app-builder-lib 26.0.0-alpha.4 → 26.0.0-alpha.5

package/out/asar/asarUtil.js

@@ -68,7 +68,8 @@ class AsarPackager {
                 return;
             }
         };
-        const writeFileOrSymlink = async (transformedData, source, destination, stat) => {
+        const writeFileOrSymlink = async (options) => {
+            const { transformedData, file: source, destination, stat, fileSet: { src: sourceDir }, } = options;
             copiedFiles.add(destination);
             // If transformed data, skip symlink logic
             if (transformedData) {
@@ -78,13 +79,13 @@ class AsarPackager {
             if (source === realPathFile) {
                 return this.copyFileOrData(undefined, source, destination, stat);
             }
-            const realPathRelative = path.relative(this.config.appDir, realPathFile);
-            const symlinkTarget = path.resolve(this.rootForAppFilesWithoutAsar, realPathRelative);
+            const realPathRelative = path.relative(sourceDir, realPathFile);
             const isOutsidePackage = realPathRelative.startsWith("..");
             if (isOutsidePackage) {
                 builder_util_1.log.error({ source: builder_util_1.log.filePath(source), realPathFile: builder_util_1.log.filePath(realPathFile) }, `unable to copy, file is symlinked outside the package`);
                 throw new Error(`Cannot copy file (${path.basename(source)}) symlinked to file (${path.basename(realPathFile)}) outside the package as that violates asar security integrity`);
             }
+            const symlinkTarget = path.resolve(this.rootForAppFilesWithoutAsar, realPathRelative);
             await this.copyFileOrData(undefined, source, symlinkTarget, stat);
             const target = path.relative(path.dirname(destination), symlinkTarget);
             fsNode.symlinkSync(target, destination);
@@ -101,7 +102,7 @@ class AsarPackager {
                 const relative = path.relative(this.config.defaultDestination, (0, appFileCopier_1.getDestinationPath)(file, fileSet));
                 const dest = path.resolve(this.rootForAppFilesWithoutAsar, relative);
                 matchUnpacker(file, dest, metadata);
-                taskManager.addTask(writeFileOrSymlink(transformedData, file, dest, metadata));
+                taskManager.addTask(writeFileOrSymlink({ transformedData, file, destination: dest, stat: metadata, fileSet }));
                 if (taskManager.tasks.length > fs_1.MAX_FILE_REQUESTS) {
                     await taskManager.awaitTasks();
                 }

package/out/asar/asarUtil.js.map

@@ -1 +1 @@
-{"version":3,"file":"asarUtil.js","sourceRoot":"","sources":["../../src/asar/asarUtil.ts"],"names":[],"mappings":";;;AAAA,yCAAwE;AACxE,+CAAoD;AACpD,+DAAwD;AACxD,4CAA+D;AAC/D,6BAA4B;AAC5B,+BAA8B;AAC9B,6BAA4B;AAC5B,sCAAqC;AAGrC,yDAA2E;AAC3E,qDAAqD;AAErD,gBAAgB;AAChB,MAAa,YAAY;IAKvB,YACmB,MAMhB;QANgB,WAAM,GAAN,MAAM,CAMtB;QATc,WAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAA;QAW7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgC,EAAE,SAAgC;QAC3E,IAAI,CAAC,0BAA0B,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;QAEtF,MAAM,iBAAiB,GAAG,IAAI,wCAAiB,EAAE,CAAA;QACjD,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QAE/D,MAAM,eAAe,GAAG;YACtB,qEAAqE;YACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpB,mDAAmD;YACnD,QAAQ,CAAC,CAAC,CAAC;SACZ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAEnB,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;QACnG,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,CAAA;QAElG,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAA;QACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,4IAA4I;YAC5I,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAA;YACnG,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YACrF,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,CAAC;QAED,MAAM,OAAO,GAAkB;YAC7B,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,UAAU;YACrB,QAAQ;YACR,GAAG,EAAE,IAAI;SACV,CAAA;QACD,6IAA6I;QAC7I,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAA;QACjC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kCAAkC,EAAE,CAAC;gBACnD,OAAM,CAAC,qEAAqE;YAC9E,CAAC;YACD,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC9C,CAAC,CAAA;QACD,MAAM,IAAA,+BAAwB,EAAC,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACtF,OAAO,CAAC,GAAG,GAAG,aAAa,CAAA;QAE3B,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;IAC7B,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,QAA2B,EAAE,iBAAoC;;QAC3F,MAAM,WAAW,GAAG,IAAI,+BAAgB,CAAC,iBAAiB,CAAC,CAAA;QAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;QACvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;QAErC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,IAAc,EAAE,EAAE;;YACnE,IAAI,MAAA,MAAA,IAAI,CAAC,MAAM,EAAC,aAAa,mDAAG,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC5C,kBAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,CAAA;gBAChC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACvB,OAAM;YACR,CAAC;QACH,CAAC,CAAA;QACD,MAAM,kBAAkB,GAAG,KAAK,EAAE,eAA4C,EAAE,MAAc,EAAE,WAAmB,EAAE,IAAc,EAAE,EAAE;YACrI,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YAE5B,0CAA0C;YAC1C,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;YACxE,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAE9C,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;YACxE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAA;YACrF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC1D,IAAI,gBAAgB,EAAE,CAAC;gBACrB,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,kBAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,kBAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,uDAAuD,CAAC,CAAA;gBAC9I,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,wBAAwB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,gEAAgE,CAC9J,CAAA;YACH,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAA;YACtE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YAEvC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAChC,CAAC,CAAA;QAED,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;gBAC9C,IAAA,mCAAkB,EAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;YAC5E,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAC7B,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,gBAAgB,0CAAE,GAAG,CAAC,CAAC,CAAC,CAAA;gBACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;gBAErE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAA,kCAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;gBACjG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAA;gBAEpE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;gBACnC,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;gBAE9E,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,GAAG,sBAAiB,EAAE,CAAC;oBACjD,MAAM,WAAW,CAAC,UAAU,EAAE,CAAA;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,WAAW,CAAC,UAAU,EAAE,CAAA;QAC9B,OAAO;YACL,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;YACxC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;SACrC,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAiC,EAAE,MAAc,EAAE,WAAmB,EAAE,IAAc;QACjH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;CACF;AA5ID,oCA4IC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAE7D,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,OAAO,CAAC,CAAA;QACV,CAAC;QAED,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACpC,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,CAAA;QACX,CAAC;QAED,0BAA0B;QAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,IAAI,gBAA0D,CAAA;IAC9D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;QAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;QAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;YACjE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAClC,CAAC;QAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBACpC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,+BAA+B,CAAC,CAAA;YACzE,CAAC;YAED,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAE9C,OAAO;QACL,GAAG;QACH,WAAW;QACX,QAAQ;QACR,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;QAChD,gBAAgB;KACjB,CAAA;AACH,CAAC","sourcesContent":["import { CreateOptions, createPackageWithOptions } from \"@electron/asar\"\nimport { AsyncTaskManager, log } from \"builder-util\"\nimport { CancellationToken } from \"builder-util-runtime\"\nimport { Filter, MAX_FILE_REQUESTS } from \"builder-util/out/fs\"\nimport * as fsNode from \"fs\"\nimport * as fs from \"fs-extra\"\nimport * as path from \"path\"\nimport * as tempFile from \"temp-file\"\nimport { AsarOptions } from \"../options/PlatformSpecificBuildOptions\"\nimport { PlatformPackager } from \"../platformPackager\"\nimport { ResolvedFileSet, getDestinationPath } from \"../util/appFileCopier\"\nimport { detectUnpackedDirs } from \"./unpackDetector\"\n\n/** @internal */\nexport class AsarPackager {\n  private readonly outFile: string\n  private rootForAppFilesWithoutAsar!: string\n  private readonly tmpDir = new tempFile.TmpDir()\n\n  constructor(\n    private readonly config: {\n      appDir: string\n      defaultDestination: string\n      resourcePath: string\n      options: AsarOptions\n      unpackPattern: Filter | undefined\n    }\n  ) {\n    this.outFile = path.join(config.resourcePath, `app.asar`)\n  }\n\n  async pack(fileSets: Array<ResolvedFileSet>, _packager: PlatformPackager<any>) {\n    this.rootForAppFilesWithoutAsar = await this.tmpDir.getTempDir({ prefix: \"asar-app\" })\n\n    const cancellationToken = new CancellationToken()\n    cancellationToken.on(\"cancel\", () => this.tmpDir.cleanupSync())\n\n    const orderedFileSets = [\n      // Write dependencies first to minimize offset changes to asar header\n      ...fileSets.slice(1),\n\n      // Finish with the app files that change most often\n      fileSets[0],\n    ].map(orderFileSet)\n\n    const { unpackedPaths, copiedFiles } = await this.detectAndCopy(orderedFileSets, cancellationToken)\n    const unpackGlob = unpackedPaths.length > 1 ? `{${unpackedPaths.join(\",\")}}` : unpackedPaths.pop()\n\n    let ordering = this.config.options.ordering || undefined\n    if (!ordering) {\n      // `copiedFiles` are already ordered due to `orderedFileSets` input, so we just map to their relative paths (via substring) within the asar.\n      const filesSorted = copiedFiles.map(file => file.substring(this.rootForAppFilesWithoutAsar.length))\n      ordering = await this.tmpDir.getTempFile({ prefix: \"asar-ordering\", suffix: \".txt\" })\n      await fs.writeFile(ordering, filesSorted.join(\"\\n\"))\n    }\n\n    const options: CreateOptions = {\n      unpack: unpackGlob,\n      unpackDir: unpackGlob,\n      ordering,\n      dot: true,\n    }\n    // override logger temporarily to clean up console (electron/asar does some internal logging that blogs up the default electron-builder logs)\n    const consoleLogger = console.log\n    console.log = (...args) => {\n      if (args[0] === \"Ordering file has 100% coverage.\") {\n        return // no need to log, this means our ordering logic is working correctly\n      }\n      log.info({ args }, \"logging @electron/asar\")\n    }\n    await createPackageWithOptions(this.rootForAppFilesWithoutAsar, this.outFile, options)\n    console.log = consoleLogger\n\n    await this.tmpDir.cleanup()\n  }\n\n  private async detectAndCopy(fileSets: ResolvedFileSet[], cancellationToken: CancellationToken) {\n    const taskManager = new AsyncTaskManager(cancellationToken)\n    const unpackedPaths = new Set<string>()\n    const copiedFiles = new Set<string>()\n\n    const matchUnpacker = (file: string, dest: string, stat: fs.Stats) => {\n      if (this.config.unpackPattern?.(file, stat)) {\n        log.debug({ file }, \"unpacking\")\n        unpackedPaths.add(dest)\n        return\n      }\n    }\n    const writeFileOrSymlink = async (transformedData: string | Buffer | undefined, source: string, destination: string, stat: fs.Stats) => {\n      copiedFiles.add(destination)\n\n      // If transformed data, skip symlink logic\n      if (transformedData) {\n        return this.copyFileOrData(transformedData, source, destination, stat)\n      }\n\n      const realPathFile = await fs.realpath(source)\n\n      if (source === realPathFile) {\n        return this.copyFileOrData(undefined, source, destination, stat)\n      }\n\n      const realPathRelative = path.relative(this.config.appDir, realPathFile)\n      const symlinkTarget = path.resolve(this.rootForAppFilesWithoutAsar, realPathRelative)\n      const isOutsidePackage = realPathRelative.startsWith(\"..\")\n      if (isOutsidePackage) {\n        log.error({ source: log.filePath(source), realPathFile: log.filePath(realPathFile) }, `unable to copy, file is symlinked outside the package`)\n        throw new Error(\n          `Cannot copy file (${path.basename(source)}) symlinked to file (${path.basename(realPathFile)}) outside the package as that violates asar security integrity`\n        )\n      }\n\n      await this.copyFileOrData(undefined, source, symlinkTarget, stat)\n      const target = path.relative(path.dirname(destination), symlinkTarget)\n      fsNode.symlinkSync(target, destination)\n\n      copiedFiles.add(symlinkTarget)\n    }\n\n    for await (const fileSet of fileSets) {\n      if (this.config.options.smartUnpack !== false) {\n        detectUnpackedDirs(fileSet, unpackedPaths, this.config.defaultDestination)\n      }\n      for (let i = 0; i < fileSet.files.length; i++) {\n        const file = fileSet.files[i]\n        const transformedData = fileSet.transformedFiles?.get(i)\n        const metadata = fileSet.metadata.get(file) || (await fs.lstat(file))\n\n        const relative = path.relative(this.config.defaultDestination, getDestinationPath(file, fileSet))\n        const dest = path.resolve(this.rootForAppFilesWithoutAsar, relative)\n\n        matchUnpacker(file, dest, metadata)\n        taskManager.addTask(writeFileOrSymlink(transformedData, file, dest, metadata))\n\n        if (taskManager.tasks.length > MAX_FILE_REQUESTS) {\n          await taskManager.awaitTasks()\n        }\n      }\n    }\n    await taskManager.awaitTasks()\n    return {\n      unpackedPaths: Array.from(unpackedPaths),\n      copiedFiles: Array.from(copiedFiles),\n    }\n  }\n\n  private async copyFileOrData(data: string | Buffer | undefined, source: string, destination: string, stat: fs.Stats) {\n    await fs.mkdir(path.dirname(destination), { recursive: true })\n    if (data) {\n      await fs.writeFile(destination, data, { mode: stat.mode })\n    } else {\n      await fs.copyFile(source, destination)\n    }\n  }\n}\n\nfunction orderFileSet(fileSet: ResolvedFileSet): ResolvedFileSet {\n  const sortedFileEntries = Array.from(fileSet.files.entries())\n\n  sortedFileEntries.sort(([, a], [, b]) => {\n    if (a === b) {\n      return 0\n    }\n\n    // Place addons last because their signature changes per build\n    const isAAddon = a.endsWith(\".node\")\n    const isBAddon = b.endsWith(\".node\")\n    if (isAAddon && !isBAddon) {\n      return 1\n    }\n    if (isBAddon && !isAAddon) {\n      return -1\n    }\n\n    // Otherwise order by name\n    return a < b ? -1 : 1\n  })\n\n  let transformedFiles: Map<number, string | Buffer> | undefined\n  if (fileSet.transformedFiles) {\n    transformedFiles = new Map()\n\n    const indexMap = new Map<number, number>()\n    for (const [newIndex, [oldIndex]] of sortedFileEntries.entries()) {\n      indexMap.set(oldIndex, newIndex)\n    }\n\n    for (const [oldIndex, value] of fileSet.transformedFiles) {\n      const newIndex = indexMap.get(oldIndex)\n      if (newIndex === undefined) {\n        const file = fileSet.files[oldIndex]\n        throw new Error(`Internal error: ${file} was lost while ordering asar`)\n      }\n\n      transformedFiles.set(newIndex, value)\n    }\n  }\n\n  const { src, destination, metadata } = fileSet\n\n  return {\n    src,\n    destination,\n    metadata,\n    files: sortedFileEntries.map(([, file]) => file),\n    transformedFiles,\n  }\n}\n"]}
+{"version":3,"file":"asarUtil.js","sourceRoot":"","sources":["../../src/asar/asarUtil.ts"],"names":[],"mappings":";;;AAAA,yCAAwE;AACxE,+CAAoD;AACpD,+DAAwD;AACxD,4CAA+D;AAC/D,6BAA4B;AAC5B,+BAA8B;AAC9B,6BAA4B;AAC5B,sCAAqC;AAGrC,yDAA2E;AAC3E,qDAAqD;AAErD,gBAAgB;AAChB,MAAa,YAAY;IAKvB,YACmB,MAKhB;QALgB,WAAM,GAAN,MAAM,CAKtB;QARc,WAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAA;QAU7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgC,EAAE,SAAgC;QAC3E,IAAI,CAAC,0BAA0B,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;QAEtF,MAAM,iBAAiB,GAAG,IAAI,wCAAiB,EAAE,CAAA;QACjD,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QAE/D,MAAM,eAAe,GAAG;YACtB,qEAAqE;YACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpB,mDAAmD;YACnD,QAAQ,CAAC,CAAC,CAAC;SACZ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAEnB,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;QACnG,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,CAAA;QAElG,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAA;QACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,4IAA4I;YAC5I,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAA;YACnG,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YACrF,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACtD,CAAC;QAED,MAAM,OAAO,GAAkB;YAC7B,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,UAAU;YACrB,QAAQ;YACR,GAAG,EAAE,IAAI;SACV,CAAA;QACD,6IAA6I;QAC7I,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAA;QACjC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kCAAkC,EAAE,CAAC;gBACnD,OAAM,CAAC,qEAAqE;YAC9E,CAAC;YACD,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC9C,CAAC,CAAA;QACD,MAAM,IAAA,+BAAwB,EAAC,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACtF,OAAO,CAAC,GAAG,GAAG,aAAa,CAAA;QAE3B,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;IAC7B,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,QAA2B,EAAE,iBAAoC;;QAC3F,MAAM,WAAW,GAAG,IAAI,+BAAgB,CAAC,iBAAiB,CAAC,CAAA;QAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;QACvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;QAErC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,IAAc,EAAE,EAAE;;YACnE,IAAI,MAAA,MAAA,IAAI,CAAC,MAAM,EAAC,aAAa,mDAAG,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC5C,kBAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,CAAA;gBAChC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACvB,OAAM;YACR,CAAC;QACH,CAAC,CAAA;QACD,MAAM,kBAAkB,GAAG,KAAK,EAAE,OAAsI,EAAE,EAAE;YAC1K,MAAM,EACJ,eAAe,EACf,IAAI,EAAE,MAAM,EACZ,WAAW,EACX,IAAI,EACJ,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAC5B,GAAG,OAAO,CAAA;YACX,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YAE5B,0CAA0C;YAC1C,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;YACxE,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAE9C,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;YAClE,CAAC;YAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;YAC/D,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAC1D,IAAI,gBAAgB,EAAE,CAAC;gBACrB,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,kBAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,kBAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,uDAAuD,CAAC,CAAA;gBAC9I,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,wBAAwB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,gEAAgE,CAC9J,CAAA;YACH,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAA;YACrF,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,CAAA;YACtE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YAEvC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAChC,CAAC,CAAA;QAED,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;gBAC9C,IAAA,mCAAkB,EAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;YAC5E,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAC7B,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,gBAAgB,0CAAE,GAAG,CAAC,CAAC,CAAC,CAAA;gBACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;gBAErE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAA,kCAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;gBACjG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAA;gBAEpE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;gBACnC,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;gBAE9G,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,GAAG,sBAAiB,EAAE,CAAC;oBACjD,MAAM,WAAW,CAAC,UAAU,EAAE,CAAA;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,WAAW,CAAC,UAAU,EAAE,CAAA;QAC9B,OAAO;YACL,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;YACxC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;SACrC,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAiC,EAAE,MAAc,EAAE,WAAmB,EAAE,IAAc;QACjH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACxC,CAAC;IACH,CAAC;CACF;AAlJD,oCAkJC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAE7D,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,OAAO,CAAC,CAAA;QACV,CAAC;QAED,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACpC,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAA;QACV,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,CAAA;QACX,CAAC;QAED,0BAA0B;QAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,IAAI,gBAA0D,CAAA;IAC9D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;QAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;QAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;YACjE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAClC,CAAC;QAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBACpC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,+BAA+B,CAAC,CAAA;YACzE,CAAC;YAED,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAE9C,OAAO;QACL,GAAG;QACH,WAAW;QACX,QAAQ;QACR,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;QAChD,gBAAgB;KACjB,CAAA;AACH,CAAC","sourcesContent":["import { CreateOptions, createPackageWithOptions } from \"@electron/asar\"\nimport { AsyncTaskManager, log } from \"builder-util\"\nimport { CancellationToken } from \"builder-util-runtime\"\nimport { Filter, MAX_FILE_REQUESTS } from \"builder-util/out/fs\"\nimport * as fsNode from \"fs\"\nimport * as fs from \"fs-extra\"\nimport * as path from \"path\"\nimport * as tempFile from \"temp-file\"\nimport { AsarOptions } from \"../options/PlatformSpecificBuildOptions\"\nimport { PlatformPackager } from \"../platformPackager\"\nimport { ResolvedFileSet, getDestinationPath } from \"../util/appFileCopier\"\nimport { detectUnpackedDirs } from \"./unpackDetector\"\n\n/** @internal */\nexport class AsarPackager {\n  private readonly outFile: string\n  private rootForAppFilesWithoutAsar!: string\n  private readonly tmpDir = new tempFile.TmpDir()\n\n  constructor(\n    private readonly config: {\n      defaultDestination: string\n      resourcePath: string\n      options: AsarOptions\n      unpackPattern: Filter | undefined\n    }\n  ) {\n    this.outFile = path.join(config.resourcePath, `app.asar`)\n  }\n\n  async pack(fileSets: Array<ResolvedFileSet>, _packager: PlatformPackager<any>) {\n    this.rootForAppFilesWithoutAsar = await this.tmpDir.getTempDir({ prefix: \"asar-app\" })\n\n    const cancellationToken = new CancellationToken()\n    cancellationToken.on(\"cancel\", () => this.tmpDir.cleanupSync())\n\n    const orderedFileSets = [\n      // Write dependencies first to minimize offset changes to asar header\n      ...fileSets.slice(1),\n\n      // Finish with the app files that change most often\n      fileSets[0],\n    ].map(orderFileSet)\n\n    const { unpackedPaths, copiedFiles } = await this.detectAndCopy(orderedFileSets, cancellationToken)\n    const unpackGlob = unpackedPaths.length > 1 ? `{${unpackedPaths.join(\",\")}}` : unpackedPaths.pop()\n\n    let ordering = this.config.options.ordering || undefined\n    if (!ordering) {\n      // `copiedFiles` are already ordered due to `orderedFileSets` input, so we just map to their relative paths (via substring) within the asar.\n      const filesSorted = copiedFiles.map(file => file.substring(this.rootForAppFilesWithoutAsar.length))\n      ordering = await this.tmpDir.getTempFile({ prefix: \"asar-ordering\", suffix: \".txt\" })\n      await fs.writeFile(ordering, filesSorted.join(\"\\n\"))\n    }\n\n    const options: CreateOptions = {\n      unpack: unpackGlob,\n      unpackDir: unpackGlob,\n      ordering,\n      dot: true,\n    }\n    // override logger temporarily to clean up console (electron/asar does some internal logging that blogs up the default electron-builder logs)\n    const consoleLogger = console.log\n    console.log = (...args) => {\n      if (args[0] === \"Ordering file has 100% coverage.\") {\n        return // no need to log, this means our ordering logic is working correctly\n      }\n      log.info({ args }, \"logging @electron/asar\")\n    }\n    await createPackageWithOptions(this.rootForAppFilesWithoutAsar, this.outFile, options)\n    console.log = consoleLogger\n\n    await this.tmpDir.cleanup()\n  }\n\n  private async detectAndCopy(fileSets: ResolvedFileSet[], cancellationToken: CancellationToken) {\n    const taskManager = new AsyncTaskManager(cancellationToken)\n    const unpackedPaths = new Set<string>()\n    const copiedFiles = new Set<string>()\n\n    const matchUnpacker = (file: string, dest: string, stat: fs.Stats) => {\n      if (this.config.unpackPattern?.(file, stat)) {\n        log.debug({ file }, \"unpacking\")\n        unpackedPaths.add(dest)\n        return\n      }\n    }\n    const writeFileOrSymlink = async (options: { transformedData: string | Buffer | undefined; file: string; destination: string; stat: fs.Stats; fileSet: ResolvedFileSet }) => {\n      const {\n        transformedData,\n        file: source,\n        destination,\n        stat,\n        fileSet: { src: sourceDir },\n      } = options\n      copiedFiles.add(destination)\n\n      // If transformed data, skip symlink logic\n      if (transformedData) {\n        return this.copyFileOrData(transformedData, source, destination, stat)\n      }\n\n      const realPathFile = await fs.realpath(source)\n\n      if (source === realPathFile) {\n        return this.copyFileOrData(undefined, source, destination, stat)\n      }\n\n      const realPathRelative = path.relative(sourceDir, realPathFile)\n      const isOutsidePackage = realPathRelative.startsWith(\"..\")\n      if (isOutsidePackage) {\n        log.error({ source: log.filePath(source), realPathFile: log.filePath(realPathFile) }, `unable to copy, file is symlinked outside the package`)\n        throw new Error(\n          `Cannot copy file (${path.basename(source)}) symlinked to file (${path.basename(realPathFile)}) outside the package as that violates asar security integrity`\n        )\n      }\n\n      const symlinkTarget = path.resolve(this.rootForAppFilesWithoutAsar, realPathRelative)\n      await this.copyFileOrData(undefined, source, symlinkTarget, stat)\n      const target = path.relative(path.dirname(destination), symlinkTarget)\n      fsNode.symlinkSync(target, destination)\n\n      copiedFiles.add(symlinkTarget)\n    }\n\n    for await (const fileSet of fileSets) {\n      if (this.config.options.smartUnpack !== false) {\n        detectUnpackedDirs(fileSet, unpackedPaths, this.config.defaultDestination)\n      }\n      for (let i = 0; i < fileSet.files.length; i++) {\n        const file = fileSet.files[i]\n        const transformedData = fileSet.transformedFiles?.get(i)\n        const metadata = fileSet.metadata.get(file) || (await fs.lstat(file))\n\n        const relative = path.relative(this.config.defaultDestination, getDestinationPath(file, fileSet))\n        const dest = path.resolve(this.rootForAppFilesWithoutAsar, relative)\n\n        matchUnpacker(file, dest, metadata)\n        taskManager.addTask(writeFileOrSymlink({ transformedData, file, destination: dest, stat: metadata, fileSet }))\n\n        if (taskManager.tasks.length > MAX_FILE_REQUESTS) {\n          await taskManager.awaitTasks()\n        }\n      }\n    }\n    await taskManager.awaitTasks()\n    return {\n      unpackedPaths: Array.from(unpackedPaths),\n      copiedFiles: Array.from(copiedFiles),\n    }\n  }\n\n  private async copyFileOrData(data: string | Buffer | undefined, source: string, destination: string, stat: fs.Stats) {\n    await fs.mkdir(path.dirname(destination), { recursive: true })\n    if (data) {\n      await fs.writeFile(destination, data, { mode: stat.mode })\n    } else {\n      await fs.copyFile(source, destination)\n    }\n  }\n}\n\nfunction orderFileSet(fileSet: ResolvedFileSet): ResolvedFileSet {\n  const sortedFileEntries = Array.from(fileSet.files.entries())\n\n  sortedFileEntries.sort(([, a], [, b]) => {\n    if (a === b) {\n      return 0\n    }\n\n    // Place addons last because their signature changes per build\n    const isAAddon = a.endsWith(\".node\")\n    const isBAddon = b.endsWith(\".node\")\n    if (isAAddon && !isBAddon) {\n      return 1\n    }\n    if (isBAddon && !isAAddon) {\n      return -1\n    }\n\n    // Otherwise order by name\n    return a < b ? -1 : 1\n  })\n\n  let transformedFiles: Map<number, string | Buffer> | undefined\n  if (fileSet.transformedFiles) {\n    transformedFiles = new Map()\n\n    const indexMap = new Map<number, number>()\n    for (const [newIndex, [oldIndex]] of sortedFileEntries.entries()) {\n      indexMap.set(oldIndex, newIndex)\n    }\n\n    for (const [oldIndex, value] of fileSet.transformedFiles) {\n      const newIndex = indexMap.get(oldIndex)\n      if (newIndex === undefined) {\n        const file = fileSet.files[oldIndex]\n        throw new Error(`Internal error: ${file} was lost while ordering asar`)\n      }\n\n      transformedFiles.set(newIndex, value)\n    }\n  }\n\n  const { src, destination, metadata } = fileSet\n\n  return {\n    src,\n    destination,\n    metadata,\n    files: sortedFileEntries.map(([, file]) => file),\n    transformedFiles,\n  }\n}\n"]}

package/out/codeSign/macCodeSign.js

@@ -155,7 +155,7 @@ async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIK
         bluebird_lst_1.default.mapSeries(securityCommands, it => (0, builder_util_1.exec)("/usr/bin/security", it)),
     ]);
     const cscPasswords = [cscKeyPassword];
-    if (cscIKeyPassword) {
+    if (cscIKeyPassword != null) {
         cscPasswords.push(cscIKeyPassword);
     }
     return await importCerts(keychainFile, certPaths, cscPasswords);

package/out/codeSign/macCodeSign.js.map

@@ -1 +1 @@
-{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/macCodeSign.ts"],"names":[],"mappings":";;;AA+BA,sCA4BC;AAED,kCA0CC;AA+CD,wCAOC;AAED,wCA6CC;AAiBD,oBAEC;AAsGD,oCAeC;AApVD,+CAA0C;AAC1C,+CAA6H;AAC7H,+CAAuD;AACvD,+CAA6C;AAC7C,mCAAgD;AAChD,0CAAoC;AACpC,uCAA+B;AAC/B,2BAAoC;AACpC,6BAA4B;AAC5B,yCAAuC;AACvC,yCAA+D;AAC/D,yCAA8C;AAC9C,iFAAmF;AAEnF,iDAA8C;AAEjC,QAAA,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,SAAgB,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,iBAAiB,GACrB,kKAAkK;QAClK,6LAA6L,CAAA;IAE/L,IAAI,IAAA,4BAAa,GAAE,EAAE,CAAC;QACpB,IAAI,IAAA,wBAAS,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,kBAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,kBAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,KAAc,EACd,gBAA4B,EAC5B,SAAoC,EACpC,YAAuC,EACvC,kBAA2B;IAE3B,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAM,CAAC,aAAa,CAAC,wCAAwC,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/G,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,eAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAA,uBAAW,EAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,IAAA,uBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,iBAAM,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KAC9I,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,IAAA,8BAAe,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,SAAgB,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,IAAA,6BAAc,EAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAA,WAAM,GAAE,EAAE,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,2LAA2L;QAC3L,sBAAe,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxH,sBAAe,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;KACjF,CAAC,CAAA;IACF,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,EAAE,CAAC;QACpB,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,OAAO,IAAA,oBAAK,EAAC,GAAG,EAAE,CAAC,IAAA,oBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACpD,CAAC;AAEU,QAAA,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,6BAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB;YAClC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACX,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;iBAChB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBACb,MAAM,CACL,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CACvK;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,6BAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,0BAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,wCAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import BluebirdPromise from \"bluebird-lst\"\nimport { exec, InvalidConfigurationError, isEmptyOrSpaces, isEnvTrue, isPullRequest, log, TmpDir, retry } from \"builder-util\"\nimport { copyFile, unlinkIfExists } from \"builder-util\"\nimport { Fields, Logger } from \"builder-util\"\nimport { randomBytes, createHash } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { isAutoDiscoveryCodeSignIdentity } from \"../util/flags\"\nimport { importCertificate } from \"./codesign\"\nimport { Identity as _Identity } from \"@electron/osx-sign/dist/cjs/util-identities\"\nimport { SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport { signAsync } from \"@electron/osx-sign\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  const buildForPrWarning =\n    \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n    \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n  if (isPullRequest()) {\n    if (isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n  return true\n}\n\nexport async function reportError(\n  isMas: boolean,\n  certificateTypes: CertType[],\n  qualifier: string | null | undefined,\n  keychainFile: string | null | undefined,\n  isForceCodeSigning: boolean\n) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(\"skipped macOS application code signing\", logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, \"skipped macOS application code signing\")\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(__dirname, \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (process.env.TRAVIS !== \"true\") {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  await Promise.all([\n    // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.\n    BluebirdPromise.map(certLinks, (link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))),\n    BluebirdPromise.mapSeries(securityCommands, it => exec(\"/usr/bin/security\", it)),\n  ])\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i]\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  return retry(() => signAsync(opts), 3, 5000, 5000)\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    result = Promise.all<Array<string>>([\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]).then(it => {\n      const array = it[0]\n        .concat(it[1])\n        .filter(\n          it => !it.includes(\"(Missing required extension)\") && !it.includes(\"valid identities found\") && !it.includes(\"iPhone \") && !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return parseIdentity(line)\n    }\n  }\n  return null\n}\n\nexport declare class Identity {\n  readonly name: string\n  readonly hash?: string\n\n  constructor(name: string, hash?: string)\n}\n\nfunction parseIdentity(line: string): Identity {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  return new _Identity(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}
+{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/macCodeSign.ts"],"names":[],"mappings":";;;AA+BA,sCA4BC;AAED,kCA0CC;AA+CD,wCAOC;AAED,wCA6CC;AAiBD,oBAEC;AAsGD,oCAeC;AApVD,+CAA0C;AAC1C,+CAA6H;AAC7H,+CAAuD;AACvD,+CAA6C;AAC7C,mCAAgD;AAChD,0CAAoC;AACpC,uCAA+B;AAC/B,2BAAoC;AACpC,6BAA4B;AAC5B,yCAAuC;AACvC,yCAA+D;AAC/D,yCAA8C;AAC9C,iFAAmF;AAEnF,iDAA8C;AAEjC,QAAA,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,SAAgB,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,iBAAiB,GACrB,kKAAkK;QAClK,6LAA6L,CAAA;IAE/L,IAAI,IAAA,4BAAa,GAAE,EAAE,CAAC;QACpB,IAAI,IAAA,wBAAS,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,kBAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,kBAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,WAAW,CAC/B,KAAc,EACd,gBAA4B,EAC5B,SAAoC,EACpC,YAAuC,EACvC,kBAA2B;IAE3B,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAM,CAAC,aAAa,CAAC,wCAAwC,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/G,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,eAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAA,uBAAW,EAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,IAAA,uBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,iBAAM,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KAC9I,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,IAAA,8BAAe,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,SAAgB,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,IAAA,6BAAc,EAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAA,WAAM,GAAE,EAAE,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,2LAA2L;QAC3L,sBAAe,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxH,sBAAe,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;KACjF,CAAC,CAAA;IACF,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,OAAO,IAAA,oBAAK,EAAC,GAAG,EAAE,CAAC,IAAA,oBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACpD,CAAC;AAEU,QAAA,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,6BAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB;YAClC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACX,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;iBAChB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBACb,MAAM,CACL,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CACvK;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,6BAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,0BAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,wCAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import BluebirdPromise from \"bluebird-lst\"\nimport { exec, InvalidConfigurationError, isEmptyOrSpaces, isEnvTrue, isPullRequest, log, TmpDir, retry } from \"builder-util\"\nimport { copyFile, unlinkIfExists } from \"builder-util\"\nimport { Fields, Logger } from \"builder-util\"\nimport { randomBytes, createHash } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { isAutoDiscoveryCodeSignIdentity } from \"../util/flags\"\nimport { importCertificate } from \"./codesign\"\nimport { Identity as _Identity } from \"@electron/osx-sign/dist/cjs/util-identities\"\nimport { SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport { signAsync } from \"@electron/osx-sign\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  const buildForPrWarning =\n    \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n    \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n  if (isPullRequest()) {\n    if (isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n  return true\n}\n\nexport async function reportError(\n  isMas: boolean,\n  certificateTypes: CertType[],\n  qualifier: string | null | undefined,\n  keychainFile: string | null | undefined,\n  isForceCodeSigning: boolean\n) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(\"skipped macOS application code signing\", logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, \"skipped macOS application code signing\")\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(__dirname, \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (process.env.TRAVIS !== \"true\") {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  await Promise.all([\n    // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.\n    BluebirdPromise.map(certLinks, (link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))),\n    BluebirdPromise.mapSeries(securityCommands, it => exec(\"/usr/bin/security\", it)),\n  ])\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i]\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  return retry(() => signAsync(opts), 3, 5000, 5000)\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    result = Promise.all<Array<string>>([\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]).then(it => {\n      const array = it[0]\n        .concat(it[1])\n        .filter(\n          it => !it.includes(\"(Missing required extension)\") && !it.includes(\"valid identities found\") && !it.includes(\"iPhone \") && !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return parseIdentity(line)\n    }\n  }\n  return null\n}\n\nexport declare class Identity {\n  readonly name: string\n  readonly hash?: string\n\n  constructor(name: string, hash?: string)\n}\n\nfunction parseIdentity(line: string): Identity {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  return new _Identity(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}

package/out/codeSign/signManager.d.ts

@@ -0,0 +1,13 @@
+import { Lazy } from "lazy-val";
+import { WindowsSignOptions } from "./windowsCodeSign";
+import { Target } from "../core";
+import { MemoLazy } from "builder-util-runtime";
+import { FileCodeSigningInfo, CertificateFromStoreInfo } from "./windowsSignToolManager";
+import { WindowsConfiguration } from "../options/winOptions";
+export interface SignManager {
+    readonly computedPublisherName: Lazy<Array<string> | null>;
+    readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
+    computePublisherName(target: Target, publisherName: string | null | undefined): Promise<string>;
+    initialize(): Promise<void>;
+    signFile(options: WindowsSignOptions): Promise<boolean>;
+}

package/out/codeSign/signManager.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=signManager.js.map

package/out/codeSign/signManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signManager.js","sourceRoot":"","sources":["../../src/codeSign/signManager.ts"],"names":[],"mappings":"","sourcesContent":["import { Lazy } from \"lazy-val\"\nimport { WindowsSignOptions } from \"./windowsCodeSign\"\nimport { Target } from \"../core\"\nimport { MemoLazy } from \"builder-util-runtime\"\nimport { FileCodeSigningInfo, CertificateFromStoreInfo } from \"./windowsSignToolManager\"\nimport { WindowsConfiguration } from \"../options/winOptions\"\n\nexport interface SignManager {\n  readonly computedPublisherName: Lazy<Array<string> | null>\n  readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>\n  computePublisherName(target: Target, publisherName: string | null | undefined): Promise<string>\n  initialize(): Promise<void>\n  signFile(options: WindowsSignOptions): Promise<boolean>\n}\n"]}

package/out/codeSign/windowsCodeSign.js

@@ -4,33 +4,36 @@ exports.signWindows = signWindows;
 exports.getPSCmd = getPSCmd;
 const builder_util_1 = require("builder-util");
 async function signWindows(options, packager) {
+    const packageManager = await packager.signingManager.value;
     if (options.options.azureSignOptions) {
+        if (options.options.signtoolOptions) {
+            builder_util_1.log.warn(null, "ignoring signtool options, using Azure Trusted Signing; please only configure one");
+        }
         builder_util_1.log.info({ path: builder_util_1.log.filePath(options.path) }, "signing with Azure Trusted Signing (beta)");
-        const packageManager = await packager.azureSignManager.value;
-        return signWithRetry(async () => packageManager.signUsingAzureTrustedSigning(options));
     }
-    builder_util_1.log.info({ path: builder_util_1.log.filePath(options.path) }, "signing with signtool.exe");
-    const deprecatedFields = {
-        sign: options.options.sign,
-        signDlls: options.options.signDlls,
-        signingHashAlgorithms: options.options.signingHashAlgorithms,
-        certificateFile: options.options.certificateFile,
-        certificatePassword: options.options.certificatePassword,
-        certificateSha1: options.options.certificateSha1,
-        certificateSubjectName: options.options.certificateSubjectName,
-        additionalCertificateFile: options.options.additionalCertificateFile,
-        rfc3161TimeStampServer: options.options.rfc3161TimeStampServer,
-        timeStampServer: options.options.timeStampServer,
-        publisherName: options.options.publisherName,
-    };
-    const fields = Object.entries(deprecatedFields)
-        .filter(([, value]) => !!value)
-        .map(([field]) => field);
-    if (fields.length) {
-        builder_util_1.log.warn({ fields, reason: "please move to win.signtoolOptions.<field_name>" }, `deprecated field`);
+    else {
+        builder_util_1.log.info({ path: builder_util_1.log.filePath(options.path) }, "signing with signtool.exe");
+        const deprecatedFields = {
+            sign: options.options.sign,
+            signDlls: options.options.signDlls,
+            signingHashAlgorithms: options.options.signingHashAlgorithms,
+            certificateFile: options.options.certificateFile,
+            certificatePassword: options.options.certificatePassword,
+            certificateSha1: options.options.certificateSha1,
+            certificateSubjectName: options.options.certificateSubjectName,
+            additionalCertificateFile: options.options.additionalCertificateFile,
+            rfc3161TimeStampServer: options.options.rfc3161TimeStampServer,
+            timeStampServer: options.options.timeStampServer,
+            publisherName: options.options.publisherName,
+        };
+        const fields = Object.entries(deprecatedFields)
+            .filter(([, value]) => !!value)
+            .map(([field]) => field);
+        if (fields.length) {
+            builder_util_1.log.warn({ fields, reason: "please move to win.signtoolOptions.<field_name>" }, `deprecated field`);
+        }
     }
-    const packageManager = await packager.signtoolManager.value;
-    return signWithRetry(async () => packageManager.signUsingSigntool(options));
+    return signWithRetry(async () => packageManager.signFile(options));
 }
 function signWithRetry(signer) {
     return (0, builder_util_1.retry)(signer, 3, 1000, 1000, 0, (e) => {

package/out/codeSign/windowsCodeSign.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/windowsCodeSign.ts"],"names":[],"mappings":";;AAUA,kCA6BC;AAkBD,4BAWC;AApED,+CAAyC;AAUlC,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,QAAqB;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACrC,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2CAA2C,CAAC,CAAA;QAC3F,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAA;QAC5D,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAA;IACxF,CAAC;IAED,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC3E,MAAM,gBAAgB,GAAG;QACvB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;QAClC,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,qBAAqB;QAC5D,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;QAChD,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,mBAAmB;QACxD,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;QAChD,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB;QAC9D,yBAAyB,EAAE,OAAO,CAAC,OAAO,CAAC,yBAAyB;QACpE,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB;QAC9D,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;QAChD,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;KAC7C,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,iDAAiD,EAAE,EAAE,kBAAkB,CAAC,CAAA;IACrG,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAA;IAC3D,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACnD,OAAO,IAAA,oBAAK,EAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAM,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;QACzB;QACE,oEAAoE;QACpE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAC,4BAA4B,CAAC;;YAC/C,oEAAoE;YACpE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAC,gCAAgC,CAAC,CAAA,EACnD,CAAC;YACD,kBAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,sDAAsD,CAAC,CAAA;YACpF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,EAAa;IAC1C,OAAO,MAAM,EAAE;SACZ,IAAI,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;SAC7F,IAAI,CAAC,GAAG,EAAE;QACT,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,gDAAgD,CAAC,CAAA;QACjE,OAAO,UAAU,CAAA;IACnB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yDAAyD,CAAC,CAAA;QAC1E,OAAO,gBAAgB,CAAA;IACzB,CAAC,CAAC,CAAA;AACN,CAAC","sourcesContent":["import { log, retry } from \"builder-util\"\nimport { WindowsConfiguration } from \"../options/winOptions\"\nimport { VmManager } from \"../vm/vm\"\nimport { WinPackager } from \"../winPackager\"\n\nexport interface WindowsSignOptions {\n  readonly path: string\n  readonly options: WindowsConfiguration\n}\n\nexport async function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean> {\n  if (options.options.azureSignOptions) {\n    log.info({ path: log.filePath(options.path) }, \"signing with Azure Trusted Signing (beta)\")\n    const packageManager = await packager.azureSignManager.value\n    return signWithRetry(async () => packageManager.signUsingAzureTrustedSigning(options))\n  }\n\n  log.info({ path: log.filePath(options.path) }, \"signing with signtool.exe\")\n  const deprecatedFields = {\n    sign: options.options.sign,\n    signDlls: options.options.signDlls,\n    signingHashAlgorithms: options.options.signingHashAlgorithms,\n    certificateFile: options.options.certificateFile,\n    certificatePassword: options.options.certificatePassword,\n    certificateSha1: options.options.certificateSha1,\n    certificateSubjectName: options.options.certificateSubjectName,\n    additionalCertificateFile: options.options.additionalCertificateFile,\n    rfc3161TimeStampServer: options.options.rfc3161TimeStampServer,\n    timeStampServer: options.options.timeStampServer,\n    publisherName: options.options.publisherName,\n  }\n  const fields = Object.entries(deprecatedFields)\n    .filter(([, value]) => !!value)\n    .map(([field]) => field)\n  if (fields.length) {\n    log.warn({ fields, reason: \"please move to win.signtoolOptions.<field_name>\" }, `deprecated field`)\n  }\n  const packageManager = await packager.signtoolManager.value\n  return signWithRetry(async () => packageManager.signUsingSigntool(options))\n}\n\nfunction signWithRetry(signer: () => Promise<boolean>): Promise<boolean> {\n  return retry(signer, 3, 1000, 1000, 0, (e: any) => {\n    const message = e.message\n    if (\n      // https://github.com/electron-userland/electron-builder/issues/1414\n      message?.includes(\"Couldn't resolve host name\") ||\n      // https://github.com/electron-userland/electron-builder/issues/8615\n      message?.includes(\"being used by another process.\")\n    ) {\n      log.warn({ error: message }, \"attempt to sign failed, another attempt will be made\")\n      return true\n    }\n    return false\n  })\n}\n\nexport async function getPSCmd(vm: VmManager): Promise<string> {\n  return await vm\n    .exec(\"powershell.exe\", [\"-NoProfile\", \"-NonInteractive\", \"-Command\", `Get-Command pwsh.exe`])\n    .then(() => {\n      log.debug(null, \"identified pwsh.exe for executing code signing\")\n      return \"pwsh.exe\"\n    })\n    .catch(() => {\n      log.debug(null, \"unable to find pwsh.exe, falling back to powershell.exe\")\n      return \"powershell.exe\"\n    })\n}\n"]}
+{"version":3,"file":"windowsCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/windowsCodeSign.ts"],"names":[],"mappings":";;AAUA,kCA+BC;AAkBD,4BAWC;AAtED,+CAAyC;AAUlC,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,QAAqB;IAClF,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAA;IAC1D,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACpC,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,mFAAmF,CAAC,CAAA;QACrG,CAAC;QACD,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2CAA2C,CAAC,CAAA;IAC7F,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;QAC3E,MAAM,gBAAgB,GAAG;YACvB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,qBAAqB;YAC5D,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,mBAAmB;YACxD,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB;YAC9D,yBAAyB,EAAE,OAAO,CAAC,OAAO,CAAC,yBAAyB;YACpE,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB;YAC9D,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;SAC7C,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,iDAAiD,EAAE,EAAE,kBAAkB,CAAC,CAAA;QACrG,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACnD,OAAO,IAAA,oBAAK,EAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAM,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;QACzB;QACE,oEAAoE;QACpE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAC,4BAA4B,CAAC;;YAC/C,oEAAoE;YACpE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAC,gCAAgC,CAAC,CAAA,EACnD,CAAC;YACD,kBAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,sDAAsD,CAAC,CAAA;YACpF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,EAAa;IAC1C,OAAO,MAAM,EAAE;SACZ,IAAI,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;SAC7F,IAAI,CAAC,GAAG,EAAE;QACT,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,gDAAgD,CAAC,CAAA;QACjE,OAAO,UAAU,CAAA;IACnB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yDAAyD,CAAC,CAAA;QAC1E,OAAO,gBAAgB,CAAA;IACzB,CAAC,CAAC,CAAA;AACN,CAAC","sourcesContent":["import { log, retry } from \"builder-util\"\nimport { WindowsConfiguration } from \"../options/winOptions\"\nimport { VmManager } from \"../vm/vm\"\nimport { WinPackager } from \"../winPackager\"\n\nexport interface WindowsSignOptions {\n  readonly path: string\n  readonly options: WindowsConfiguration\n}\n\nexport async function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean> {\n  const packageManager = await packager.signingManager.value\n  if (options.options.azureSignOptions) {\n    if (options.options.signtoolOptions) {\n      log.warn(null, \"ignoring signtool options, using Azure Trusted Signing; please only configure one\")\n    }\n    log.info({ path: log.filePath(options.path) }, \"signing with Azure Trusted Signing (beta)\")\n  } else {\n    log.info({ path: log.filePath(options.path) }, \"signing with signtool.exe\")\n    const deprecatedFields = {\n      sign: options.options.sign,\n      signDlls: options.options.signDlls,\n      signingHashAlgorithms: options.options.signingHashAlgorithms,\n      certificateFile: options.options.certificateFile,\n      certificatePassword: options.options.certificatePassword,\n      certificateSha1: options.options.certificateSha1,\n      certificateSubjectName: options.options.certificateSubjectName,\n      additionalCertificateFile: options.options.additionalCertificateFile,\n      rfc3161TimeStampServer: options.options.rfc3161TimeStampServer,\n      timeStampServer: options.options.timeStampServer,\n      publisherName: options.options.publisherName,\n    }\n    const fields = Object.entries(deprecatedFields)\n      .filter(([, value]) => !!value)\n      .map(([field]) => field)\n    if (fields.length) {\n      log.warn({ fields, reason: \"please move to win.signtoolOptions.<field_name>\" }, `deprecated field`)\n    }\n  }\n\n  return signWithRetry(async () => packageManager.signFile(options))\n}\n\nfunction signWithRetry(signer: () => Promise<boolean>): Promise<boolean> {\n  return retry(signer, 3, 1000, 1000, 0, (e: any) => {\n    const message = e.message\n    if (\n      // https://github.com/electron-userland/electron-builder/issues/1414\n      message?.includes(\"Couldn't resolve host name\") ||\n      // https://github.com/electron-userland/electron-builder/issues/8615\n      message?.includes(\"being used by another process.\")\n    ) {\n      log.warn({ error: message }, \"attempt to sign failed, another attempt will be made\")\n      return true\n    }\n    return false\n  })\n}\n\nexport async function getPSCmd(vm: VmManager): Promise<string> {\n  return await vm\n    .exec(\"powershell.exe\", [\"-NoProfile\", \"-NonInteractive\", \"-Command\", `Get-Command pwsh.exe`])\n    .then(() => {\n      log.debug(null, \"identified pwsh.exe for executing code signing\")\n      return \"pwsh.exe\"\n    })\n    .catch(() => {\n      log.debug(null, \"unable to find pwsh.exe, falling back to powershell.exe\")\n      return \"powershell.exe\"\n    })\n}\n"]}

package/out/codeSign/windowsSignAzureManager.d.ts

@@ -1,12 +1,21 @@
+import { WindowsConfiguration } from "../options/winOptions";
 import { WinPackager } from "../winPackager";
 import { WindowsSignOptions } from "./windowsCodeSign";
-export declare class WindowsSignAzureManager {
+import { Lazy } from "lazy-val";
+import { SignManager } from "./signManager";
+import { MemoLazy } from "builder-util-runtime";
+import { CertificateFromStoreInfo, FileCodeSigningInfo } from "./windowsSignToolManager";
+export declare class WindowsSignAzureManager implements SignManager {
     private readonly packager;
+    private readonly platformSpecificBuildOptions;
+    readonly computedPublisherName: Lazy<string[] | null>;
     constructor(packager: WinPackager);
-    initializeProviderModules(): Promise<void>;
+    initialize(): Promise<void>;
     verifyRequiredEnvVars(): void;
     verifyPrincipleSecretEnv(): boolean;
     verifyPrincipleCertificateEnv(): boolean;
     verifyUsernamePasswordEnv(): boolean;
-    signUsingAzureTrustedSigning(options: WindowsSignOptions): Promise<boolean>;
+    computePublisherName(): Promise<string>;
+    readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
+    signFile(options: WindowsSignOptions): Promise<boolean>;
 }

package/out/codeSign/windowsSignAzureManager.js

@@ -3,11 +3,28 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.WindowsSignAzureManager = void 0;
 const builder_util_1 = require("builder-util");
 const windowsCodeSign_1 = require("./windowsCodeSign");
+const lazy_val_1 = require("lazy-val");
+const builder_util_runtime_1 = require("builder-util-runtime");
 class WindowsSignAzureManager {
     constructor(packager) {
         this.packager = packager;
+        this.computedPublisherName = new lazy_val_1.Lazy(() => {
+            var _a;
+            const publisherName = (_a = this.platformSpecificBuildOptions.azureSignOptions) === null || _a === void 0 ? void 0 : _a.publisherName;
+            if (publisherName === null) {
+                return Promise.resolve(null);
+            }
+            else if (publisherName != null) {
+                return Promise.resolve((0, builder_util_1.asArray)(publisherName));
+            }
+            // TODO: Is there another way to automatically pull Publisher Name from AzureTrusted service?
+            // For now return null.
+            return Promise.resolve(null);
+        });
+        this.cscInfo = new builder_util_runtime_1.MemoLazy(() => this.packager.platformSpecificBuildOptions, _selected => Promise.resolve(null));
+        this.platformSpecificBuildOptions = packager.platformSpecificBuildOptions;
     }
-    async initializeProviderModules() {
+    async initialize() {
         const vm = await this.packager.vm.value;
         const ps = await (0, windowsCodeSign_1.getPSCmd)(vm);
         builder_util_1.log.info(null, "installing required module (TrustedSigning) with scope CurrentUser");
@@ -66,11 +83,15 @@ class WindowsSignAzureManager {
         }
         return true;
     }
+    computePublisherName() {
+        return Promise.resolve(this.packager.platformSpecificBuildOptions.azureSignOptions.publisherName);
+    }
     // prerequisite: requires `initializeProviderModules` to already have been executed
-    async signUsingAzureTrustedSigning(options) {
+    async signFile(options) {
         const vm = await this.packager.vm.value;
         const ps = await (0, windowsCodeSign_1.getPSCmd)(vm);
-        const { endpoint, certificateProfileName, codeSigningAccountName, fileDigest, timestampRfc3161, timestampDigest, ...extraSigningArgs } = options.options.azureSignOptions;
+        const { publisherName: _publisher, // extract from `extraSigningArgs`
+        endpoint, certificateProfileName, codeSigningAccountName, fileDigest, timestampRfc3161, timestampDigest, ...extraSigningArgs } = options.options.azureSignOptions;
         const params = {
             ...extraSigningArgs,
             Endpoint: endpoint,

package/out/codeSign/windowsSignAzureManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../src/codeSign/windowsSignAzureManager.ts"],"names":[],"mappings":";;;AAAA,+CAA6D;AAG7D,uDAAgE;AAEhE,MAAa,uBAAuB;IAClC,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;IAAG,CAAC;IAEtD,KAAK,CAAC,yBAAyB;QAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,IAAA,0BAAQ,EAAC,EAAE,CAAC,CAAA;QAE7B,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,mEAAmE;YACnE,gKAAgK;YAChK,kBAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kHAAkH,CAAC,CAAA;QAC1K,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,4GAA4G,CAAC,CAAC,CAAA;QAE9K,yDAAyD;QACzD,0HAA0H;QAC1H,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,6DAA6D,CAAC,CAAA;QAC7E,IAAI,CAAC,qBAAqB,EAAE,CAAA;QAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,IAAI,CAAC,6BAA6B,EAAE,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YACnH,MAAM,IAAI,wCAAyB,CACjC,0PAA0P,CAC3P,CAAA;QACH,CAAC;IACH,CAAC;IAED,qBAAqB;QACnB,CAAC;QAAA,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,wCAAyB,CACjC,wCAAwC,KAAK,+IAA+I,CAC7L,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,wBAAwB;QACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACrC,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,0DAA0D,CAAC,CAAA;YACxG,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6BAA6B;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC;YAC/C,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,EAAE,gFAAgF,CAAC,CAAA;YACxI,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,CAAC;YACnD,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,EAAE,iEAAiE,CAAC,CAAA;QAC/H,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC;YACrD,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE,EAAE,wCAAwC,CAAC,CAAA;QACxG,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yBAAyB;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAChC,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,4DAA4D,CAAC,CAAA;YACrG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;gBAChC,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,4DAA4D,CAAC,CAAA;YACvG,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,4BAA4B,CAAC,OAA2B;QAC5D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,IAAA,0BAAQ,EAAC,EAAE,CAAC,CAAA;QAE7B,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,gBAAgB,EAAE,GACpI,OAAO,CAAC,OAAO,CAAC,gBAAiB,CAAA;QACnC,MAAM,MAAM,GAAG;YACb,GAAG,gBAAgB;YACnB,QAAQ,EAAE,QAAQ;YAClB,sBAAsB,EAAE,sBAAsB;YAC9C,sBAAsB,EAAE,sBAAsB;YAC9C,gBAAgB,EAAE,gBAAgB,IAAI,oCAAoC;YAC1E,eAAe,EAAE,eAAe,IAAI,QAAQ;YAC5C,UAAU,EAAE,UAAU,IAAI,QAAQ;YAClC,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG;SAC3B,CAAA;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACrC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;YAC9B,OAAO,CAAC,GAAG,GAAG,EAAE,IAAI,KAAK,EAAE,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC,EAAE,EAAc,CAAC;aACjB,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yBAAyB,YAAY,EAAE,CAAC,CAAC,CAAA;QAEzG,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAlGD,0DAkGC","sourcesContent":["import { InvalidConfigurationError, log } from \"builder-util\"\nimport { WindowsAzureSigningConfiguration } from \"../options/winOptions\"\nimport { WinPackager } from \"../winPackager\"\nimport { getPSCmd, WindowsSignOptions } from \"./windowsCodeSign\"\n\nexport class WindowsSignAzureManager {\n  constructor(private readonly packager: WinPackager) {}\n\n  async initializeProviderModules() {\n    const vm = await this.packager.vm.value\n    const ps = await getPSCmd(vm)\n\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      // Might not be needed, seems GH runners already have NuGet set up.\n      // Logging to debug just in case users run into this. If NuGet isn't present, Install-Module -Name TrustedSigning will fail, so we'll get the logs at that point\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider Nuget. Might be a false alarm though as some systems already have it installed\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -RequiredVersion 0.4.1 -Force -Repository PSGallery -Scope CurrentUser\"])\n\n    // Preemptively check env vars once during initialization\n    // Options: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition\n    log.info(null, \"verifying env vars for authenticating to Microsoft Entra ID\")\n    this.verifyRequiredEnvVars()\n    if (!(this.verifyPrincipleSecretEnv() || this.verifyPrincipleCertificateEnv() || this.verifyUsernamePasswordEnv())) {\n      throw new InvalidConfigurationError(\n        `Unable to find valid azure env configuration for signing. Missing field(s) can be debugged via \"DEBUG=electron-builder\". Please refer to: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition`\n      )\n    }\n  }\n\n  verifyRequiredEnvVars() {\n    ;[\"AZURE_TENANT_ID\", \"AZURE_CLIENT_ID\"].forEach(field => {\n      if (!process.env[field]) {\n        throw new InvalidConfigurationError(\n          `Unable to find valid azure env field ${field} for signing. Please refer to: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition`\n        )\n      }\n    })\n  }\n\n  verifyPrincipleSecretEnv() {\n    if (!process.env.AZURE_CLIENT_SECRET) {\n      log.debug({ envVar: \"AZURE_CLIENT_SECRET\" }, \"no secret found for authenticating to Microsoft Entra ID\")\n      return false\n    }\n    return true\n  }\n\n  verifyPrincipleCertificateEnv() {\n    if (!process.env.AZURE_CLIENT_CERTIFICATE_PATH) {\n      log.debug({ envVar: \"AZURE_CLIENT_CERTIFICATE_PATH\" }, \"no path found for signing certificate for authenticating to Microsoft Entra ID\")\n      return false\n    }\n    if (!process.env.AZURE_CLIENT_CERTIFICATE_PASSWORD) {\n      log.debug({ envVar: \"AZURE_CLIENT_CERTIFICATE_PASSWORD\" }, \"(optional) certificate password not found, assuming no password\")\n    }\n    if (!process.env.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN) {\n      log.debug({ envVar: \"AZURE_CLIENT_SEND_CERTIFICATE_CHAIN\" }, \"(optional) certificate chain not found\")\n    }\n    return true\n  }\n\n  verifyUsernamePasswordEnv() {\n    if (!process.env.AZURE_USERNAME) {\n      log.debug({ envVar: \"AZURE_USERNAME\" }, \"no username found for authenticating to Microsoft Entra ID\")\n      if (!process.env.AZURE_PASSWORD) {\n        log.debug({ envVar: \"AZURE_PASSWORD\" }, \"no password found for authenticating to Microsoft Entra ID\")\n      }\n      return false\n    }\n    return true\n  }\n\n  // prerequisite: requires `initializeProviderModules` to already have been executed\n  async signUsingAzureTrustedSigning(options: WindowsSignOptions): Promise<boolean> {\n    const vm = await this.packager.vm.value\n    const ps = await getPSCmd(vm)\n\n    const { endpoint, certificateProfileName, codeSigningAccountName, fileDigest, timestampRfc3161, timestampDigest, ...extraSigningArgs }: WindowsAzureSigningConfiguration =\n      options.options.azureSignOptions!\n    const params = {\n      ...extraSigningArgs,\n      Endpoint: endpoint,\n      CertificateProfileName: certificateProfileName,\n      CodeSigningAccountName: codeSigningAccountName,\n      TimestampRfc3161: timestampRfc3161 || \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: timestampDigest || \"SHA256\",\n      FileDigest: fileDigest || \"SHA256\",\n      Files: `\"${options.path}\"`,\n    }\n    const paramsString = Object.entries(params)\n      .filter(([_, value]) => value != null)\n      .reduce((res, [field, value]) => {\n        return [...res, `-${field}`, value]\n      }, [] as string[])\n      .join(\" \")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", `Invoke-TrustedSigning ${paramsString}`])\n\n    return true\n  }\n}\n"]}
+{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../src/codeSign/windowsSignAzureManager.ts"],"names":[],"mappings":";;;AAAA,+CAAsE;AAGtE,uDAAgE;AAChE,uCAA+B;AAE/B,+DAA+C;AAG/C,MAAa,uBAAuB;IAgBlC,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAbzC,0BAAqB,GAAG,IAAI,eAAI,CAAuB,GAAG,EAAE;;YACnE,MAAM,aAAa,GAAG,MAAA,IAAI,CAAC,4BAA4B,CAAC,gBAAgB,0CAAE,aAAa,CAAA;YACvF,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,sBAAO,EAAC,aAAa,CAAC,CAAC,CAAA;YAChD,CAAC;YAED,6FAA6F;YAC7F,uBAAuB;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;QA6EO,YAAO,GAAG,IAAI,+BAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAChD,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QA7EC,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,4BAA4B,CAAA;IAC3E,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,IAAA,0BAAQ,EAAC,EAAE,CAAC,CAAA;QAE7B,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,mEAAmE;YACnE,gKAAgK;YAChK,kBAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kHAAkH,CAAC,CAAA;QAC1K,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,4GAA4G,CAAC,CAAC,CAAA;QAE9K,yDAAyD;QACzD,0HAA0H;QAC1H,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,6DAA6D,CAAC,CAAA;QAC7E,IAAI,CAAC,qBAAqB,EAAE,CAAA;QAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,IAAI,CAAC,6BAA6B,EAAE,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YACnH,MAAM,IAAI,wCAAyB,CACjC,0PAA0P,CAC3P,CAAA;QACH,CAAC;IACH,CAAC;IAED,qBAAqB;QACnB,CAAC;QAAA,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,wCAAyB,CACjC,wCAAwC,KAAK,+IAA+I,CAC7L,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,wBAAwB;QACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACrC,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,0DAA0D,CAAC,CAAA;YACxG,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6BAA6B;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC;YAC/C,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,EAAE,gFAAgF,CAAC,CAAA;YACxI,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,CAAC;YACnD,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,EAAE,iEAAiE,CAAC,CAAA;QAC/H,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC;YACrD,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE,EAAE,wCAAwC,CAAC,CAAA;QACxG,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yBAAyB;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAChC,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,4DAA4D,CAAC,CAAA;YACrG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;gBAChC,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,4DAA4D,CAAC,CAAA;YACvG,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,oBAAoB;QAClB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,gBAAiB,CAAC,aAAa,CAAC,CAAA;IACpG,CAAC;IAKD,mFAAmF;IACnF,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,IAAA,0BAAQ,EAAC,EAAE,CAAC,CAAA;QAE7B,MAAM,EACJ,aAAa,EAAE,UAAU,EAAE,kCAAkC;QAC7D,QAAQ,EACR,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,GAAG,gBAAgB,EACpB,GAAqC,OAAO,CAAC,OAAO,CAAC,gBAAiB,CAAA;QACvE,MAAM,MAAM,GAAG;YACb,GAAG,gBAAgB;YACnB,QAAQ,EAAE,QAAQ;YAClB,sBAAsB,EAAE,sBAAsB;YAC9C,sBAAsB,EAAE,sBAAsB;YAC9C,gBAAgB,EAAE,gBAAgB,IAAI,oCAAoC;YAC1E,eAAe,EAAE,eAAe,IAAI,QAAQ;YAC5C,UAAU,EAAE,UAAU,IAAI,QAAQ;YAClC,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG;SAC3B,CAAA;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACrC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;YAC9B,OAAO,CAAC,GAAG,GAAG,EAAE,IAAI,KAAK,EAAE,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC,EAAE,EAAc,CAAC;aACjB,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yBAAyB,YAAY,EAAE,CAAC,CAAC,CAAA;QAEzG,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAlID,0DAkIC","sourcesContent":["import { asArray, InvalidConfigurationError, log } from \"builder-util\"\nimport { WindowsAzureSigningConfiguration, WindowsConfiguration } from \"../options/winOptions\"\nimport { WinPackager } from \"../winPackager\"\nimport { getPSCmd, WindowsSignOptions } from \"./windowsCodeSign\"\nimport { Lazy } from \"lazy-val\"\nimport { SignManager } from \"./signManager\"\nimport { MemoLazy } from \"builder-util-runtime\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager\"\n\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly platformSpecificBuildOptions: WindowsConfiguration\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    const publisherName = this.platformSpecificBuildOptions.azureSignOptions?.publisherName\n    if (publisherName === null) {\n      return Promise.resolve(null)\n    } else if (publisherName != null) {\n      return Promise.resolve(asArray(publisherName))\n    }\n\n    // TODO: Is there another way to automatically pull Publisher Name from AzureTrusted service?\n    // For now return null.\n    return Promise.resolve(null)\n  })\n\n  constructor(private readonly packager: WinPackager) {\n    this.platformSpecificBuildOptions = packager.platformSpecificBuildOptions\n  }\n\n  async initialize() {\n    const vm = await this.packager.vm.value\n    const ps = await getPSCmd(vm)\n\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      // Might not be needed, seems GH runners already have NuGet set up.\n      // Logging to debug just in case users run into this. If NuGet isn't present, Install-Module -Name TrustedSigning will fail, so we'll get the logs at that point\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider Nuget. Might be a false alarm though as some systems already have it installed\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -RequiredVersion 0.4.1 -Force -Repository PSGallery -Scope CurrentUser\"])\n\n    // Preemptively check env vars once during initialization\n    // Options: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition\n    log.info(null, \"verifying env vars for authenticating to Microsoft Entra ID\")\n    this.verifyRequiredEnvVars()\n    if (!(this.verifyPrincipleSecretEnv() || this.verifyPrincipleCertificateEnv() || this.verifyUsernamePasswordEnv())) {\n      throw new InvalidConfigurationError(\n        `Unable to find valid azure env configuration for signing. Missing field(s) can be debugged via \"DEBUG=electron-builder\". Please refer to: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition`\n      )\n    }\n  }\n\n  verifyRequiredEnvVars() {\n    ;[\"AZURE_TENANT_ID\", \"AZURE_CLIENT_ID\"].forEach(field => {\n      if (!process.env[field]) {\n        throw new InvalidConfigurationError(\n          `Unable to find valid azure env field ${field} for signing. Please refer to: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition`\n        )\n      }\n    })\n  }\n\n  verifyPrincipleSecretEnv() {\n    if (!process.env.AZURE_CLIENT_SECRET) {\n      log.debug({ envVar: \"AZURE_CLIENT_SECRET\" }, \"no secret found for authenticating to Microsoft Entra ID\")\n      return false\n    }\n    return true\n  }\n\n  verifyPrincipleCertificateEnv() {\n    if (!process.env.AZURE_CLIENT_CERTIFICATE_PATH) {\n      log.debug({ envVar: \"AZURE_CLIENT_CERTIFICATE_PATH\" }, \"no path found for signing certificate for authenticating to Microsoft Entra ID\")\n      return false\n    }\n    if (!process.env.AZURE_CLIENT_CERTIFICATE_PASSWORD) {\n      log.debug({ envVar: \"AZURE_CLIENT_CERTIFICATE_PASSWORD\" }, \"(optional) certificate password not found, assuming no password\")\n    }\n    if (!process.env.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN) {\n      log.debug({ envVar: \"AZURE_CLIENT_SEND_CERTIFICATE_CHAIN\" }, \"(optional) certificate chain not found\")\n    }\n    return true\n  }\n\n  verifyUsernamePasswordEnv() {\n    if (!process.env.AZURE_USERNAME) {\n      log.debug({ envVar: \"AZURE_USERNAME\" }, \"no username found for authenticating to Microsoft Entra ID\")\n      if (!process.env.AZURE_PASSWORD) {\n        log.debug({ envVar: \"AZURE_PASSWORD\" }, \"no password found for authenticating to Microsoft Entra ID\")\n      }\n      return false\n    }\n    return true\n  }\n\n  computePublisherName(): Promise<string> {\n    return Promise.resolve(this.packager.platformSpecificBuildOptions.azureSignOptions!.publisherName)\n  }\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformSpecificBuildOptions,\n    _selected => Promise.resolve(null)\n  )\n  // prerequisite: requires `initializeProviderModules` to already have been executed\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    const vm = await this.packager.vm.value\n    const ps = await getPSCmd(vm)\n\n    const {\n      publisherName: _publisher, // extract from `extraSigningArgs`\n      endpoint,\n      certificateProfileName,\n      codeSigningAccountName,\n      fileDigest,\n      timestampRfc3161,\n      timestampDigest,\n      ...extraSigningArgs\n    }: WindowsAzureSigningConfiguration = options.options.azureSignOptions!\n    const params = {\n      ...extraSigningArgs,\n      Endpoint: endpoint,\n      CertificateProfileName: certificateProfileName,\n      CodeSigningAccountName: codeSigningAccountName,\n      TimestampRfc3161: timestampRfc3161 || \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: timestampDigest || \"SHA256\",\n      FileDigest: fileDigest || \"SHA256\",\n      Files: `\"${options.path}\"`,\n    }\n    const paramsString = Object.entries(params)\n      .filter(([_, value]) => value != null)\n      .reduce((res, [field, value]) => {\n        return [...res, `-${field}`, value]\n      }, [] as string[])\n      .join(\" \")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", `Invoke-TrustedSigning ${paramsString}`])\n\n    return true\n  }\n}\n"]}

package/out/codeSign/windowsSignToolManager.d.ts

@@ -5,6 +5,8 @@ import { WinPackager } from "../winPackager";
 import { WindowsSignOptions } from "./windowsCodeSign";
 import { MemoLazy } from "builder-util-runtime";
 import { Lazy } from "lazy-val";
+import { SignManager } from "./signManager";
+import { Target } from "../core";
 export declare function getSignVendorPath(): Promise<string>;
 export type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>;
 export interface WindowsSignToolOptions extends WindowsSignOptions {
@@ -34,14 +36,16 @@ export interface CertificateFromStoreInfo {
     store: string;
     isLocalMachineStore: boolean;
 }
-export declare class WindowsSignToolManager {
+export declare class WindowsSignToolManager implements SignManager {
     private readonly packager;
     private readonly platformSpecificBuildOptions;
     constructor(packager: WinPackager);
     readonly computedPublisherName: Lazy<string[] | null>;
     readonly lazyCertInfo: MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>;
     readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
-    signUsingSigntool(options: WindowsSignOptions): Promise<boolean>;
+    initialize(): Promise<void>;
+    computePublisherName(target: Target, publisherName: string): Promise<string>;
+    signFile(options: WindowsSignOptions): Promise<boolean>;
     getCertInfo(file: string, password: string): Promise<CertificateInfo>;
     computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm?: VmManager): Array<string>;
     getOutputPath(inputPath: string, hash: string): string;

package/out/codeSign/windowsSignToolManager.js

@@ -18,6 +18,7 @@ const windowsCodeSign_1 = require("./windowsCodeSign");
 const builder_util_runtime_1 = require("builder-util-runtime");
 const lazy_val_1 = require("lazy-val");
 const codesign_1 = require("./codesign");
+const AppxTarget_1 = require("../targets/AppxTarget");
 function getSignVendorPath() {
     return (0, binDownload_1.getBin)("winCodeSign");
 }
@@ -104,7 +105,23 @@ class WindowsSignToolManager {
         });
         this.platformSpecificBuildOptions = packager.platformSpecificBuildOptions;
     }
-    async signUsingSigntool(options) {
+    initialize() {
+        return Promise.resolve();
+    }
+    // https://github.com/electron-userland/electron-builder/issues/2108#issuecomment-333200711
+    async computePublisherName(target, publisherName) {
+        if (target instanceof AppxTarget_1.default && (await this.cscInfo.value) == null) {
+            builder_util_1.log.info({ reason: "Windows Store only build" }, "AppX is not signed");
+            return publisherName || "CN=ms";
+        }
+        const certInfo = await this.lazyCertInfo.value;
+        const publisher = publisherName || (certInfo == null ? null : certInfo.bloodyMicrosoftSubjectDn);
+        if (publisher == null) {
+            throw new Error("Internal error: cannot compute subject using certificate info");
+        }
+        return publisher;
+    }
+    async signFile(options) {
         var _a, _b;
         let hashes = (0, platformPackager_1.chooseNotNull)((_a = options.options.signtoolOptions) === null || _a === void 0 ? void 0 : _a.signingHashAlgorithms, options.options.signingHashAlgorithms);
         // msi does not support dual-signing