Skip to content

Commit 36a37e7

Browse files
endorpersandendorpersand
authored
Merge pull request #29 from gt-cs2110/auto-updater
Auto-updater and automatic macOS code signing
2 parents d917282 + 18335f1 commit 36a37e7

File tree

9 files changed

+142
-175
lines changed

9 files changed

+142
-175
lines changed

‎.github/workflows/release.yml‎

Lines changed: 41 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -115,21 +115,52 @@ jobs:
115115
run: npm install
116116
- name: Build backend
117117
run: npm run build-backend
118+
- name: Install Apple certificate
119+
# https://docs.github.com/en/actions/use-cases-and-examples/deploying/installing-an-apple-certificate-on-macos-runners-for-xcode-development#add-a-step-to-your-workflow
120+
# We're not uploading to MAS, so we do not include BUILD_PROVISION_PROFILE_BASE64.
121+
env:
122+
BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
123+
P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
124+
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
125+
run: |
126+
# create variables
127+
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
128+
PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
129+
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
130+
131+
# import certificate and provisioning profile from secrets
132+
echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
133+
134+
# create temporary keychain
135+
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
136+
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
137+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
138+
139+
# import certificate to keychain
140+
security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
141+
security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
142+
security list-keychain -d user -s $KEYCHAIN_PATH
118143
- name: Publish app (macOS)
119144
env:
120145
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
121-
# Apps built on M1 are displayed as "damaged" if they're missing a code signature
122-
# (even if they're perfectly fine).
146+
SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
147+
NOTARIZE_EMAIL: ${{ secrets.NOTARIZE_EMAIL }}
148+
NOTARIZE_PASSWORD: ${{ secrets.NOTARIZE_PASSWORD }}
149+
TEAM_ID: ${{ secrets.TEAM_ID }}
150+
# Note to future developers:
151+
# If we ever lose the Apple dev profile,
152+
# we can return to an ad-hoc signature to get the program to work with warnings.
123153
#
124-
# We aren't going to code-sign, but we can "ad-hoc code sign" (give a blank signature)
125-
# to revert it back to the error that's usually seen on Intel Macs
126-
# ("LC3Tools.app" cannot be opened because Apple cannot check it for malicious software.)
154+
# To do so, remove the `Install the Apple certificate and provisioning profile` step,
155+
# and replace this step with:
156+
# run: |
157+
# npm run package
158+
# codesign --force --deep -s - ./out/*/*.app
159+
# npm run publish -- --skip-package
127160
#
128-
# This unfortunately complicates the command a bit since we have to apply codesign
129-
# in the middle of the publishing process.
161+
# This reverts the program to the error that is usually seen on Intel Macs:
162+
# ("LC3Tools.app" cannot be opened because Apple cannot check it for malicious software.)
130163
#
131164
# https://github.com/electron-userland/electron-builder/issues/5850#issuecomment-1821648559
132165
run: |
133-
npm run package
134-
codesign --force --deep -s - ./out/*/*.app
135-
npm run publish -- --skip-package
166+
npm run publish

‎src/gui/entitlements.plist‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.files.user-selected.read-write</key>
6+
<true/>
7+
<key>com.apple.security.cs.disable-library-validation</key>
8+
<true/>
9+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
10+
<true/>
11+
<key>com.apple.security.cs.allow-jit</key>
12+
<true/>
13+
<key>com.apple.security.device.audio-input</key>
14+
<true/>
15+
<key>com.apple.security.device.bluetooth</key>
16+
<true/>
17+
<key>com.apple.security.device.camera</key>
18+
<true/>
19+
<key>com.apple.security.device.print</key>
20+
<true/>
21+
<key>com.apple.security.device.usb</key>
22+
<true/>
23+
<key>com.apple.security.personal-information.location</key>
24+
<true/>
25+
</dict>
26+
</plist>

‎src/gui/forge.config.ts‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ import type { ForgeConfig } from '@electron-forge/shared-types';
22
import { MakerSquirrel } from '@electron-forge/maker-squirrel';
33
import { MakerDMG } from "@electron-forge/maker-dmg";
44
import { MakerFlatpak } from "@electron-forge/maker-flatpak";
5+
import { MakerZIP } from "@electron-forge/maker-zip";
56
import { PublisherGithub } from '@electron-forge/publisher-github';
67
import { VitePlugin } from '@electron-forge/plugin-vite';
78
import { FusesPlugin } from '@electron-forge/plugin-fuses';
@@ -10,10 +11,24 @@ import { FuseV1Options, FuseVersion } from '@electron/fuses';
1011
const config: ForgeConfig = {
1112
packagerConfig: {
1213
asar: true,
13-
icon: "static/icons/icon"
14+
icon: "static/icons/icon",
15+
osxSign: {
16+
identity: process.env.SIGNING_IDENTITY,
17+
preAutoEntitlements: false,
18+
optionsForFile: (filePath) => {
19+
return {
20+
entitlements: "entitlements.plist",
21+
};
22+
},
23+
},
24+
osxNotarize: {
25+
appleId: process.env.NOTARIZE_EMAIL,
26+
appleIdPassword: process.env.NOTARIZE_PASSWORD,
27+
teamId: process.env.TEAM_ID,
28+
},
1429
},
1530
rebuildConfig: {},
16-
makers: [new MakerSquirrel({}), new MakerDMG(), new MakerFlatpak({
31+
makers: [new MakerSquirrel({}), new MakerDMG(), new MakerZIP({}, ['darwin', 'linux']), new MakerFlatpak({
1732
// Override the default settings:
1833
// Uses `org.freedesktop.Platform//24.08` and `org.freedesktop.SDK//24.08` instead of `19.08`
1934
// Uses zypak v2024.01.17 instead of the default (v2021).

‎src/gui/package.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "LC3Tools",
3-
"version": "4.0.0",
3+
"version": "4.0.1",
44
"author": "gt-cs2110",
55
"description": "LC3Tools frontend",
66
"license": "MIT",
@@ -22,6 +22,7 @@
2222
"@electron-forge/maker-dmg": "~7.4.0",
2323
"@electron-forge/maker-flatpak": "~7.4.0",
2424
"@electron-forge/maker-squirrel": "~7.4.0",
25+
"@electron-forge/maker-zip": "~7.4.0",
2526
"@electron-forge/plugin-auto-unpack-natives": "~7.4.0",
2627
"@electron-forge/plugin-fuses": "~7.4.0",
2728
"@electron-forge/plugin-vite": "~7.4.0",
@@ -51,6 +52,7 @@
5152
"electron-store": "^10.0.0",
5253
"lc3-backend": "file:../backend",
5354
"pinia": "^2.2.4",
55+
"update-electron-app": "^3.0.0",
5456
"vue": "^3.5.10",
5557
"vue-router": "^4.4.5",
5658
"vue3-ace-editor": "^2.2.4",

‎src/gui/pnpm-lock.yaml‎

Lines changed: 48 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)