|
| 1 | +/* eslint-disable @typescript-eslint/no-require-imports */ |
| 2 | +/** |
| 3 | + * electron-builder afterSign hook — ad-hoc code signing for macOS. |
| 4 | + * |
| 5 | + * electron-updater's ShipIt process validates code signatures when applying |
| 6 | + * updates. Without a valid signature the update fails with: |
| 7 | + * "Code signature did not pass validation: 代码未能满足指定的代码要求" |
| 8 | + * |
| 9 | + * The previous approach used `codesign --force --deep -s -`, but --deep is |
| 10 | + * unreliable: it does not guarantee correct signing order and may miss nested |
| 11 | + * components, causing kSecCSStrictValidate failures. |
| 12 | + * |
| 13 | + * This script signs each component individually from the inside out: |
| 14 | + * 1. All native binaries (.node, .dylib, .so) |
| 15 | + * 2. All Frameworks (*.framework) |
| 16 | + * 3. All Helper apps (*.app inside Frameworks/) |
| 17 | + * 4. The main .app bundle |
| 18 | + * |
| 19 | + * Runs in the afterSign hook so it executes AFTER electron-builder's own |
| 20 | + * signing step (which is a no-op with CSC_IDENTITY_AUTO_DISCOVERY=false) |
| 21 | + * and right before DMG/ZIP artifact creation. |
| 22 | + */ |
| 23 | +const fs = require('fs'); |
| 24 | +const path = require('path'); |
| 25 | +const { execSync } = require('child_process'); |
| 26 | + |
| 27 | +/** |
| 28 | + * Ad-hoc sign a single path. Failures are logged but non-fatal to avoid |
| 29 | + * breaking builds on edge-case binaries (e.g. debug symbols). |
| 30 | + */ |
| 31 | +function codesign(targetPath) { |
| 32 | + try { |
| 33 | + execSync(`codesign --force --sign - "${targetPath}"`, { |
| 34 | + stdio: 'pipe', |
| 35 | + timeout: 30000, |
| 36 | + }); |
| 37 | + } catch (err) { |
| 38 | + console.warn(`[afterSign] Failed to sign ${targetPath}: ${err.message}`); |
| 39 | + } |
| 40 | +} |
| 41 | + |
| 42 | +/** |
| 43 | + * Recursively collect all files matching the given extensions. |
| 44 | + */ |
| 45 | +function collectFiles(dir, extensions) { |
| 46 | + const results = []; |
| 47 | + if (!fs.existsSync(dir)) return results; |
| 48 | + |
| 49 | + const entries = fs.readdirSync(dir, { withFileTypes: true }); |
| 50 | + for (const entry of entries) { |
| 51 | + const fullPath = path.join(dir, entry.name); |
| 52 | + if (entry.isDirectory()) { |
| 53 | + // Don't descend into .app or .framework bundles — they are signed as a unit |
| 54 | + if (entry.name.endsWith('.app') || entry.name.endsWith('.framework')) { |
| 55 | + continue; |
| 56 | + } |
| 57 | + results.push(...collectFiles(fullPath, extensions)); |
| 58 | + } else if (entry.isFile()) { |
| 59 | + const ext = path.extname(entry.name); |
| 60 | + if (extensions.includes(ext)) { |
| 61 | + results.push(fullPath); |
| 62 | + } |
| 63 | + } |
| 64 | + } |
| 65 | + return results; |
| 66 | +} |
| 67 | + |
| 68 | +/** |
| 69 | + * Collect bundle directories (.app, .framework) at a given depth. |
| 70 | + */ |
| 71 | +function collectBundles(dir, extension) { |
| 72 | + const results = []; |
| 73 | + if (!fs.existsSync(dir)) return results; |
| 74 | + |
| 75 | + const entries = fs.readdirSync(dir, { withFileTypes: true }); |
| 76 | + for (const entry of entries) { |
| 77 | + if (entry.isDirectory() && entry.name.endsWith(extension)) { |
| 78 | + results.push(path.join(dir, entry.name)); |
| 79 | + } |
| 80 | + } |
| 81 | + return results; |
| 82 | +} |
| 83 | + |
| 84 | +module.exports = async function afterSign(context) { |
| 85 | + const platform = context.packager.platform.name; |
| 86 | + if (platform !== 'mac') return; |
| 87 | + |
| 88 | + const appOutDir = context.appOutDir; |
| 89 | + const appName = context.packager.appInfo.productFilename; |
| 90 | + const appPath = path.join(appOutDir, `${appName}.app`); |
| 91 | + |
| 92 | + if (!fs.existsSync(appPath)) { |
| 93 | + console.warn(`[afterSign] macOS app not found at ${appPath}, skipping ad-hoc signing`); |
| 94 | + return; |
| 95 | + } |
| 96 | + |
| 97 | + console.log(`[afterSign] Ad-hoc signing ${appPath} (individual component signing)...`); |
| 98 | + |
| 99 | + const contentsPath = path.join(appPath, 'Contents'); |
| 100 | + const frameworksPath = path.join(contentsPath, 'Frameworks'); |
| 101 | + let signed = 0; |
| 102 | + |
| 103 | + // ── Step 1: Sign all native binaries (.node, .dylib, .so) ───────────── |
| 104 | + // These are the innermost signable items. Must be signed before their |
| 105 | + // enclosing bundles. |
| 106 | + const nativeBinaries = collectFiles(contentsPath, ['.node', '.dylib', '.so']); |
| 107 | + for (const bin of nativeBinaries) { |
| 108 | + codesign(bin); |
| 109 | + signed++; |
| 110 | + } |
| 111 | + if (nativeBinaries.length > 0) { |
| 112 | + console.log(`[afterSign] Signed ${nativeBinaries.length} native binaries (.node/.dylib/.so)`); |
| 113 | + } |
| 114 | + |
| 115 | + // ── Step 2: Sign all Frameworks ─────────────────────────────────────── |
| 116 | + // Frameworks contain nested code that was already signed in step 1 (if any |
| 117 | + // .dylib/.so lived outside the framework) or that --sign covers here. |
| 118 | + const frameworks = collectBundles(frameworksPath, '.framework'); |
| 119 | + for (const fw of frameworks) { |
| 120 | + codesign(fw); |
| 121 | + signed++; |
| 122 | + } |
| 123 | + if (frameworks.length > 0) { |
| 124 | + console.log(`[afterSign] Signed ${frameworks.length} frameworks`); |
| 125 | + } |
| 126 | + |
| 127 | + // ── Step 3: Sign all Helper apps ────────────────────────────────────── |
| 128 | + // Electron ships multiple helper apps (GPU, Plugin, Renderer, etc.) |
| 129 | + const helperApps = collectBundles(frameworksPath, '.app'); |
| 130 | + for (const helper of helperApps) { |
| 131 | + codesign(helper); |
| 132 | + signed++; |
| 133 | + } |
| 134 | + if (helperApps.length > 0) { |
| 135 | + console.log(`[afterSign] Signed ${helperApps.length} helper apps`); |
| 136 | + } |
| 137 | + |
| 138 | + // ── Step 4: Sign the main app bundle ────────────────────────────────── |
| 139 | + codesign(appPath); |
| 140 | + signed++; |
| 141 | + |
| 142 | + console.log(`[afterSign] Ad-hoc signing complete — ${signed} components signed`); |
| 143 | + |
| 144 | + // ── Verify ──────────────────────────────────────────────────────────── |
| 145 | + try { |
| 146 | + execSync(`codesign --verify --strict "${appPath}"`, { |
| 147 | + stdio: 'pipe', |
| 148 | + timeout: 30000, |
| 149 | + }); |
| 150 | + console.log('[afterSign] Signature verification passed (--strict)'); |
| 151 | + } catch (err) { |
| 152 | + console.error('[afterSign] WARNING: Signature verification FAILED:', err.stderr?.toString() || err.message); |
| 153 | + } |
| 154 | +}; |
0 commit comments