Merge pull request #2939 from balena-io/update-macos-catalina

Make Etcher work on macOS Catalina

.gitattributes

@@ -26,6 +26,7 @@ Makefile text
 *.patch text
 *.txt text
 CODEOWNERS text
+*.plist text
 
 # Binary files (no line-ending conversions)
 *.bz2 binary diff=hex

.resinci.json

@@ -42,6 +42,9 @@
         "!node_modules/**/.eslintrc.yml",
         "!node_modules/**/.eslintignore",
         "!node_modules/**/.publishrc",
+        "assets/icon.png",
+        "build/**/*.node",
+        "lib",
         "!lib/gui/app",
         "lib/gui/app/index.html",
         "generated",
@@ -78,8 +81,13 @@
         "node_modules/roboto-fontface/fonts/roboto/Roboto-Medium.woff",
         "node_modules/roboto-fontface/fonts/roboto/Roboto-Bold.woff"
       ],
+      "afterSign": "./afterSignHook.js",
       "mac": {
-        "category": "public.app-category.developer-tools"
+        "asar": false,
+        "category": "public.app-category.developer-tools",
+        "hardenedRuntime": true,
+        "entitlements": "entitlements.mac.plist",
+        "entitlementsInherit": "entitlements.mac.plist"
       },
       "dmg": {
         "iconSize": 110,

Makefile

@@ -170,7 +170,7 @@ lint-spell:
 		--dictionary - \
 		--dictionary dictionary.txt \
 		--skip *.svg *.gz,*.bz2,*.xz,*.zip,*.img,*.dmg,*.iso,*.rpi-sdcard,*.wic,.DS_Store,*.dtb,*.dtbo,*.dat,*.elf,*.bin,*.foo,xz-without-extension \
-		lib tests docs scripts Makefile *.md LICENSE
+		lib tests docs Makefile *.md LICENSE
 
 lint: lint-ts lint-js lint-sass lint-cpp lint-html lint-spell
 

afterSignHook.js

@@ -0,0 +1,22 @@
+'use strict'
+
+const { notarize } = require('electron-notarize')
+
+async function main(context) {
+  const { electronPlatformName, appOutDir } = context
+  if (electronPlatformName !== 'darwin') {
+    return
+  }
+
+  const appName = context.packager.appInfo.productFilename
+  const appleId = 'accounts+apple@balena.io'
+
+  await notarize({
+    appBundleId: 'io.balena.etcher',
+    appPath: `${appOutDir}/${appName}.app`,
+    appleId,
+    appleIdPassword: `@keychain:Application Loader: ${appleId}`
+  })
+}
+
+exports.default = main

electron-builder.yml

@@ -12,8 +12,12 @@ files:
   - assets/icon.png
   - node_modules/**/*
 mac:
+  asar: false
   icon: assets/icon.icns
   category: public.app-category.developer-tools
+  hardenedRuntime: true
+  entitlements: "entitlements.mac.plist"
+  entitlementsInherit: "entitlements.mac.plist"
 dmg:
   background: assets/dmg/background.tiff
   icon: assets/icon.icns

entitlements.mac.plist

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.device.usb</key>
+    <true/>
+    <key>com.apple.security.files.user-selected.read-only</key>
+    <true/>
+    <key>com.apple.security.network.client</key>
+    <true/>
+  </dict>
+</plist>

lib/gui/app/modules/image-writer.js

@@ -21,7 +21,6 @@ const _ = require('lodash')
 const path = require('path')
 const os = require('os')
 const ipc = require('node-ipc')
-const isRunningInAsar = require('electron-is-running-in-asar')
 const electron = require('electron')
 const store = require('../models/store')
 const settings = require('../models/settings')
@@ -41,27 +40,6 @@ const selectionState = require('../models/selection-state')
  */
 const THREADS_PER_CPU = 16
 
-/**
- * @summary Get application entry point
- * @function
- * @private
- *
- * @returns {String} entry point
- *
- * @example
- * const entryPoint = imageWriter.getApplicationEntryPoint()
- */
-const getApplicationEntryPoint = () => {
-  if (isRunningInAsar()) {
-    return path.join(process.resourcesPath, 'app.asar')
-  }
-
-  const relativeEntryPoint = _.last(electron.remote.process.argv)
-
-  const PROJECT_ROOT = path.join(__dirname, '..', '..', '..', '..')
-  return path.resolve(PROJECT_ROOT, relativeEntryPoint)
-}
-
 /**
  * @summary Handle a flash  error and log it to analytics
  * @function
@@ -206,7 +184,7 @@ exports.performWrite = (image, drives, onProgress) => {
     })
 
     const argv = _.attempt(() => {
-      let entryPoint = getApplicationEntryPoint()
+      let entryPoint = electron.remote.app.getAppPath()
 
       // AppImages run over FUSE, so the files inside the mount point
       // can only be accessed by the user that mounted the AppImage.

lib/shared/catalina-sudo/sudo-askpass.osascript.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env osascript -l JavaScript
+
+/* eslint-disable */
+
+ObjC.import('stdlib')
+
+const app = Application.currentApplication()
+app.includeStandardAdditions = true
+
+const result = app.displayDialog('balenaEtcher wants to make changes. Type your password to allow this.', {
+  defaultAnswer: '',
+  withIcon: 'stop',
+  buttons: ['Cancel', 'Ok'],
+  defaultButton: 'Ok',
+  hiddenAnswer: true,
+})
+
+if (result.buttonReturned === 'Ok') {
+  result.textReturned
+} else {
+  $.exit(255)
+}
+

lib/shared/catalina-sudo/sudo.js

@@ -0,0 +1,42 @@
+'use strict'
+
+const { execFile } = require('child_process')
+const { env } = require('process')
+const { join } = require('path')
+const { promisify } = require('util')
+
+const execFileAsync = promisify(execFile)
+
+const SUCCESSFUL_AUTH_MARKER = 'AUTHENTICATION SUCCEEDED'
+const EXPECTED_SUCCESSFUL_AUTH_MARKER = `${SUCCESSFUL_AUTH_MARKER}\n`
+
+exports.sudo = async (command) => {
+  try {
+    const { stdout, stderr } = await execFileAsync(
+      'sudo',
+      [ '--askpass', 'sh', '-c', `echo ${SUCCESSFUL_AUTH_MARKER} && ${command}` ],
+      {
+        encoding: 'utf8',
+        env: {
+          PATH: env.PATH,
+          SUDO_ASKPASS: join(__dirname, 'sudo-askpass.osascript.js')
+        }
+      }
+    )
+    return {
+      cancelled: false,
+      stdout: stdout.slice(EXPECTED_SUCCESSFUL_AUTH_MARKER.length),
+      stderr
+    }
+  } catch (error) {
+    /* eslint-disable-next-line no-magic-numbers */
+    if (error.code === 1) {
+      /* eslint-disable-next-line lodash/prefer-lodash-method */
+      if (!error.stdout.startsWith(EXPECTED_SUCCESSFUL_AUTH_MARKER)) {
+        return { cancelled: true }
+      }
+      error.stdout = error.stdout.slice(EXPECTED_SUCCESSFUL_AUTH_MARKER.length)
+    }
+    throw error
+  }
+}

lib/shared/permissions.js

@@ -23,12 +23,14 @@ const childProcess = Bluebird.promisifyAll(require('child_process'))
 const fs = require('fs')
 const _ = require('lodash')
 const os = require('os')
+const semver = require('semver')
 const sudoPrompt = Bluebird.promisifyAll(require('sudo-prompt'))
 const { promisify } = require('util')
 
 const errors = require('./errors')
 
 const { tmpFileDisposer } = require('./utils')
+const { sudo: catalinaSudo } = require('./catalina-sudo/sudo')
 
 const writeFileAsync = promisify(fs.writeFile)
 
@@ -154,6 +156,16 @@ const elevateScriptUnix = async (path, name) => {
   return { cancelled: false }
 }
 
+const elevateScriptCatalina = async (path) => {
+  const cmd = [ 'sh', escapeSh(path) ].join(' ')
+  try {
+    const { cancelled } = await catalinaSudo(cmd)
+    return { cancelled }
+  } catch (error) {
+    return errors.createError({ title: error.stderr })
+  }
+}
+
 /**
  * @summary Elevate a command
  * @function
@@ -190,6 +202,10 @@ exports.elevateCommand = async (command, options) => {
     if (isWindows) {
       return elevateScriptWindows(path)
     }
+    if (os.platform() === 'darwin' && semver.compare(os.release(), '19.0.0') >= 0) {
+      // >= macOS Catalina
+      return elevateScriptCatalina(path)
+    }
     try {
       return await elevateScriptUnix(path, options.applicationName)
     } catch (error) {

package.json

@@ -52,7 +52,6 @@
     "color": "^2.0.1",
     "d3": "^4.13.0",
     "debug": "^3.1.0",
-    "electron-is-running-in-asar": "^1.0.0",
     "electron-updater": "4.0.6",
     "etcher-sdk": "^2.0.13",
     "flexboxgrid": "^6.3.0",
@@ -92,8 +91,9 @@
     "babel-loader": "^8.0.4",
     "chalk": "^1.1.3",
     "electron": "3.1.9",
-    "electron-builder": "^20.40.2",
+    "electron-builder": "^22.1.0",
     "electron-mocha": "^6.0.4",
+    "electron-notarize": "^0.1.1",
     "eslint": "^4.17.0",
     "eslint-config-standard": "^10.2.1",
     "eslint-plugin-import": "^2.9.0",

scripts/resin

@@ -1 +1 @@
-Subproject commit 1b5bb595fe00a81e9a12df654c9909e674997dd9
+Subproject commit 39270eb2e5d72652f42f91ccd4cee1a66d41e06e