app-builder-lib 26.15.2 → 27.0.0-alpha.0

package/dist/targets/mac/MacTargetHelper.js

@@ -0,0 +1,267 @@
+import { Arch, InvalidConfigurationError, log, statOrNull } from "builder-util";
+import { dynamicImport } from "../../util/dynamicImport.js";
+import * as path from "path";
+import { findIdentity, reportError } from "../../codeSign/mac/macCodeSign.js";
+import { getTemplatePath } from "../../util/pathManager.js";
+export class MacTargetHelper {
+    constructor(packager) {
+        this.packager = packager;
+    }
+    handleNullIdentity() {
+        if (this.packager.forceCodeSigning) {
+            throw new InvalidConfigurationError("identity explicitly is set to null, but forceCodeSigning is set to true");
+        }
+        log.info({ reason: "identity explicitly is set to null" }, "skipped macOS code signing");
+        return false;
+    }
+    async findSigningIdentity(isMas, isDevelopment, qualifier, keychainFile, config) {
+        const certificateTypes = MacTargetHelper.getCertificateTypes(isMas, isDevelopment);
+        let identity = null;
+        for (const certificateType of certificateTypes) {
+            identity = await findIdentity(certificateType, qualifier, keychainFile);
+            if (identity != null) {
+                break;
+            }
+        }
+        if (identity == null) {
+            if (!isMas && !isDevelopment && config.type !== "distribution") {
+                identity = await findIdentity("Mac Developer", qualifier, keychainFile);
+                if (identity != null) {
+                    log.warn("Mac Developer is used to sign app — it is only for development and testing, not for production");
+                }
+            }
+            const noIdentity = !config.sign && identity == null;
+            if (qualifier === "-") {
+                if (MacTargetHelper.isHardenedRuntimeEnabledForSigning(isMas, config)) {
+                    log.warn(null, "ad-hoc signing with hardenedRuntime enabled requires the com.apple.security.cs.disable-library-validation entitlement " +
+                        "to prevent app launch failures due to library validation. See https://electron.build/code-signing for details.");
+                }
+                const { Identity: IdentityClass } = await dynamicImport("@electron/osx-sign/dist/cjs/util-identities");
+                identity = new IdentityClass("-", undefined);
+            }
+            else if (noIdentity) {
+                await reportError(isMas, certificateTypes, qualifier, keychainFile, this.packager.forceCodeSigning);
+                return null;
+            }
+        }
+        return identity;
+    }
+    async buildSignOptions(appPath, identity, type, isMas, config, keychainFile, arch) {
+        let filter = config.signIgnore;
+        if (Array.isArray(filter)) {
+            if (filter.length == 0) {
+                filter = null;
+            }
+        }
+        else if (filter != null) {
+            filter = filter.length === 0 ? null : [filter];
+        }
+        const filterRe = filter == null
+            ? null
+            : filter.map(it => {
+                try {
+                    return new RegExp(it);
+                }
+                catch (e) {
+                    throw new InvalidConfigurationError(`Invalid regex filter pattern: ${it}. ${e.message}`);
+                }
+            });
+        let binaries = config.binaries || undefined;
+        if (binaries) {
+            // Accept absolute paths for external binaries, else resolve relative paths from the artifact's app Contents path.
+            binaries = (await Promise.all(binaries.flatMap(async (destination) => {
+                const expandedDestination = this.packager.expandArch(destination, arch);
+                return await Promise.all(expandedDestination.map(async (d) => {
+                    if (await statOrNull(d)) {
+                        return d;
+                    }
+                    return path.resolve(appPath, d);
+                }));
+            }))).flat();
+            log.info({ binaries, arch: arch == null ? null : Arch[arch] }, "signing additional user-defined binaries for arch");
+        }
+        return {
+            identityValidation: false,
+            // https://github.com/electron-userland/electron-builder/issues/1699
+            // kext are signed by the chipset manufacturers. You need a special certificate (only available on request) from Apple to be able to sign kext.
+            ignore: (file) => {
+                if (filterRe != null) {
+                    for (const regExp of filterRe) {
+                        if (regExp.test(file)) {
+                            return true;
+                        }
+                    }
+                }
+                return (file.endsWith(".kext") ||
+                    file.startsWith("/Contents/PlugIns", appPath.length) ||
+                    file.includes("/node_modules/puppeteer/.local-chromium") ||
+                    file.includes("/node_modules/playwright-firefox/.local-browsers") ||
+                    file.includes("/node_modules/playwright/.local-browsers"));
+                /* Those are browser automating modules, browser (chromium, nightly) cannot be signed
+                  https://github.com/electron-userland/electron-builder/issues/2010
+                  https://github.com/electron-userland/electron-builder/issues/5383
+                  */
+            },
+            identity: identity ? identity.hash || identity.name : undefined,
+            type,
+            platform: isMas ? "mas" : "darwin",
+            version: this.packager.config.electronVersion || undefined,
+            app: appPath,
+            keychain: keychainFile || undefined,
+            binaries,
+            // https://github.com/electron-userland/electron-builder/issues/1480
+            strictVerify: config.strictVerify,
+            preAutoEntitlements: config.preAutoEntitlements,
+            optionsForFile: await this.getOptionsForFile(appPath, isMas, config),
+            provisioningProfile: config.provisioningProfile || undefined,
+        };
+    }
+    async createMasInstaller(appPath, outDir, masOptions, keychainFile, isDevelopment, arch) {
+        const certType = isDevelopment ? "Mac Developer" : "3rd Party Mac Developer Installer";
+        const masInstallerIdentity = await findIdentity(certType, masOptions.identity, keychainFile);
+        if (masInstallerIdentity == null) {
+            throw new InvalidConfigurationError(`Cannot find valid "${certType}" identity to sign MAS installer, please see https://electron.build/code-signing`);
+        }
+        MacTargetHelper.assertSafePathForCommandUsage(outDir, "output directory");
+        // mas uploaded to AppStore, so, use "-" instead of space for name
+        // path.basename prevents path traversal if a crafted artifactName contains "../../"
+        const artifactName = path.basename(this.packager.expandArtifactNamePattern(masOptions, "pkg", arch));
+        MacTargetHelper.assertSafePathForCommandUsage(artifactName, "artifact name");
+        const artifactPath = path.resolve(outDir, artifactName);
+        await this.packager.doFlat(appPath, artifactPath, masInstallerIdentity, keychainFile);
+        await this.packager.emitArtifactBuildCompleted({
+            file: artifactPath,
+            target: null,
+            arch: Arch.x64,
+            safeArtifactName: this.packager.computeSafeArtifactName(artifactName, "pkg", arch, true, this.packager.platformOptions.defaultArch),
+            packager: this.packager,
+        });
+    }
+    async getOptionsForFile(appPath, isMas, customSignOptions) {
+        const resourceList = await this.packager.resourceList;
+        const entitlementsSuffix = isMas ? "mas" : "mac";
+        const getEntitlements = (filePath) => {
+            if (filePath === appPath) {
+                if (customSignOptions.entitlements) {
+                    return customSignOptions.entitlements;
+                }
+                const p = `entitlements.${entitlementsSuffix}.plist`;
+                if (resourceList.includes(p)) {
+                    return path.join(this.packager.buildResourcesDir, p);
+                }
+                else {
+                    return getTemplatePath("entitlements.mac.plist");
+                }
+            }
+            if (filePath.includes("Library/LoginItems")) {
+                return customSignOptions.entitlementsLoginHelper;
+            }
+            if (customSignOptions.entitlementsInherit) {
+                return customSignOptions.entitlementsInherit;
+            }
+            const p = `entitlements.${entitlementsSuffix}.inherit.plist`;
+            if (resourceList.includes(p)) {
+                return path.join(this.packager.buildResourcesDir, p);
+            }
+            else {
+                return getTemplatePath("entitlements.mac.plist");
+            }
+        };
+        const requirements = isMas || this.packager.platformOptions.requirements == null ? undefined : await this.packager.getResource(this.packager.platformOptions.requirements);
+        // harden by default for mac builds. Only harden mas builds if explicitly true (backward compatibility)
+        const hardenedRuntime = isMas ? customSignOptions.hardenedRuntime === true : customSignOptions.hardenedRuntime !== false;
+        return (filePath) => {
+            const entitlements = getEntitlements(filePath);
+            return {
+                entitlements: entitlements || undefined,
+                hardenedRuntime: hardenedRuntime ?? undefined,
+                timestamp: customSignOptions.timestamp || undefined,
+                requirements: requirements || undefined,
+                additionalArguments: customSignOptions.additionalArguments || [],
+            };
+        };
+    }
+    static getCertificateTypes(isMas, isDevelopment) {
+        if (isDevelopment) {
+            return isMas ? ["Mac Developer", "Apple Development"] : ["Mac Developer", "Developer ID Application"];
+        }
+        return isMas ? ["Apple Distribution", "3rd Party Mac Developer Application"] : ["Developer ID Application"];
+    }
+    static isMasTarget(targetName) {
+        return targetName === "mas" || targetName === "mas-dev";
+    }
+    static getPlatformTypeFromTarget(targetName) {
+        if (targetName === "mas") {
+            return "mas";
+        }
+        if (targetName === "mas-dev") {
+            return "mas-dev";
+        }
+        return "mac";
+    }
+    /**
+     * Returns true when hardened runtime will be active for signing.
+     * For non-MAS builds it defaults to on; for MAS it defaults to off.
+     */
+    static isHardenedRuntimeEnabledForSigning(isMas, config) {
+        return isMas ? config.hardenedRuntime === true : config.hardenedRuntime !== false;
+    }
+    static assertSafePathForCommandUsage(pathValue, description) {
+        if (/[\0\r\n"'`$;&|<>]/.test(pathValue)) {
+            throw new InvalidConfigurationError(`Invalid ${description}: contains unsupported shell-special characters`);
+        }
+    }
+    static getNotarizeOptions(appPath) {
+        const tool = "notarytool";
+        const teamId = process.env.APPLE_TEAM_ID;
+        const appleId = process.env.APPLE_ID;
+        const appleIdPassword = process.env.APPLE_APP_SPECIFIC_PASSWORD;
+        if (appleId || appleIdPassword) {
+            if (!appleId) {
+                throw new InvalidConfigurationError(`APPLE_ID env var needs to be set`);
+            }
+            if (!appleIdPassword) {
+                throw new InvalidConfigurationError(`APPLE_APP_SPECIFIC_PASSWORD env var needs to be set`);
+            }
+            if (!teamId) {
+                throw new InvalidConfigurationError(`APPLE_TEAM_ID env var needs to be set`);
+            }
+            return { tool, appPath, appleId, appleIdPassword, teamId };
+        }
+        const appleApiKey = process.env.APPLE_API_KEY;
+        const appleApiKeyId = process.env.APPLE_API_KEY_ID;
+        const appleApiIssuer = process.env.APPLE_API_ISSUER;
+        if (appleApiKey || appleApiKeyId || appleApiIssuer) {
+            if (!appleApiKey || !appleApiKeyId || !appleApiIssuer) {
+                throw new InvalidConfigurationError(`Env vars APPLE_API_KEY, APPLE_API_KEY_ID and APPLE_API_ISSUER need to be set`);
+            }
+            return { tool, appPath, appleApiKey, appleApiKeyId, appleApiIssuer };
+        }
+        const keychain = process.env.APPLE_KEYCHAIN;
+        const keychainProfile = process.env.APPLE_KEYCHAIN_PROFILE;
+        if (keychainProfile) {
+            let args = { keychainProfile };
+            if (keychain) {
+                args = { ...args, keychain };
+            }
+            return { tool, appPath, ...args };
+        }
+        return undefined;
+    }
+    async notarizeIfProvided(appPath) {
+        const notarizeOptions = this.packager.platformOptions.notarize;
+        if (notarizeOptions === false) {
+            log.info({ reason: "`notarize` options were set explicitly `false`" }, "skipped macOS notarization");
+            return;
+        }
+        const options = MacTargetHelper.getNotarizeOptions(appPath);
+        if (!options) {
+            log.warn({ reason: "`notarize` options were unable to be generated" }, "skipped macOS notarization");
+            return;
+        }
+        const { notarize } = await dynamicImport("@electron/notarize");
+        await notarize(options);
+        log.info(null, "notarization successful");
+    }
+}
+//# sourceMappingURL=MacTargetHelper.js.map

package/dist/targets/mac/MacTargetHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MacTargetHelper.js","sourceRoot":"","sources":["../../../src/targets/mac/MacTargetHelper.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAE3D,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAY,YAAY,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AAGvF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAI3D,MAAM,OAAO,eAAe;IAC1B,YAAoB,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;IAAG,CAAC;IAE7C,kBAAkB;QAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACnC,MAAM,IAAI,yBAAyB,CAAC,yEAAyE,CAAC,CAAA;QAChH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,EAAE,4BAA4B,CAAC,CAAA;QACxF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,KAAc,EACd,aAAsB,EACtB,SAA6B,EAC7B,YAA8B,EAC9B,MAA2C;QAE3C,MAAM,gBAAgB,GAAG,eAAe,CAAC,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;QAElF,IAAI,QAAQ,GAAoB,IAAI,CAAA;QACpC,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC/C,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;YACvE,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAK;YACP,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC/D,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;gBACvE,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrB,GAAG,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAA;gBAC5G,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,CAAA;YACnD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACtB,IAAI,eAAe,CAAC,kCAAkC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,IAAI,CACN,IAAI,EACJ,wHAAwH;wBACtH,gHAAgH,CACnH,CAAA;gBACH,CAAC;gBACD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,aAAa,CAA8D,6CAA6C,CAAC,CAAA;gBACnK,QAAQ,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAC9C,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACtB,MAAM,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;gBACnG,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,QAAkB,EAClB,IAA6B,EAC7B,KAAc,EACd,MAA2C,EAC3C,YAA8B,EAC9B,IAAU;QAEV,IAAI,MAAM,GAAG,MAAM,CAAC,UAAU,CAAA;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,GAAG,IAAI,CAAA;YACf,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,IAAI,IAAI;YACZ,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBACd,IAAI,CAAC;oBACH,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC,CAAA;gBACvB,CAAC;gBAAC,OAAO,CAAM,EAAE,CAAC;oBAChB,MAAM,IAAI,yBAAyB,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC1F,CAAC;YACH,CAAC,CAAC,CAAA;QAER,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAA;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,kHAAkH;YAClH,QAAQ,GAAG,CACT,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAC,WAAW,EAAC,EAAE;gBACnC,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;gBACvE,OAAO,MAAM,OAAO,CAAC,GAAG,CACtB,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,EAAE;oBAChC,IAAI,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;wBACxB,OAAO,CAAC,CAAA;oBACV,CAAC;oBACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;gBACjC,CAAC,CAAC,CACH,CAAA;YACH,CAAC,CAAC,CACH,CACF,CAAC,IAAI,EAAE,CAAA;YACR,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,mDAAmD,CAAC,CAAA;QACrH,CAAC;QAED,OAAO;YACL,kBAAkB,EAAE,KAAK;YACzB,oEAAoE;YACpE,+IAA+I;YAC/I,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvB,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;wBAC9B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACtB,OAAO,IAAI,CAAA;wBACb,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtB,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC;oBACpD,IAAI,CAAC,QAAQ,CAAC,yCAAyC,CAAC;oBACxD,IAAI,CAAC,QAAQ,CAAC,kDAAkD,CAAC;oBACjE,IAAI,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAC1D,CAAA;gBAED;;;oBAGI;YACN,CAAC;YACD,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI;YACJ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;YAClC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,IAAI,SAAS;YAC1D,GAAG,EAAE,OAAO;YACZ,QAAQ,EAAE,YAAY,IAAI,SAAS;YACnC,QAAQ;YACR,oEAAoE;YACpE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,cAAc,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;YACpE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,SAAS;SAC7D,CAAA;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,MAAc,EAAE,UAA4B,EAAE,YAA8B,EAAE,aAAsB,EAAE,IAAU;QACxJ,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,mCAAmC,CAAA;QACtF,MAAM,oBAAoB,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAE5F,IAAI,oBAAoB,IAAI,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CAAC,sBAAsB,QAAQ,kFAAkF,CAAC,CAAA;QACvJ,CAAC;QAED,eAAe,CAAC,6BAA6B,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QAEzE,kEAAkE;QAClE,oFAAoF;QACpF,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;QACpG,eAAe,CAAC,6BAA6B,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QACvD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAA;QACrF,MAAM,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YAC7C,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,IAAI,CAAC,GAAG;YACd,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,WAAW,CAAC;YACnI,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,KAAc,EAAE,iBAAsD;QAC7G,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAA;QACrD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;QAEhD,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAE,EAAE;YAC3C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,IAAI,iBAAiB,CAAC,YAAY,EAAE,CAAC;oBACnC,OAAO,iBAAiB,CAAC,YAAY,CAAA;gBACvC,CAAC;gBACD,MAAM,CAAC,GAAG,gBAAgB,kBAAkB,QAAQ,CAAA;gBACpD,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAA;gBACtD,CAAC;qBAAM,CAAC;oBACN,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAA;gBAClD,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC5C,OAAO,iBAAiB,CAAC,uBAAuB,CAAA;YAClD,CAAC;YAED,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,CAAC;gBAC1C,OAAO,iBAAiB,CAAC,mBAAmB,CAAA;YAC9C,CAAC;YACD,MAAM,CAAC,GAAG,gBAAgB,kBAAkB,gBAAgB,CAAA;YAC5D,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAA;YACtD,CAAC;iBAAM,CAAC;gBACN,OAAO,eAAe,CAAC,wBAAwB,CAAC,CAAA;YAClD,CAAC;QACH,CAAC,CAAA;QAED,MAAM,YAAY,GAAG,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;QAE1K,uGAAuG;QACvG,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,eAAe,KAAK,KAAK,CAAA;QAExH,OAAO,CAAC,QAAgB,EAAsB,EAAE;YAC9C,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;YAC9C,OAAO;gBACL,YAAY,EAAE,YAAY,IAAI,SAAS;gBACvC,eAAe,EAAE,eAAe,IAAI,SAAS;gBAC7C,SAAS,EAAE,iBAAiB,CAAC,SAAS,IAAI,SAAS;gBACnD,YAAY,EAAE,YAAY,IAAI,SAAS;gBACvC,mBAAmB,EAAE,iBAAiB,CAAC,mBAAmB,IAAI,EAAE;aACjE,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,KAAc,EAAE,aAAsB;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAA;QACvG,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;IAC7G,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,UAAkB;QACnC,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,SAAS,CAAA;IACzD,CAAC;IAED,MAAM,CAAC,yBAAyB,CAAC,UAAkB;QACjD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,kCAAkC,CAAC,KAAc,EAAE,MAAoE;QAC5H,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,KAAK,KAAK,CAAA;IACnF,CAAC;IAED,MAAM,CAAC,6BAA6B,CAAC,SAAiB,EAAE,WAAmB;QACzE,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CAAC,WAAW,WAAW,iDAAiD,CAAC,CAAA;QAC9G,CAAC;IACH,CAAC;IAED,MAAM,CAAC,kBAAkB,CAAC,OAAe;QACvC,MAAM,IAAI,GAAG,YAAY,CAAA;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACpC,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAA;QAE/D,IAAI,OAAO,IAAI,eAAe,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,yBAAyB,CAAC,kCAAkC,CAAC,CAAA;YACzE,CAAC;YACD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,yBAAyB,CAAC,qDAAqD,CAAC,CAAA;YAC5F,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,CAAC,CAAA;YAC9E,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;QAC5D,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;QAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;QAClD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;QACnD,IAAI,WAAW,IAAI,aAAa,IAAI,cAAc,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,IAAI,yBAAyB,CAAC,8EAA8E,CAAC,CAAA;YACrH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,CAAA;QACtE,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;QAC3C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;QAC1D,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,IAAI,GAAkC,EAAE,eAAe,EAAE,CAAA;YAC7D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAA;YAC9B,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAA;QACnC,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAA;QAC9D,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gDAAgD,EAAE,EAAE,4BAA4B,CAAC,CAAA;YACpG,OAAM;QACR,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gDAAgD,EAAE,EAAE,4BAA4B,CAAC,CAAA;YACpG,OAAM;QACR,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAsC,oBAAoB,CAAC,CAAA;QACnG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QACvB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;IAC3C,CAAC;CACF","sourcesContent":["import type { NotarizeOptionsNotaryTool, NotaryToolKeychainCredentials } from \"@electron/notarize/lib/types\"\nimport type { PerFileSignOptions, SigningDistributionType, SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport type { Identity } from \"@electron/osx-sign/dist/cjs/util-identities\"\nimport { Arch, InvalidConfigurationError, log, statOrNull } from \"builder-util\"\nimport { dynamicImport } from \"../../util/dynamicImport.js\"\nimport { Nullish } from \"builder-util-runtime\"\nimport * as path from \"path\"\nimport { CertType, findIdentity, reportError } from \"../../codeSign/mac/macCodeSign.js\"\nimport type { MacPackager } from \"../../macPackager.js\"\nimport { MacConfiguration, MasConfiguration } from \"../../options/macOptions.js\"\nimport { getTemplatePath } from \"../../util/pathManager.js\"\n\nexport type PlatformType = \"mas\" | \"mas-dev\" | \"mac\"\n\nexport class MacTargetHelper {\n  constructor(private packager: MacPackager) {}\n\n  handleNullIdentity(): boolean {\n    if (this.packager.forceCodeSigning) {\n      throw new InvalidConfigurationError(\"identity explicitly is set to null, but forceCodeSigning is set to true\")\n    }\n    log.info({ reason: \"identity explicitly is set to null\" }, \"skipped macOS code signing\")\n    return false\n  }\n\n  async findSigningIdentity(\n    isMas: boolean,\n    isDevelopment: boolean,\n    qualifier: string | undefined,\n    keychainFile: string | Nullish,\n    config: MacConfiguration | MasConfiguration\n  ): Promise<Identity | null> {\n    const certificateTypes = MacTargetHelper.getCertificateTypes(isMas, isDevelopment)\n\n    let identity: Identity | null = null\n    for (const certificateType of certificateTypes) {\n      identity = await findIdentity(certificateType, qualifier, keychainFile)\n      if (identity != null) {\n        break\n      }\n    }\n\n    if (identity == null) {\n      if (!isMas && !isDevelopment && config.type !== \"distribution\") {\n        identity = await findIdentity(\"Mac Developer\", qualifier, keychainFile)\n        if (identity != null) {\n          log.warn(\"Mac Developer is used to sign app — it is only for development and testing, not for production\")\n        }\n      }\n\n      const noIdentity = !config.sign && identity == null\n      if (qualifier === \"-\") {\n        if (MacTargetHelper.isHardenedRuntimeEnabledForSigning(isMas, config)) {\n          log.warn(\n            null,\n            \"ad-hoc signing with hardenedRuntime enabled requires the com.apple.security.cs.disable-library-validation entitlement \" +\n              \"to prevent app launch failures due to library validation. See https://electron.build/code-signing for details.\"\n          )\n        }\n        const { Identity: IdentityClass } = await dynamicImport<{ Identity: new (name: string, hash?: string) => Identity }>(\"@electron/osx-sign/dist/cjs/util-identities\")\n        identity = new IdentityClass(\"-\", undefined)\n      } else if (noIdentity) {\n        await reportError(isMas, certificateTypes, qualifier, keychainFile, this.packager.forceCodeSigning)\n        return null\n      }\n    }\n\n    return identity\n  }\n\n  async buildSignOptions(\n    appPath: string,\n    identity: Identity,\n    type: SigningDistributionType,\n    isMas: boolean,\n    config: MacConfiguration | MasConfiguration,\n    keychainFile: string | Nullish,\n    arch: Arch\n  ): Promise<SignOptions> {\n    let filter = config.signIgnore\n    if (Array.isArray(filter)) {\n      if (filter.length == 0) {\n        filter = null\n      }\n    } else if (filter != null) {\n      filter = filter.length === 0 ? null : [filter]\n    }\n\n    const filterRe =\n      filter == null\n        ? null\n        : filter.map(it => {\n            try {\n              return new RegExp(it)\n            } catch (e: any) {\n              throw new InvalidConfigurationError(`Invalid regex filter pattern: ${it}. ${e.message}`)\n            }\n          })\n\n    let binaries = config.binaries || undefined\n    if (binaries) {\n      // Accept absolute paths for external binaries, else resolve relative paths from the artifact's app Contents path.\n      binaries = (\n        await Promise.all(\n          binaries.flatMap(async destination => {\n            const expandedDestination = this.packager.expandArch(destination, arch)\n            return await Promise.all(\n              expandedDestination.map(async d => {\n                if (await statOrNull(d)) {\n                  return d\n                }\n                return path.resolve(appPath, d)\n              })\n            )\n          })\n        )\n      ).flat()\n      log.info({ binaries, arch: arch == null ? null : Arch[arch] }, \"signing additional user-defined binaries for arch\")\n    }\n\n    return {\n      identityValidation: false,\n      // https://github.com/electron-userland/electron-builder/issues/1699\n      // kext are signed by the chipset manufacturers. You need a special certificate (only available on request) from Apple to be able to sign kext.\n      ignore: (file: string) => {\n        if (filterRe != null) {\n          for (const regExp of filterRe) {\n            if (regExp.test(file)) {\n              return true\n            }\n          }\n        }\n        return (\n          file.endsWith(\".kext\") ||\n          file.startsWith(\"/Contents/PlugIns\", appPath.length) ||\n          file.includes(\"/node_modules/puppeteer/.local-chromium\") ||\n          file.includes(\"/node_modules/playwright-firefox/.local-browsers\") ||\n          file.includes(\"/node_modules/playwright/.local-browsers\")\n        )\n\n        /* Those are browser automating modules, browser (chromium, nightly) cannot be signed\n          https://github.com/electron-userland/electron-builder/issues/2010\n          https://github.com/electron-userland/electron-builder/issues/5383\n          */\n      },\n      identity: identity ? identity.hash || identity.name : undefined,\n      type,\n      platform: isMas ? \"mas\" : \"darwin\",\n      version: this.packager.config.electronVersion || undefined,\n      app: appPath,\n      keychain: keychainFile || undefined,\n      binaries,\n      // https://github.com/electron-userland/electron-builder/issues/1480\n      strictVerify: config.strictVerify,\n      preAutoEntitlements: config.preAutoEntitlements,\n      optionsForFile: await this.getOptionsForFile(appPath, isMas, config),\n      provisioningProfile: config.provisioningProfile || undefined,\n    }\n  }\n\n  async createMasInstaller(appPath: string, outDir: string, masOptions: MasConfiguration, keychainFile: string | Nullish, isDevelopment: boolean, arch: Arch): Promise<void> {\n    const certType = isDevelopment ? \"Mac Developer\" : \"3rd Party Mac Developer Installer\"\n    const masInstallerIdentity = await findIdentity(certType, masOptions.identity, keychainFile)\n\n    if (masInstallerIdentity == null) {\n      throw new InvalidConfigurationError(`Cannot find valid \"${certType}\" identity to sign MAS installer, please see https://electron.build/code-signing`)\n    }\n\n    MacTargetHelper.assertSafePathForCommandUsage(outDir, \"output directory\")\n\n    // mas uploaded to AppStore, so, use \"-\" instead of space for name\n    // path.basename prevents path traversal if a crafted artifactName contains \"../../\"\n    const artifactName = path.basename(this.packager.expandArtifactNamePattern(masOptions, \"pkg\", arch))\n    MacTargetHelper.assertSafePathForCommandUsage(artifactName, \"artifact name\")\n    const artifactPath = path.resolve(outDir, artifactName)\n    await this.packager.doFlat(appPath, artifactPath, masInstallerIdentity, keychainFile)\n    await this.packager.emitArtifactBuildCompleted({\n      file: artifactPath,\n      target: null,\n      arch: Arch.x64,\n      safeArtifactName: this.packager.computeSafeArtifactName(artifactName, \"pkg\", arch, true, this.packager.platformOptions.defaultArch),\n      packager: this.packager,\n    })\n  }\n\n  async getOptionsForFile(appPath: string, isMas: boolean, customSignOptions: MacConfiguration | MasConfiguration): Promise<(filePath: string) => PerFileSignOptions> {\n    const resourceList = await this.packager.resourceList\n    const entitlementsSuffix = isMas ? \"mas\" : \"mac\"\n\n    const getEntitlements = (filePath: string) => {\n      if (filePath === appPath) {\n        if (customSignOptions.entitlements) {\n          return customSignOptions.entitlements\n        }\n        const p = `entitlements.${entitlementsSuffix}.plist`\n        if (resourceList.includes(p)) {\n          return path.join(this.packager.buildResourcesDir, p)\n        } else {\n          return getTemplatePath(\"entitlements.mac.plist\")\n        }\n      }\n\n      if (filePath.includes(\"Library/LoginItems\")) {\n        return customSignOptions.entitlementsLoginHelper\n      }\n\n      if (customSignOptions.entitlementsInherit) {\n        return customSignOptions.entitlementsInherit\n      }\n      const p = `entitlements.${entitlementsSuffix}.inherit.plist`\n      if (resourceList.includes(p)) {\n        return path.join(this.packager.buildResourcesDir, p)\n      } else {\n        return getTemplatePath(\"entitlements.mac.plist\")\n      }\n    }\n\n    const requirements = isMas || this.packager.platformOptions.requirements == null ? undefined : await this.packager.getResource(this.packager.platformOptions.requirements)\n\n    // harden by default for mac builds. Only harden mas builds if explicitly true (backward compatibility)\n    const hardenedRuntime = isMas ? customSignOptions.hardenedRuntime === true : customSignOptions.hardenedRuntime !== false\n\n    return (filePath: string): PerFileSignOptions => {\n      const entitlements = getEntitlements(filePath)\n      return {\n        entitlements: entitlements || undefined,\n        hardenedRuntime: hardenedRuntime ?? undefined,\n        timestamp: customSignOptions.timestamp || undefined,\n        requirements: requirements || undefined,\n        additionalArguments: customSignOptions.additionalArguments || [],\n      }\n    }\n  }\n\n  static getCertificateTypes(isMas: boolean, isDevelopment: boolean): CertType[] {\n    if (isDevelopment) {\n      return isMas ? [\"Mac Developer\", \"Apple Development\"] : [\"Mac Developer\", \"Developer ID Application\"]\n    }\n    return isMas ? [\"Apple Distribution\", \"3rd Party Mac Developer Application\"] : [\"Developer ID Application\"]\n  }\n\n  static isMasTarget(targetName: string): boolean {\n    return targetName === \"mas\" || targetName === \"mas-dev\"\n  }\n\n  static getPlatformTypeFromTarget(targetName: string): PlatformType {\n    if (targetName === \"mas\") {\n      return \"mas\"\n    }\n    if (targetName === \"mas-dev\") {\n      return \"mas-dev\"\n    }\n    return \"mac\"\n  }\n\n  /**\n   * Returns true when hardened runtime will be active for signing.\n   * For non-MAS builds it defaults to on; for MAS it defaults to off.\n   */\n  static isHardenedRuntimeEnabledForSigning(isMas: boolean, config: Pick<MacConfiguration | MasConfiguration, \"hardenedRuntime\">): boolean {\n    return isMas ? config.hardenedRuntime === true : config.hardenedRuntime !== false\n  }\n\n  static assertSafePathForCommandUsage(pathValue: string, description: string): void {\n    if (/[\\0\\r\\n\"'`$;&|<>]/.test(pathValue)) {\n      throw new InvalidConfigurationError(`Invalid ${description}: contains unsupported shell-special characters`)\n    }\n  }\n\n  static getNotarizeOptions(appPath: string): NotarizeOptionsNotaryTool | undefined {\n    const tool = \"notarytool\"\n    const teamId = process.env.APPLE_TEAM_ID\n    const appleId = process.env.APPLE_ID\n    const appleIdPassword = process.env.APPLE_APP_SPECIFIC_PASSWORD\n\n    if (appleId || appleIdPassword) {\n      if (!appleId) {\n        throw new InvalidConfigurationError(`APPLE_ID env var needs to be set`)\n      }\n      if (!appleIdPassword) {\n        throw new InvalidConfigurationError(`APPLE_APP_SPECIFIC_PASSWORD env var needs to be set`)\n      }\n      if (!teamId) {\n        throw new InvalidConfigurationError(`APPLE_TEAM_ID env var needs to be set`)\n      }\n      return { tool, appPath, appleId, appleIdPassword, teamId }\n    }\n\n    const appleApiKey = process.env.APPLE_API_KEY\n    const appleApiKeyId = process.env.APPLE_API_KEY_ID\n    const appleApiIssuer = process.env.APPLE_API_ISSUER\n    if (appleApiKey || appleApiKeyId || appleApiIssuer) {\n      if (!appleApiKey || !appleApiKeyId || !appleApiIssuer) {\n        throw new InvalidConfigurationError(`Env vars APPLE_API_KEY, APPLE_API_KEY_ID and APPLE_API_ISSUER need to be set`)\n      }\n      return { tool, appPath, appleApiKey, appleApiKeyId, appleApiIssuer }\n    }\n\n    const keychain = process.env.APPLE_KEYCHAIN\n    const keychainProfile = process.env.APPLE_KEYCHAIN_PROFILE\n    if (keychainProfile) {\n      let args: NotaryToolKeychainCredentials = { keychainProfile }\n      if (keychain) {\n        args = { ...args, keychain }\n      }\n      return { tool, appPath, ...args }\n    }\n\n    return undefined\n  }\n\n  async notarizeIfProvided(appPath: string): Promise<void> {\n    const notarizeOptions = this.packager.platformOptions.notarize\n    if (notarizeOptions === false) {\n      log.info({ reason: \"`notarize` options were set explicitly `false`\" }, \"skipped macOS notarization\")\n      return\n    }\n    const options = MacTargetHelper.getNotarizeOptions(appPath)\n    if (!options) {\n      log.warn({ reason: \"`notarize` options were unable to be generated\" }, \"skipped macOS notarization\")\n      return\n    }\n    const { notarize } = await dynamicImport<typeof import(\"@electron/notarize\")>(\"@electron/notarize\")\n    await notarize(options)\n    log.info(null, \"notarization successful\")\n  }\n}\n"]}

package/dist/targets/mac/pkg.d.ts

@@ -0,0 +1,31 @@
+import { Arch } from "builder-util";
+import { Nullish } from "builder-util-runtime";
+import type { Identity } from "../../codeSign/mac/macCodeSign.js";
+import { Target } from "../../core.js";
+import { MacPackager } from "../../macPackager.js";
+import { PkgOptions } from "../../options/pkgOptions.js";
+export declare class PkgTarget extends Target {
+    private readonly packager;
+    readonly outDir: string;
+    readonly options: PkgOptions;
+    constructor(packager: MacPackager, outDir: string);
+    build(appPath: string, arch: Arch): Promise<any>;
+    private getExtraPackages;
+    private customizeDistributionConfiguration;
+    private buildComponentPackage;
+}
+export declare function prepareProductBuildArgs(identity: Identity | null, keychain: string | Nullish): Array<string>;
+/**
+ * Resolves the version string to pass as `--version` to pkgbuild.
+ * Reads CFBundleShortVersionString from the app bundle's Info.plist (what pkgbuild
+ * previously inferred automatically), falling back to the appInfo version.
+ */
+export declare function resolvePkgBuildVersion(appPath: string, fallback: string): Promise<string>;
+/**
+ * Resolves the scripts directory path for pkgbuild.
+ * Returns null when scripts is explicitly set to null (disabled).
+ * Returns a custom path when scripts is a non-empty string.
+ * Falls back to the default "pkg-scripts" directory otherwise.
+ */
+export declare function resolveScriptsDir(buildResourcesDir: string, scripts: string | null | undefined): string | null;
+//# sourceMappingURL=pkg.d.ts.map

package/dist/targets/mac/pkg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkg.d.ts","sourceRoot":"","sources":["../../../src/targets/mac/pkg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgC,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAM9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AA+BxD,qBAAa,SAAU,SAAQ,MAAM;IAIjC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;gBAGT,QAAQ,EAAE,WAAW,EAC7B,MAAM,EAAE,MAAM;IAWnB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;IA0DtD,OAAO,CAAC,gBAAgB;YAuBV,kCAAkC;YAiFlC,qBAAqB;CAgEpC;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAS5G;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAK9G"}

package/dist/targets/mac/pkg.js

@@ -0,0 +1,271 @@
+import { Arch, debug, exec, statOrNull, use } from "builder-util";
+import { readdirSync } from "fs";
+import { readFile, unlink, writeFile } from "fs/promises";
+import * as path from "path";
+import { filterCFBundleIdentifier } from "../../appInfo.js";
+import { findIdentity } from "../../codeSign/mac/macCodeSign.js";
+import { Target } from "../../core.js";
+import { savePlistFile, parsePlistFile } from "../../util/mac/plist.js";
+import { getNotLocalizedLicenseFile } from "../../util/license.js";
+const certType = "Developer ID Installer";
+// Maps electron-builder Arch to Apple's architecture names for productbuild requirements plist
+function archToAppleArchitectures(arch) {
+    switch (arch) {
+        case Arch.arm64:
+            return ["arm64"];
+        case Arch.x64:
+            return ["x86_64"];
+        case Arch.universal:
+            return ["arm64", "x86_64"];
+        case Arch.ia32:
+            return ["i386"];
+        default:
+            return ["arm64", "x86_64"];
+    }
+}
+// http://www.shanekirk.com/2013/10/creating-flat-packages-in-osx/
+// to use --scripts, we must build .app bundle separately using pkgbuild
+// productbuild --scripts doesn't work (because scripts in this case not added to our package)
+// https://github.com/electron-userland/@electron/osx-sign/issues/96#issuecomment-274986942
+export class PkgTarget extends Target {
+    constructor(packager, outDir) {
+        super("pkg");
+        this.packager = packager;
+        this.outDir = outDir;
+        this.options = {
+            allowAnywhere: true,
+            allowCurrentUserHome: true,
+            allowRootDirectory: true,
+            ...this.packager.config.pkg,
+        };
+    }
+    async build(appPath, arch) {
+        const packager = this.packager;
+        const options = this.options;
+        const appInfo = packager.appInfo;
+        // pkg doesn't like not ASCII symbols (Could not open package to list files: /Volumes/test/t-gIjdGK/test-project-0/dist/Test App ßW-1.1.0.pkg)
+        const artifactName = packager.expandArtifactNamePattern(options, "pkg", arch);
+        const artifactPath = path.join(this.outDir, artifactName);
+        await packager.emitArtifactBuildStarted({
+            targetPresentableName: "pkg",
+            file: artifactPath,
+            arch,
+        });
+        const keychainFile = (await packager.codeSigningInfo.value).keychainFile;
+        const appOutDir = this.outDir;
+        // https://developer.apple.com/library/content/documentation/DeveloperTools/Reference/DistributionDefinitionRef/Chapters/Distribution_XML_Ref.html
+        const distInfoFile = path.join(appOutDir, "distribution.xml");
+        const extraPackages = this.getExtraPackages();
+        const innerPackageFile = path.join(appOutDir, `${filterCFBundleIdentifier(appInfo.id)}.pkg`);
+        const componentPropertyListFile = path.join(appOutDir, `${filterCFBundleIdentifier(appInfo.id)}.plist`);
+        const identity = (await Promise.all([
+            findIdentity(certType, options.identity || packager.platformOptions.identity, keychainFile),
+            this.customizeDistributionConfiguration(distInfoFile, appPath, extraPackages, arch),
+            this.buildComponentPackage(appPath, componentPropertyListFile, innerPackageFile),
+        ]))[0];
+        if (identity == null && packager.forceCodeSigning) {
+            throw new Error(`Cannot find valid "${certType}" to sign standalone installer, please see https://electron.build/code-signing`);
+        }
+        const args = prepareProductBuildArgs(identity, keychainFile);
+        args.push("--distribution", distInfoFile);
+        if (extraPackages) {
+            args.push("--package-path", extraPackages.packagePath);
+        }
+        args.push(artifactPath);
+        use(options.productbuild, it => args.push(...it));
+        await exec("productbuild", args, {
+            cwd: appOutDir,
+        });
+        await Promise.all([unlink(innerPackageFile), unlink(distInfoFile)]);
+        await packager.helper.notarizeIfProvided(artifactPath);
+        await packager.emitArtifactBuildCompleted({
+            file: artifactPath,
+            target: this,
+            arch,
+            safeArtifactName: packager.computeSafeArtifactName(artifactName, "pkg", arch),
+            packager,
+        });
+    }
+    getExtraPackages() {
+        const extraPkgsDir = this.options.extraPkgsDir;
+        if (extraPkgsDir == null) {
+            return null;
+        }
+        const packagePath = path.join(this.packager.buildResourcesDir, extraPkgsDir);
+        let files;
+        try {
+            files = readdirSync(packagePath);
+        }
+        catch (e) {
+            if (e.code === "ENOENT") {
+                return null;
+            }
+            else {
+                throw e;
+            }
+        }
+        const packages = files.filter(file => file.endsWith(".pkg"));
+        if (packages.length === 0) {
+            return null;
+        }
+        return { packagePath, packages };
+    }
+    async customizeDistributionConfiguration(distInfoFile, appPath, extraPackages, arch) {
+        const options = this.options;
+        // Build requirements plist for productbuild to generate correct hostArchitectures and allowed-os-versions
+        // This is the Apple-recommended way to specify architecture and OS requirements
+        // See: man productbuild, section "PRE-INSTALL REQUIREMENTS PROPERTY LIST"
+        const requirements = {};
+        // Set architecture based on build target - productbuild will generate correct hostArchitectures in distribution XML
+        // On macOS Big Sur+, productbuild defaults to both arm64 and x86_64 unless we specify otherwise
+        requirements.arch = archToAppleArchitectures(arch);
+        // Set minimum OS version - productbuild will generate allowed-os-versions in distribution XML
+        const minimumSystemVersion = this.packager.platformOptions.minimumSystemVersion;
+        if (minimumSystemVersion != null) {
+            requirements.os = [minimumSystemVersion];
+        }
+        const requirementsPlistFile = await this.packager.tempDirManager.getTempFile({ suffix: ".plist", prefix: "productbuild-requirements" });
+        await savePlistFile(requirementsPlistFile, requirements);
+        const args = ["--synthesize", "--product", requirementsPlistFile, "--component", appPath];
+        if (extraPackages) {
+            extraPackages.packages.forEach(pkg => {
+                args.push("--package", path.join(extraPackages.packagePath, pkg));
+            });
+        }
+        args.push(distInfoFile);
+        await exec("productbuild", args, {
+            cwd: this.outDir,
+        });
+        let distInfo = await readFile(distInfoFile, "utf-8");
+        if (options.mustClose != null && options.mustClose.length !== 0) {
+            const startContent = `    <pkg-ref id="${this.packager.appInfo.id}">\n        <must-close>\n`;
+            const endContent = "        </must-close>\n    </pkg-ref>\n</installer-gui-script>";
+            let mustCloseContent = "";
+            options.mustClose.forEach(appId => {
+                mustCloseContent += `            <app id="${appId}"/>\n`;
+            });
+            distInfo = distInfo.replace("</installer-gui-script>", `${startContent}${mustCloseContent}${endContent}`);
+        }
+        const insertIndex = distInfo.lastIndexOf("</installer-gui-script>");
+        distInfo =
+            distInfo.substring(0, insertIndex) +
+                `    <domains enable_anywhere="${options.allowAnywhere}" enable_currentUserHome="${options.allowCurrentUserHome}" enable_localSystem="${options.allowRootDirectory}" />\n` +
+                distInfo.substring(insertIndex);
+        if (options.background != null) {
+            const background = await this.packager.getResource(options.background.file);
+            if (background != null) {
+                const alignment = options.background.alignment || "center";
+                // noinspection SpellCheckingInspection
+                const scaling = options.background.scaling || "tofit";
+                distInfo = distInfo.substring(0, insertIndex) + `    <background file="${background}" alignment="${alignment}" scaling="${scaling}"/>\n` + distInfo.substring(insertIndex);
+                distInfo =
+                    distInfo.substring(0, insertIndex) + `    <background-darkAqua file="${background}" alignment="${alignment}" scaling="${scaling}"/>\n` + distInfo.substring(insertIndex);
+            }
+        }
+        const welcome = await this.packager.getResource(options.welcome);
+        if (welcome != null) {
+            distInfo = distInfo.substring(0, insertIndex) + `    <welcome file="${welcome}"/>\n` + distInfo.substring(insertIndex);
+        }
+        const license = await getNotLocalizedLicenseFile(options.license, this.packager);
+        if (license != null) {
+            distInfo = distInfo.substring(0, insertIndex) + `    <license file="${license}"/>\n` + distInfo.substring(insertIndex);
+        }
+        const conclusion = await this.packager.getResource(options.conclusion);
+        if (conclusion != null) {
+            distInfo = distInfo.substring(0, insertIndex) + `    <conclusion file="${conclusion}"/>\n` + distInfo.substring(insertIndex);
+        }
+        debug(distInfo);
+        await writeFile(distInfoFile, distInfo);
+    }
+    async buildComponentPackage(appPath, propertyListOutputFile, packageOutputFile) {
+        const options = this.options;
+        const rootPath = path.dirname(appPath);
+        // first produce a component plist template
+        await exec("pkgbuild", ["--analyze", "--root", rootPath, propertyListOutputFile]);
+        // process the template plist
+        const plistInfo = (await parsePlistFile(propertyListOutputFile)).filter((it) => it.RootRelativeBundlePath !== "Electron.dSYM");
+        let packageInfo = {};
+        if (plistInfo.length > 0) {
+            packageInfo = plistInfo[0];
+            // ChildBundles lists all of electron binaries within the .app.
+            // There is no particular reason for removing that key, except to be as close as possible to
+            // the PackageInfo generated by previous versions of electron-builder.
+            delete packageInfo.ChildBundles;
+            if (options.isRelocatable != null) {
+                packageInfo.BundleIsRelocatable = options.isRelocatable;
+            }
+            if (options.isVersionChecked != null) {
+                packageInfo.BundleIsVersionChecked = options.isVersionChecked;
+            }
+            if (options.hasStrictIdentifier != null) {
+                packageInfo.BundleHasStrictIdentifier = options.hasStrictIdentifier;
+            }
+            if (options.overwriteAction != null) {
+                packageInfo.BundleOverwriteAction = options.overwriteAction;
+            }
+        }
+        // now build the package
+        const args = ["--root", rootPath, "--identifier", this.packager.appInfo.id, "--component-plist", propertyListOutputFile];
+        use(this.options.installLocation || "/Applications", it => args.push("--install-location", it));
+        // Pass the version explicitly — macOS 15+ pkgbuild no longer infers it from the bundle
+        const pkgVersion = await resolvePkgBuildVersion(appPath, this.packager.appInfo.version);
+        args.push("--version", pkgVersion);
+        const scriptsDir = resolveScriptsDir(this.packager.buildResourcesDir, options.scripts);
+        if (scriptsDir && (await statOrNull(scriptsDir))?.isDirectory()) {
+            const dirContents = readdirSync(scriptsDir);
+            dirContents.forEach(name => {
+                if (name.includes("preinstall")) {
+                    packageInfo.BundlePreInstallScriptPath = name;
+                }
+                else if (name.includes("postinstall")) {
+                    packageInfo.BundlePostInstallScriptPath = name;
+                }
+            });
+            args.push("--scripts", scriptsDir);
+        }
+        if (plistInfo.length > 0) {
+            await savePlistFile(propertyListOutputFile, plistInfo);
+        }
+        args.push(packageOutputFile);
+        await exec("pkgbuild", args);
+    }
+}
+export function prepareProductBuildArgs(identity, keychain) {
+    const args = [];
+    if (identity != null) {
+        args.push("--sign", identity.hash);
+        if (keychain != null) {
+            args.push("--keychain", keychain);
+        }
+    }
+    return args;
+}
+/**
+ * Resolves the version string to pass as `--version` to pkgbuild.
+ * Reads CFBundleShortVersionString from the app bundle's Info.plist (what pkgbuild
+ * previously inferred automatically), falling back to the appInfo version.
+ */
+export async function resolvePkgBuildVersion(appPath, fallback) {
+    const infoPlistPath = path.join(appPath, "Contents", "Info.plist");
+    try {
+        const plist = await parsePlistFile(infoPlistPath);
+        const version = plist.CFBundleShortVersionString;
+        return typeof version === "string" && version.length > 0 ? version : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+/**
+ * Resolves the scripts directory path for pkgbuild.
+ * Returns null when scripts is explicitly set to null (disabled).
+ * Returns a custom path when scripts is a non-empty string.
+ * Falls back to the default "pkg-scripts" directory otherwise.
+ */
+export function resolveScriptsDir(buildResourcesDir, scripts) {
+    if (scripts === null) {
+        return null;
+    }
+    return scripts != null ? path.resolve(buildResourcesDir, scripts) : path.join(buildResourcesDir, "pkg-scripts");
+}
+//# sourceMappingURL=pkg.js.map