !adhoc, |
| 17 | platform: "darwin", |
| 18 | type: "distribution", |
| 19 | preAutoEntitlements: false, |
| 20 | preEmbedProvisioningProfile: false, |
| 21 | strictVerify: true, |
| 22 | // Signing the main executable also seals its app. Defer it to osx-sign's |
| 23 | // final app signing call, after the adjacent Go service has been signed. |
| 24 | ignore: [(file) => file === join(bundle, "Contents", "MacOS", PRODUCT.executable)], |
| 25 | optionsForFile: () => ({ |
| 26 | entitlements: fileURLToPath(new URL("../build/darwin/entitlements.plist", import.meta.url)), |
| 27 | hardenedRuntime: true, |
| 28 | ...(adhoc ? { timestamp: "none" } : {}), |
| 29 | }), |
| 30 | }); |
| 31 | } |
| 32 | |
| 33 | if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { |
| 34 | await signMacOS(...process.argv.slice(2)); |
| 35 | } |
| 36 |