@rightkit/release 0.2.81 → 0.2.83

package/build-release.mjs

@@ -42,7 +42,7 @@ import { cancelAndReapManagedRequest, firstManagedRequestId, releaseProgressLimi
 // These four files are the ones whose behaviour the cached target directory can
 // outlive.
 
-const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
+const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "notarize-macos.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
 const PIPELINE_FINGERPRINT = createHash("sha256")
   .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
   .digest("hex")
@@ -168,7 +168,26 @@ try {
     // outlived the change that was supposed to retire them.
     pipeline: PIPELINE_FINGERPRINT,
     configSha256: hashFile(configPath),
-    receiptInputs: ["raw-exe", "installer", "embedding"].map((phase) => path.join(receiptRoot, `windows-${phase}.json`)),
+    // Resolve each phase receipt the same way signing does: the config's
+    // sign.receipt / sign.installerReceipt override wins, the default
+    // windows-<phase>.json name is only the fallback. Hardcoding the default
+    // here made the seal read a path the signer never wrote whenever a config
+    // (e.g. an architecture-qualified receipt) overrode it.
+    receiptInputs: ["raw-exe", "installer", "embedding"].map((phase) => {
+      const configured = phase === "raw-exe" ? target.sign?.receipt : phase === "installer" ? target.sign?.installerReceipt : undefined;
+      return configured ? path.resolve(appRoot, configured) : path.join(receiptRoot, `windows-${phase}.json`);
+    }),
+  } : platform === "mac" ? {
+    contract: target.signingContract ?? "<missing>",
+    pipeline: PIPELINE_FINGERPRINT,
+    configSha256: hashFile(configPath),
+    // Mac portable releases produce one Developer ID receipt before packaging
+    // and one Accepted notarization receipt after. Both must be part of cache
+    // identity and seal evidence, including configured receipt overrides.
+    receiptInputs: [
+      target.sign?.receipt ? path.resolve(appRoot, target.sign.receipt) : path.join(receiptRoot, "macos-signing.json"),
+      target.notarize?.receipt ? path.resolve(appRoot, target.notarize.receipt) : path.join(receiptRoot, "macos-notarization.json"),
+    ],
   } : null;
   if (signingIdentity) inputHashes[".right-release/signing-identity.json"] = hashFileText(JSON.stringify(signingIdentity));
   const cargoLock = nativeLayout.lockPath;
@@ -435,7 +454,15 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     commit,
     platform,
     cacheKey,
-    signing: signingIdentity ? { ...signingIdentity, receipts: signingIdentity.receiptInputs.map((file) => ({ file, sha256: hashFile(file) })) } : null,
+    // Portable contracts sign only raw executables — installer/embedding
+    // receipts legitimately never exist there. Seal every receipt that was
+    // produced, but never zero: a signed platform with no receipt at all is
+    // an unsound seal, not a portable release.
+    signing: signingIdentity ? { ...signingIdentity, receipts: (() => {
+      const present = signingIdentity.receiptInputs.filter((file) => existsSync(file));
+      if (present.length === 0) throw new Error(`no signing receipts found to seal; expected at least ${signingIdentity.receiptInputs[0]}`);
+      return present.map((file) => ({ file, sha256: hashFile(file) }));
+    })() } : null,
     files,
     routes,
     inputs: inputHashes,

package/macos-signing-contract.mjs

@@ -0,0 +1 @@
+export const MACOS_PORTABLE_SIGNING_CONTRACT = "macos-developer-id-notarized-portable-v1";

package/notarize-macos.mjs

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { notarytoolAuthArgs } from "./notary-auth.mjs";
+import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+
+const args = process.argv.slice(2);
+const dryRun = args.includes("--dry-run");
+const receiptIndex = args.indexOf("--receipt");
+const profileIndex = args.indexOf("--profile");
+const receiptPath = receiptIndex >= 0 ? args[receiptIndex + 1] : null;
+const profile = profileIndex >= 0 ? args[profileIndex + 1] : undefined;
+const archiveArgs = args.filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && arg !== "--profile" && (receiptIndex < 0 || index !== receiptIndex + 1) && (profileIndex < 0 || index !== profileIndex + 1));
+if (archiveArgs.length !== 1) fail("usage: node notarize-macos.mjs [--dry-run] --receipt <path> [--profile <name>] <archive>");
+if (!receiptPath) fail("--receipt requires a path");
+const archive = path.resolve(archiveArgs[0]);
+if (dryRun) {
+  console.log(`dry-run: notarize ${archive}`);
+  process.exit(0);
+}
+if (process.platform !== "darwin") fail("macOS notarization must run on macOS");
+if (!existsSync(archive)) fail(`missing archive: ${archive}`);
+
+let authArgs;
+try { authArgs = notarytoolAuthArgs({ profile }); } catch (error) { fail(error.message); }
+const output = run("xcrun", ["notarytool", "submit", archive, "--wait", "--output-format", "json", ...authArgs]);
+let result;
+try { result = JSON.parse(output); } catch { fail(`notarytool did not return JSON for ${archive}`); }
+if (result.status !== "Accepted") fail(`notarization was not accepted for ${archive}: ${result.status ?? "missing status"}`);
+
+const absoluteReceipt = path.resolve(receiptPath);
+mkdirSync(path.dirname(absoluteReceipt), { recursive: true });
+writeFileSync(absoluteReceipt, `${JSON.stringify({
+  schema: 1,
+  signingContract: MACOS_PORTABLE_SIGNING_CONTRACT,
+  archive: { file: archive, ...fileEvidence(archive) },
+  notarization: { status: result.status, id: result.id ?? result.submissionId ?? null },
+}, null, 2)}\n`);
+
+function fileEvidence(file) {
+  const bytes = readFileSync(file);
+  return { sha256: createHash("sha256").update(bytes).digest("hex"), sizeBytes: statSync(file).size };
+}
+
+function run(cmd, runArgs) {
+  const result = spawnSync(cmd, runArgs, { encoding: "utf8" });
+  const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
+  if (result.status !== 0) fail(`${cmd} ${runArgs.join(" ")} failed: ${output}`);
+  return output;
+}
+
+function fail(message) {
+  console.error(`right-notarize-macos: ${message}`);
+  process.exit(1);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.81",
+  "version": "0.2.83",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { access, readFile, readdir } from "node:fs/promises";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
@@ -22,11 +22,14 @@ import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
 import { terminateProcessTree } from "./heavy-command.mjs";
 import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
+import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
+const SIGN_MACOS = path.resolve(TOOL_ROOT, "sign-macos.mjs");
+const NOTARIZE_MACOS = path.resolve(TOOL_ROOT, "notarize-macos.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
 const RIGHTKIT_VERSIONS = JSON.parse(readFileSync(path.resolve(TOOL_ROOT, "rightkit-versions.json"), "utf8"));
 const VERSION = RIGHTKIT_VERSIONS.stagedNpm?.["@rightkit/release"] ?? RIGHTKIT_VERSIONS.npm["@rightkit/release"];
@@ -124,6 +127,12 @@ if (opts.platform === "win") {
   if (isNsis && target.sign.prePackageFiles.some((file) => target.sign.files.includes(file))) fail(`${config.app ?? "app"} win raw EXE and installer signing files must be distinct`);
   if (isPortable && target.sign?.files?.length) fail(`${config.app ?? "app"} win portable release must sign every executable through sign.prePackageFiles and omit sign.files`);
 }
+if (opts.platform === "mac") {
+  if (target.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT) fail(`${config.app ?? "app"} mac must declare signingContract: ${MACOS_PORTABLE_SIGNING_CONTRACT}`);
+  if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} mac must declare prePackage to materialize Developer ID signing files`);
+  if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} mac must declare at least one sign.prePackageFiles`);
+  if (!target.notarize?.file) fail(`${config.app ?? "app"} mac must declare notarize.file`);
+}
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
  * Assemble preflight inputs from the app's own files. Kept here (not in
@@ -240,6 +249,11 @@ if (opts.platform === "win") {
       signedFiles: rawFiles,
     });
   }
+} else if (opts.platform === "mac") {
+  const signingFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
+  await runCommand(target.prePackage, root);
+  for (const file of signingFiles) await mustExist(file, `missing macOS Developer ID signing artifact: ${file}`);
+  await signMacos(signingFiles, root);
 } else if (nativeAssembly) {
   if (nativeAssembly.packageHook) await runCommand(nativeAssembly.packageHook, root);
   if (nativeFinalizer) {
@@ -279,6 +293,12 @@ if (target.postSign && opts.platform !== "win") {
   await runCommand(target.postSign, root);
 }
 
+if (opts.platform === "mac") {
+  const archive = path.resolve(root, target.notarize.file);
+  await mustExist(archive, `missing macOS notarization archive: ${archive}`);
+  await notarizeMacos(archive, root);
+}
+
 {
   const scanTargets = target.hardening ?? target.artifacts ?? [];
   if (scanTargets.length) {
@@ -378,6 +398,12 @@ async function runNativeFinalizer({ finalizer, nativeAssembly, target, root, sig
     ...finalizer,
     args: finalizer.args.map((arg) => expandFinalizerToken(arg, { provenance, outputPath, packageIdentity })),
   };
+  // A finalization receipt at outputPath from a PREVIOUS run must not
+  // survive into this one: the file is preferred over the finalizer's
+  // stdout below, and a stale receipt carries the prior run's provenance,
+  // which fails the identity check against this run's mint. Any file
+  // present after the finalizer returns was written by this run.
+  if (!opts.dryRun) rmSync(outputPath, { force: true });
   const stdout = await runCommand(finalizerCommand, root, {
     captureStdout: true,
     env: {
@@ -645,9 +671,14 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     if (!source.startsWith("# Managed by right-git")) {
       fail(`${appName} ${workflow} is not marked as right-git managed`);
     }
+    const requestedSecrets = [...source.matchAll(/\bsecrets\.([A-Z0-9_]+)/gi)].map((match) => match[1]);
+    const allowedMacosSecrets = new Set(["APPLE_CERTIFICATE_BASE64", "APPLE_CERTIFICATE_PASSWORD", "APPLE_KEYCHAIN_PASSWORD", "APPLE_API_KEY_BASE64", "APPLE_API_KEY", "APPLE_API_ISSUER"]);
+    const macosSigningAllowed = workflow === "release-candidate.yml" && manifest?.candidate?.signMacos === true;
     if (/^\s*permissions:\s*write-all\s*$/mi.test(source)
       || /^\s*(?:actions|attestations|checks|contents|deployments|discussions|id-token|issues|models|packages|pages|pull-requests|security-events|statuses):\s*write\s*$/mi.test(source)
-      || /\bsecrets\s*(?:\.|\[)/i.test(source)) {
+      || /pull_request_target\s*:/i.test(source)
+      || /\bsecrets\s*\[/i.test(source)
+      || requestedSecrets.some((name) => !macosSigningAllowed || !allowedMacosSecrets.has(name))) {
       fail(`${appName} right-git managed ${workflow} requests release-capable permissions or secrets`);
     }
   }
@@ -699,6 +730,58 @@ function windowsReceiptPath(root, phase) {
   return path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
 }
 
+async function signMacos(files, root) {
+  const receipt = macosReceiptPath(root, "signing");
+  const args = [SIGN_MACOS];
+  if (opts.dryRun) args.push("--dry-run");
+  args.push("--receipt", receipt, ...files);
+  if (!opts.dryRun && existsSync(receipt)) unlinkSync(receipt);
+  console.log("right-release: signing macOS Developer ID files");
+  await run("node", args, root);
+  if (!opts.dryRun) verifyMacosSigningReceipt(receipt, files);
+}
+
+async function notarizeMacos(archive, root) {
+  const receipt = macosReceiptPath(root, "notarization");
+  const args = [NOTARIZE_MACOS];
+  if (opts.dryRun) args.push("--dry-run");
+  args.push("--receipt", receipt);
+  if (target.notarize.profile) args.push("--profile", target.notarize.profile);
+  args.push(archive);
+  if (!opts.dryRun && existsSync(receipt)) unlinkSync(receipt);
+  console.log("right-release: notarizing macOS archive");
+  await run("node", args, root);
+  if (!opts.dryRun) verifyMacosNotarizationReceipt(receipt, archive);
+}
+
+function macosReceiptPath(root, phase) {
+  const configured = phase === "signing" ? target.sign?.receipt : target.notarize?.receipt;
+  if (configured) return path.resolve(root, configured);
+  return path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `macos-${phase}.json`);
+}
+
+function verifyMacosSigningReceipt(receipt, files) {
+  if (!existsSync(receipt)) fail(`missing macOS Developer ID signing receipt: ${receipt}`);
+  let evidence;
+  try { evidence = JSON.parse(readFileSync(receipt, "utf8")); } catch { fail(`invalid macOS Developer ID signing receipt: ${receipt}`); }
+  const expectedIdentity = process.env.APPLE_DEVELOPER_ID?.trim();
+  const expected = files.map((file) => path.resolve(file)).sort();
+  const actual = Array.isArray(evidence.files) ? evidence.files.map((item) => path.resolve(item.file)).sort() : [];
+  const hashes = new Map(files.map((file) => [path.resolve(file), createHash("sha256").update(readFileSync(file)).digest("hex")]));
+  if (evidence.schema !== 1 || evidence.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT || !expectedIdentity || evidence.identity !== expectedIdentity
+    || JSON.stringify(expected) !== JSON.stringify(actual)
+    || evidence.files.some((item) => item.codesign !== "strict-valid" || item.identity !== expectedIdentity || item.timestampPresent !== true || item.after?.sha256 !== hashes.get(path.resolve(item.file)))) fail(`invalid macOS Developer ID signing receipt evidence: ${receipt}`);
+}
+
+function verifyMacosNotarizationReceipt(receipt, archive) {
+  if (!existsSync(receipt)) fail(`missing macOS notarization receipt: ${receipt}`);
+  let evidence;
+  try { evidence = JSON.parse(readFileSync(receipt, "utf8")); } catch { fail(`invalid macOS notarization receipt: ${receipt}`); }
+  const sha256 = createHash("sha256").update(readFileSync(archive)).digest("hex");
+  if (evidence.schema !== 1 || evidence.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT || path.resolve(evidence.archive?.file ?? "") !== archive
+    || evidence.archive?.sha256 !== sha256 || evidence.notarization?.status !== "Accepted") fail(`invalid macOS notarization receipt evidence: ${receipt}`);
+}
+
 /**
  * Close the gap between "the raw EXE was signed" and "the installer ships that
  * EXE". Three independent facts, each able to fail on its own:

package/rightkit-versions.json

@@ -14,7 +14,7 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.1",
-    "@rightkit/git": "0.2.5",
+    "@rightkit/git": "0.2.7",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.81",
+    "@rightkit/release": "0.2.83",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
@@ -34,7 +34,9 @@
       "0.2.1",
       "0.2.2",
       "0.2.3",
-      "0.2.4"
+      "0.2.4",
+      "0.2.5",
+      "0.2.6"
     ],
     "@rightkit/legal-ui": [
       "0.1.0"
@@ -81,7 +83,8 @@
       "0.2.73",
       "0.2.74",
       "0.2.75",
-      "0.2.76"
+      "0.2.76",
+      "0.2.82"
     ],
     "@rightkit/qa": [
       "0.1.0",

package/sign-macos.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+
+const args = process.argv.slice(2);
+const dryRun = args.includes("--dry-run");
+const receiptIndex = args.indexOf("--receipt");
+const receiptPath = receiptIndex >= 0 ? args[receiptIndex + 1] : null;
+const files = args
+  .filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && (receiptIndex < 0 || index !== receiptIndex + 1))
+  .map((arg) => path.resolve(arg));
+
+if (!files.length) fail("usage: node sign-macos.mjs [--dry-run] --receipt <path> <file>...");
+if (!receiptPath) fail("--receipt requires a path");
+if (dryRun) {
+  console.log(`dry-run: Developer ID signing ${files.join(", ")}`);
+  process.exit(0);
+}
+if (process.platform !== "darwin") fail("macOS signing must run on macOS");
+const identity = process.env.APPLE_DEVELOPER_ID?.trim();
+if (!identity) fail("set APPLE_DEVELOPER_ID to an installed Developer ID Application signing identity");
+for (const file of files) if (!existsSync(file)) fail(`missing file: ${file}`);
+
+const evidence = [];
+for (const file of files) {
+  const before = fileEvidence(file);
+  run("codesign", ["--force", "--options", "runtime", "--timestamp", "--sign", identity, file]);
+  const verification = run("codesign", ["--verify", "--strict", "--verbose=4", file]);
+  const details = run("codesign", ["-dvv", file]);
+  if (!/valid on disk/i.test(verification) || !/satisfies its designated requirement/i.test(verification)) {
+    fail(`strict codesign verification failed for ${file}`);
+  }
+  if (!new RegExp(`^Authority=${escapeRegExp(identity)}$`, "m").test(details) && !details.includes(`Authority=${identity}`)) {
+    fail(`codesign identity mismatch for ${file}: expected ${identity}`);
+  }
+  evidence.push({ file, before, after: fileEvidence(file), codesign: "strict-valid", identity, timestampPresent: /(?:Timestamp|Signed Time)[=:]/i.test(details) });
+  if (!evidence.at(-1).timestampPresent) fail(`Developer ID timestamp is missing for ${file}`);
+}
+
+const absoluteReceipt = path.resolve(receiptPath);
+mkdirSync(path.dirname(absoluteReceipt), { recursive: true });
+writeFileSync(absoluteReceipt, `${JSON.stringify({ schema: 1, signingContract: MACOS_PORTABLE_SIGNING_CONTRACT, identity, files: evidence }, null, 2)}\n`);
+
+function fileEvidence(file) {
+  const bytes = readFileSync(file);
+  return { sha256: createHash("sha256").update(bytes).digest("hex"), sizeBytes: statSync(file).size };
+}
+
+function run(cmd, runArgs) {
+  const result = spawnSync(cmd, runArgs, { encoding: "utf8" });
+  const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+  if (result.status !== 0) fail(`${cmd} ${runArgs.join(" ")} failed: ${output.trim()}`);
+  return output;
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function fail(message) {
+  console.error(`right-sign-macos: ${message}`);
+  process.exit(1);
+}

package/sign-release-manifest.mjs

@@ -13,7 +13,6 @@ export const RIGHTRELEASE_MANIFEST_SIGNER = Object.freeze({
 
 const EXCLUDE_CREDENTIALS = [
   "ManagedIdentityCredential",
-  "WorkloadIdentityCredential",
   "SharedTokenCacheCredential",
   "VisualStudioCredential",
   "VisualStudioCodeCredential",

package/sign-windows.mjs

@@ -7,7 +7,6 @@ import { spawnSync } from "node:child_process";
 
 const EXCLUDE_CREDENTIALS = [
   "ManagedIdentityCredential",
-  "WorkloadIdentityCredential",
   "SharedTokenCacheCredential",
   "VisualStudioCredential",
   "VisualStudioCodeCredential",