app-builder-lib 26.11.1 → 26.12.1

package/out/mac/MacTargetHelper.js

@@ -0,0 +1,267 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MacTargetHelper = void 0;
+const notarize_1 = require("@electron/notarize");
+const util_identities_1 = require("@electron/osx-sign/dist/cjs/util-identities");
+const builder_util_1 = require("builder-util");
+const path = require("path");
+const macCodeSign_1 = require("../codeSign/macCodeSign");
+const pathManager_1 = require("../util/pathManager");
+class MacTargetHelper {
+    constructor(packager) {
+        this.packager = packager;
+    }
+    handleNullIdentity(fallBackToAdhoc) {
+        if (this.packager.forceCodeSigning) {
+            throw new builder_util_1.InvalidConfigurationError("identity explicitly is set to null, but forceCodeSigning is set to true");
+        }
+        builder_util_1.log.info({ reason: "identity explicitly is set to null" }, "skipped macOS code signing");
+        if (fallBackToAdhoc) {
+            builder_util_1.log.warn("arm64 requires signing, but identity is set to null and signing is being skipped");
+        }
+        return false;
+    }
+    async findSigningIdentity(isMas, isDevelopment, qualifier, keychainFile, config, fallBackToAdhoc) {
+        const certificateTypes = MacTargetHelper.getCertificateTypes(isMas, isDevelopment);
+        let identity = null;
+        for (const certificateType of certificateTypes) {
+            identity = await (0, macCodeSign_1.findIdentity)(certificateType, qualifier, keychainFile);
+            if (identity != null) {
+                break;
+            }
+        }
+        if (identity == null) {
+            if (!isMas && !isDevelopment && config.type !== "distribution") {
+                identity = await (0, macCodeSign_1.findIdentity)("Mac Developer", qualifier, keychainFile);
+                if (identity != null) {
+                    builder_util_1.log.warn("Mac Developer is used to sign app — it is only for development and testing, not for production");
+                }
+            }
+            const noIdentity = !config.sign && identity == null;
+            if (qualifier === "-") {
+                identity = new util_identities_1.Identity("-", undefined);
+            }
+            else if (noIdentity && fallBackToAdhoc) {
+                builder_util_1.log.warn(null, "falling back to ad-hoc signature for macOS application code signing");
+                identity = new util_identities_1.Identity("-", undefined);
+            }
+            else if (noIdentity) {
+                await (0, macCodeSign_1.reportError)(isMas, certificateTypes, qualifier, keychainFile, this.packager.forceCodeSigning);
+                return null;
+            }
+        }
+        return identity;
+    }
+    async buildSignOptions(appPath, identity, type, isMas, config, keychainFile, arch) {
+        let filter = config.signIgnore;
+        if (Array.isArray(filter)) {
+            if (filter.length == 0) {
+                filter = null;
+            }
+        }
+        else if (filter != null) {
+            filter = filter.length === 0 ? null : [filter];
+        }
+        const filterRe = filter == null
+            ? null
+            : filter.map(it => {
+                try {
+                    return new RegExp(it);
+                }
+                catch (e) {
+                    throw new builder_util_1.InvalidConfigurationError(`Invalid regex filter pattern: ${it}. ${e.message}`);
+                }
+            });
+        let binaries = config.binaries || undefined;
+        if (binaries) {
+            // Accept absolute paths for external binaries, else resolve relative paths from the artifact's app Contents path.
+            binaries = (await Promise.all(binaries.flatMap(async (destination) => {
+                const expandedDestination = this.packager.expandArch(destination, arch);
+                return await Promise.all(expandedDestination.map(async (d) => {
+                    if (await (0, builder_util_1.statOrNull)(d)) {
+                        return d;
+                    }
+                    return path.resolve(appPath, d);
+                }));
+            }))).flat();
+            builder_util_1.log.info({ binaries, arch: arch == null ? null : builder_util_1.Arch[arch] }, "signing additional user-defined binaries for arch");
+        }
+        const signOptions = {
+            identityValidation: false,
+            // https://github.com/electron-userland/electron-builder/issues/1699
+            // kext are signed by the chipset manufacturers. You need a special certificate (only available on request) from Apple to be able to sign kext.
+            ignore: (file) => {
+                if (filterRe != null) {
+                    for (const regExp of filterRe) {
+                        if (regExp.test(file)) {
+                            return true;
+                        }
+                    }
+                }
+                return (file.endsWith(".kext") ||
+                    file.startsWith("/Contents/PlugIns", appPath.length) ||
+                    file.includes("/node_modules/puppeteer/.local-chromium") ||
+                    file.includes("/node_modules/playwright-firefox/.local-browsers") ||
+                    file.includes("/node_modules/playwright/.local-browsers"));
+                /* Those are browser automating modules, browser (chromium, nightly) cannot be signed
+                  https://github.com/electron-userland/electron-builder/issues/2010
+                  https://github.com/electron-userland/electron-builder/issues/5383
+                  */
+            },
+            identity: identity ? identity.hash || identity.name : undefined,
+            type,
+            platform: isMas ? "mas" : "darwin",
+            version: this.packager.config.electronVersion || undefined,
+            app: appPath,
+            keychain: keychainFile || undefined,
+            binaries,
+            // https://github.com/electron-userland/electron-builder/issues/1480
+            strictVerify: config.strictVerify,
+            preAutoEntitlements: config.preAutoEntitlements,
+            optionsForFile: await this.getOptionsForFile(appPath, isMas, config),
+            provisioningProfile: config.provisioningProfile || undefined,
+        };
+        return signOptions;
+    }
+    async createMasInstaller(appPath, outDir, masOptions, keychainFile, isDevelopment, arch) {
+        const certType = isDevelopment ? "Mac Developer" : "3rd Party Mac Developer Installer";
+        const masInstallerIdentity = await (0, macCodeSign_1.findIdentity)(certType, masOptions.identity, keychainFile);
+        if (masInstallerIdentity == null) {
+            throw new builder_util_1.InvalidConfigurationError(`Cannot find valid "${certType}" identity to sign MAS installer, please see https://electron.build/code-signing`);
+        }
+        MacTargetHelper.assertSafePathForCommandUsage(outDir, "output directory");
+        // mas uploaded to AppStore, so, use "-" instead of space for name
+        // path.basename prevents path traversal if a crafted artifactName contains "../"
+        const artifactName = path.basename(this.packager.expandArtifactNamePattern(masOptions, "pkg", arch));
+        MacTargetHelper.assertSafePathForCommandUsage(artifactName, "artifact name");
+        const artifactPath = path.resolve(outDir, artifactName);
+        await this.packager.doFlat(appPath, artifactPath, masInstallerIdentity, keychainFile);
+        await this.packager.info.emitArtifactBuildCompleted({
+            file: artifactPath,
+            target: null,
+            arch: builder_util_1.Arch.x64,
+            safeArtifactName: this.packager.computeSafeArtifactName(artifactName, "pkg", arch, true, this.packager.platformSpecificBuildOptions.defaultArch),
+            packager: this.packager,
+        });
+    }
+    async getOptionsForFile(appPath, isMas, customSignOptions) {
+        const resourceList = await this.packager.resourceList;
+        const entitlementsSuffix = isMas ? "mas" : "mac";
+        const getEntitlements = (filePath) => {
+            if (filePath === appPath) {
+                if (customSignOptions.entitlements) {
+                    return customSignOptions.entitlements;
+                }
+                const p = `entitlements.${entitlementsSuffix}.plist`;
+                if (resourceList.includes(p)) {
+                    return path.join(this.packager.info.buildResourcesDir, p);
+                }
+                else {
+                    return (0, pathManager_1.getTemplatePath)("entitlements.mac.plist");
+                }
+            }
+            if (filePath.includes("Library/LoginItems")) {
+                return customSignOptions.entitlementsLoginHelper;
+            }
+            if (customSignOptions.entitlementsInherit) {
+                return customSignOptions.entitlementsInherit;
+            }
+            const p = `entitlements.${entitlementsSuffix}.inherit.plist`;
+            if (resourceList.includes(p)) {
+                return path.join(this.packager.info.buildResourcesDir, p);
+            }
+            else {
+                return (0, pathManager_1.getTemplatePath)("entitlements.mac.plist");
+            }
+        };
+        const requirements = isMas || this.packager.platformSpecificBuildOptions.requirements == null
+            ? undefined
+            : await this.packager.getResource(this.packager.platformSpecificBuildOptions.requirements);
+        // harden by default for mac builds. Only harden mas builds if explicitly true (backward compatibility)
+        const hardenedRuntime = isMas ? customSignOptions.hardenedRuntime === true : customSignOptions.hardenedRuntime !== false;
+        return (filePath) => {
+            const entitlements = getEntitlements(filePath);
+            return {
+                entitlements: entitlements || undefined,
+                hardenedRuntime: hardenedRuntime !== null && hardenedRuntime !== void 0 ? hardenedRuntime : undefined,
+                timestamp: customSignOptions.timestamp || undefined,
+                requirements: requirements || undefined,
+                additionalArguments: customSignOptions.additionalArguments || [],
+            };
+        };
+    }
+    static getCertificateTypes(isMas, isDevelopment) {
+        if (isDevelopment) {
+            return isMas ? ["Mac Developer", "Apple Development"] : ["Mac Developer", "Developer ID Application"];
+        }
+        return isMas ? ["Apple Distribution", "3rd Party Mac Developer Application"] : ["Developer ID Application"];
+    }
+    static isMasTarget(targetName) {
+        return targetName === "mas" || targetName === "mas-dev";
+    }
+    static getPlatformTypeFromTarget(targetName) {
+        if (targetName === "mas")
+            return "mas";
+        if (targetName === "mas-dev")
+            return "mas-dev";
+        return "mac";
+    }
+    static assertSafePathForCommandUsage(pathValue, description) {
+        if (/[\0\r\n"'`$;&|<>]/.test(pathValue)) {
+            throw new builder_util_1.InvalidConfigurationError(`Invalid ${description}: contains unsupported shell-special characters`);
+        }
+    }
+    static getNotarizeOptions(appPath) {
+        const tool = "notarytool";
+        const teamId = process.env.APPLE_TEAM_ID;
+        const appleId = process.env.APPLE_ID;
+        const appleIdPassword = process.env.APPLE_APP_SPECIFIC_PASSWORD;
+        if (appleId || appleIdPassword) {
+            if (!appleId) {
+                throw new builder_util_1.InvalidConfigurationError(`APPLE_ID env var needs to be set`);
+            }
+            if (!appleIdPassword) {
+                throw new builder_util_1.InvalidConfigurationError(`APPLE_APP_SPECIFIC_PASSWORD env var needs to be set`);
+            }
+            if (!teamId) {
+                throw new builder_util_1.InvalidConfigurationError(`APPLE_TEAM_ID env var needs to be set`);
+            }
+            return { tool, appPath, appleId, appleIdPassword, teamId };
+        }
+        const appleApiKey = process.env.APPLE_API_KEY;
+        const appleApiKeyId = process.env.APPLE_API_KEY_ID;
+        const appleApiIssuer = process.env.APPLE_API_ISSUER;
+        if (appleApiKey || appleApiKeyId || appleApiIssuer) {
+            if (!appleApiKey || !appleApiKeyId || !appleApiIssuer) {
+                throw new builder_util_1.InvalidConfigurationError(`Env vars APPLE_API_KEY, APPLE_API_KEY_ID and APPLE_API_ISSUER need to be set`);
+            }
+            return { tool, appPath, appleApiKey, appleApiKeyId, appleApiIssuer };
+        }
+        const keychain = process.env.APPLE_KEYCHAIN;
+        const keychainProfile = process.env.APPLE_KEYCHAIN_PROFILE;
+        if (keychainProfile) {
+            let args = { keychainProfile };
+            if (keychain) {
+                args = { ...args, keychain };
+            }
+            return { tool, appPath, ...args };
+        }
+        return undefined;
+    }
+    async notarizeIfProvided(appPath) {
+        const notarizeOptions = this.packager.platformSpecificBuildOptions.notarize;
+        if (notarizeOptions === false) {
+            builder_util_1.log.info({ reason: "`notarize` options were set explicitly `false`" }, "skipped macOS notarization");
+            return;
+        }
+        const options = MacTargetHelper.getNotarizeOptions(appPath);
+        if (!options) {
+            builder_util_1.log.warn({ reason: "`notarize` options were unable to be generated" }, "skipped macOS notarization");
+            return;
+        }
+        await (0, notarize_1.notarize)(options);
+        builder_util_1.log.info(null, "notarization successful");
+    }
+}
+exports.MacTargetHelper = MacTargetHelper;
+//# sourceMappingURL=MacTargetHelper.js.map

package/out/mac/MacTargetHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MacTargetHelper.js","sourceRoot":"","sources":["../../src/mac/MacTargetHelper.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAG7C,iFAAsE;AACtE,+CAA+E;AAE/E,6BAA4B;AAC5B,yDAA6E;AAG7E,qDAAqD;AAIrD,MAAa,eAAe;IAC1B,YAAoB,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;IAAG,CAAC;IAE7C,kBAAkB,CAAC,eAAwB;QACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACnC,MAAM,IAAI,wCAAyB,CAAC,yEAAyE,CAAC,CAAA;QAChH,CAAC;QACD,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,EAAE,4BAA4B,CAAC,CAAA;QACxF,IAAI,eAAe,EAAE,CAAC;YACpB,kBAAG,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAA;QAC9F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAAc,EACd,aAAsB,EACtB,SAA6B,EAC7B,YAA8B,EAC9B,MAA2C,EAC3C,eAAwB;QAExB,MAAM,gBAAgB,GAAG,eAAe,CAAC,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;QAElF,IAAI,QAAQ,GAAoB,IAAI,CAAA;QACpC,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC/C,QAAQ,GAAG,MAAM,IAAA,0BAAY,EAAC,eAAe,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YACvE,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC/D,QAAQ,GAAG,MAAM,IAAA,0BAAY,EAAC,eAAe,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;gBACvE,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrB,kBAAG,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAA;gBAC5G,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,CAAA;YACnD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACtB,QAAQ,GAAG,IAAI,0BAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YACzC,CAAC;iBAAM,IAAI,UAAU,IAAI,eAAe,EAAE,CAAC;gBACzC,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,qEAAqE,CAAC,CAAA;gBACrF,QAAQ,GAAG,IAAI,0BAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YACzC,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACtB,MAAM,IAAA,yBAAW,EAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;gBACnG,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,QAAkB,EAClB,IAA6B,EAC7B,KAAc,EACd,MAA2C,EAC3C,YAA8B,EAC9B,IAAU;QAEV,IAAI,MAAM,GAAG,MAAM,CAAC,UAAU,CAAA;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,IAAI,IAAI;YACZ,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBACd,IAAI,CAAC;oBACH,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC,CAAA;gBACvB,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,MAAM,IAAI,wCAAyB,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC1F,CAAC;YACH,CAAC,CAAC,CAAA;QAER,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAA;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,kHAAkH;YAClH,QAAQ,GAAG,CACT,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;gBACnC,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;gBACvE,OAAO,MAAM,OAAO,CAAC,GAAG,CACtB,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE;oBAChC,IAAI,MAAM,IAAA,yBAAU,EAAC,CAAC,CAAC,EAAE,CAAC;wBACxB,OAAO,CAAC,CAAA;oBACV,CAAC;oBACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;gBACjC,CAAC,CAAC,CACH,CAAA;YACH,CAAC,CAAC,CACH,CACF,CAAC,IAAI,EAAE,CAAA;YACR,kBAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAI,CAAC,IAAI,CAAC,EAAE,EAAE,mDAAmD,CAAC,CAAA;QACrH,CAAC;QAED,MAAM,WAAW,GAAgB;YAC/B,kBAAkB,EAAE,KAAK;YACzB,oEAAoE;YACpE,+IAA+I;YAC/I,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvB,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;wBAC9B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACtB,OAAO,IAAI,CAAA;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtB,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC;oBACpD,IAAI,CAAC,QAAQ,CAAC,yCAAyC,CAAC;oBACxD,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC;oBACjE,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAC1D,CAAA;gBAED;;;oBAGI;YACN,CAAC;YACD,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI;YACJ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;YAClC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,IAAI,SAAS;YAC1D,GAAG,EAAE,OAAO;YACZ,QAAQ,EAAE,YAAY,IAAI,SAAS;YACnC,QAAQ;YACR,oEAAoE;YACpE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,cAAc,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;YACpE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,SAAS;SAC7D,CAAA;QAED,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,MAAc,EAAE,UAA4B,EAAE,YAA8B,EAAE,aAAsB,EAAE,IAAU;QACxJ,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,mCAAmC,CAAA;QACtF,MAAM,oBAAoB,GAAG,MAAM,IAAA,0BAAY,EAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAE5F,IAAI,oBAAoB,IAAI,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,wCAAyB,CAAC,sBAAsB,QAAQ,kFAAkF,CAAC,CAAA;QACvJ,CAAC;QAED,eAAe,CAAC,6BAA6B,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QAEzE,kEAAkE;QAClE,iFAAiF;QACjF,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;QACpG,eAAe,CAAC,6BAA6B,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QACvD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAA;QACrF,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC;YAClD,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,mBAAI,CAAC,GAAG;YACd,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,WAAW,CAAC;YAChJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,KAAc,EAAE,iBAAsD;QAC7G,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAA;QACrD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;QAEhD,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAE,EAAE;YAC3C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,IAAI,iBAAiB,CAAC,YAAY,EAAE,CAAC;oBACnC,OAAO,iBAAiB,CAAC,YAAY,CAAA;gBACvC,CAAC;gBACD,MAAM,CAAC,GAAG,gBAAgB,kBAAkB,QAAQ,CAAA;gBACpD,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAA;gBAC3D,CAAC;qBAAM,CAAC;oBACN,OAAO,IAAA,6BAAe,EAAC,wBAAwB,CAAC,CAAA;gBAClD,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC5C,OAAO,iBAAiB,CAAC,uBAAuB,CAAA;YAClD,CAAC;YAED,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,CAAC;gBAC1C,OAAO,iBAAiB,CAAC,mBAAmB,CAAA;YAC9C,CAAC;YACD,MAAM,CAAC,GAAG,gBAAgB,kBAAkB,gBAAgB,CAAA;YAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAA;YAC3D,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAA,6BAAe,EAAC,wBAAwB,CAAC,CAAA;YAClD,CAAC;QACH,CAAC,CAAA;QAED,MAAM,YAAY,GAChB,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,YAAY,IAAI,IAAI;YACtE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAA;QAE9F,uGAAuG;QACvG,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,eAAe,KAAK,KAAK,CAAA;QAExH,OAAO,CAAC,QAAgB,EAAsB,EAAE;YAC9C,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC9C,OAAO;gBACL,YAAY,EAAE,YAAY,IAAI,SAAS;gBACvC,eAAe,EAAE,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,SAAS;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,SAAS,IAAI,SAAS;gBACnD,YAAY,EAAE,YAAY,IAAI,SAAS;gBACvC,mBAAmB,EAAE,iBAAiB,CAAC,mBAAmB,IAAI,EAAE;aACjE,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,KAAc,EAAE,aAAsB;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAA;QACvG,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;IAC7G,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,UAAkB;QACnC,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,SAAS,CAAA;IACzD,CAAC;IAED,MAAM,CAAC,yBAAyB,CAAC,UAAkB;QACjD,IAAI,UAAU,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QACtC,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC9C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,CAAC,6BAA6B,CAAC,SAAiB,EAAE,WAAmB;QACzE,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,wCAAyB,CAAC,WAAW,WAAW,iDAAiD,CAAC,CAAA;QAC9G,CAAC;IACH,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,OAAe;QACvC,MAAM,IAAI,GAAG,YAAY,CAAA;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACpC,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAA;QAE/D,IAAI,OAAO,IAAI,eAAe,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,wCAAyB,CAAC,kCAAkC,CAAC,CAAA;YACzE,CAAC;YACD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,wCAAyB,CAAC,qDAAqD,CAAC,CAAA;YAC5F,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,wCAAyB,CAAC,uCAAuC,CAAC,CAAA;YAC9E,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;QAC5D,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;QAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;QAClD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;QACnD,IAAI,WAAW,IAAI,aAAa,IAAI,cAAc,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,IAAI,wCAAyB,CAAC,8EAA8E,CAAC,CAAA;YACrH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,CAAA;QACtE,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;QAC3C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;QAC1D,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,IAAI,GAAkC,EAAE,eAAe,EAAE,CAAA;YAC7D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAA;YAC9B,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAA;QACnC,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,QAAQ,CAAA;QAC3E,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;YAC9B,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gDAAgD,EAAE,EAAE,4BAA4B,CAAC,CAAA;YACpG,OAAM;QACR,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gDAAgD,EAAE,EAAE,4BAA4B,CAAC,CAAA;YACpG,OAAM;QACR,CAAC;QACD,MAAM,IAAA,mBAAQ,EAAC,OAAO,CAAC,CAAA;QACvB,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;IAC3C,CAAC;CACF;AA/SD,0CA+SC","sourcesContent":["import { notarize } from \"@electron/notarize\"\nimport { NotarizeOptionsNotaryTool, NotaryToolKeychainCredentials } from \"@electron/notarize/lib/types\"\nimport { PerFileSignOptions, SigningDistributionType, SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport { Identity } from \"@electron/osx-sign/dist/cjs/util-identities\"\nimport { Arch, InvalidConfigurationError, log, statOrNull } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport * as path from \"path\"\nimport { CertType, findIdentity, reportError } from \"../codeSign/macCodeSign\"\nimport type { MacPackager } from \"../macPackager\"\nimport { MacConfiguration, MasConfiguration } from \"../options/macOptions\"\nimport { getTemplatePath } from \"../util/pathManager\"\n\nexport type PlatformType = \"mas\" | \"mas-dev\" | \"mac\"\n\nexport class MacTargetHelper {\n  constructor(private packager: MacPackager) {}\n\n  handleNullIdentity(fallBackToAdhoc: boolean): boolean {\n    if (this.packager.forceCodeSigning) {\n      throw new InvalidConfigurationError(\"identity explicitly is set to null, but forceCodeSigning is set to true\")\n    }\n    log.info({ reason: \"identity explicitly is set to null\" }, \"skipped macOS code signing\")\n    if (fallBackToAdhoc) {\n      log.warn(\"arm64 requires signing, but identity is set to null and signing is being skipped\")\n    }\n    return false\n  }\n\n  async findSigningIdentity(\n    isMas: boolean,\n    isDevelopment: boolean,\n    qualifier: string | undefined,\n    keychainFile: string | Nullish,\n    config: MacConfiguration | MasConfiguration,\n    fallBackToAdhoc: boolean\n  ): Promise<Identity | null> {\n    const certificateTypes = MacTargetHelper.getCertificateTypes(isMas, isDevelopment)\n\n    let identity: Identity | null = null\n    for (const certificateType of certificateTypes) {\n      identity = await findIdentity(certificateType, qualifier, keychainFile)\n      if (identity != null) {\n        break\n      }\n    }\n\n    if (identity == null) {\n      if (!isMas && !isDevelopment && config.type !== \"distribution\") {\n        identity = await findIdentity(\"Mac Developer\", qualifier, keychainFile)\n        if (identity != null) {\n          log.warn(\"Mac Developer is used to sign app — it is only for development and testing, not for production\")\n        }\n      }\n\n      const noIdentity = !config.sign && identity == null\n      if (qualifier === \"-\") {\n        identity = new Identity(\"-\", undefined)\n      } else if (noIdentity && fallBackToAdhoc) {\n        log.warn(null, \"falling back to ad-hoc signature for macOS application code signing\")\n        identity = new Identity(\"-\", undefined)\n      } else if (noIdentity) {\n        await reportError(isMas, certificateTypes, qualifier, keychainFile, this.packager.forceCodeSigning)\n        return null\n      }\n    }\n\n    return identity\n  }\n\n  async buildSignOptions(\n    appPath: string,\n    identity: Identity,\n    type: SigningDistributionType,\n    isMas: boolean,\n    config: MacConfiguration | MasConfiguration,\n    keychainFile: string | Nullish,\n    arch: Arch\n  ): Promise<SignOptions> {\n    let filter = config.signIgnore\n    if (Array.isArray(filter)) {\n      if (filter.length == 0) {\n        filter = null\n      }\n    } else if (filter != null) {\n      filter = filter.length === 0 ? null : [filter]\n    }\n\n    const filterRe =\n      filter == null\n        ? null\n        : filter.map(it => {\n            try {\n              return new RegExp(it)\n            } catch (e: any) {\n              throw new InvalidConfigurationError(`Invalid regex filter pattern: ${it}. ${e.message}`)\n            }\n          })\n\n    let binaries = config.binaries || undefined\n    if (binaries) {\n      // Accept absolute paths for external binaries, else resolve relative paths from the artifact's app Contents path.\n      binaries = (\n        await Promise.all(\n          binaries.flatMap(async destination => {\n            const expandedDestination = this.packager.expandArch(destination, arch)\n            return await Promise.all(\n              expandedDestination.map(async d => {\n                if (await statOrNull(d)) {\n                  return d\n                }\n                return path.resolve(appPath, d)\n              })\n            )\n          })\n        )\n      ).flat()\n      log.info({ binaries, arch: arch == null ? null : Arch[arch] }, \"signing additional user-defined binaries for arch\")\n    }\n\n    const signOptions: SignOptions = {\n      identityValidation: false,\n      // https://github.com/electron-userland/electron-builder/issues/1699\n      // kext are signed by the chipset manufacturers. You need a special certificate (only available on request) from Apple to be able to sign kext.\n      ignore: (file: string) => {\n        if (filterRe != null) {\n          for (const regExp of filterRe) {\n            if (regExp.test(file)) {\n              return true\n            }\n          }\n        }\n        return (\n          file.endsWith(\".kext\") ||\n          file.startsWith(\"/Contents/PlugIns\", appPath.length) ||\n          file.includes(\"/node_modules/puppeteer/.local-chromium\") ||\n          file.includes(\"/node_modules/playwright-firefox/.local-browsers\") ||\n          file.includes(\"/node_modules/playwright/.local-browsers\")\n        )\n\n        /* Those are browser automating modules, browser (chromium, nightly) cannot be signed\n          https://github.com/electron-userland/electron-builder/issues/2010\n          https://github.com/electron-userland/electron-builder/issues/5383\n          */\n      },\n      identity: identity ? identity.hash || identity.name : undefined,\n      type,\n      platform: isMas ? \"mas\" : \"darwin\",\n      version: this.packager.config.electronVersion || undefined,\n      app: appPath,\n      keychain: keychainFile || undefined,\n      binaries,\n      // https://github.com/electron-userland/electron-builder/issues/1480\n      strictVerify: config.strictVerify,\n      preAutoEntitlements: config.preAutoEntitlements,\n      optionsForFile: await this.getOptionsForFile(appPath, isMas, config),\n      provisioningProfile: config.provisioningProfile || undefined,\n    }\n\n    return signOptions\n  }\n\n  async createMasInstaller(appPath: string, outDir: string, masOptions: MasConfiguration, keychainFile: string | Nullish, isDevelopment: boolean, arch: Arch): Promise<void> {\n    const certType = isDevelopment ? \"Mac Developer\" : \"3rd Party Mac Developer Installer\"\n    const masInstallerIdentity = await findIdentity(certType, masOptions.identity, keychainFile)\n\n    if (masInstallerIdentity == null) {\n      throw new InvalidConfigurationError(`Cannot find valid \"${certType}\" identity to sign MAS installer, please see https://electron.build/code-signing`)\n    }\n\n    MacTargetHelper.assertSafePathForCommandUsage(outDir, \"output directory\")\n\n    // mas uploaded to AppStore, so, use \"-\" instead of space for name\n    // path.basename prevents path traversal if a crafted artifactName contains \"../\"\n    const artifactName = path.basename(this.packager.expandArtifactNamePattern(masOptions, \"pkg\", arch))\n    MacTargetHelper.assertSafePathForCommandUsage(artifactName, \"artifact name\")\n    const artifactPath = path.resolve(outDir, artifactName)\n    await this.packager.doFlat(appPath, artifactPath, masInstallerIdentity, keychainFile)\n    await this.packager.info.emitArtifactBuildCompleted({\n      file: artifactPath,\n      target: null,\n      arch: Arch.x64,\n      safeArtifactName: this.packager.computeSafeArtifactName(artifactName, \"pkg\", arch, true, this.packager.platformSpecificBuildOptions.defaultArch),\n      packager: this.packager,\n    })\n  }\n\n  async getOptionsForFile(appPath: string, isMas: boolean, customSignOptions: MacConfiguration | MasConfiguration): Promise<(filePath: string) => PerFileSignOptions> {\n    const resourceList = await this.packager.resourceList\n    const entitlementsSuffix = isMas ? \"mas\" : \"mac\"\n\n    const getEntitlements = (filePath: string) => {\n      if (filePath === appPath) {\n        if (customSignOptions.entitlements) {\n          return customSignOptions.entitlements\n        }\n        const p = `entitlements.${entitlementsSuffix}.plist`\n        if (resourceList.includes(p)) {\n          return path.join(this.packager.info.buildResourcesDir, p)\n        } else {\n          return getTemplatePath(\"entitlements.mac.plist\")\n        }\n      }\n\n      if (filePath.includes(\"Library/LoginItems\")) {\n        return customSignOptions.entitlementsLoginHelper\n      }\n\n      if (customSignOptions.entitlementsInherit) {\n        return customSignOptions.entitlementsInherit\n      }\n      const p = `entitlements.${entitlementsSuffix}.inherit.plist`\n      if (resourceList.includes(p)) {\n        return path.join(this.packager.info.buildResourcesDir, p)\n      } else {\n        return getTemplatePath(\"entitlements.mac.plist\")\n      }\n    }\n\n    const requirements =\n      isMas || this.packager.platformSpecificBuildOptions.requirements == null\n        ? undefined\n        : await this.packager.getResource(this.packager.platformSpecificBuildOptions.requirements)\n\n    // harden by default for mac builds. Only harden mas builds if explicitly true (backward compatibility)\n    const hardenedRuntime = isMas ? customSignOptions.hardenedRuntime === true : customSignOptions.hardenedRuntime !== false\n\n    return (filePath: string): PerFileSignOptions => {\n      const entitlements = getEntitlements(filePath)\n      return {\n        entitlements: entitlements || undefined,\n        hardenedRuntime: hardenedRuntime ?? undefined,\n        timestamp: customSignOptions.timestamp || undefined,\n        requirements: requirements || undefined,\n        additionalArguments: customSignOptions.additionalArguments || [],\n      }\n    }\n  }\n\n  static getCertificateTypes(isMas: boolean, isDevelopment: boolean): CertType[] {\n    if (isDevelopment) {\n      return isMas ? [\"Mac Developer\", \"Apple Development\"] : [\"Mac Developer\", \"Developer ID Application\"]\n    }\n    return isMas ? [\"Apple Distribution\", \"3rd Party Mac Developer Application\"] : [\"Developer ID Application\"]\n  }\n\n  static isMasTarget(targetName: string): boolean {\n    return targetName === \"mas\" || targetName === \"mas-dev\"\n  }\n\n  static getPlatformTypeFromTarget(targetName: string): PlatformType {\n    if (targetName === \"mas\") return \"mas\"\n    if (targetName === \"mas-dev\") return \"mas-dev\"\n    return \"mac\"\n  }\n\n  static assertSafePathForCommandUsage(pathValue: string, description: string): void {\n    if (/[\\0\\r\\n\"'`$;&|<>]/.test(pathValue)) {\n      throw new InvalidConfigurationError(`Invalid ${description}: contains unsupported shell-special characters`)\n    }\n  }\n\n  static getNotarizeOptions(appPath: string): NotarizeOptionsNotaryTool | undefined {\n    const tool = \"notarytool\"\n    const teamId = process.env.APPLE_TEAM_ID\n    const appleId = process.env.APPLE_ID\n    const appleIdPassword = process.env.APPLE_APP_SPECIFIC_PASSWORD\n\n    if (appleId || appleIdPassword) {\n      if (!appleId) {\n        throw new InvalidConfigurationError(`APPLE_ID env var needs to be set`)\n      }\n      if (!appleIdPassword) {\n        throw new InvalidConfigurationError(`APPLE_APP_SPECIFIC_PASSWORD env var needs to be set`)\n      }\n      if (!teamId) {\n        throw new InvalidConfigurationError(`APPLE_TEAM_ID env var needs to be set`)\n      }\n      return { tool, appPath, appleId, appleIdPassword, teamId }\n    }\n\n    const appleApiKey = process.env.APPLE_API_KEY\n    const appleApiKeyId = process.env.APPLE_API_KEY_ID\n    const appleApiIssuer = process.env.APPLE_API_ISSUER\n    if (appleApiKey || appleApiKeyId || appleApiIssuer) {\n      if (!appleApiKey || !appleApiKeyId || !appleApiIssuer) {\n        throw new InvalidConfigurationError(`Env vars APPLE_API_KEY, APPLE_API_KEY_ID and APPLE_API_ISSUER need to be set`)\n      }\n      return { tool, appPath, appleApiKey, appleApiKeyId, appleApiIssuer }\n    }\n\n    const keychain = process.env.APPLE_KEYCHAIN\n    const keychainProfile = process.env.APPLE_KEYCHAIN_PROFILE\n    if (keychainProfile) {\n      let args: NotaryToolKeychainCredentials = { keychainProfile }\n      if (keychain) {\n        args = { ...args, keychain }\n      }\n      return { tool, appPath, ...args }\n    }\n\n    return undefined\n  }\n\n  async notarizeIfProvided(appPath: string): Promise<void> {\n    const notarizeOptions = this.packager.platformSpecificBuildOptions.notarize\n    if (notarizeOptions === false) {\n      log.info({ reason: \"`notarize` options were set explicitly `false`\" }, \"skipped macOS notarization\")\n      return\n    }\n    const options = MacTargetHelper.getNotarizeOptions(appPath)\n    if (!options) {\n      log.warn({ reason: \"`notarize` options were unable to be generated\" }, \"skipped macOS notarization\")\n      return\n    }\n    await notarize(options)\n    log.info(null, \"notarization successful\")\n  }\n}\n"]}

package/out/macPackager.d.ts

@@ -6,30 +6,44 @@ import { AppInfo } from "./appInfo";
 import { CodeSigningInfo, CreateKeychainOptions } from "./codeSign/macCodeSign";
 import { Target } from "./core";
 import { AfterPackContext } from "./index";
-import { MacConfiguration } from "./options/macOptions";
+import { MacTargetHelper } from "./mac/MacTargetHelper";
+import { MacConfiguration, MasConfiguration } from "./options/macOptions";
 import { Packager } from "./packager";
 import { DoPackOptions, PlatformPackager } from "./platformPackager";
 export type CustomMacSignOptions = SignOptions;
 export type CustomMacSign = (configuration: CustomMacSignOptions, packager: MacPackager) => Promise<void>;
-export declare class MacPackager extends PlatformPackager<MacConfiguration> {
+export declare class MacPackager extends PlatformPackager<MacConfiguration | MasConfiguration> {
     readonly codeSigningInfo: MemoLazy<CreateKeychainOptions | null, CodeSigningInfo>;
     private _iconPath;
+    private _activePackConfig;
+    readonly helper: MacTargetHelper;
     constructor(info: Packager);
     get defaultTarget(): Array<string>;
+    /**
+     * Get the merged configuration for a specific platform type
+     */
+    private getPlatformConfig;
     expandArch(pattern: string, arch?: Arch | null): string[];
     protected prepareAppInfo(appInfo: AppInfo): AppInfo;
     getIconPath(): Promise<string | null>;
     createTargets(targets: Array<string>, mapper: (name: string, factory: (outDir: string) => Target) => void): void;
     protected doPack(config: DoPackOptions<MacConfiguration>): Promise<any>;
+    /**
+     * Handle universal build packing
+     */
+    private doUniversalPack;
     pack(outDir: string, arch: Arch, targets: Array<Target>, taskManager: AsyncTaskManager): Promise<void>;
+    private packMasTargets;
+    private packMacTargets;
+    private signMas;
+    /**
+     * Main signing method with platform awareness
+     */
     private sign;
-    private getOptionsForFile;
-    protected doSign(opts: SignOptions, customSignOptions: MacConfiguration, identity: Identity | null): Promise<void>;
-    protected doFlat(appPath: string, outFile: string, identity: Identity, keychain: string | Nullish): Promise<any>;
+    protected doSign(opts: SignOptions, customSignOptions: MacConfiguration | MasConfiguration, identity: Identity | null): Promise<void>;
+    doFlat(appPath: string, outFile: string, identity: Identity, keychain: string | Nullish): Promise<any>;
     getElectronSrcDir(dist: string): string;
     getElectronDestinationDir(appOutDir: string): string;
     applyCommonInfo(appPlist: any, contentsPath: string): Promise<void>;
     protected signApp(packContext: AfterPackContext, isAsar: boolean): Promise<boolean>;
-    notarizeIfProvided(appPath: string): Promise<void>;
-    private getNotarizeOptions;
 }