app-builder-lib 26.11.1 → 26.12.1

package/out/macPackager.js

@@ -1,8 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MacPackager = void 0;
-const notarize_1 = require("@electron/notarize");
-const util_identities_1 = require("@electron/osx-sign/dist/cjs/util-identities");
+const universal_1 = require("@electron/universal");
 const builder_util_1 = require("builder-util");
 const builder_util_runtime_1 = require("builder-util-runtime");
 const fs = require("fs/promises");
@@ -12,15 +11,14 @@ const path = require("path");
 const appInfo_1 = require("./appInfo");
 const macCodeSign_1 = require("./codeSign/macCodeSign");
 const core_1 = require("./core");
+const MacTargetHelper_1 = require("./mac/MacTargetHelper");
 const platformPackager_1 = require("./platformPackager");
 const ArchiveTarget_1 = require("./targets/ArchiveTarget");
 const pkg_1 = require("./targets/pkg");
 const targetFactory_1 = require("./targets/targetFactory");
 const macosVersion_1 = require("./util/macosVersion");
-const pathManager_1 = require("./util/pathManager");
-const resolve_1 = require("./util/resolve");
 const macroExpander_1 = require("./util/macroExpander");
-const universal_1 = require("@electron/universal");
+const resolve_1 = require("./util/resolve");
 class MacPackager extends platformPackager_1.PlatformPackager {
     constructor(info) {
         super(info, core_1.Platform.MAC);
@@ -51,10 +49,43 @@ class MacPackager extends platformPackager_1.PlatformPackager {
             return Promise.resolve({ keychainFile: process.env.CSC_KEYCHAIN || null });
         });
         this._iconPath = new lazy_val_1.Lazy(() => this.getOrConvertIcon("icns"));
+        // Set/cleared in doPack so applyCommonInfo can read the per-pack platformSpecificBuildOptions
+        // (the framework call chain doesn't thread it through to applyCommonInfo). Fixes #8909.
+        this._activePackConfig = null;
+        this.helper = new MacTargetHelper_1.MacTargetHelper(this);
     }
     get defaultTarget() {
         return this.info.framework.macOsDefaultTargets;
     }
+    /**
+     * Get the merged configuration for a specific platform type
+     */
+    getPlatformConfig(platformType) {
+        let config;
+        let isDevelopment = false;
+        let platformName;
+        switch (platformType) {
+            case "mas":
+                config = (0, builder_util_1.deepAssign)({}, this.platformSpecificBuildOptions, this.config.mas);
+                isDevelopment = false;
+                platformName = "mas";
+                break;
+            case "mas-dev":
+                config = (0, builder_util_1.deepAssign)({}, this.platformSpecificBuildOptions, this.config.mas, this.config.masDev, {
+                    type: "development",
+                });
+                isDevelopment = true;
+                platformName = "mas";
+                break;
+            case "mac":
+            default:
+                config = this.platformSpecificBuildOptions;
+                isDevelopment = false;
+                platformName = this.platform.nodeName;
+                break;
+        }
+        return { type: platformType, config, isDevelopment, platformName };
+    }
     expandArch(pattern, arch) {
         if (arch === builder_util_1.Arch.universal) {
             // Universal build has `app-x64.asar.unpacked` & `app-arm64.asar.unpacked`
@@ -89,318 +120,205 @@ class MacPackager extends platformPackager_1.PlatformPackager {
                     mapper(name, outDir => new pkg_1.PkgTarget(this, outDir));
                     break;
                 default:
-                    mapper(name, outDir => (name === "mas" || name === "mas-dev" ? new targetFactory_1.NoOpTarget(name) : (0, targetFactory_1.createCommonTarget)(name, outDir, this)));
+                    mapper(name, outDir => (MacTargetHelper_1.MacTargetHelper.isMasTarget(name) ? new targetFactory_1.NoOpTarget(name) : (0, targetFactory_1.createCommonTarget)(name, outDir, this)));
                     break;
             }
         }
     }
     async doPack(config) {
-        var _a;
-        const { outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets } = config;
-        switch (arch) {
-            default: {
-                return super.doPack(config);
-            }
-            case builder_util_1.Arch.universal: {
-                const outDirName = (arch) => `${appOutDir}-${builder_util_1.Arch[arch]}-temp`;
-                const options = {
-                    ...config,
-                    options: {
-                        sign: false,
-                        disableAsarIntegrity: true,
-                        disableFuses: true,
-                    },
-                };
-                const x64Arch = builder_util_1.Arch.x64;
-                const x64AppOutDir = outDirName(x64Arch);
-                await super.doPack({ ...options, appOutDir: x64AppOutDir, arch: x64Arch });
-                if (this.info.cancellationToken.cancelled) {
-                    return;
-                }
-                const arm64Arch = builder_util_1.Arch.arm64;
-                const arm64AppOutPath = outDirName(arm64Arch);
-                await super.doPack({ ...options, appOutDir: arm64AppOutPath, arch: arm64Arch });
-                if (this.info.cancellationToken.cancelled) {
-                    return;
-                }
-                const framework = this.info.framework;
-                builder_util_1.log.info({
-                    platform: platformName,
-                    arch: builder_util_1.Arch[arch],
-                    [`${framework.name}`]: framework.version,
-                    appOutDir: builder_util_1.log.filePath(appOutDir),
-                }, `packaging`);
-                const appFile = `${this.appInfo.productFilename}.app`;
-                // Make sure the Assets.car file is the same for both architectures
-                const sourceCatalogPath = path.join(x64AppOutDir, appFile, "Contents/Resources/Assets.car");
-                if (await (0, builder_util_1.exists)(sourceCatalogPath)) {
-                    const targetCatalogPath = path.join(arm64AppOutPath, appFile, "Contents/Resources/Assets.car");
-                    await fs.copyFile(sourceCatalogPath, targetCatalogPath);
-                }
-                await (0, universal_1.makeUniversalApp)({
-                    x64AppPath: path.join(x64AppOutDir, appFile),
-                    arm64AppPath: path.join(arm64AppOutPath, appFile),
-                    outAppPath: path.join(appOutDir, appFile),
-                    force: true,
-                    mergeASARs: (_a = platformSpecificBuildOptions.mergeASARs) !== null && _a !== void 0 ? _a : true, // must be ?? to allow false
-                    singleArchFiles: platformSpecificBuildOptions.singleArchFiles || undefined,
-                    x64ArchFiles: platformSpecificBuildOptions.x64ArchFiles || undefined,
-                });
-                await fs.rm(x64AppOutDir, { recursive: true, force: true });
-                await fs.rm(arm64AppOutPath, { recursive: true, force: true });
-                // Give users a final opportunity to perform things on the combined universal package before signing
-                const packContext = {
-                    appOutDir,
-                    outDir,
-                    arch,
-                    targets,
-                    packager: this,
-                    electronPlatformName: platformName,
-                };
-                await this.info.emitAfterPack(packContext);
-                if (this.info.cancellationToken.cancelled) {
-                    return;
-                }
-                await this.doAddElectronFuses(packContext);
+        if (config.arch === builder_util_1.Arch.universal) {
+            return this.doUniversalPack(config);
+        }
+        // Bridge the per-pack platformSpecificBuildOptions to applyCommonInfo, which is called deep in the
+        // framework stack (doPack → beforeCopyExtraFiles → createMacApp → applyCommonInfo) without it.
+        this._activePackConfig = config.platformSpecificBuildOptions;
+        try {
+            return await super.doPack(config);
+        }
+        finally {
+            this._activePackConfig = null;
+        }
+    }
+    /**
+     * Handle universal build packing
+     */
+    async doUniversalPack(config) {
+        var _a, _b, _c;
+        this._activePackConfig = config.platformSpecificBuildOptions;
+        try {
+            const { outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets } = config;
+            const outDirName = (arch) => `${appOutDir}-${builder_util_1.Arch[arch]}-temp`;
+            const options = {
+                ...config,
+                options: {
+                    sign: false,
+                    disableAsarIntegrity: true,
+                    disableFuses: true,
+                },
+            };
+            const x64Arch = builder_util_1.Arch.x64;
+            const x64AppOutDir = outDirName(x64Arch);
+            await super.doPack({ ...options, appOutDir: x64AppOutDir, arch: x64Arch });
+            if (this.info.cancellationToken.cancelled) {
+                return;
+            }
+            const arm64Arch = builder_util_1.Arch.arm64;
+            const arm64AppOutPath = outDirName(arm64Arch);
+            await super.doPack({ ...options, appOutDir: arm64AppOutPath, arch: arm64Arch });
+            if (this.info.cancellationToken.cancelled) {
+                return;
+            }
+            const framework = this.info.framework;
+            builder_util_1.log.info({
+                platform: platformName,
+                arch: builder_util_1.Arch[arch],
+                [`${framework.name}`]: framework.version,
+                appOutDir: builder_util_1.log.filePath(appOutDir),
+            }, `packaging`);
+            const appFile = `${this.appInfo.productFilename}.app`;
+            // Make sure the Assets.car file is the same for both architectures
+            const safeX64AppOutDir = (0, builder_util_1.sanitizeDirPath)(x64AppOutDir);
+            const safeArm64AppOutPath = (0, builder_util_1.sanitizeDirPath)(arm64AppOutPath);
+            const safeAppOutDir = (0, builder_util_1.sanitizeDirPath)(appOutDir);
+            const sourceCatalogPath = path.join(safeX64AppOutDir, appFile, "Contents/Resources/Assets.car");
+            if (await (0, builder_util_1.exists)(sourceCatalogPath)) {
+                const targetCatalogPath = path.join(safeArm64AppOutPath, appFile, "Contents/Resources/Assets.car");
+                await fs.copyFile(sourceCatalogPath, targetCatalogPath);
+            }
+            await (0, universal_1.makeUniversalApp)({
+                x64AppPath: path.join(safeX64AppOutDir, appFile),
+                arm64AppPath: path.join(safeArm64AppOutPath, appFile),
+                outAppPath: path.join(safeAppOutDir, appFile),
+                force: true,
+                mergeASARs: (_a = platformSpecificBuildOptions.mergeASARs) !== null && _a !== void 0 ? _a : true, // must be ?? to allow false
+                singleArchFiles: platformSpecificBuildOptions.singleArchFiles || undefined,
+                x64ArchFiles: platformSpecificBuildOptions.x64ArchFiles || undefined,
+            });
+            await fs.rm(x64AppOutDir, { recursive: true, force: true });
+            await fs.rm(arm64AppOutPath, { recursive: true, force: true });
+            // Give users a final opportunity to perform things on the combined universal package before signing
+            const packContext = {
+                appOutDir,
+                outDir,
+                arch,
+                targets,
+                packager: this,
+                electronPlatformName: platformName,
+            };
+            await this.info.emitAfterPack(packContext);
+            if (this.info.cancellationToken.cancelled) {
+                return;
+            }
+            await this.doAddElectronFuses(packContext);
+            // Mirror the base-class guard: skip signing when the caller explicitly set sign:false
+            // (e.g. packMasTargets passes sign:false so that signMas() is the sole signing step).
+            if ((_c = (_b = config.options) === null || _b === void 0 ? void 0 : _b.sign) !== null && _c !== void 0 ? _c : true) {
                 await this.doSignAfterPack(outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets);
-                break;
             }
         }
+        finally {
+            this._activePackConfig = null;
+        }
     }
     async pack(outDir, arch, targets, taskManager) {
-        const hasMas = targets.length !== 0 && targets.some(it => it.name === "mas" || it.name === "mas-dev");
+        const masTargets = targets.filter(it => MacTargetHelper_1.MacTargetHelper.isMasTarget(it.name));
+        const nonMasTargets = targets.filter(it => !MacTargetHelper_1.MacTargetHelper.isMasTarget(it.name));
         const prepackaged = this.packagerOptions.prepackaged;
+        const hasMas = masTargets.length > 0;
+        // mas always first
+        await this.packMasTargets(outDir, arch, masTargets, prepackaged);
+        // Mirror master's condition: skip the non-MAS darwin pack only when there are exclusively MAS
+        // targets (hasMas=true, targets.length=1). DIR_TARGET passes targets=[] to pack() because
+        // MacPackager.createTargets() doesn't call mapper() for it, so hasMas=false and doPack still runs.
+        if (!hasMas || targets.length > 1) {
+            await this.packMacTargets(outDir, arch, nonMasTargets, prepackaged, taskManager);
+        }
+    }
+    async packMasTargets(outDir, arch, targets, prepackaged) {
+        const resolvedOutDir = path.resolve(outDir);
+        MacTargetHelper_1.MacTargetHelper.assertSafePathForCommandUsage(resolvedOutDir, "output directory");
         for (const target of targets) {
-            const targetName = target.name;
-            if (!(targetName === "mas" || targetName === "mas-dev")) {
-                continue;
-            }
-            const masBuildOptions = (0, builder_util_1.deepAssign)({}, this.platformSpecificBuildOptions, this.config.mas);
-            if (targetName === "mas-dev") {
-                (0, builder_util_1.deepAssign)(masBuildOptions, this.config.masDev, {
-                    type: "development",
-                });
-            }
-            const targetOutDir = path.join(outDir, `${targetName}${(0, builder_util_1.getArchSuffix)(arch, this.platformSpecificBuildOptions.defaultArch)}`);
-            if (prepackaged == null) {
-                await this.doPack({ outDir, appOutDir: targetOutDir, platformName: "mas", arch, platformSpecificBuildOptions: masBuildOptions, targets: [target] });
-                await this.sign(path.join(targetOutDir, `${this.appInfo.productFilename}.app`), targetOutDir, masBuildOptions, arch);
-            }
-            else {
-                await this.sign(prepackaged, targetOutDir, masBuildOptions, arch);
+            const platformType = MacTargetHelper_1.MacTargetHelper.getPlatformTypeFromTarget(target.name);
+            const platformConfig = this.getPlatformConfig(platformType);
+            const targetOutDir = path.resolve(resolvedOutDir, `${target.name}${(0, builder_util_1.getArchSuffix)(arch, this.platformSpecificBuildOptions.defaultArch)}`);
+            MacTargetHelper_1.MacTargetHelper.assertSafePathForCommandUsage(targetOutDir, "target output directory");
+            const relativeTargetOutDir = path.relative(resolvedOutDir, targetOutDir);
+            if (relativeTargetOutDir.startsWith("..") || path.isAbsolute(relativeTargetOutDir)) {
+                throw new builder_util_1.InvalidConfigurationError(`Invalid target output directory: ${targetOutDir}`);
             }
-        }
-        if (!hasMas || targets.length > 1) {
-            const appPath = prepackaged == null ? path.join(this.computeAppOutDir(outDir, arch), `${this.appInfo.productFilename}.app`) : prepackaged;
             if (prepackaged == null) {
                 await this.doPack({
-                    outDir,
-                    appOutDir: path.dirname(appPath),
-                    platformName: this.platform.nodeName,
+                    outDir: resolvedOutDir,
+                    appOutDir: targetOutDir,
+                    platformName: platformConfig.platformName,
                     arch,
-                    platformSpecificBuildOptions: this.platformSpecificBuildOptions,
-                    targets,
+                    platformSpecificBuildOptions: platformConfig.config,
+                    targets: [target],
+                    options: { sign: false },
                 });
+                MacTargetHelper_1.MacTargetHelper.assertSafePathForCommandUsage(this.appInfo.productFilename, "product filename");
+                await this.signMas(path.resolve(targetOutDir, `${path.basename(this.appInfo.productFilename)}.app`), targetOutDir, platformConfig, arch);
+            }
+            else {
+                await this.signMas(prepackaged, targetOutDir, platformConfig, arch);
             }
-            this.packageInDistributableFormat(appPath, arch, targets, taskManager);
         }
     }
-    async sign(appPath, outDir, masOptions, arch) {
+    async packMacTargets(outDir, arch, targets, prepackaged, taskManager) {
+        const appPath = prepackaged == null ? path.join(this.computeAppOutDir(outDir, arch), `${path.basename(this.appInfo.productFilename)}.app`) : prepackaged;
+        if (prepackaged == null) {
+            const platformConfig = this.getPlatformConfig("mac");
+            await this.doPack({
+                outDir,
+                appOutDir: path.dirname(appPath),
+                platformName: platformConfig.platformName,
+                arch,
+                platformSpecificBuildOptions: platformConfig.config,
+                targets,
+            });
+        }
+        this.packageInDistributableFormat(appPath, arch, targets, taskManager);
+    }
+    async signMas(appPath, outDir, platformConfig, arch) {
+        const signed = await this.sign(appPath, outDir, platformConfig.config, arch, true);
+        return signed;
+    }
+    /**
+     * Main signing method with platform awareness
+     */
+    async sign(appPath, outDir, options, arch, isMas = false) {
         if (!(0, macCodeSign_1.isSignAllowed)()) {
             return false;
         }
-        const isMas = masOptions != null;
-        const options = masOptions == null ? this.platformSpecificBuildOptions : masOptions;
-        const qualifier = options.identity;
+        const config = options !== null && options !== void 0 ? options : this.platformSpecificBuildOptions;
+        const qualifier = config.identity;
         const fallBackToAdhoc = (arch === builder_util_1.Arch.arm64 || arch === builder_util_1.Arch.universal) && !this.forceCodeSigning;
         if (qualifier === null) {
-            if (this.forceCodeSigning) {
-                throw new builder_util_1.InvalidConfigurationError("identity explicitly is set to null, but forceCodeSigning is set to true");
-            }
-            builder_util_1.log.info({ reason: "identity explicitly is set to null" }, "skipped macOS code signing");
-            if (fallBackToAdhoc) {
-                builder_util_1.log.warn("arm64 requires signing, but identity is set to null and signing is being skipped");
-            }
-            return false;
+            return this.helper.handleNullIdentity(fallBackToAdhoc);
         }
         const keychainFile = (await this.codeSigningInfo.value).keychainFile;
-        const explicitType = options.type;
+        const explicitType = config.type;
         const type = explicitType || "distribution";
         const isDevelopment = type === "development";
-        const certificateTypes = getCertificateTypes(isMas, isDevelopment);
-        let identity = null;
-        for (const certificateType of certificateTypes) {
-            identity = await (0, macCodeSign_1.findIdentity)(certificateType, qualifier, keychainFile);
-            if (identity != null) {
-                break;
-            }
-        }
-        if (identity == null) {
-            if (!isMas && !isDevelopment && explicitType !== "distribution") {
-                identity = await (0, macCodeSign_1.findIdentity)("Mac Developer", qualifier, keychainFile);
-                if (identity != null) {
-                    builder_util_1.log.warn("Mac Developer is used to sign app — it is only for development and testing, not for production");
-                }
-            }
-            const noIdentity = !options.sign && identity == null;
-            if (qualifier === "-") {
-                identity = new util_identities_1.Identity("-", undefined);
-            }
-            else if (noIdentity && fallBackToAdhoc) {
-                builder_util_1.log.warn(null, "falling back to ad-hoc signature for macOS application code signing");
-                identity = new util_identities_1.Identity("-", undefined);
-            }
-            else if (noIdentity) {
-                await (0, macCodeSign_1.reportError)(isMas, certificateTypes, qualifier, keychainFile, this.forceCodeSigning);
-                return false;
-            }
+        const identity = await this.helper.findSigningIdentity(isMas, isDevelopment, qualifier, keychainFile, config, fallBackToAdhoc);
+        if (!identity) {
+            return false;
         }
         if (!(0, macosVersion_1.isMacOsHighSierra)()) {
             throw new builder_util_1.InvalidConfigurationError("macOS High Sierra 10.13.6 is required to sign");
         }
-        let filter = options.signIgnore;
-        if (Array.isArray(filter)) {
-            if (filter.length == 0) {
-                filter = null;
-            }
-        }
-        else if (filter != null) {
-            filter = filter.length === 0 ? null : [filter];
-        }
-        const filterRe = filter == null
-            ? null
-            : filter.map(it => {
-                try {
-                    return new RegExp(it);
-                }
-                catch (e) {
-                    throw new builder_util_1.InvalidConfigurationError(`Invalid regex filter pattern: ${it}. ${e.message}`);
-                }
-            });
-        let binaries = options.binaries || undefined;
-        if (binaries) {
-            // Accept absolute paths for external binaries, else resolve relative paths from the artifact's app Contents path.
-            binaries = (await Promise.all(binaries.flatMap(async (destination) => {
-                const expandedDestination = this.expandArch(destination, arch);
-                return await Promise.all(expandedDestination.map(async (d) => {
-                    if (await (0, builder_util_1.statOrNull)(d)) {
-                        return d;
-                    }
-                    return path.resolve(appPath, d);
-                }));
-            }))).flat();
-            builder_util_1.log.info({ binaries, arch: arch == null ? null : builder_util_1.Arch[arch] }, "signing additional user-defined binaries for arch");
-        }
-        const customSignOptions = (isMas ? masOptions : this.platformSpecificBuildOptions) || this.platformSpecificBuildOptions;
-        const signOptions = {
-            identityValidation: false,
-            // https://github.com/electron-userland/electron-builder/issues/1699
-            // kext are signed by the chipset manufacturers. You need a special certificate (only available on request) from Apple to be able to sign kext.
-            ignore: (file) => {
-                if (filterRe != null) {
-                    for (const regExp of filterRe) {
-                        if (regExp.test(file)) {
-                            return true;
-                        }
-                    }
-                }
-                return (file.endsWith(".kext") ||
-                    file.startsWith("/Contents/PlugIns", appPath.length) ||
-                    file.includes("/node_modules/puppeteer/.local-chromium") ||
-                    file.includes("/node_modules/playwright-firefox/.local-browsers") ||
-                    file.includes("/node_modules/playwright/.local-browsers"));
-                /* Those are browser automating modules, browser (chromium, nightly) cannot be signed
-                  https://github.com/electron-userland/electron-builder/issues/2010
-                  https://github.com/electron-userland/electron-builder/issues/5383
-                  */
-            },
-            identity: identity ? identity.hash || identity.name : undefined,
-            type,
-            platform: isMas ? "mas" : "darwin",
-            version: this.config.electronVersion || undefined,
-            app: appPath,
-            keychain: keychainFile || undefined,
-            binaries,
-            // https://github.com/electron-userland/electron-builder/issues/1480
-            strictVerify: options.strictVerify,
-            preAutoEntitlements: options.preAutoEntitlements,
-            optionsForFile: await this.getOptionsForFile(appPath, isMas, customSignOptions),
-            provisioningProfile: customSignOptions.provisioningProfile || undefined,
-        };
-        await this.doSign(signOptions, customSignOptions, identity);
-        // https://github.com/electron-userland/electron-builder/issues/1196#issuecomment-312310209
-        if (masOptions != null && !isDevelopment) {
-            const certType = isDevelopment ? "Mac Developer" : "3rd Party Mac Developer Installer";
-            const masInstallerIdentity = await (0, macCodeSign_1.findIdentity)(certType, masOptions.identity, keychainFile);
-            if (masInstallerIdentity == null) {
-                throw new builder_util_1.InvalidConfigurationError(`Cannot find valid "${certType}" identity to sign MAS installer, please see https://electron.build/code-signing`);
-            }
-            // mas uploaded to AppStore, so, use "-" instead of space for name
-            const artifactName = this.expandArtifactNamePattern(masOptions, "pkg", arch);
-            const artifactPath = path.join(outDir, artifactName);
-            await this.doFlat(appPath, artifactPath, masInstallerIdentity, keychainFile);
-            await this.info.emitArtifactBuildCompleted({
-                file: artifactPath,
-                target: null,
-                arch: builder_util_1.Arch.x64,
-                safeArtifactName: this.computeSafeArtifactName(artifactName, "pkg", arch, true, this.platformSpecificBuildOptions.defaultArch),
-                packager: this,
-            });
+        const signOptions = await this.helper.buildSignOptions(appPath, identity, type, isMas, config, keychainFile, arch);
+        await this.doSign(signOptions, config, identity);
+        // Handle MAS installer creation
+        if (isMas && !isDevelopment && outDir) {
+            await this.helper.createMasInstaller(appPath, outDir, config, keychainFile, isDevelopment, arch);
         }
+        // Handle notarization for non-MAS builds
         if (!isMas) {
-            await this.notarizeIfProvided(appPath);
+            await this.helper.notarizeIfProvided(appPath);
         }
         return true;
     }
-    async getOptionsForFile(appPath, isMas, customSignOptions) {
-        const resourceList = await this.resourceList;
-        const entitlementsSuffix = isMas ? "mas" : "mac";
-        const getEntitlements = (filePath) => {
-            // check if root app, then use main entitlements
-            if (filePath === appPath) {
-                if (customSignOptions.entitlements) {
-                    return customSignOptions.entitlements;
-                }
-                const p = `entitlements.${entitlementsSuffix}.plist`;
-                if (resourceList.includes(p)) {
-                    return path.join(this.info.buildResourcesDir, p);
-                }
-                else {
-                    return (0, pathManager_1.getTemplatePath)("entitlements.mac.plist");
-                }
-            }
-            // It's a login helper...
-            if (filePath.includes("Library/LoginItems")) {
-                return customSignOptions.entitlementsLoginHelper;
-            }
-            // Only remaining option is that it's inherited entitlements
-            if (customSignOptions.entitlementsInherit) {
-                return customSignOptions.entitlementsInherit;
-            }
-            const p = `entitlements.${entitlementsSuffix}.inherit.plist`;
-            if (resourceList.includes(p)) {
-                return path.join(this.info.buildResourcesDir, p);
-            }
-            else {
-                return (0, pathManager_1.getTemplatePath)("entitlements.mac.plist");
-            }
-        };
-        const requirements = isMas || this.platformSpecificBuildOptions.requirements == null ? undefined : await this.getResource(this.platformSpecificBuildOptions.requirements);
-        // harden by default for mac builds. Only harden mas builds if explicitly true (backward compatibility)
-        const hardenedRuntime = isMas ? customSignOptions.hardenedRuntime === true : customSignOptions.hardenedRuntime !== false;
-        const optionsForFile = filePath => {
-            const entitlements = getEntitlements(filePath);
-            const args = {
-                entitlements: entitlements || undefined,
-                hardenedRuntime: hardenedRuntime !== null && hardenedRuntime !== void 0 ? hardenedRuntime : undefined,
-                timestamp: customSignOptions.timestamp || undefined,
-                requirements: requirements || undefined,
-                additionalArguments: customSignOptions.additionalArguments || [],
-            };
-            return args;
-        };
-        return optionsForFile;
-    }
     //noinspection JSMethodCanBeStatic
     async doSign(opts, customSignOptions, identity) {
         const customSign = await (0, resolve_1.resolveFunction)(this.appInfo.type, customSignOptions.sign, "sign", await this.info.getWorkspaceRoot());
@@ -417,11 +335,13 @@ class MacPackager extends platformPackager_1.PlatformPackager {
     }
     //noinspection JSMethodCanBeStatic
     async doFlat(appPath, outFile, identity, keychain) {
+        const safeAppPath = (0, builder_util_1.sanitizeDirPath)(appPath);
+        const safeOutFile = (0, builder_util_1.sanitizeDirPath)(outFile);
         // productbuild doesn't created directory for out file
-        await (0, promises_1.mkdir)(path.dirname(outFile), { recursive: true });
+        await (0, promises_1.mkdir)(path.dirname(safeOutFile), { recursive: true });
         const args = (0, pkg_1.prepareProductBuildArgs)(identity, keychain);
-        args.push("--component", appPath, "/Applications");
-        args.push(outFile);
+        args.push("--component", safeAppPath, "/Applications");
+        args.push(safeOutFile);
         return await (0, builder_util_1.exec)("productbuild", args);
     }
     getElectronSrcDir(dist) {
@@ -432,6 +352,7 @@ class MacPackager extends platformPackager_1.PlatformPackager {
     }
     // todo fileAssociations
     async applyCommonInfo(appPlist, contentsPath) {
+        var _a;
         const appInfo = this.appInfo;
         const appFilename = appInfo.productFilename;
         // https://github.com/electron-userland/electron-builder/issues/1278
@@ -472,8 +393,9 @@ class MacPackager extends platformPackager_1.PlatformPackager {
         if (minimumSystemVersion != null) {
             appPlist.LSMinimumSystemVersion = minimumSystemVersion;
         }
-        appPlist.CFBundleShortVersionString = this.platformSpecificBuildOptions.bundleShortVersion || appInfo.version;
-        appPlist.CFBundleVersion = appInfo.buildVersion;
+        const activeOpts = (_a = this._activePackConfig) !== null && _a !== void 0 ? _a : this.platformSpecificBuildOptions;
+        appPlist.CFBundleShortVersionString = activeOpts.bundleShortVersion || appInfo.version;
+        appPlist.CFBundleVersion = activeOpts.bundleVersion || appInfo.buildVersion;
         (0, builder_util_1.use)(this.platformSpecificBuildOptions.category || this.config.category, it => (appPlist.LSApplicationCategoryType = it));
         appPlist.NSHumanReadableCopyright = appInfo.copyright;
         if (this.platformSpecificBuildOptions.darkModeSupport) {
@@ -490,10 +412,21 @@ class MacPackager extends platformPackager_1.PlatformPackager {
         }
     }
     async signApp(packContext, isAsar) {
+        var _a;
+        const isMas = packContext.electronPlatformName === "mas";
+        const activeConfig = (_a = this._activePackConfig) !== null && _a !== void 0 ? _a : this.platformSpecificBuildOptions;
         const readDirectoryAndSign = async (sourceDirectory, directories, shouldSign) => {
+            const normalizedSourceDirectory = path.resolve(sourceDirectory);
+            MacTargetHelper_1.MacTargetHelper.assertSafePathForCommandUsage(normalizedSourceDirectory, "application output directory");
             await Promise.all(directories.map(async (file) => {
                 if (shouldSign(file)) {
-                    await this.sign(path.join(sourceDirectory, file), null, null, packContext.arch);
+                    const entryName = path.basename(file);
+                    if (file !== entryName) {
+                        throw new builder_util_1.InvalidConfigurationError(`Invalid entry name in source directory: ${file}`);
+                    }
+                    const signTarget = path.resolve(normalizedSourceDirectory, entryName);
+                    const safeSignTarget = (0, builder_util_1.sanitizeDirPath)(signTarget, normalizedSourceDirectory);
+                    await this.sign(safeSignTarget, null, isMas ? activeConfig : null, packContext.arch, isMas);
                 }
             }));
             return true;
@@ -507,67 +440,6 @@ class MacPackager extends platformPackager_1.PlatformPackager {
         await readDirectoryAndSign(outResourcesDir, await (0, builder_util_1.orIfFileNotExist)((0, promises_1.readdir)(outResourcesDir), []), file => file.endsWith(".app"));
         return true;
     }
-    async notarizeIfProvided(appPath) {
-        const notarizeOptions = this.platformSpecificBuildOptions.notarize;
-        if (notarizeOptions === false) {
-            builder_util_1.log.info({ reason: "`notarize` options were set explicitly `false`" }, "skipped macOS notarization");
-            return;
-        }
-        const options = this.getNotarizeOptions(appPath);
-        if (!options) {
-            builder_util_1.log.warn({ reason: "`notarize` options were unable to be generated" }, "skipped macOS notarization");
-            return;
-        }
-        await (0, notarize_1.notarize)(options);
-        builder_util_1.log.info(null, "notarization successful");
-    }
-    getNotarizeOptions(appPath) {
-        const teamId = process.env.APPLE_TEAM_ID;
-        const appleId = process.env.APPLE_ID;
-        const appleIdPassword = process.env.APPLE_APP_SPECIFIC_PASSWORD;
-        const tool = "notarytool";
-        // option 1: app specific password
-        if (appleId || appleIdPassword) {
-            if (!appleId) {
-                throw new builder_util_1.InvalidConfigurationError(`APPLE_ID env var needs to be set`);
-            }
-            if (!appleIdPassword) {
-                throw new builder_util_1.InvalidConfigurationError(`APPLE_APP_SPECIFIC_PASSWORD env var needs to be set`);
-            }
-            if (!teamId) {
-                throw new builder_util_1.InvalidConfigurationError(`APPLE_TEAM_ID env var needs to be set`);
-            }
-            return { tool, appPath, appleId, appleIdPassword, teamId };
-        }
-        // option 2: API key
-        const appleApiKey = process.env.APPLE_API_KEY;
-        const appleApiKeyId = process.env.APPLE_API_KEY_ID;
-        const appleApiIssuer = process.env.APPLE_API_ISSUER;
-        if (appleApiKey || appleApiKeyId || appleApiIssuer) {
-            if (!appleApiKey || !appleApiKeyId || !appleApiIssuer) {
-                throw new builder_util_1.InvalidConfigurationError(`Env vars APPLE_API_KEY, APPLE_API_KEY_ID and APPLE_API_ISSUER need to be set`);
-            }
-            return { tool, appPath, appleApiKey, appleApiKeyId, appleApiIssuer };
-        }
-        // option 3: keychain
-        const keychain = process.env.APPLE_KEYCHAIN;
-        const keychainProfile = process.env.APPLE_KEYCHAIN_PROFILE;
-        if (keychainProfile) {
-            let args = { keychainProfile };
-            if (keychain) {
-                args = { ...args, keychain };
-            }
-            return { tool, appPath, ...args };
-        }
-        // if no credentials provided, skip silently
-        return undefined;
-    }
 }
 exports.MacPackager = MacPackager;
-function getCertificateTypes(isMas, isDevelopment) {
-    if (isDevelopment) {
-        return isMas ? ["Mac Developer", "Apple Development"] : ["Mac Developer", "Developer ID Application"];
-    }
-    return isMas ? ["Apple Distribution", "3rd Party Mac Developer Application"] : ["Developer ID Application"];
-}
 //# sourceMappingURL=macPackager.js.map