app-builder-lib 26.11.1 → 26.12.1

package/out/binDownload.js

@@ -14,10 +14,16 @@ const electronGet_1 = require("./util/electronGet");
 const versionToPromise = new Map();
 async function download(url, output, checksum) {
     const filenameWithExt = path.basename(new URL(url).pathname);
+    if (checksum == null) {
+        // Without a checksum, a download intercepted via a rogue mirror, tampered CDN
+        // edge, or DNS spoofing can substitute a malicious payload undetected.
+        // Callers should supply a checksum whenever possible.
+        builder_util_1.log.warn({ url }, "downloading without an integrity checksum — the download is not verified against a known-good hash");
+    }
     const downloadedFile = await get.downloadArtifact({
         version: "9.9.9",
         artifactName: filenameWithExt,
-        cacheRoot: path.resolve((0, electronGet_1.getCacheDirectory)(), "downloads"),
+        cacheRoot: path.resolve((0, electronGet_1.getCacheDirectory)({ allowEnvVarOverride: true }), "downloads"),
         cacheMode: get_1.ElectronDownloadCacheMode.ReadWrite,
         ...(checksum != null ? { checksums: { [filenameWithExt]: checksum } } : { unsafelyDisableChecksums: true }),
         mirrorOptions: { resolveAssetURL: async () => Promise.resolve(url) },
@@ -29,7 +35,26 @@ function getBinFromCustomLoc(name, version, binariesLocUrl, checksum) {
     const dirName = `${name}-${version}`;
     return getBin(dirName, binariesLocUrl, checksum);
 }
+/**
+ * Validates a binary-download custom-directory value read from an environment
+ * variable.  These values are interpolated directly into a download URL; a
+ * malicious value (e.g. set via a postinstall hook in node_modules) could
+ * redirect tool downloads to an attacker-controlled server.
+ *
+ * Allowed: relative path components such as "v1.0.0-custom" or "my-mirror/nsis".
+ * Rejected: anything containing "://", ".." (traversal), or a leading "/" (which
+ * could make the resulting URL protocol-relative or change the host).
+ */
+function validateBinaryCustomDir(envVarName, value) {
+    if (value.includes("://") || value.includes("..") || value.startsWith("/")) {
+        throw new Error(`${envVarName} must be a safe relative path component (e.g. "v1.0.0-custom"). Values containing "://", "..", or a leading "/" are not allowed. Got: "${value}"`);
+    }
+    return value;
+}
 function getBinFromUrl(releaseName, filenameWithExt, checksum, githubOrgRepo = "electron-userland/electron-builder-binaries") {
+    if (/[/\\]|^\.\./.test(filenameWithExt) || filenameWithExt.includes("..")) {
+        throw new Error(`getBinFromUrl: unsafe filenameWithExt "${filenameWithExt}" — must be a plain filename with no path separators or traversal sequences`);
+    }
     let url;
     const overrideUrl = (0, builder_util_1.parseValidEnvVarUrl)("ELECTRON_BUILDER_BINARIES_DOWNLOAD_OVERRIDE_URL");
     if (overrideUrl != null) {
@@ -37,11 +62,16 @@ function getBinFromUrl(releaseName, filenameWithExt, checksum, githubOrgRepo = "
     }
     else {
         const baseUrl = (0, electronGet_1.getBinariesMirrorUrl)(githubOrgRepo);
-        const middleUrl = process.env.NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR ||
-            process.env.npm_config_electron_builder_binaries_custom_dir ||
-            process.env.npm_package_config_electron_builder_binaries_custom_dir ||
-            process.env.ELECTRON_BUILDER_BINARIES_CUSTOM_DIR ||
-            releaseName;
+        // Any of these env vars can redirect downloads to a custom release directory.
+        // Validate each one before interpolating into the URL.
+        const CUSTOM_DIR_ENV_VARS = [
+            "NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR",
+            "npm_config_electron_builder_binaries_custom_dir",
+            "npm_package_config_electron_builder_binaries_custom_dir",
+            "ELECTRON_BUILDER_BINARIES_CUSTOM_DIR",
+        ];
+        const customDirEntry = CUSTOM_DIR_ENV_VARS.map(name => ({ name, value: process.env[name] })).find(e => e.value != null);
+        const middleUrl = customDirEntry != null ? validateBinaryCustomDir(customDirEntry.name, customDirEntry.value) : releaseName;
         url = `${baseUrl}${middleUrl}/${filenameWithExt}`;
     }
     const cacheKey = `${releaseName}-${path.basename(filenameWithExt, path.extname(filenameWithExt))}`;

package/out/binDownload.js.map

@@ -1 +1 @@
-{"version":3,"file":"binDownload.js","sourceRoot":"","sources":["../src/binDownload.ts"],"names":[],"mappings":";;AAWA,4BAYC;AAED,kDAGC;AAED,sCAkBC;AAED,wBA2BC;AA7ED,qCAAoC;AACpC,uCAAyD;AACzD,kCAAiC;AACjC,+CAAkD;AAElD,wDAA4D;AAC5D,6BAA4B;AAC5B,oDAAoG;AAEpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAA;AAEpD,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,QAAwB;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC;QAChD,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAA,+BAAiB,GAAE,EAAE,WAAW,CAAC;QACzD,SAAS,EAAE,+BAAyB,CAAC,SAAS;QAC9C,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QAC3G,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACpE,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IACF,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,cAAsB,EAAE,QAAgB;IACzG,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAA;IACpC,OAAO,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAA;AAClD,CAAC;AAED,SAAgB,aAAa,CAAC,WAAmB,EAAE,eAAuB,EAAE,QAAgB,EAAE,aAAa,GAAG,6CAA6C;IACzJ,IAAI,GAAW,CAAA;IACf,MAAM,WAAW,GAAG,IAAA,kCAAmB,EAAC,iDAAiD,CAAC,CAAA;IAC1F,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,GAAG,GAAG,WAAW,GAAG,GAAG,GAAG,eAAe,CAAA;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAA,kCAAoB,EAAC,aAAa,CAAC,CAAA;QACnD,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,+CAA+C;YAC3D,OAAO,CAAC,GAAG,CAAC,+CAA+C;YAC3D,OAAO,CAAC,GAAG,CAAC,uDAAuD;YACnE,OAAO,CAAC,GAAG,CAAC,oCAAoC;YAChD,WAAW,CAAA;QACb,GAAG,GAAG,GAAG,OAAO,GAAG,SAAS,IAAI,eAAe,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAA;IAClG,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED,SAAgB,MAAM,CAAC,QAAgB,EAAE,GAAsB,EAAE,QAA2B;;IAC1F,MAAM,SAAS,GAAG,IAAA,2BAAgB,EAAC,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,sBAAsB,mCAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;IAC5F,IAAI,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,WAAW,QAAQ,kCAAkC;YACnD,wEAAwE;YACxE,wDAAwD,CAC3D,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAE9C,OAAO,GAAG,IAAA,oCAAsB,EAAC;QAC/B,WAAW;QACX,eAAe;QACf,SAAS,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,WAAW;KACZ,CAAC,CAAA;IACF,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACxC,OAAO,OAAO,CAAA;AAChB,CAAC","sourcesContent":["import * as get from \"@electron/get\"\nimport { ElectronDownloadCacheMode } from \"@electron/get\"\nimport * as fs from \"fs/promises\"\nimport { parseValidEnvVarUrl } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { sanitizeFileName } from \"builder-util/out/filename\"\nimport * as path from \"path\"\nimport { downloadBuilderToolset, getBinariesMirrorUrl, getCacheDirectory } from \"./util/electronGet\"\n\nconst versionToPromise = new Map<string, Promise<string>>()\n\nexport async function download(url: string, output: string, checksum?: string | null): Promise<void> {\n  const filenameWithExt = path.basename(new URL(url).pathname)\n  const downloadedFile = await get.downloadArtifact({\n    version: \"9.9.9\",\n    artifactName: filenameWithExt,\n    cacheRoot: path.resolve(getCacheDirectory(), \"downloads\"),\n    cacheMode: ElectronDownloadCacheMode.ReadWrite,\n    ...(checksum != null ? { checksums: { [filenameWithExt]: checksum } } : { unsafelyDisableChecksums: true }),\n    mirrorOptions: { resolveAssetURL: async () => Promise.resolve(url) },\n    isGeneric: true,\n  })\n  await fs.copyFile(downloadedFile, output)\n}\n\nexport function getBinFromCustomLoc(name: string, version: string, binariesLocUrl: string, checksum: string): Promise<string> {\n  const dirName = `${name}-${version}`\n  return getBin(dirName, binariesLocUrl, checksum)\n}\n\nexport function getBinFromUrl(releaseName: string, filenameWithExt: string, checksum: string, githubOrgRepo = \"electron-userland/electron-builder-binaries\"): Promise<string> {\n  let url: string\n  const overrideUrl = parseValidEnvVarUrl(\"ELECTRON_BUILDER_BINARIES_DOWNLOAD_OVERRIDE_URL\")\n  if (overrideUrl != null) {\n    url = overrideUrl + \"/\" + filenameWithExt\n  } else {\n    const baseUrl = getBinariesMirrorUrl(githubOrgRepo)\n    const middleUrl =\n      process.env.NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR ||\n      process.env.npm_config_electron_builder_binaries_custom_dir ||\n      process.env.npm_package_config_electron_builder_binaries_custom_dir ||\n      process.env.ELECTRON_BUILDER_BINARIES_CUSTOM_DIR ||\n      releaseName\n    url = `${baseUrl}${middleUrl}/${filenameWithExt}`\n  }\n\n  const cacheKey = `${releaseName}-${path.basename(filenameWithExt, path.extname(filenameWithExt))}`\n  return getBin(cacheKey, url, checksum)\n}\n\nexport function getBin(cacheKey: string, url?: string | Nullish, checksum?: string | Nullish): Promise<string> {\n  const cacheName = sanitizeFileName(`${process.env.ELECTRON_BUILDER_CACHE ?? \"\"}${cacheKey}`)\n  let promise = versionToPromise.get(cacheName)\n  if (promise != null) {\n    return promise\n  }\n\n  if (url == null) {\n    throw new Error(\n      `getBin(\"${cacheKey}\"): a download URL is required. ` +\n        `The no-URL legacy path (e.g. winCodeSign \"0.0.0\") is no longer used — ` +\n        `it now downloads from winCodeSign-2.6.0 automatically.`\n    )\n  }\n\n  const filenameWithExt = path.basename(url)\n  const overrideUrl = url.substring(0, url.lastIndexOf(\"/\"))\n  const releaseName = path.basename(overrideUrl)\n\n  promise = downloadBuilderToolset({\n    releaseName,\n    filenameWithExt,\n    checksums: checksum != null ? { [filenameWithExt]: checksum } : undefined,\n    overrideUrl,\n  })\n  versionToPromise.set(cacheName, promise)\n  return promise\n}\n"]}
+{"version":3,"file":"binDownload.js","sourceRoot":"","sources":["../src/binDownload.ts"],"names":[],"mappings":";;AAWA,4BAkBC;AAED,kDAGC;AAmBD,sCAyBC;AAED,wBA2BC;AA3GD,qCAAoC;AACpC,uCAAyD;AACzD,kCAAiC;AACjC,+CAAuD;AAEvD,wDAA4D;AAC5D,6BAA4B;AAC5B,oDAAoG;AAEpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAA;AAEpD,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,QAAwB;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,8EAA8E;QAC9E,uEAAuE;QACvE,sDAAsD;QACtD,kBAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oGAAoG,CAAC,CAAA;IACzH,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC;QAChD,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAA,+BAAiB,EAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC;QACtF,SAAS,EAAE,+BAAyB,CAAC,SAAS;QAC9C,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QAC3G,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACpE,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IACF,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,cAAsB,EAAE,QAAgB;IACzG,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAA;IACpC,OAAO,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,UAAkB,EAAE,KAAa;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,0IAA0I,KAAK,GAAG,CAAC,CAAA;IAClL,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,aAAa,CAAC,WAAmB,EAAE,eAAuB,EAAE,QAAgB,EAAE,aAAa,GAAG,6CAA6C;IACzJ,IAAI,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,6EAA6E,CAAC,CAAA;IACzJ,CAAC;IACD,IAAI,GAAW,CAAA;IACf,MAAM,WAAW,GAAG,IAAA,kCAAmB,EAAC,iDAAiD,CAAC,CAAA;IAC1F,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,GAAG,GAAG,WAAW,GAAG,GAAG,GAAG,eAAe,CAAA;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAA,kCAAoB,EAAC,aAAa,CAAC,CAAA;QACnD,8EAA8E;QAC9E,uDAAuD;QACvD,MAAM,mBAAmB,GAAG;YAC1B,iDAAiD;YACjD,iDAAiD;YACjD,yDAAyD;YACzD,sCAAsC;SAC9B,CAAA;QACV,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAA;QACvH,MAAM,SAAS,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;QAC5H,GAAG,GAAG,GAAG,OAAO,GAAG,SAAS,IAAI,eAAe,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAA;IAClG,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED,SAAgB,MAAM,CAAC,QAAgB,EAAE,GAAsB,EAAE,QAA2B;;IAC1F,MAAM,SAAS,GAAG,IAAA,2BAAgB,EAAC,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,sBAAsB,mCAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;IAC5F,IAAI,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,WAAW,QAAQ,kCAAkC;YACnD,wEAAwE;YACxE,wDAAwD,CAC3D,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAE9C,OAAO,GAAG,IAAA,oCAAsB,EAAC;QAC/B,WAAW;QACX,eAAe;QACf,SAAS,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,WAAW;KACZ,CAAC,CAAA;IACF,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACxC,OAAO,OAAO,CAAA;AAChB,CAAC","sourcesContent":["import * as get from \"@electron/get\"\nimport { ElectronDownloadCacheMode } from \"@electron/get\"\nimport * as fs from \"fs/promises\"\nimport { log, parseValidEnvVarUrl } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { sanitizeFileName } from \"builder-util/out/filename\"\nimport * as path from \"path\"\nimport { downloadBuilderToolset, getBinariesMirrorUrl, getCacheDirectory } from \"./util/electronGet\"\n\nconst versionToPromise = new Map<string, Promise<string>>()\n\nexport async function download(url: string, output: string, checksum?: string | null): Promise<void> {\n  const filenameWithExt = path.basename(new URL(url).pathname)\n  if (checksum == null) {\n    // Without a checksum, a download intercepted via a rogue mirror, tampered CDN\n    // edge, or DNS spoofing can substitute a malicious payload undetected.\n    // Callers should supply a checksum whenever possible.\n    log.warn({ url }, \"downloading without an integrity checksum — the download is not verified against a known-good hash\")\n  }\n  const downloadedFile = await get.downloadArtifact({\n    version: \"9.9.9\",\n    artifactName: filenameWithExt,\n    cacheRoot: path.resolve(getCacheDirectory({ allowEnvVarOverride: true }), \"downloads\"),\n    cacheMode: ElectronDownloadCacheMode.ReadWrite,\n    ...(checksum != null ? { checksums: { [filenameWithExt]: checksum } } : { unsafelyDisableChecksums: true }),\n    mirrorOptions: { resolveAssetURL: async () => Promise.resolve(url) },\n    isGeneric: true,\n  })\n  await fs.copyFile(downloadedFile, output)\n}\n\nexport function getBinFromCustomLoc(name: string, version: string, binariesLocUrl: string, checksum: string): Promise<string> {\n  const dirName = `${name}-${version}`\n  return getBin(dirName, binariesLocUrl, checksum)\n}\n\n/**\n * Validates a binary-download custom-directory value read from an environment\n * variable.  These values are interpolated directly into a download URL; a\n * malicious value (e.g. set via a postinstall hook in node_modules) could\n * redirect tool downloads to an attacker-controlled server.\n *\n * Allowed: relative path components such as \"v1.0.0-custom\" or \"my-mirror/nsis\".\n * Rejected: anything containing \"://\", \"..\" (traversal), or a leading \"/\" (which\n * could make the resulting URL protocol-relative or change the host).\n */\nfunction validateBinaryCustomDir(envVarName: string, value: string): string {\n  if (value.includes(\"://\") || value.includes(\"..\") || value.startsWith(\"/\")) {\n    throw new Error(`${envVarName} must be a safe relative path component (e.g. \"v1.0.0-custom\"). Values containing \"://\", \"..\", or a leading \"/\" are not allowed. Got: \"${value}\"`)\n  }\n  return value\n}\n\nexport function getBinFromUrl(releaseName: string, filenameWithExt: string, checksum: string, githubOrgRepo = \"electron-userland/electron-builder-binaries\"): Promise<string> {\n  if (/[/\\\\]|^\\.\\./.test(filenameWithExt) || filenameWithExt.includes(\"..\")) {\n    throw new Error(`getBinFromUrl: unsafe filenameWithExt \"${filenameWithExt}\" — must be a plain filename with no path separators or traversal sequences`)\n  }\n  let url: string\n  const overrideUrl = parseValidEnvVarUrl(\"ELECTRON_BUILDER_BINARIES_DOWNLOAD_OVERRIDE_URL\")\n  if (overrideUrl != null) {\n    url = overrideUrl + \"/\" + filenameWithExt\n  } else {\n    const baseUrl = getBinariesMirrorUrl(githubOrgRepo)\n    // Any of these env vars can redirect downloads to a custom release directory.\n    // Validate each one before interpolating into the URL.\n    const CUSTOM_DIR_ENV_VARS = [\n      \"NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR\",\n      \"npm_config_electron_builder_binaries_custom_dir\",\n      \"npm_package_config_electron_builder_binaries_custom_dir\",\n      \"ELECTRON_BUILDER_BINARIES_CUSTOM_DIR\",\n    ] as const\n    const customDirEntry = CUSTOM_DIR_ENV_VARS.map(name => ({ name, value: process.env[name] })).find(e => e.value != null)\n    const middleUrl = customDirEntry != null ? validateBinaryCustomDir(customDirEntry.name, customDirEntry.value!) : releaseName\n    url = `${baseUrl}${middleUrl}/${filenameWithExt}`\n  }\n\n  const cacheKey = `${releaseName}-${path.basename(filenameWithExt, path.extname(filenameWithExt))}`\n  return getBin(cacheKey, url, checksum)\n}\n\nexport function getBin(cacheKey: string, url?: string | Nullish, checksum?: string | Nullish): Promise<string> {\n  const cacheName = sanitizeFileName(`${process.env.ELECTRON_BUILDER_CACHE ?? \"\"}${cacheKey}`)\n  let promise = versionToPromise.get(cacheName)\n  if (promise != null) {\n    return promise\n  }\n\n  if (url == null) {\n    throw new Error(\n      `getBin(\"${cacheKey}\"): a download URL is required. ` +\n        `The no-URL legacy path (e.g. winCodeSign \"0.0.0\") is no longer used — ` +\n        `it now downloads from winCodeSign-2.6.0 automatically.`\n    )\n  }\n\n  const filenameWithExt = path.basename(url)\n  const overrideUrl = url.substring(0, url.lastIndexOf(\"/\"))\n  const releaseName = path.basename(overrideUrl)\n\n  promise = downloadBuilderToolset({\n    releaseName,\n    filenameWithExt,\n    checksums: checksum != null ? { [filenameWithExt]: checksum } : undefined,\n    overrideUrl,\n  })\n  versionToPromise.set(cacheName, promise)\n  return promise\n}\n"]}

package/out/codeSign/codesign.js

@@ -3,38 +3,22 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.importCertificate = importCertificate;
 const builder_util_1 = require("builder-util");
 const fs_extra_1 = require("fs-extra");
-const os_1 = require("os");
-const path = require("path");
 const binDownload_1 = require("../binDownload");
 /** @private */
 async function importCertificate(cscLink, tmpDir, currentDir) {
-    var _a, _b;
     cscLink = cscLink.trim();
-    let file = null;
-    if ((cscLink.length > 3 && cscLink[1] === ":") || cscLink.startsWith("/") || cscLink.startsWith(".")) {
-        file = cscLink;
-    }
-    else if (cscLink.startsWith("file://")) {
-        file = cscLink.substring("file://".length);
-    }
-    else if (cscLink.startsWith("~/")) {
-        file = path.join((0, os_1.homedir)(), cscLink.substring("~/".length));
-    }
-    else if (cscLink.startsWith("https://")) {
+    if (cscLink.startsWith("https://")) {
         const tempFile = await tmpDir.getTempFile({ suffix: ".p12" });
         await (0, binDownload_1.download)(cscLink, tempFile);
         return tempFile;
     }
-    else {
-        const mimeType = (_a = /data:.*;base64,/.exec(cscLink)) === null || _a === void 0 ? void 0 : _a[0];
-        if (mimeType || cscLink.length > 2048 || cscLink.endsWith("=")) {
-            const tempFile = await tmpDir.getTempFile({ suffix: ".p12" });
-            await (0, fs_extra_1.outputFile)(tempFile, Buffer.from(cscLink.substring((_b = mimeType === null || mimeType === void 0 ? void 0 : mimeType.length) !== null && _b !== void 0 ? _b : 0), "base64"));
-            return tempFile;
-        }
-        file = cscLink;
+    const decoded = (0, builder_util_1.decodeCscLinkBase64)(cscLink);
+    if (decoded) {
+        const tempFile = await tmpDir.getTempFile({ suffix: ".p12" });
+        await (0, fs_extra_1.outputFile)(tempFile, decoded);
+        return tempFile;
     }
-    file = path.resolve(currentDir, file);
+    const file = (0, builder_util_1.resolveCscLinkPath)(cscLink, currentDir);
     const stat = await (0, builder_util_1.statOrNull)(file);
     if (stat == null) {
         throw new builder_util_1.InvalidConfigurationError(`${file} doesn't exist`);

package/out/codeSign/codesign.js.map

@@ -1 +1 @@
-{"version":3,"file":"codesign.js","sourceRoot":"","sources":["../../src/codeSign/codesign.ts"],"names":[],"mappings":";;AAQA,8CAiCC;AAzCD,+CAAoE;AACpE,uCAAqC;AACrC,2BAA4B;AAC5B,6BAA4B;AAE5B,gDAAyC;AAEzC,eAAe;AACR,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,MAAc,EAAE,UAAkB;;IACzF,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IAExB,IAAI,IAAI,GAAkB,IAAI,CAAA;IAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrG,IAAI,GAAG,OAAO,CAAA;IAChB,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7D,MAAM,IAAA,sBAAQ,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACjC,OAAO,QAAQ,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAA,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,0CAAG,CAAC,CAAC,CAAA;QACrD,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7D,MAAM,IAAA,qBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC3F,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,IAAI,GAAG,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,MAAM,IAAA,yBAAU,EAAC,IAAI,CAAC,CAAA;IACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,wCAAyB,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAA;IAC9D,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,wCAAyB,CAAC,GAAG,IAAI,aAAa,CAAC,CAAA;IAC3D,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC","sourcesContent":["import { InvalidConfigurationError, statOrNull } from \"builder-util\"\nimport { outputFile } from \"fs-extra\"\nimport { homedir } from \"os\"\nimport * as path from \"path\"\nimport { TmpDir } from \"temp-file\"\nimport { download } from \"../binDownload\"\n\n/** @private */\nexport async function importCertificate(cscLink: string, tmpDir: TmpDir, currentDir: string): Promise<string> {\n  cscLink = cscLink.trim()\n\n  let file: string | null = null\n  if ((cscLink.length > 3 && cscLink[1] === \":\") || cscLink.startsWith(\"/\") || cscLink.startsWith(\".\")) {\n    file = cscLink\n  } else if (cscLink.startsWith(\"file://\")) {\n    file = cscLink.substring(\"file://\".length)\n  } else if (cscLink.startsWith(\"~/\")) {\n    file = path.join(homedir(), cscLink.substring(\"~/\".length))\n  } else if (cscLink.startsWith(\"https://\")) {\n    const tempFile = await tmpDir.getTempFile({ suffix: \".p12\" })\n    await download(cscLink, tempFile)\n    return tempFile\n  } else {\n    const mimeType = /data:.*;base64,/.exec(cscLink)?.[0]\n    if (mimeType || cscLink.length > 2048 || cscLink.endsWith(\"=\")) {\n      const tempFile = await tmpDir.getTempFile({ suffix: \".p12\" })\n      await outputFile(tempFile, Buffer.from(cscLink.substring(mimeType?.length ?? 0), \"base64\"))\n      return tempFile\n    }\n    file = cscLink\n  }\n\n  file = path.resolve(currentDir, file)\n  const stat = await statOrNull(file)\n  if (stat == null) {\n    throw new InvalidConfigurationError(`${file} doesn't exist`)\n  } else if (!stat.isFile()) {\n    throw new InvalidConfigurationError(`${file} not a file`)\n  } else {\n    return file\n  }\n}\n"]}
+{"version":3,"file":"codesign.js","sourceRoot":"","sources":["../../src/codeSign/codesign.ts"],"names":[],"mappings":";;AAMA,8CAyBC;AA/BD,+CAA6G;AAC7G,uCAAqC;AAErC,gDAAyC;AAEzC,eAAe;AACR,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,MAAc,EAAE,UAAkB;IACzF,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IAExB,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7D,MAAM,IAAA,sBAAQ,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACjC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,kCAAmB,EAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7D,MAAM,IAAA,qBAAU,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACnC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,iCAAkB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,MAAM,IAAA,yBAAU,EAAC,IAAI,CAAC,CAAA;IACnC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,wCAAyB,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAA;IAC9D,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,wCAAyB,CAAC,GAAG,IAAI,aAAa,CAAC,CAAA;IAC3D,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC","sourcesContent":["import { decodeCscLinkBase64, InvalidConfigurationError, resolveCscLinkPath, statOrNull } from \"builder-util\"\nimport { outputFile } from \"fs-extra\"\nimport { TmpDir } from \"temp-file\"\nimport { download } from \"../binDownload\"\n\n/** @private */\nexport async function importCertificate(cscLink: string, tmpDir: TmpDir, currentDir: string): Promise<string> {\n  cscLink = cscLink.trim()\n\n  if (cscLink.startsWith(\"https://\")) {\n    const tempFile = await tmpDir.getTempFile({ suffix: \".p12\" })\n    await download(cscLink, tempFile)\n    return tempFile\n  }\n\n  const decoded = decodeCscLinkBase64(cscLink)\n  if (decoded) {\n    const tempFile = await tmpDir.getTempFile({ suffix: \".p12\" })\n    await outputFile(tempFile, decoded)\n    return tempFile\n  }\n\n  const file = resolveCscLinkPath(cscLink, currentDir)\n  const stat = await statOrNull(file)\n  if (stat == null) {\n    throw new InvalidConfigurationError(`${file} doesn't exist`)\n  } else if (!stat.isFile()) {\n    throw new InvalidConfigurationError(`${file} not a file`)\n  } else {\n    return file\n  }\n}\n"]}

package/out/codeSign/macCodeSign.js

@@ -26,9 +26,9 @@ function isSignAllowed(isPrintWarn = true) {
         }
         return false;
     }
-    const buildForPrWarning = "There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)" +
-        "\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.";
     if ((0, builder_util_1.isPullRequest)()) {
+        const buildForPrWarning = "There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)" +
+            "\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.";
         if ((0, builder_util_1.isEnvTrue)(process.env.CSC_FOR_PULL_REQUEST)) {
             if (isPrintWarn) {
                 builder_util_1.log.warn(buildForPrWarning);

package/out/codeSign/macCodeSign.js.map

@@ -1 +1 @@
-{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/macCodeSign.ts"],"names":[],"mappings":";;;AA6BA,sCA4BC;AAED,kCAqCC;AA+CD,wCAOC;AAED,wCA8CC;AAiBD,oBAMC;AAsGD,oCAeC;AAlVD,iDAA8C;AAE9C,iFAAmF;AACnF,+CAAuK;AAEvK,mCAAgD;AAChD,0CAAoC;AACpC,uCAA+B;AAC/B,2BAAoC;AACpC,6BAA4B;AAC5B,yCAAuC;AACvC,yCAA+D;AAC/D,yCAA8C;AAEjC,QAAA,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,SAAgB,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,iBAAiB,GACrB,kKAAkK;QAClK,6LAA6L,CAAA;IAE/L,IAAI,IAAA,4BAAa,GAAE,EAAE,CAAC;QACpB,IAAI,IAAA,wBAAS,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,kBAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,kBAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,gBAA4B,EAAE,SAA2B,EAAE,YAA8B,EAAE,kBAA2B;IACtK,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAA;IAC5D,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,eAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAA,uBAAW,EAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,IAAA,uBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,iBAAM,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KAC9I,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,IAAA,8BAAe,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,SAAgB,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,IAAA,6BAAc,EAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAA,WAAM,GAAE,EAAE,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,2LAA2L;QAC3L,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1G,8BAA8B;QAC9B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;KACrI,CAAC,CAAA;IACF,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAA,YAAY,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAA;QACtC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,OAAO,IAAA,oBAAK,EAAC,GAAG,EAAE,CAAC,IAAA,oBAAS,EAAC,IAAI,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAEU,QAAA,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,6BAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB;YAClC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACX,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;iBAChB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBACb,MAAM,CACL,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CACvK;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,6BAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,0BAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,wCAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import { signAsync } from \"@electron/osx-sign\"\nimport { SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport { Identity as _Identity } from \"@electron/osx-sign/dist/cjs/util-identities\"\nimport { copyFile, exec, Fields, InvalidConfigurationError, isEmptyOrSpaces, isEnvTrue, isPullRequest, log, Logger, retry, TmpDir, unlinkIfExists } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { createHash, randomBytes } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { isAutoDiscoveryCodeSignIdentity } from \"../util/flags\"\nimport { importCertificate } from \"./codesign\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  const buildForPrWarning =\n    \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n    \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n  if (isPullRequest()) {\n    if (isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n  return true\n}\n\nexport async function reportError(isMas: boolean, certificateTypes: CertType[], qualifier: string | Nullish, keychainFile: string | Nullish, isForceCodeSigning: boolean) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  const skipMessage = \"skipped macOS application code signing\"\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(skipMessage, logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, skipMessage)\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(__dirname, \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (process.env.TRAVIS !== \"true\") {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  await Promise.all([\n    // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.\n    ...certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))),\n    // queue each security command\n    securityCommands.reduce((promise, cmd) => promise.then(() => exec(\"/usr/bin/security\", cmd)), new Promise(resolve => resolve(null))),\n  ])\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i] ?? \"\"\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  return retry(() => signAsync(opts), {\n    retries: 3,\n    interval: 5000,\n    backoff: 5000,\n  })\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    result = Promise.all<Array<string>>([\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]).then(it => {\n      const array = it[0]\n        .concat(it[1])\n        .filter(\n          it => !it.includes(\"(Missing required extension)\") && !it.includes(\"valid identities found\") && !it.includes(\"iPhone \") && !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return parseIdentity(line)\n    }\n  }\n  return null\n}\n\nexport declare class Identity {\n  readonly name: string\n  readonly hash?: string\n\n  constructor(name: string, hash?: string)\n}\n\nfunction parseIdentity(line: string): Identity {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  return new _Identity(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}
+{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/macCodeSign.ts"],"names":[],"mappings":";;;AA6BA,sCA6BC;AAED,kCAqCC;AA+CD,wCAOC;AAED,wCA8CC;AAiBD,oBAMC;AAsGD,oCAeC;AAnVD,iDAA8C;AAE9C,iFAAmF;AACnF,+CAAuK;AAEvK,mCAAgD;AAChD,0CAAoC;AACpC,uCAA+B;AAC/B,2BAAoC;AACpC,6BAA4B;AAC5B,yCAAuC;AACvC,yCAA+D;AAC/D,yCAA8C;AAEjC,QAAA,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,SAAgB,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAA,4BAAa,GAAE,EAAE,CAAC;QACpB,MAAM,iBAAiB,GACrB,kKAAkK;YAClK,6LAA6L,CAAA;QAE/L,IAAI,IAAA,wBAAS,EAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,IAAI,WAAW,EAAE,CAAC;gBAChB,kBAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,kBAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,gBAA4B,EAAE,SAA2B,EAAE,YAA8B,EAAE,kBAA2B;IACtK,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAA;IAC5D,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,kBAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,eAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAA,uBAAW,EAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,IAAA,uBAAQ,EAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,iBAAM,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KAC9I,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,IAAA,8BAAe,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,YAAO,GAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,SAAgB,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,IAAA,6BAAc,EAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClC,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAA,WAAM,GAAE,EAAE,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,2LAA2L;QAC3L,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1G,8BAA8B;QAC9B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;KACrI,CAAC,CAAA;IACF,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAA,YAAY,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAA;QACtC,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAA,mBAAI,EAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAEM,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,OAAO,IAAA,oBAAK,EAAC,GAAG,EAAE,CAAC,IAAA,oBAAS,EAAC,IAAI,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAEU,QAAA,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,6BAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB;YAClC,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAA,mBAAI,EAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACX,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;iBAChB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBACb,MAAM,CACL,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CACvK;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,6BAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,0BAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAA,uCAA+B,GAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,gCAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,wCAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import { signAsync } from \"@electron/osx-sign\"\nimport { SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport { Identity as _Identity } from \"@electron/osx-sign/dist/cjs/util-identities\"\nimport { copyFile, exec, Fields, InvalidConfigurationError, isEmptyOrSpaces, isEnvTrue, isPullRequest, log, Logger, retry, TmpDir, unlinkIfExists } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { createHash, randomBytes } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { isAutoDiscoveryCodeSignIdentity } from \"../util/flags\"\nimport { importCertificate } from \"./codesign\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  if (isPullRequest()) {\n    const buildForPrWarning =\n      \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n      \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n    if (isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n\n  return true\n}\n\nexport async function reportError(isMas: boolean, certificateTypes: CertType[], qualifier: string | Nullish, keychainFile: string | Nullish, isForceCodeSigning: boolean) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  const skipMessage = \"skipped macOS application code signing\"\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(skipMessage, logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, skipMessage)\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(__dirname, \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (process.env.TRAVIS !== \"true\") {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  await Promise.all([\n    // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.\n    ...certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))),\n    // queue each security command\n    securityCommands.reduce((promise, cmd) => promise.then(() => exec(\"/usr/bin/security\", cmd)), new Promise(resolve => resolve(null))),\n  ])\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i] ?? \"\"\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  return retry(() => signAsync(opts), {\n    retries: 3,\n    interval: 5000,\n    backoff: 5000,\n  })\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    result = Promise.all<Array<string>>([\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]).then(it => {\n      const array = it[0]\n        .concat(it[1])\n        .filter(\n          it => !it.includes(\"(Missing required extension)\") && !it.includes(\"valid identities found\") && !it.includes(\"iPhone \") && !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return parseIdentity(line)\n    }\n  }\n  return null\n}\n\nexport declare class Identity {\n  readonly name: string\n  readonly hash?: string\n\n  constructor(name: string, hash?: string)\n}\n\nfunction parseIdentity(line: string): Identity {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  return new _Identity(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}

package/out/configuration.d.ts

@@ -9,7 +9,7 @@ import { MsiOptions } from "./options/MsiOptions";
 import { MsiWrappedOptions } from "./options/MsiWrappedOptions";
 import { PkgOptions } from "./options/pkgOptions";
 import { PlatformSpecificBuildOptions } from "./options/PlatformSpecificBuildOptions";
-import { SnapOptions } from "./options/SnapOptions";
+import { SnapcraftOptions, SnapOptions } from "./options/SnapOptions";
 import { SquirrelWindowsOptions } from "./options/SquirrelWindowsOptions";
 import { WindowsConfiguration } from "./options/winOptions";
 import { BuildResult } from "./packager";
@@ -101,9 +101,32 @@ export interface CommonConfiguration {
      */
     readonly deb?: DebOptions | null;
     /**
-     * Snap package options. Requires [snapcraft](https://snapcraft.io/) to be installed.
+     * Flat snap configuration targeting core22 and older snap bases.
+     *
+     * @deprecated Use `snapcraft` instead — it supersedes `snap` when both are present and supports
+     * all snap bases including core24. `snap` will be removed in a future major release.
+     * See {@link SnapOptions} for available properties.
      */
     readonly snap?: SnapOptions | null;
+    /**
+     * Snapcraft configuration. Prefer this over the deprecated `snap` field.
+     *
+     * Selects the snapcraft base and provides per-core options:
+     * - `base: "core18" | "core20" | "core22"` — legacy builds; accepts the same options as `snap`
+     * - `base: "core24"` — modern builds with the GNOME extension (recommended for new apps, requires Electron 25+)
+     * - `base: "custom"` — pass an existing `snapcraft.yaml` through unchanged; no plugs, extensions,
+     *   or desktop files are injected
+     *
+     * When both `snapcraft` and `snap` are set, `snapcraft` takes precedence.
+     *
+     * @example
+     * ```json
+     * { "snapcraft": { "base": "core24", "core24": { "useLXD": true } } }
+     * ```
+     *
+     * See {@link SnapcraftOptions} for all available properties.
+     */
+    readonly snapcraft?: SnapcraftOptions | null;
     /**
      * AppImage options. AppImage is a portable application format that bundles the app
      * and its dependencies into a single self-contained executable that runs on most
@@ -306,6 +329,17 @@ export interface ToolsetConfig {
      * @default "0.0.0"
      */
     readonly appimage?: "0.0.0" | "1.0.2" | "1.0.3" | null;
+    /**
+     * `nsis` bundle version to use for NSIS installer compilation.
+     * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=nsis&expanded=true
+     * 0.0.0 - legacy toolset (nsis-3.0.4.1 + nsis-resources-3.4.1)
+     *
+     * Betas:
+     * 1.2.1 - unified bundle (makensis 3.12 + plugins in one archive, entrypoint scripts auto-set NSISDIR)
+     *
+     * @default "0.0.0"
+     */
+    readonly nsis?: "0.0.0" | "1.2.1" | null;
 }
 export interface Hooks {
     /**

package/out/configuration.js.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"","sourcesContent":["import { Arch } from \"builder-util\"\nimport { BeforeBuildContext, Target } from \"./core\"\nimport { ElectronBrandingOptions } from \"./electron/ElectronFramework\"\nimport { PrepareApplicationStageDirectoryOptions } from \"./Framework\"\nimport { AppXOptions } from \"./options/AppXOptions\"\nimport { AppImageOptions, DebOptions, FlatpakOptions, LinuxConfiguration, LinuxTargetSpecificOptions, PacmanOptions, RpmOptions } from \"./options/linuxOptions\"\nimport { DmgOptions, MacConfiguration, MasConfiguration } from \"./options/macOptions\"\nimport { MsiOptions } from \"./options/MsiOptions\"\nimport { MsiWrappedOptions } from \"./options/MsiWrappedOptions\"\nimport { PkgOptions } from \"./options/pkgOptions\"\nimport { PlatformSpecificBuildOptions } from \"./options/PlatformSpecificBuildOptions\"\nimport { SnapOptions } from \"./options/SnapOptions\"\nimport { SquirrelWindowsOptions } from \"./options/SquirrelWindowsOptions\"\nimport { WindowsConfiguration } from \"./options/winOptions\"\nimport { BuildResult } from \"./packager\"\nimport { ArtifactBuildStarted, ArtifactCreated } from \"./packagerApi\"\nimport { PlatformPackager } from \"./platformPackager\"\nimport { NsisOptions, NsisWebOptions, PortableOptions } from \"./targets/nsis/nsisOptions\"\nimport { ElectronDownloadOptions, ElectronGetOptions } from \"./util/electronGet\"\n\n// duplicate appId here because it is important\n/**\n * Configuration Options\n */\nexport interface CommonConfiguration {\n  /**\n   * The application id. Used as [CFBundleIdentifier](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html#//apple_ref/doc/uid/20001431-102070) for MacOS and as\n   * [Application User Model ID](https://msdn.microsoft.com/en-us/library/windows/desktop/dd378459(v=vs.85).aspx) for Windows (NSIS target only, Squirrel.Windows not supported). It is strongly recommended that an explicit ID is set.\n   * @default com.electron.${name}\n   */\n  readonly appId?: string | null\n\n  /**\n   * As [name](#metadata), but allows you to specify a product name for your executable which contains spaces and other special characters not allowed in the [name property](https://docs.npmjs.com/files/package.json#name).\n   * If not specified inside of the `build` configuration, `productName` property defined at the top level of `package.json` is used. If not specified at the top level of `package.json`, [name property](https://docs.npmjs.com/files/package.json#name) is used.\n   */\n  readonly productName?: string | null\n\n  /**\n   * The human-readable copyright line for the app.\n   * @default Copyright © year ${author}\n   */\n  readonly copyright?: string | null\n\n  /**\n   * Directories for build resources\n   */\n  readonly directories?: MetadataDirectories | null\n\n  /**\n   * Configuration of toolsets utilized by electron-builder\n   */\n  readonly toolsets?: ToolsetConfig | null\n\n  /**\n   * Options related to how build macOS targets.\n   */\n  readonly mac?: MacConfiguration | null\n  /**\n   * MAS (Mac Application Store) options.\n   */\n  readonly mas?: MasConfiguration | null\n  /**\n   * MAS (Mac Application Store) development options (`mas-dev` target).\n   */\n  readonly masDev?: MasConfiguration | null\n  /**\n   * macOS DMG options.\n   */\n  readonly dmg?: DmgOptions | null\n  /**\n   * macOS PKG options.\n   */\n  readonly pkg?: PkgOptions | null\n\n  /**\n   * Options related to how build Windows targets.\n   */\n  readonly win?: WindowsConfiguration | null\n  /** NSIS installer options. */\n  readonly nsis?: NsisOptions | null\n  /** NSIS web installer options (downloads app package at install time). */\n  readonly nsisWeb?: NsisWebOptions | null\n  /** Portable executable options (no installation required). */\n  readonly portable?: PortableOptions | null\n  /** Windows Store (AppX) package options. */\n  readonly appx?: AppXOptions | null\n  /**\n   * MSI package options.\n   */\n  readonly msi?: MsiOptions | null\n  /**\n   * MSI-wrapped installer options.\n   */\n  readonly msiWrapped?: MsiWrappedOptions | null\n  /**\n   * Squirrel.Windows installer options. Requires the `electron-builder-squirrel-windows` dependency.\n   */\n  readonly squirrelWindows?: SquirrelWindowsOptions | null\n  /**\n   * General Linux build options shared across all Linux targets (icon, category, desktop entry,\n   * executable name, etc.). Target-specific compression and packaging options live in the\n   * per-format interfaces (`DebOptions`, `RpmOptions`, `PacmanOptions`, etc.).\n   */\n  readonly linux?: LinuxConfiguration | null\n  /**\n   * Debian package options. Targets Debian, Ubuntu, and Debian-based distributions.\n   * Produces a `.deb` archive installable via `dpkg -i` or `apt install`.\n   */\n  readonly deb?: DebOptions | null\n  /**\n   * Snap package options. Requires [snapcraft](https://snapcraft.io/) to be installed.\n   */\n  readonly snap?: SnapOptions | null\n  /**\n   * AppImage options. AppImage is a portable application format that bundles the app\n   * and its dependencies into a single self-contained executable that runs on most\n   * Linux distributions without installation.\n   */\n  readonly appImage?: AppImageOptions | null\n  /**\n   * Flatpak options. Flatpak is a sandboxed application distribution format for Linux\n   * that runs in a controlled environment and is distributed via [Flathub](https://flathub.org/)\n   * or other Flatpak repositories.\n   */\n  readonly flatpak?: FlatpakOptions | null\n  /**\n   * Pacman package options. Targets Arch Linux and Arch-based distributions\n   * (Manjaro, EndeavourOS, etc.). Produces a `.pacman` archive installable via `pacman -U`.\n   */\n  readonly pacman?: PacmanOptions | null\n  /**\n   * RPM package options. Targets Fedora, Red Hat Enterprise Linux, SUSE, and related\n   * distributions. Produces a `.rpm` archive installable via `rpm` or `dnf`.\n   */\n  readonly rpm?: RpmOptions | null\n  /**\n   * FreeBSD package options. Produces a `.pkg` archive for the FreeBSD `pkg` package manager.\n   */\n  readonly freebsd?: LinuxTargetSpecificOptions | null\n  /**\n   * Solaris IPS package options. Produces a `.p5p` archive for the Solaris Image Packaging\n   * System (`pkg`).\n   */\n  readonly p5p?: LinuxTargetSpecificOptions | null\n  /**\n   * Alpine Linux APK package options. Produces an `.apk` archive installable via `apk add`.\n   */\n  readonly apk?: LinuxTargetSpecificOptions | null\n\n  /**\n   * Whether to build the application native dependencies from source.\n   * @default false\n   */\n  buildDependenciesFromSource?: boolean\n  /**\n   * Whether to execute `node-gyp rebuild` before starting to package the app.\n   *\n   * Don't [use](https://github.com/electron-userland/electron-builder/issues/683#issuecomment-241214075) [npm](http://electron.atom.io/docs/tutorial/using-native-node-modules/#using-npm) (neither `.npmrc`) for configuring electron headers. Use `electron-builder node-gyp-rebuild` instead.\n   * @default false\n   */\n  readonly nodeGypRebuild?: boolean\n  /**\n   * Additional command line arguments to use when installing app native deps.\n   */\n  readonly npmArgs?: Array<string> | string | null\n  /**\n   * Whether to [rebuild](https://docs.npmjs.com/cli/rebuild) native dependencies before starting to package the app.\n   * @default true\n   */\n  readonly npmRebuild?: boolean\n  /**\n   * Use `legacy` app-builder binary for installing native dependencies, or `@electron/rebuild` in `sequential` or `parallel` compilation modes.\n   * @default sequential\n   */\n  readonly nativeRebuilder?: \"legacy\" | \"sequential\" | \"parallel\" | null\n\n  /**\n   * The build number. Maps to the `--iteration` flag for builds using FPM on Linux.\n   * If not defined, then it will fallback to `BUILD_NUMBER` or `TRAVIS_BUILD_NUMBER` or `APPVEYOR_BUILD_NUMBER` or `CIRCLE_BUILD_NUM` or `BUILD_BUILDNUMBER` or `CI_PIPELINE_IID` env.\n   */\n  readonly buildNumber?: string | null\n\n  /**\n   * The build version. Maps to the `CFBundleVersion` on macOS, and `FileVersion` metadata property on Windows. Defaults to the `version`.\n   * If `buildVersion` is not defined and `buildNumber` (or one of the `buildNumber` envs) is defined, it will be used as a build version (`version.buildNumber`).\n   */\n  readonly buildVersion?: string | null\n\n  /**\n   * Whether to download the alternate FFmpeg library from Electron's release assets and replace the default FFmpeg library prior to signing\n   */\n  readonly downloadAlternateFFmpeg?: boolean\n\n  /**\n   * Inject properties to `package.json`.\n   */\n  readonly extraMetadata?: any\n\n  /**\n   * Whether to fail if the application is not signed (to prevent unsigned app if code signing configuration is not correct).\n   * @default false\n   */\n  readonly forceCodeSigning?: boolean\n\n  /**\n   * Whether to include PDB files.\n   * @default false\n   */\n  readonly includePdb?: boolean\n\n  /**\n   * Whether to remove `scripts` field from `package.json` files.\n   *\n   * @default true\n   */\n  readonly removePackageScripts?: boolean\n\n  /**\n   * Whether to remove `keywords` field from `package.json` files.\n   *\n   * @default true\n   */\n  readonly removePackageKeywords?: boolean\n\n  /**\n   * Options to pass to `@electron/fuses`\n   * Ref: https://github.com/electron/fuses\n   */\n  readonly electronFuses?: FuseOptionsV1 | null\n\n  /**\n   * [Experimental] Configuration for concurrent builds.\n   */\n  readonly concurrency?: Concurrency | null\n}\n\nexport interface Configuration extends CommonConfiguration, PlatformSpecificBuildOptions, Hooks {\n  /**\n   * Whether to use [electron-compile](http://github.com/electron/electron-compile) to compile app. Defaults to `true` if `electron-compile` in the dependencies. And `false` if in the `devDependencies` or doesn't specified.\n   * @deprecated `electron-compile` is no longer maintained. Compile your app with a modern bundler (webpack, vite, etc.) instead.\n   */\n  readonly electronCompile?: boolean\n\n  /**\n   * The [electron-download](https://github.com/electron-userland/electron-download#usage) options. (legacy)\n   * Alternatively, you can use [electron/get](https://github.com/electron/get#usage) options.\n   */\n  readonly electronDownload?: ElectronDownloadOptions | ElectronGetOptions | null\n\n  /**\n   * The branding used by Electron's distributables. This is needed if a fork has modified Electron's BRANDING.json file.\n   */\n  readonly electronBranding?: ElectronBrandingOptions\n\n  /**\n   * The version of electron you are packaging for. Defaults to version of `electron`, `electron-prebuilt` or `electron-prebuilt-compile` dependency.\n   */\n  electronVersion?: string | null\n\n  /**\n   * The name of a built-in configuration preset (currently, only `react-cra` is supported) or any number of paths to config files (relative to project dir).\n   *\n   * The latter allows to mixin a config from multiple other configs, as if you `Object.assign` them, but properly combine `files` glob patterns.\n   *\n   * If `react-scripts` in the app dependencies, `react-cra` will be set automatically. Set to `null` to disable automatic detection.\n   */\n  extends?: Array<string> | string | null\n\n  /**\n   * *libui-based frameworks only* The version of NodeJS you are packaging for.\n   * You can set it to `current` to set the Node.js version that you use to run.\n   * @deprecated libui-based frameworks (proton-native, etc.) are no longer actively maintained. This option has no effect when using Electron.\n   */\n  readonly nodeVersion?: string | null\n\n  /**\n   * *libui-based frameworks only* The version of LaunchUI you are packaging for. Applicable for Windows only. Defaults to version suitable for used framework version.\n   * @deprecated libui-based frameworks (proton-native, etc.) are no longer actively maintained. This option has no effect when using Electron.\n   */\n  readonly launchUiVersion?: boolean | string | null\n\n  /**\n   * The framework name. One of `electron`, `proton`, `libui`. Defaults to `electron`.\n   * @deprecated `proton` and `libui` framework support is no longer actively maintained. Use `electron` (the default).\n   */\n  readonly framework?: string | null\n\n  /**\n   * Whether to disable sanity check asar package (useful for custom electron forks that implement their own encrypted integrity validation)\n   * @default false\n   */\n  readonly disableSanityCheckAsar?: boolean\n}\n\nexport type Hook<T, V> = (contextOrPath: T) => Promise<V> | V\n\nexport interface PackContext {\n  readonly outDir: string\n  readonly appOutDir: string\n  readonly packager: PlatformPackager<any>\n  readonly electronPlatformName: string\n  readonly arch: Arch\n  readonly targets: Array<Target>\n}\nexport type AfterPackContext = PackContext\nexport type BeforePackContext = PackContext\nexport type AfterExtractContext = PackContext\n\n/**\n * Configuration of toolsets utilized by electron-builder\n */\nexport interface ToolsetConfig {\n  /**\n   * `win-codesign` version to use for signing Windows artifacts.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=win-codesign&expanded=true\n   *\n   * Stable:\n   * v0.0.0 (winCodeSign)\n   *\n   * Beta:\n   * Windows Kits 10.0.26100.0\n   * v1.0.0, v1.1.0\n   *\n   * @default \"0.0.0\"\n   */\n  readonly winCodeSign?: \"0.0.0\" | \"1.0.0\" | \"1.1.0\" | null\n\n  /**\n   * `appimage` bundle version to use for Appimage packaging and runtime.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=appimage&expanded=true\n   * 0.0.0 - legacy toolset (appimage)\n   *\n   * Betas:\n   * 1.0.2 - Runtime 20251108\n   * 1.0.3 - Runtime 20251108 (Resolves GH issue #9598)\n   *\n   * @default \"0.0.0\"\n   */\n  readonly appimage?: \"0.0.0\" | \"1.0.2\" | \"1.0.3\" | null\n}\n\nexport interface Hooks {\n  /**\n   * The function (or path to file or module id) to be run before pack.\n   * Receives a {@link BeforePackContext}.\n   *\n   * Can be specified inline as a function in JavaScript configs:\n   * ```js\n   * // electron-builder.config.js\n   * module.exports = {\n   *   beforePack: async (context) => {\n   *     // your code\n   *   }\n   * }\n   * ```\n   *\n   * Or as a path to a module that exports the function as its default export:\n   * ```json\n   * { \"build\": { \"beforePack\": \"./myBeforePackHook.js\" } }\n   * ```\n   * ```js\n   * // myBeforePackHook.js\n   * exports.default = async function(context) {\n   *   // your custom code\n   * }\n   * ```\n   */\n  readonly beforePack?: Hook<BeforePackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after the prebuilt Electron binary has been extracted to the output directory.\n   * Receives an {@link AfterExtractContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterExtract?: Hook<AfterExtractContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after pack but before pack into distributable format and sign.\n   * Receives an {@link AfterPackContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterPack?: Hook<AfterPackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after pack and sign but before pack into distributable format.\n   * Receives an {@link AfterPackContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterSign?: Hook<AfterPackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run when an individual artifact build starts.\n   * Receives an {@link ArtifactBuildStarted}. For file/module setup, see {@link beforePack}.\n   */\n  readonly artifactBuildStarted?: Hook<ArtifactBuildStarted, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run when an individual artifact build completes.\n   * Receives an {@link ArtifactCreated}. For file/module setup, see {@link beforePack}.\n   */\n  readonly artifactBuildCompleted?: Hook<ArtifactCreated, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run after all artifacts are built.\n   * Receives a {@link BuildResult}. May return an array of additional file paths to publish.\n   *\n   * For file/module setup, see {@link beforePack}.\n   *\n   * @example\n   * ```js\n   * exports.default = function () {\n   *   // return additional files to publish\n   *   return [\"/path/to/additional/result/file\"]\n   * }\n   * ```\n   */\n  readonly afterAllArtifactBuild?: Hook<BuildResult, Array<string>> | string | null\n  /**\n   * The function (or path to file or module id) to be run after MSI project created on disk - not packed into .msi package yet.\n   */\n  readonly msiProjectCreated?: Hook<string, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run after Appx manifest created on disk - not packed into .appx package yet.\n   */\n  readonly appxManifestCreated?: Hook<string, void> | string | null\n  /**\n   * The function (or path to file or module id) to be [run on each node module](#onnodemodulefile) file. Returning `true`/`false` will determine whether to force include or to use the default copier logic\n   */\n  readonly onNodeModuleFile?: Hook<string, void | boolean> | string | null\n  /**\n   * The function (or path to file or module id) to be run before dependencies are installed or rebuilt. Works when `npmRebuild` is set to `true`. Resolving to `false` will skip dependencies install or rebuild.\n   *\n   * If provided and `node_modules` are missing, it will not invoke production dependencies check.\n   */\n  readonly beforeBuild?: Hook<BeforeBuildContext, boolean | void> | string | null\n  /**\n   * The function (or path to file or module id) to be run when staging the electron artifact environment.\n   * Returns the path to custom Electron build (e.g. `~/electron/out/R`) or folder of electron zips.\n   *\n   * Zip files must follow the pattern `electron-v${version}-${platformName}-${arch}.zip`, otherwise it will be assumed to be an unpacked Electron app directory\n   */\n  readonly electronDist?: Hook<PrepareApplicationStageDirectoryOptions, string> | string | null\n}\n\nexport interface MetadataDirectories {\n  /**\n   * The path to build resources.\n   *\n   * Please note — build resources are not packed into the app. If you need to use some files, e.g. as tray icon, please include required files explicitly: `\"files\": [\"**\\/*\", \"build/icon.*\"]`\n   * @default build\n   */\n  readonly buildResources?: string | null\n\n  /**\n   * The output directory. [File macros](https://www.electron.build/file-patterns#file-macros) are supported.\n   * @default dist\n   */\n  readonly output?: string | null\n\n  /**\n   * The application directory (containing the application package.json), defaults to `app`, `www` or working directory.\n   */\n  readonly app?: string | null\n}\n\n/**\n * All options come from [@electron/fuses](https://github.com/electron/fuses)\n * Ref: https://raw.githubusercontent.com/electron/electron/refs/heads/main/docs/tutorial/fuses.md\n */\nexport interface FuseOptionsV1 {\n  /**\n   *The runAsNode fuse toggles whether the `ELECTRON_RUN_AS_NODE` environment variable is respected or not.  Please note that if this fuse is disabled then `process.fork` in the main process will not function as expected as it depends on this environment variable to function. Instead, we recommend that you use [Utility Processes](https://github.com/electron/electron/blob/main/docs/api/utility-process.md), which work for many use cases where you need a standalone Node.js process (like a Sqlite server process or similar scenarios).\n   */\n  runAsNode?: boolean\n  /**\n   * The cookieEncryption fuse toggles whether the cookie store on disk is encrypted using OS level cryptography keys.  By default the sqlite database that Chromium uses to store cookies stores the values in plaintext.  If you wish to ensure your apps cookies are encrypted in the same way Chrome does then you should enable this fuse.  Please note it is a one-way transition, if you enable this fuse existing unencrypted cookies will be encrypted-on-write but if you then disable the fuse again your cookie store will effectively be corrupt and useless.  Most apps can safely enable this fuse.\n   */\n  enableCookieEncryption?: boolean\n  /**\n   * The nodeOptions fuse toggles whether the [`NODE_OPTIONS`](https://nodejs.org/api/cli.html#node_optionsoptions)  and [`NODE_EXTRA_CA_CERTS`](https://github.com/nodejs/node/blob/main/doc/api/cli.md#node_extra_ca_certsfile) environment variables are respected.  The `NODE_OPTIONS` environment variable can be used to pass all kinds of custom options to the Node.js runtime and isn't typically used by apps in production.  Most apps can safely disable this fuse.\n   */\n  enableNodeOptionsEnvironmentVariable?: boolean\n  /**\n   * The nodeCliInspect fuse toggles whether the `--inspect`, `--inspect-brk`, etc. flags are respected or not.  When disabled it also ensures that `SIGUSR1` signal does not initialize the main process inspector.  Most apps can safely disable this fuse.\n   */\n  enableNodeCliInspectArguments?: boolean\n  /**\n   * The embeddedAsarIntegrityValidation fuse toggles an experimental feature on macOS that validates the content of the `app.asar` file when it is loaded.  This feature is designed to have a minimal performance impact but may marginally slow down file reads from inside the `app.asar` archive.\n   * Currently, ASAR integrity checking is supported on:\n   *\n   *  - macOS as of electron>=16.0.0\n   *  - Windows as of electron>=30.0.0\n   *\n   * For more information on how to use asar integrity validation please read the [Asar Integrity](https://github.com/electron/electron/blob/main/docs/tutorial/asar-integrity.md) documentation.\n   */\n  enableEmbeddedAsarIntegrityValidation?: boolean\n  /**\n   * The onlyLoadAppFromAsar fuse changes the search system that Electron uses to locate your app code.  By default Electron will search in the following order `app.asar` -> `app` -> `default_app.asar`.  When this fuse is enabled the search order becomes a single entry `app.asar` thus ensuring that when combined with the `embeddedAsarIntegrityValidation` fuse it is impossible to load non-validated code.\n   */\n  onlyLoadAppFromAsar?: boolean\n  /**\n   * The loadBrowserProcessSpecificV8Snapshot fuse changes which V8 snapshot file is used for the browser process.  By default Electron's processes will all use the same V8 snapshot file.  When this fuse is enabled the browser process uses the file called `browser_v8_context_snapshot.bin` for its V8 snapshot. The other processes will use the V8 snapshot file that they normally do.\n   */\n  loadBrowserProcessSpecificV8Snapshot?: boolean\n  /**\n   * The grantFileProtocolExtraPrivileges fuse changes whether pages loaded from the `file://` protocol are given privileges beyond what they would receive in a traditional web browser.  This behavior was core to Electron apps in original versions of Electron but is no longer required as apps should be [serving local files from custom protocols](https://github.com/electron/electron/blob/main/docs/tutorial/security.md#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols) now instead.  If you aren't serving pages from `file://` you should disable this fuse.\n   * The extra privileges granted to the `file://` protocol by this fuse are incompletely documented below:\n   *\n   *  - `file://` protocol pages can use `fetch` to load other assets over `file://`\n   *  - `file://` protocol pages can use service workers\n   *  - `file://` protocol pages have universal access granted to child frames also running on `file://` protocols regardless of sandbox settings\n   */\n  grantFileProtocolExtraPrivileges?: boolean\n  /**\n   * Resets the app signature, specifically used for macOS.\n   * Note: This should be unneeded since electron-builder signs the app directly after flipping the fuses.\n   * Ref: https://github.com/electron/fuses?tab=readme-ov-file#apple-silicon\n   */\n  resetAdHocDarwinSignature?: boolean\n}\n\nexport interface Concurrency {\n  /**\n   * The maximum number of concurrent jobs to run.\n   * @default 1\n   */\n  jobs: number\n}\n"]}
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../src/configuration.ts"],"names":[],"mappings":"","sourcesContent":["import { Arch } from \"builder-util\"\nimport { BeforeBuildContext, Target } from \"./core\"\nimport { ElectronBrandingOptions } from \"./electron/ElectronFramework\"\nimport { PrepareApplicationStageDirectoryOptions } from \"./Framework\"\nimport { AppXOptions } from \"./options/AppXOptions\"\nimport { AppImageOptions, DebOptions, FlatpakOptions, LinuxConfiguration, LinuxTargetSpecificOptions, PacmanOptions, RpmOptions } from \"./options/linuxOptions\"\nimport { DmgOptions, MacConfiguration, MasConfiguration } from \"./options/macOptions\"\nimport { MsiOptions } from \"./options/MsiOptions\"\nimport { MsiWrappedOptions } from \"./options/MsiWrappedOptions\"\nimport { PkgOptions } from \"./options/pkgOptions\"\nimport { PlatformSpecificBuildOptions } from \"./options/PlatformSpecificBuildOptions\"\nimport { SnapcraftOptions, SnapOptions } from \"./options/SnapOptions\"\nimport { SquirrelWindowsOptions } from \"./options/SquirrelWindowsOptions\"\nimport { WindowsConfiguration } from \"./options/winOptions\"\nimport { BuildResult } from \"./packager\"\nimport { ArtifactBuildStarted, ArtifactCreated } from \"./packagerApi\"\nimport { PlatformPackager } from \"./platformPackager\"\nimport { NsisOptions, NsisWebOptions, PortableOptions } from \"./targets/nsis/nsisOptions\"\nimport { ElectronDownloadOptions, ElectronGetOptions } from \"./util/electronGet\"\n\n// duplicate appId here because it is important\n/**\n * Configuration Options\n */\nexport interface CommonConfiguration {\n  /**\n   * The application id. Used as [CFBundleIdentifier](https://developer.apple.com/library/ios/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html#//apple_ref/doc/uid/20001431-102070) for MacOS and as\n   * [Application User Model ID](https://msdn.microsoft.com/en-us/library/windows/desktop/dd378459(v=vs.85).aspx) for Windows (NSIS target only, Squirrel.Windows not supported). It is strongly recommended that an explicit ID is set.\n   * @default com.electron.${name}\n   */\n  readonly appId?: string | null\n\n  /**\n   * As [name](#metadata), but allows you to specify a product name for your executable which contains spaces and other special characters not allowed in the [name property](https://docs.npmjs.com/files/package.json#name).\n   * If not specified inside of the `build` configuration, `productName` property defined at the top level of `package.json` is used. If not specified at the top level of `package.json`, [name property](https://docs.npmjs.com/files/package.json#name) is used.\n   */\n  readonly productName?: string | null\n\n  /**\n   * The human-readable copyright line for the app.\n   * @default Copyright © year ${author}\n   */\n  readonly copyright?: string | null\n\n  /**\n   * Directories for build resources\n   */\n  readonly directories?: MetadataDirectories | null\n\n  /**\n   * Configuration of toolsets utilized by electron-builder\n   */\n  readonly toolsets?: ToolsetConfig | null\n\n  /**\n   * Options related to how build macOS targets.\n   */\n  readonly mac?: MacConfiguration | null\n  /**\n   * MAS (Mac Application Store) options.\n   */\n  readonly mas?: MasConfiguration | null\n  /**\n   * MAS (Mac Application Store) development options (`mas-dev` target).\n   */\n  readonly masDev?: MasConfiguration | null\n  /**\n   * macOS DMG options.\n   */\n  readonly dmg?: DmgOptions | null\n  /**\n   * macOS PKG options.\n   */\n  readonly pkg?: PkgOptions | null\n\n  /**\n   * Options related to how build Windows targets.\n   */\n  readonly win?: WindowsConfiguration | null\n  /** NSIS installer options. */\n  readonly nsis?: NsisOptions | null\n  /** NSIS web installer options (downloads app package at install time). */\n  readonly nsisWeb?: NsisWebOptions | null\n  /** Portable executable options (no installation required). */\n  readonly portable?: PortableOptions | null\n  /** Windows Store (AppX) package options. */\n  readonly appx?: AppXOptions | null\n  /**\n   * MSI package options.\n   */\n  readonly msi?: MsiOptions | null\n  /**\n   * MSI-wrapped installer options.\n   */\n  readonly msiWrapped?: MsiWrappedOptions | null\n  /**\n   * Squirrel.Windows installer options. Requires the `electron-builder-squirrel-windows` dependency.\n   */\n  readonly squirrelWindows?: SquirrelWindowsOptions | null\n  /**\n   * General Linux build options shared across all Linux targets (icon, category, desktop entry,\n   * executable name, etc.). Target-specific compression and packaging options live in the\n   * per-format interfaces (`DebOptions`, `RpmOptions`, `PacmanOptions`, etc.).\n   */\n  readonly linux?: LinuxConfiguration | null\n  /**\n   * Debian package options. Targets Debian, Ubuntu, and Debian-based distributions.\n   * Produces a `.deb` archive installable via `dpkg -i` or `apt install`.\n   */\n  readonly deb?: DebOptions | null\n  /**\n   * Flat snap configuration targeting core22 and older snap bases.\n   *\n   * @deprecated Use `snapcraft` instead — it supersedes `snap` when both are present and supports\n   * all snap bases including core24. `snap` will be removed in a future major release.\n   * See {@link SnapOptions} for available properties.\n   */\n  readonly snap?: SnapOptions | null\n  /**\n   * Snapcraft configuration. Prefer this over the deprecated `snap` field.\n   *\n   * Selects the snapcraft base and provides per-core options:\n   * - `base: \"core18\" | \"core20\" | \"core22\"` — legacy builds; accepts the same options as `snap`\n   * - `base: \"core24\"` — modern builds with the GNOME extension (recommended for new apps, requires Electron 25+)\n   * - `base: \"custom\"` — pass an existing `snapcraft.yaml` through unchanged; no plugs, extensions,\n   *   or desktop files are injected\n   *\n   * When both `snapcraft` and `snap` are set, `snapcraft` takes precedence.\n   *\n   * @example\n   * ```json\n   * { \"snapcraft\": { \"base\": \"core24\", \"core24\": { \"useLXD\": true } } }\n   * ```\n   *\n   * See {@link SnapcraftOptions} for all available properties.\n   */\n  readonly snapcraft?: SnapcraftOptions | null\n  /**\n   * AppImage options. AppImage is a portable application format that bundles the app\n   * and its dependencies into a single self-contained executable that runs on most\n   * Linux distributions without installation.\n   */\n  readonly appImage?: AppImageOptions | null\n  /**\n   * Flatpak options. Flatpak is a sandboxed application distribution format for Linux\n   * that runs in a controlled environment and is distributed via [Flathub](https://flathub.org/)\n   * or other Flatpak repositories.\n   */\n  readonly flatpak?: FlatpakOptions | null\n  /**\n   * Pacman package options. Targets Arch Linux and Arch-based distributions\n   * (Manjaro, EndeavourOS, etc.). Produces a `.pacman` archive installable via `pacman -U`.\n   */\n  readonly pacman?: PacmanOptions | null\n  /**\n   * RPM package options. Targets Fedora, Red Hat Enterprise Linux, SUSE, and related\n   * distributions. Produces a `.rpm` archive installable via `rpm` or `dnf`.\n   */\n  readonly rpm?: RpmOptions | null\n  /**\n   * FreeBSD package options. Produces a `.pkg` archive for the FreeBSD `pkg` package manager.\n   */\n  readonly freebsd?: LinuxTargetSpecificOptions | null\n  /**\n   * Solaris IPS package options. Produces a `.p5p` archive for the Solaris Image Packaging\n   * System (`pkg`).\n   */\n  readonly p5p?: LinuxTargetSpecificOptions | null\n  /**\n   * Alpine Linux APK package options. Produces an `.apk` archive installable via `apk add`.\n   */\n  readonly apk?: LinuxTargetSpecificOptions | null\n\n  /**\n   * Whether to build the application native dependencies from source.\n   * @default false\n   */\n  buildDependenciesFromSource?: boolean\n  /**\n   * Whether to execute `node-gyp rebuild` before starting to package the app.\n   *\n   * Don't [use](https://github.com/electron-userland/electron-builder/issues/683#issuecomment-241214075) [npm](http://electron.atom.io/docs/tutorial/using-native-node-modules/#using-npm) (neither `.npmrc`) for configuring electron headers. Use `electron-builder node-gyp-rebuild` instead.\n   * @default false\n   */\n  readonly nodeGypRebuild?: boolean\n  /**\n   * Additional command line arguments to use when installing app native deps.\n   */\n  readonly npmArgs?: Array<string> | string | null\n  /**\n   * Whether to [rebuild](https://docs.npmjs.com/cli/rebuild) native dependencies before starting to package the app.\n   * @default true\n   */\n  readonly npmRebuild?: boolean\n  /**\n   * Use `legacy` app-builder binary for installing native dependencies, or `@electron/rebuild` in `sequential` or `parallel` compilation modes.\n   * @default sequential\n   */\n  readonly nativeRebuilder?: \"legacy\" | \"sequential\" | \"parallel\" | null\n\n  /**\n   * The build number. Maps to the `--iteration` flag for builds using FPM on Linux.\n   * If not defined, then it will fallback to `BUILD_NUMBER` or `TRAVIS_BUILD_NUMBER` or `APPVEYOR_BUILD_NUMBER` or `CIRCLE_BUILD_NUM` or `BUILD_BUILDNUMBER` or `CI_PIPELINE_IID` env.\n   */\n  readonly buildNumber?: string | null\n\n  /**\n   * The build version. Maps to the `CFBundleVersion` on macOS, and `FileVersion` metadata property on Windows. Defaults to the `version`.\n   * If `buildVersion` is not defined and `buildNumber` (or one of the `buildNumber` envs) is defined, it will be used as a build version (`version.buildNumber`).\n   */\n  readonly buildVersion?: string | null\n\n  /**\n   * Whether to download the alternate FFmpeg library from Electron's release assets and replace the default FFmpeg library prior to signing\n   */\n  readonly downloadAlternateFFmpeg?: boolean\n\n  /**\n   * Inject properties to `package.json`.\n   */\n  readonly extraMetadata?: any\n\n  /**\n   * Whether to fail if the application is not signed (to prevent unsigned app if code signing configuration is not correct).\n   * @default false\n   */\n  readonly forceCodeSigning?: boolean\n\n  /**\n   * Whether to include PDB files.\n   * @default false\n   */\n  readonly includePdb?: boolean\n\n  /**\n   * Whether to remove `scripts` field from `package.json` files.\n   *\n   * @default true\n   */\n  readonly removePackageScripts?: boolean\n\n  /**\n   * Whether to remove `keywords` field from `package.json` files.\n   *\n   * @default true\n   */\n  readonly removePackageKeywords?: boolean\n\n  /**\n   * Options to pass to `@electron/fuses`\n   * Ref: https://github.com/electron/fuses\n   */\n  readonly electronFuses?: FuseOptionsV1 | null\n\n  /**\n   * [Experimental] Configuration for concurrent builds.\n   */\n  readonly concurrency?: Concurrency | null\n}\n\nexport interface Configuration extends CommonConfiguration, PlatformSpecificBuildOptions, Hooks {\n  /**\n   * Whether to use [electron-compile](http://github.com/electron/electron-compile) to compile app. Defaults to `true` if `electron-compile` in the dependencies. And `false` if in the `devDependencies` or doesn't specified.\n   * @deprecated `electron-compile` is no longer maintained. Compile your app with a modern bundler (webpack, vite, etc.) instead.\n   */\n  readonly electronCompile?: boolean\n\n  /**\n   * The [electron-download](https://github.com/electron-userland/electron-download#usage) options. (legacy)\n   * Alternatively, you can use [electron/get](https://github.com/electron/get#usage) options.\n   */\n  readonly electronDownload?: ElectronDownloadOptions | ElectronGetOptions | null\n\n  /**\n   * The branding used by Electron's distributables. This is needed if a fork has modified Electron's BRANDING.json file.\n   */\n  readonly electronBranding?: ElectronBrandingOptions\n\n  /**\n   * The version of electron you are packaging for. Defaults to version of `electron`, `electron-prebuilt` or `electron-prebuilt-compile` dependency.\n   */\n  electronVersion?: string | null\n\n  /**\n   * The name of a built-in configuration preset (currently, only `react-cra` is supported) or any number of paths to config files (relative to project dir).\n   *\n   * The latter allows to mixin a config from multiple other configs, as if you `Object.assign` them, but properly combine `files` glob patterns.\n   *\n   * If `react-scripts` in the app dependencies, `react-cra` will be set automatically. Set to `null` to disable automatic detection.\n   */\n  extends?: Array<string> | string | null\n\n  /**\n   * *libui-based frameworks only* The version of NodeJS you are packaging for.\n   * You can set it to `current` to set the Node.js version that you use to run.\n   * @deprecated libui-based frameworks (proton-native, etc.) are no longer actively maintained. This option has no effect when using Electron.\n   */\n  readonly nodeVersion?: string | null\n\n  /**\n   * *libui-based frameworks only* The version of LaunchUI you are packaging for. Applicable for Windows only. Defaults to version suitable for used framework version.\n   * @deprecated libui-based frameworks (proton-native, etc.) are no longer actively maintained. This option has no effect when using Electron.\n   */\n  readonly launchUiVersion?: boolean | string | null\n\n  /**\n   * The framework name. One of `electron`, `proton`, `libui`. Defaults to `electron`.\n   * @deprecated `proton` and `libui` framework support is no longer actively maintained. Use `electron` (the default).\n   */\n  readonly framework?: string | null\n\n  /**\n   * Whether to disable sanity check asar package (useful for custom electron forks that implement their own encrypted integrity validation)\n   * @default false\n   */\n  readonly disableSanityCheckAsar?: boolean\n}\n\nexport type Hook<T, V> = (contextOrPath: T) => Promise<V> | V\n\nexport interface PackContext {\n  readonly outDir: string\n  readonly appOutDir: string\n  readonly packager: PlatformPackager<any>\n  readonly electronPlatformName: string\n  readonly arch: Arch\n  readonly targets: Array<Target>\n}\nexport type AfterPackContext = PackContext\nexport type BeforePackContext = PackContext\nexport type AfterExtractContext = PackContext\n\n/**\n * Configuration of toolsets utilized by electron-builder\n */\nexport interface ToolsetConfig {\n  /**\n   * `win-codesign` version to use for signing Windows artifacts.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=win-codesign&expanded=true\n   *\n   * Stable:\n   * v0.0.0 (winCodeSign)\n   *\n   * Beta:\n   * Windows Kits 10.0.26100.0\n   * v1.0.0, v1.1.0\n   *\n   * @default \"0.0.0\"\n   */\n  readonly winCodeSign?: \"0.0.0\" | \"1.0.0\" | \"1.1.0\" | null\n\n  /**\n   * `appimage` bundle version to use for Appimage packaging and runtime.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=appimage&expanded=true\n   * 0.0.0 - legacy toolset (appimage)\n   *\n   * Betas:\n   * 1.0.2 - Runtime 20251108\n   * 1.0.3 - Runtime 20251108 (Resolves GH issue #9598)\n   *\n   * @default \"0.0.0\"\n   */\n  readonly appimage?: \"0.0.0\" | \"1.0.2\" | \"1.0.3\" | null\n\n  /**\n   * `nsis` bundle version to use for NSIS installer compilation.\n   * Located at https://github.com/electron-userland/electron-builder-binaries/releases?q=nsis&expanded=true\n   * 0.0.0 - legacy toolset (nsis-3.0.4.1 + nsis-resources-3.4.1)\n   *\n   * Betas:\n   * 1.2.1 - unified bundle (makensis 3.12 + plugins in one archive, entrypoint scripts auto-set NSISDIR)\n   *\n   * @default \"0.0.0\"\n   */\n  readonly nsis?: \"0.0.0\" | \"1.2.1\" | null\n}\n\nexport interface Hooks {\n  /**\n   * The function (or path to file or module id) to be run before pack.\n   * Receives a {@link BeforePackContext}.\n   *\n   * Can be specified inline as a function in JavaScript configs:\n   * ```js\n   * // electron-builder.config.js\n   * module.exports = {\n   *   beforePack: async (context) => {\n   *     // your code\n   *   }\n   * }\n   * ```\n   *\n   * Or as a path to a module that exports the function as its default export:\n   * ```json\n   * { \"build\": { \"beforePack\": \"./myBeforePackHook.js\" } }\n   * ```\n   * ```js\n   * // myBeforePackHook.js\n   * exports.default = async function(context) {\n   *   // your custom code\n   * }\n   * ```\n   */\n  readonly beforePack?: Hook<BeforePackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after the prebuilt Electron binary has been extracted to the output directory.\n   * Receives an {@link AfterExtractContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterExtract?: Hook<AfterExtractContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after pack but before pack into distributable format and sign.\n   * Receives an {@link AfterPackContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterPack?: Hook<AfterPackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run after pack and sign but before pack into distributable format.\n   * Receives an {@link AfterPackContext}. For file/module setup, see {@link beforePack}.\n   */\n  readonly afterSign?: Hook<AfterPackContext, void> | string | null\n\n  /**\n   * The function (or path to file or module id) to be run when an individual artifact build starts.\n   * Receives an {@link ArtifactBuildStarted}. For file/module setup, see {@link beforePack}.\n   */\n  readonly artifactBuildStarted?: Hook<ArtifactBuildStarted, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run when an individual artifact build completes.\n   * Receives an {@link ArtifactCreated}. For file/module setup, see {@link beforePack}.\n   */\n  readonly artifactBuildCompleted?: Hook<ArtifactCreated, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run after all artifacts are built.\n   * Receives a {@link BuildResult}. May return an array of additional file paths to publish.\n   *\n   * For file/module setup, see {@link beforePack}.\n   *\n   * @example\n   * ```js\n   * exports.default = function () {\n   *   // return additional files to publish\n   *   return [\"/path/to/additional/result/file\"]\n   * }\n   * ```\n   */\n  readonly afterAllArtifactBuild?: Hook<BuildResult, Array<string>> | string | null\n  /**\n   * The function (or path to file or module id) to be run after MSI project created on disk - not packed into .msi package yet.\n   */\n  readonly msiProjectCreated?: Hook<string, void> | string | null\n  /**\n   * The function (or path to file or module id) to be run after Appx manifest created on disk - not packed into .appx package yet.\n   */\n  readonly appxManifestCreated?: Hook<string, void> | string | null\n  /**\n   * The function (or path to file or module id) to be [run on each node module](#onnodemodulefile) file. Returning `true`/`false` will determine whether to force include or to use the default copier logic\n   */\n  readonly onNodeModuleFile?: Hook<string, void | boolean> | string | null\n  /**\n   * The function (or path to file or module id) to be run before dependencies are installed or rebuilt. Works when `npmRebuild` is set to `true`. Resolving to `false` will skip dependencies install or rebuild.\n   *\n   * If provided and `node_modules` are missing, it will not invoke production dependencies check.\n   */\n  readonly beforeBuild?: Hook<BeforeBuildContext, boolean | void> | string | null\n  /**\n   * The function (or path to file or module id) to be run when staging the electron artifact environment.\n   * Returns the path to custom Electron build (e.g. `~/electron/out/R`) or folder of electron zips.\n   *\n   * Zip files must follow the pattern `electron-v${version}-${platformName}-${arch}.zip`, otherwise it will be assumed to be an unpacked Electron app directory\n   */\n  readonly electronDist?: Hook<PrepareApplicationStageDirectoryOptions, string> | string | null\n}\n\nexport interface MetadataDirectories {\n  /**\n   * The path to build resources.\n   *\n   * Please note — build resources are not packed into the app. If you need to use some files, e.g. as tray icon, please include required files explicitly: `\"files\": [\"**\\/*\", \"build/icon.*\"]`\n   * @default build\n   */\n  readonly buildResources?: string | null\n\n  /**\n   * The output directory. [File macros](https://www.electron.build/file-patterns#file-macros) are supported.\n   * @default dist\n   */\n  readonly output?: string | null\n\n  /**\n   * The application directory (containing the application package.json), defaults to `app`, `www` or working directory.\n   */\n  readonly app?: string | null\n}\n\n/**\n * All options come from [@electron/fuses](https://github.com/electron/fuses)\n * Ref: https://raw.githubusercontent.com/electron/electron/refs/heads/main/docs/tutorial/fuses.md\n */\nexport interface FuseOptionsV1 {\n  /**\n   *The runAsNode fuse toggles whether the `ELECTRON_RUN_AS_NODE` environment variable is respected or not.  Please note that if this fuse is disabled then `process.fork` in the main process will not function as expected as it depends on this environment variable to function. Instead, we recommend that you use [Utility Processes](https://github.com/electron/electron/blob/main/docs/api/utility-process.md), which work for many use cases where you need a standalone Node.js process (like a Sqlite server process or similar scenarios).\n   */\n  runAsNode?: boolean\n  /**\n   * The cookieEncryption fuse toggles whether the cookie store on disk is encrypted using OS level cryptography keys.  By default the sqlite database that Chromium uses to store cookies stores the values in plaintext.  If you wish to ensure your apps cookies are encrypted in the same way Chrome does then you should enable this fuse.  Please note it is a one-way transition, if you enable this fuse existing unencrypted cookies will be encrypted-on-write but if you then disable the fuse again your cookie store will effectively be corrupt and useless.  Most apps can safely enable this fuse.\n   */\n  enableCookieEncryption?: boolean\n  /**\n   * The nodeOptions fuse toggles whether the [`NODE_OPTIONS`](https://nodejs.org/api/cli.html#node_optionsoptions)  and [`NODE_EXTRA_CA_CERTS`](https://github.com/nodejs/node/blob/main/doc/api/cli.md#node_extra_ca_certsfile) environment variables are respected.  The `NODE_OPTIONS` environment variable can be used to pass all kinds of custom options to the Node.js runtime and isn't typically used by apps in production.  Most apps can safely disable this fuse.\n   */\n  enableNodeOptionsEnvironmentVariable?: boolean\n  /**\n   * The nodeCliInspect fuse toggles whether the `--inspect`, `--inspect-brk`, etc. flags are respected or not.  When disabled it also ensures that `SIGUSR1` signal does not initialize the main process inspector.  Most apps can safely disable this fuse.\n   */\n  enableNodeCliInspectArguments?: boolean\n  /**\n   * The embeddedAsarIntegrityValidation fuse toggles an experimental feature on macOS that validates the content of the `app.asar` file when it is loaded.  This feature is designed to have a minimal performance impact but may marginally slow down file reads from inside the `app.asar` archive.\n   * Currently, ASAR integrity checking is supported on:\n   *\n   *  - macOS as of electron>=16.0.0\n   *  - Windows as of electron>=30.0.0\n   *\n   * For more information on how to use asar integrity validation please read the [Asar Integrity](https://github.com/electron/electron/blob/main/docs/tutorial/asar-integrity.md) documentation.\n   */\n  enableEmbeddedAsarIntegrityValidation?: boolean\n  /**\n   * The onlyLoadAppFromAsar fuse changes the search system that Electron uses to locate your app code.  By default Electron will search in the following order `app.asar` -> `app` -> `default_app.asar`.  When this fuse is enabled the search order becomes a single entry `app.asar` thus ensuring that when combined with the `embeddedAsarIntegrityValidation` fuse it is impossible to load non-validated code.\n   */\n  onlyLoadAppFromAsar?: boolean\n  /**\n   * The loadBrowserProcessSpecificV8Snapshot fuse changes which V8 snapshot file is used for the browser process.  By default Electron's processes will all use the same V8 snapshot file.  When this fuse is enabled the browser process uses the file called `browser_v8_context_snapshot.bin` for its V8 snapshot. The other processes will use the V8 snapshot file that they normally do.\n   */\n  loadBrowserProcessSpecificV8Snapshot?: boolean\n  /**\n   * The grantFileProtocolExtraPrivileges fuse changes whether pages loaded from the `file://` protocol are given privileges beyond what they would receive in a traditional web browser.  This behavior was core to Electron apps in original versions of Electron but is no longer required as apps should be [serving local files from custom protocols](https://github.com/electron/electron/blob/main/docs/tutorial/security.md#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols) now instead.  If you aren't serving pages from `file://` you should disable this fuse.\n   * The extra privileges granted to the `file://` protocol by this fuse are incompletely documented below:\n   *\n   *  - `file://` protocol pages can use `fetch` to load other assets over `file://`\n   *  - `file://` protocol pages can use service workers\n   *  - `file://` protocol pages have universal access granted to child frames also running on `file://` protocols regardless of sandbox settings\n   */\n  grantFileProtocolExtraPrivileges?: boolean\n  /**\n   * Resets the app signature, specifically used for macOS.\n   * Note: This should be unneeded since electron-builder signs the app directly after flipping the fuses.\n   * Ref: https://github.com/electron/fuses?tab=readme-ov-file#apple-silicon\n   */\n  resetAdHocDarwinSignature?: boolean\n}\n\nexport interface Concurrency {\n  /**\n   * The maximum number of concurrent jobs to run.\n   * @default 1\n   */\n  jobs: number\n}\n"]}

package/out/electron/ElectronFramework.js

@@ -170,7 +170,10 @@ async function unpack(prepareOptions, downloadOptions, distMacOsAppName) {
         if (resolvedDist.endsWith(".zip")) {
             builder_util_1.log.info({ zipFile: resolvedDist }, "using custom electronDist zip file");
             await (0, fs_extra_1.emptyDir)(appOutDir);
-            await (0, builder_util_1.exec)(await (0, builder_util_1.getPath7za)(), ["x", "-bd", resolvedDist, `-o${appOutDir}`, "-y"]);
+            const safeZipPath = (0, builder_util_1.sanitizeDirPath)(resolvedDist);
+            const safeAppOutDir = (0, builder_util_1.sanitizeDirPath)(appOutDir);
+            const outputSwitch = (0, builder_util_1.to7zaOutputSwitch)(safeAppOutDir);
+            await (0, builder_util_1.exec)(await (0, builder_util_1.getPath7za)(), ["x", "-bd", safeZipPath, outputSwitch, "-y"]);
             return false; // do not clean up after unpacking, it's a custom bundle and we should respect its configuration/contents as required
         }
         if (electronDistStats.isDirectory()) {