From 77d9fadc83a7910256f9ac1f14c81e134445e3cb Mon Sep 17 00:00:00 2001 From: Juan Cruz Viotti Date: Thu, 7 Apr 2016 05:20:52 -0400 Subject: [PATCH] Codesign OS X app inside the DMG package This PR fixes a frequent issue users were having where opening `Etcher.app` would result in: "Etcher.app" is damaged and can't be opened. You should move it to the trash. Checking the code-signature of the application returned the following error message: $ spctl -a -v Etcher.app Etcher.app: invalid signature (code or signature have been modified) The solution is based on the following paragraphs from Apple's "OS X Code Signing in Depth" technical note: https://developer.apple.com/library/mac/technotes/tn2206/_index.html > Code signing uses extended attributes to store signatures in non-Mach-O > executables such as script files. If the extended attributes are lost > then the program's identity will be broken. Thus, when you ship your > script, you must use a mechanism that preserves extended attributes. > > One way to guarantee preservation of extended attributes is by packing > up your signed code in a read-write disk image (DMG) file before signing > and then, after signing, converting to read-only. You probably don't > need to use a disk image until the final package stage so another less > heavy-handed method would be to use ZIP or XIP files. In summary, what we now do is: - Create a temporal read-write DMG image. - Perform the code-signing *inside* the DMG image. - Convert the temporal DMG image into a compressed read-only image. Sadly, this custom workflow doesn't fit in `electron-packager` nor `electron-builder`, so we had to re-implement the features those packages provide us in a nice encapsulated way ourselves. Signed-off-by: Juan Cruz Viotti --- Makefile | 94 ++++++++++++++++++++++++++++++++++++++++++++++++---- package.json | 23 ++----------- 2 files changed, 90 insertions(+), 27 deletions(-) diff --git a/Makefile b/Makefile index 7b289cbf..1b203df8 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,6 @@ ELECTRON_PACKAGER=./node_modules/.bin/electron-packager ELECTRON_BUILDER=./node_modules/.bin/electron-builder +ELECTRON_OSX_SIGN=./node_modules/.bin/electron-osx-sign ELECTRON_IGNORE=$(shell node -e "console.log(require('./package.json').packageIgnore.join('|'))") ELECTRON_VERSION=0.36.8 ETCHER_VERSION=$(shell node -e "console.log(require('./package.json').version)") @@ -7,7 +8,7 @@ APPLICATION_NAME=$(shell node -e "console.log(require('./package.json').displayN APPLICATION_DESCRIPTION=$(shell node -e "console.log(require('./package.json').description)") APPLICATION_COPYRIGHT=$(shell node -e "console.log(require('./package.json').copyright)") COMPANY_NAME="Resinio Ltd" -SIGN_IDENTITY_OSX="Rulemotion Ltd (66H43P8FRG)" +SIGN_IDENTITY_OSX="Developer ID Application: Rulemotion Ltd (66H43P8FRG)" S3_BUCKET="resin-production-downloads" sign-win32 = osslsigncode sign \ @@ -33,10 +34,12 @@ etcher-release/Etcher-darwin-x64: . --helper-bundle-id="io.resin.etcher-helper" \ --app-bundle-id="io.resin.etcher" \ --app-category-type="public.app-category.developer-tools" \ - --sign=$(SIGN_IDENTITY_OSX) \ --icon="assets/icon.icns" \ --overwrite \ --out=$(dir $@) + rm $@/LICENSE + rm $@/LICENSES.chromium.html + rm $@/version etcher-release/Etcher-linux-x86: . $(ELECTRON_PACKAGER) . $(APPLICATION_NAME) \ @@ -105,11 +108,88 @@ etcher-release/Etcher-win32-x64: . $(call sign-win32,$@/Etcher.exe) etcher-release/installers/Etcher-darwin-x64.dmg: etcher-release/Etcher-darwin-x64 package.json - $(ELECTRON_BUILDER) "$