app-builder-lib 27.0.0-alpha.2 → 27.0.0-alpha.4

package/dist/codeSign/mac/macCodeSign.js.map

@@ -1 +1 @@
-{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../../src/codeSign/mac/macCodeSign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAU,yBAAyB,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAU,cAAc,EAAE,MAAM,cAAc,CAAA;AAE5J,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AACpC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,MAAM,UAAU,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,MAAM,iBAAiB,GACrB,kKAAkK;YAClK,6LAA6L,CAAA;QAE/L,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,GAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,gBAA4B,EAAE,SAA2B,EAAE,YAA8B,EAAE,kBAA2B;IACtK,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,+BAA+B,EAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,+BAA+B,EAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAA;IAC5D,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,IAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KACxJ,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChB,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1H,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,CAAsC,oBAAoB,CAAC,CAAA;IACpG,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,IAAI,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,qBAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB;YAClC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACX,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;iBAChB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBACb,MAAM,CACL,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CACvK;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,qBAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,aAAa,CAA8D,6CAA6C,CAAC,CAAA;IACnK,OAAO,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import type { SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport { copyFile, exec, Fields, InvalidConfigurationError, isEmptyOrSpaces, isPullRequest, log, Logger, retry, TmpDir, unlinkIfExists } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { createHash, randomBytes } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { dynamicImport } from \"../../util/dynamicImport.js\"\nimport { isAutoDiscoveryCodeSignIdentity, isCscForPullRequest, isTravis } from \"../../util/flags.js\"\nimport { importCertificate } from \"../codesign.js\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  if (isPullRequest()) {\n    const buildForPrWarning =\n      \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n      \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n    if (isCscForPullRequest()) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n\n  return true\n}\n\nexport async function reportError(isMas: boolean, certificateTypes: CertType[], qualifier: string | Nullish, keychainFile: string | Nullish, isForceCodeSigning: boolean) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  const skipMessage = \"skipped macOS application code signing\"\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(skipMessage, logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, skipMessage)\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(import.meta.dirname, \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (!isTravis()) {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  // Import all certs in parallel, then run security commands sequentially.\n  await Promise.all(certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))))\n  for (const cmd of securityCommands) {\n    await exec(\"/usr/bin/security\", cmd)\n  }\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i] ?? \"\"\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  const { signAsync } = await dynamicImport<typeof import(\"@electron/osx-sign\")>(\"@electron/osx-sign\")\n  return retry(() => signAsync(opts), {\n    retries: 3,\n    interval: 5000,\n    backoff: 5000,\n  })\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    result = Promise.all<Array<string>>([\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]).then(it => {\n      const array = it[0]\n        .concat(it[1])\n        .filter(\n          it => !it.includes(\"(Missing required extension)\") && !it.includes(\"valid identities found\") && !it.includes(\"iPhone \") && !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return await parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return await parseIdentity(line)\n    }\n  }\n  return null\n}\n\nexport declare class Identity {\n  readonly name: string\n  readonly hash?: string\n\n  constructor(name: string, hash?: string)\n}\n\nasync function parseIdentity(line: string): Promise<Identity> {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  const { Identity: IdentityClass } = await dynamicImport<{ Identity: new (name: string, hash?: string) => Identity }>(\"@electron/osx-sign/dist/cjs/util-identities\")\n  return new IdentityClass(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}
+{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../../src/codeSign/mac/macCodeSign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,IAAI,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAU,yBAAyB,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAU,cAAc,EAAE,MAAM,cAAc,CAAA;AAE5J,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AACpC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,MAAM,UAAU,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,MAAM,iBAAiB,GACrB,kKAAkK;YAClK,6LAA6L,CAAA;QAE/L,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,GAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,gBAA4B,EAAE,SAA2B,EAAE,YAA8B,EAAE,kBAA2B;IACtK,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,+BAA+B,EAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,+BAA+B,EAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAA;IAC5D,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,IAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KAC9J,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChB,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1H,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;QAC9B,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,IAAI,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,4GAA4G;AAC5G,uGAAuG;AACvG,sGAAsG;AACtG,2GAA2G;AAC3G,IAAI,gCAAgC,GAAG,KAAK,CAAA;AAE5C,wHAAwH;AACxH,MAAM,UAAU,6CAA6C,CAAC,KAAc;IAC1E,gCAAgC,GAAG,KAAK,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,qBAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,QAAQ,GAAG;YACf,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAA;QAED,yGAAyG;QACzG,wGAAwG;QACxG,IAAI,gCAAgC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC5G,CAAC;QAED,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACtD,MAAM,KAAK,GAAG,EAAE;iBACb,IAAI,EAAE;iBACN,MAAM,CACL,EAAE,CAAC,EAAE,CACH,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;gBAC5C,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAChC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACnC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACnC,CAAC,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBACrC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACvB,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAC9C;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,qBAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,wIAAwI;AACxI,MAAM,OAAO,QAAQ;IACnB,YACW,IAAY,EACZ,IAAa;QADb,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAS;IACrB,CAAC;CACL;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import type { SignOptions } from \"@electron/osx-sign\"\nimport { sign as _sign } from \"@electron/osx-sign\"\nimport { copyFile, exec, Fields, InvalidConfigurationError, isEmptyOrSpaces, isPullRequest, log, Logger, retry, TmpDir, unlinkIfExists } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { createHash, randomBytes } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { isAutoDiscoveryCodeSignIdentity, isCscForPullRequest, isTravis } from \"../../util/flags.js\"\nimport { importCertificate } from \"../codesign.js\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  if (isPullRequest()) {\n    const buildForPrWarning =\n      \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n      \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n    if (isCscForPullRequest()) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n\n  return true\n}\n\nexport async function reportError(isMas: boolean, certificateTypes: CertType[], qualifier: string | Nullish, keychainFile: string | Nullish, isForceCodeSigning: boolean) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  const skipMessage = \"skipped macOS application code signing\"\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(skipMessage, logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, skipMessage)\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(import.meta.dirname, \"..\", \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (!isTravis()) {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  // Import all certs in parallel, then run security commands sequentially.\n  await Promise.all(certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))))\n  for (const cmd of securityCommands) {\n    await exec(\"/usr/bin/security\", cmd)\n  }\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i] ?? \"\"\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  return retry(() => _sign(opts), {\n    retries: 3,\n    interval: 5000,\n    backoff: 5000,\n  })\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\n// Discovery of untrusted self-signed identities is OFF in production, and there is intentionally NO env var\n// or build-config option to enable it: an untrusted identity must never be silently accepted in a real\n// build. This in-process flag exists solely as a seam for electron-builder's own signing tests, which\n// provision an ephemeral self-signed cert and flip it via setAllowUntrustedSelfSignedIdentityForTesting().\nlet allowUntrustedSelfSignedIdentity = false\n\n/** @internal Test-only. Enables discovery of untrusted self-signed code-signing identities. Never use in production. */\nexport function setAllowUntrustedSelfSignedIdentityForTesting(value: boolean): void {\n  allowUntrustedSelfSignedIdentity = value\n}\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    const commands = [\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]\n\n    // Test-only seam: also accept untrusted self-signed identities. `find-identity` without `-v` lists them;\n    // trusted identities discovered above still take precedence (they appear first and dupes are de-duped).\n    if (allowUntrustedSelfSignedIdentity) {\n      commands.push(exec(\"/usr/bin/security\", addKeychain([\"find-identity\"])).then(it => it.trim().split(\"\\n\")))\n    }\n\n    result = Promise.all<Array<string>>(commands).then(it => {\n      const array = it\n        .flat()\n        .filter(\n          it =>\n            !it.includes(\"(Missing required extension)\") &&\n            !it.includes(\"identities found\") &&\n            !it.includes(\"Policy: X.509 Basic\") &&\n            !it.includes(\"Matching identities\") &&\n            !it.includes(\"Valid identities only\") &&\n            !it.includes(\"iPhone \") &&\n            !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return parseIdentity(line)\n    }\n  }\n  return null\n}\n\n// @electron/osx-sign v2 no longer exposes its `Identity` class via the package's public exports, so we own this lightweight equivalent.\nexport class Identity {\n  constructor(\n    readonly name: string,\n    readonly hash?: string\n  ) {}\n}\n\nfunction parseIdentity(line: string): Identity {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  return new Identity(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}

package/dist/codeSign/win/hsmSignManager.d.ts

@@ -0,0 +1,10 @@
+import { VmManager } from "../../vm/vm.js";
+import type { WinPackager } from "../../winPackager.js";
+import { CustomWindowsSign, SigntoolBaseSignManager, WindowsSignTaskConfiguration } from "./signtoolBaseSignManager.js";
+export declare class HsmSignManager extends SigntoolBaseSignManager {
+    constructor(packager: WinPackager);
+    protected handleNullCscInfo(customSign: CustomWindowsSign | string | null | undefined): boolean;
+    protected computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>;
+    protected computeOsslsigncodeArgs(_options: WindowsSignTaskConfiguration, _vm: VmManager): Array<string>;
+}
+//# sourceMappingURL=hsmSignManager.d.ts.map

package/dist/codeSign/win/hsmSignManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsmSignManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/hsmSignManager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAA2B,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAA;AAEhJ,qBAAa,cAAe,SAAQ,uBAAuB;gBAC7C,QAAQ,EAAE,WAAW;cAQd,iBAAiB,CAAC,UAAU,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAOxG,SAAS,CAAC,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAsCrG,SAAS,CAAC,uBAAuB,CAAC,QAAQ,EAAE,4BAA4B,EAAE,GAAG,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;CAKzG"}

package/dist/codeSign/win/hsmSignManager.js

@@ -0,0 +1,50 @@
+import { InvalidConfigurationError } from "builder-util";
+import { resolveWindowsSigningConfiguration } from "../../options/winOptions.js";
+import { getSigntoolFamilyConfig, SigntoolBaseSignManager } from "./signtoolBaseSignManager.js";
+export class HsmSignManager extends SigntoolBaseSignManager {
+    constructor(packager) {
+        super(packager);
+        if (resolveWindowsSigningConfiguration(packager.platformOptions)?.type !== "hsm") {
+            throw new Error(`HsmSignManager requires signing.type = "hsm"`);
+        }
+    }
+    // HSM requires a certificate identifier; throw rather than silently skip.
+    handleNullCscInfo(customSign) {
+        if (!customSign) {
+            throw new InvalidConfigurationError("HSM signing requires a certificate identifier. Provide certificateFile (e.g. a .crt/.pfx), certificateSha1, or certificateSubjectName.");
+        }
+        return false;
+    }
+    computeWindowsSignArgs(options, vm) {
+        if (this.isLegacyToolset()) {
+            throw new InvalidConfigurationError("HSM signing requires winCodeSign toolset 1.x or later. " + 'Set toolsets.winCodeSign to "1.0.0" or "1.1.0" in your electron-builder configuration.');
+        }
+        const signing = getSigntoolFamilyConfig(options.options);
+        const inputFile = vm.toVmFile(options.path);
+        const args = ["sign"];
+        // Timestamping
+        if (process.env.ELECTRON_BUILDER_OFFLINE !== "true") {
+            const isRfc3161 = options.isNest || options.hash === "sha256";
+            args.push(isRfc3161 ? "/tr" : "/t");
+            args.push(isRfc3161 ? signing.rfc3161TimeStampServer || "http://timestamp.digicert.com" : signing.timeStampServer || "http://timestamp.digicert.com");
+        }
+        // .crt/.cer allowed: public chain only, private key lives in the HSM.
+        this.addCertificateArgs(args, options, vm, true, true);
+        // HSM: /csp and /kc immediately after certificate identification
+        args.push("/csp", signing.cryptoServiceProvider);
+        args.push("/kc", signing.keyContainer);
+        // Modern toolset always requires /fd; no sha1 dual-sign path for HSM
+        args.push("/fd", options.hash.toLowerCase());
+        if (process.env.ELECTRON_BUILDER_OFFLINE !== "true" && (options.isNest || options.hash === "sha256")) {
+            args.push("/td", "sha256");
+        }
+        this.addCommonSigningArgs(args, options, vm, true);
+        args.push("/debug");
+        args.push(inputFile);
+        return args;
+    }
+    computeOsslsigncodeArgs(_options, _vm) {
+        throw new InvalidConfigurationError("HSM signing via cryptoServiceProvider/keyContainer is only supported on Windows (signtool.exe). " + 'For macOS/Linux, use type: "pkcs11" instead.');
+    }
+}
+//# sourceMappingURL=hsmSignManager.js.map

package/dist/codeSign/win/hsmSignManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hsmSignManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/hsmSignManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,EAAE,kCAAkC,EAA2B,MAAM,6BAA6B,CAAA;AAGzG,OAAO,EAAqB,uBAAuB,EAAE,uBAAuB,EAAgC,MAAM,8BAA8B,CAAA;AAEhJ,MAAM,OAAO,cAAe,SAAQ,uBAAuB;IACzD,YAAY,QAAqB;QAC/B,KAAK,CAAC,QAAQ,CAAC,CAAA;QACf,IAAI,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,0EAA0E;IACvD,iBAAiB,CAAC,UAAyD;QAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAyB,CAAC,wIAAwI,CAAC,CAAA;QAC/K,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAES,sBAAsB,CAAC,OAAqC,EAAE,EAAa;QACnF,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CACjC,yDAAyD,GAAG,wFAAwF,CACrJ,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAA4B,CAAA;QACnF,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAErB,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACnC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,IAAI,+BAA+B,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,IAAI,+BAA+B,CAAC,CAAA;QACvJ,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAEtD,iEAAiE;QACjE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAEtC,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACrG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAC5B,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAEpB,OAAO,IAAI,CAAA;IACb,CAAC;IAES,uBAAuB,CAAC,QAAsC,EAAE,GAAc;QACtF,MAAM,IAAI,yBAAyB,CACjC,kGAAkG,GAAG,8CAA8C,CACpJ,CAAA;IACH,CAAC;CACF","sourcesContent":["import { InvalidConfigurationError } from \"builder-util\"\nimport { resolveWindowsSigningConfiguration, WindowsHsmSigningConfig } from \"../../options/winOptions.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport type { WinPackager } from \"../../winPackager.js\"\nimport { CustomWindowsSign, getSigntoolFamilyConfig, SigntoolBaseSignManager, WindowsSignTaskConfiguration } from \"./signtoolBaseSignManager.js\"\n\nexport class HsmSignManager extends SigntoolBaseSignManager {\n  constructor(packager: WinPackager) {\n    super(packager)\n    if (resolveWindowsSigningConfiguration(packager.platformOptions)?.type !== \"hsm\") {\n      throw new Error(`HsmSignManager requires signing.type = \"hsm\"`)\n    }\n  }\n\n  // HSM requires a certificate identifier; throw rather than silently skip.\n  protected override handleNullCscInfo(customSign: CustomWindowsSign | string | null | undefined): boolean {\n    if (!customSign) {\n      throw new InvalidConfigurationError(\"HSM signing requires a certificate identifier. Provide certificateFile (e.g. a .crt/.pfx), certificateSha1, or certificateSubjectName.\")\n    }\n    return false\n  }\n\n  protected computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    if (this.isLegacyToolset()) {\n      throw new InvalidConfigurationError(\n        \"HSM signing requires winCodeSign toolset 1.x or later. \" + 'Set toolsets.winCodeSign to \"1.0.0\" or \"1.1.0\" in your electron-builder configuration.'\n      )\n    }\n\n    const signing = getSigntoolFamilyConfig(options.options) as WindowsHsmSigningConfig\n    const inputFile = vm.toVmFile(options.path)\n    const args = [\"sign\"]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const isRfc3161 = options.isNest || options.hash === \"sha256\"\n      args.push(isRfc3161 ? \"/tr\" : \"/t\")\n      args.push(isRfc3161 ? signing.rfc3161TimeStampServer || \"http://timestamp.digicert.com\" : signing.timeStampServer || \"http://timestamp.digicert.com\")\n    }\n\n    // .crt/.cer allowed: public chain only, private key lives in the HSM.\n    this.addCertificateArgs(args, options, vm, true, true)\n\n    // HSM: /csp and /kc immediately after certificate identification\n    args.push(\"/csp\", signing.cryptoServiceProvider)\n    args.push(\"/kc\", signing.keyContainer)\n\n    // Modern toolset always requires /fd; no sha1 dual-sign path for HSM\n    args.push(\"/fd\", options.hash.toLowerCase())\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\" && (options.isNest || options.hash === \"sha256\")) {\n      args.push(\"/td\", \"sha256\")\n    }\n\n    this.addCommonSigningArgs(args, options, vm, true)\n    args.push(\"/debug\")\n    args.push(inputFile)\n\n    return args\n  }\n\n  protected computeOsslsigncodeArgs(_options: WindowsSignTaskConfiguration, _vm: VmManager): Array<string> {\n    throw new InvalidConfigurationError(\n      \"HSM signing via cryptoServiceProvider/keyContainer is only supported on Windows (signtool.exe). \" + 'For macOS/Linux, use type: \"pkcs11\" instead.'\n    )\n  }\n}\n"]}

package/dist/codeSign/win/pkcs11SignManager.d.ts

@@ -0,0 +1,14 @@
+import { MemoLazy } from "builder-util-runtime";
+import { WindowsConfiguration } from "../../options/winOptions.js";
+import { VmManager } from "../../vm/vm.js";
+import type { WinPackager } from "../../winPackager.js";
+import { CustomWindowsSign, CertificateFromStoreInfo, FileCodeSigningInfo, SigntoolBaseSignManager, WindowsSignTaskConfiguration } from "./signtoolBaseSignManager.js";
+export declare class Pkcs11SignManager extends SigntoolBaseSignManager {
+    private readonly signingConfig;
+    constructor(packager: WinPackager);
+    readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
+    protected handleNullCscInfo(_customSign: CustomWindowsSign | string | null | undefined): boolean;
+    protected computeWindowsSignArgs(_options: WindowsSignTaskConfiguration, _vm: VmManager): Array<string>;
+    protected computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>;
+}
+//# sourceMappingURL=pkcs11SignManager.d.ts.map

package/dist/codeSign/win/pkcs11SignManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkcs11SignManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/pkcs11SignManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAsC,oBAAoB,EAA8B,MAAM,6BAA6B,CAAA;AAClI,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EAEnB,uBAAuB,EACvB,4BAA4B,EAC7B,MAAM,8BAA8B,CAAA;AAErC,qBAAa,iBAAkB,SAAQ,uBAAuB;IAC5D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4B;gBAE9C,QAAQ,EAAE,WAAW;IAsBjC,SAAkB,OAAO,wFAUxB;cAGkB,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAIzG,SAAS,CAAC,sBAAsB,CAAC,QAAQ,EAAE,4BAA4B,EAAE,GAAG,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAIvG,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;CAmDvG"}

package/dist/codeSign/win/pkcs11SignManager.js

@@ -0,0 +1,82 @@
+import { InvalidConfigurationError } from "builder-util";
+import { MemoLazy } from "builder-util-runtime";
+import { resolveWindowsSigningConfiguration } from "../../options/winOptions.js";
+import { getSigntoolFamilyConfig, SigntoolBaseSignManager, } from "./signtoolBaseSignManager.js";
+export class Pkcs11SignManager extends SigntoolBaseSignManager {
+    constructor(packager) {
+        super(packager);
+        // PKCS#11: key and cert are in the hardware token; cert file is optional (chain only).
+        // When a cert file is supplied, the PIN (if any) is read from WIN_CSC_KEY_PASSWORD / CSC_KEY_PASSWORD.
+        this.cscInfo = new MemoLazy(() => this.platformSpecificBuildOptions, _platformSpecificBuildOptions => {
+            const { certificateFile } = this.signingConfig;
+            if (certificateFile) {
+                const pin = this.packager.getCscPassword() ?? null;
+                return Promise.resolve({ file: certificateFile, password: pin });
+            }
+            return Promise.resolve(null);
+        });
+        const signing = resolveWindowsSigningConfiguration(packager.platformOptions);
+        if (signing?.type !== "pkcs11") {
+            throw new Error(`Pkcs11SignManager requires signing.type = "pkcs11", got: ${signing?.type}`);
+        }
+        this.signingConfig = signing;
+        // publisherName == null means "auto-discover", but for PKCS#11 without a certificateFile
+        // the cert lives inside the hardware token and cannot be read at build time. The result would be
+        // a null publisherName in app-update.yml, silently disabling updater signature verification.
+        if (signing.publisherName == null && !signing.certificateFile) {
+            throw new InvalidConfigurationError("PKCS#11 signing requires either `win.sign.publisherName` or `win.sign.certificateFile` to be set. " +
+                "Without one of these the publisher name cannot be determined at build time, and auto-updater signature verification will be silently skipped. " +
+                "Set publisherName to the CN from your signing certificate, or provide certificateFile pointing to a certificate chain file (.crt / .cer).");
+        }
+    }
+    // PKCS#11: always proceed — the key URI is sufficient, no cert file required.
+    handleNullCscInfo(_customSign) {
+        return false;
+    }
+    computeWindowsSignArgs(_options, _vm) {
+        throw new InvalidConfigurationError('PKCS#11 signing is only supported via osslsigncode (non-Windows). Use type: "signtool" or type: "hsm" on Windows.');
+    }
+    computeOsslsigncodeArgs(options, vm) {
+        const signing = getSigntoolFamilyConfig(options.options);
+        // Runtime guard: JSON configs can produce partial objects that bypass TypeScript.
+        if (!signing.pkcs11Module || !signing.pkcs11KeyUri) {
+            throw new InvalidConfigurationError('pkcs11Module and pkcs11KeyUri must both be set for type: "pkcs11" signing.');
+        }
+        const inputFile = vm.toVmFile(options.path);
+        const outputPath = this.getOutputPath(inputFile, options.hash);
+        options.resultOutputPath = outputPath;
+        const args = ["sign", "-in", inputFile, "-out", outputPath];
+        // RFC 3161 for sha256/nested (mirrors signtool /tr); HTTP Authenticode for sha1 (/t).
+        if (process.env.ELECTRON_BUILDER_OFFLINE !== "true") {
+            const isRfc3161 = options.isNest || options.hash === "sha256";
+            if (isRfc3161) {
+                args.push("-ts", signing.rfc3161TimeStampServer || "http://timestamp.digicert.com");
+            }
+            else {
+                args.push("-t", signing.timeStampServer || "http://timestamp.digicert.com");
+            }
+        }
+        args.push("-pkcs11module", signing.pkcs11Module);
+        args.push("-key", signing.pkcs11KeyUri);
+        // External certificate chain (optional — token may carry the cert internally).
+        if (signing.certificateFile) {
+            args.push("-certs", vm.toVmFile(signing.certificateFile));
+        }
+        args.push("-h", options.hash.toLowerCase());
+        this.addCommonSigningArgs(args, options, vm, false);
+        // When cscInfo is null the token holds the cert; addCommonSigningArgs won't emit -pass.
+        // Read the PIN from env vars so CI workflows can inject it without embedding it in the URI.
+        if (!options.cscInfo) {
+            const pin = process.env.WIN_CSC_KEY_PASSWORD ?? process.env.CSC_KEY_PASSWORD;
+            if (pin?.trim()) {
+                args.push("-pass", pin.trim());
+            }
+        }
+        const httpsProxy = process.env.HTTPS_PROXY;
+        if (httpsProxy?.length) {
+            args.push("-p", httpsProxy);
+        }
+        return args;
+    }
+}
+//# sourceMappingURL=pkcs11SignManager.js.map

package/dist/codeSign/win/pkcs11SignManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkcs11SignManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/pkcs11SignManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,kCAAkC,EAAoD,MAAM,6BAA6B,CAAA;AAGlI,OAAO,EAIL,uBAAuB,EACvB,uBAAuB,GAExB,MAAM,8BAA8B,CAAA;AAErC,MAAM,OAAO,iBAAkB,SAAQ,uBAAuB;IAG5D,YAAY,QAAqB;QAC/B,KAAK,CAAC,QAAQ,CAAC,CAAA;QAmBjB,uFAAuF;QACvF,uGAAuG;QACrF,YAAO,GAAG,IAAI,QAAQ,CACtC,GAAG,EAAE,CAAC,IAAI,CAAC,4BAA4B,EACvC,6BAA6B,CAAC,EAAE;YAC9B,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,aAAa,CAAA;YAC9C,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,IAAI,CAAA;gBAClD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;YAClE,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,CACF,CAAA;QA9BC,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAA;QAE5B,yFAAyF;QACzF,iGAAiG;QACjG,6FAA6F;QAC7F,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC9D,MAAM,IAAI,yBAAyB,CACjC,oGAAoG;gBAClG,gJAAgJ;gBAChJ,2IAA2I,CAC9I,CAAA;QACH,CAAC;IACH,CAAC;IAgBD,8EAA8E;IAC3D,iBAAiB,CAAC,WAA0D;QAC7F,OAAO,KAAK,CAAA;IACd,CAAC;IAES,sBAAsB,CAAC,QAAsC,EAAE,GAAc;QACrF,MAAM,IAAI,yBAAyB,CAAC,mHAAmH,CAAC,CAAA;IAC1J,CAAC;IAES,uBAAuB,CAAC,OAAqC,EAAE,EAAa;QACpF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAA+B,CAAA;QAEtF,kFAAkF;QAClF,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,yBAAyB,CAAC,4EAA4E,CAAC,CAAA;QACnH,CAAC;QAED,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAA;QAErC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAE3D,sFAAsF;QACtF,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC7D,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,sBAAsB,IAAI,+BAA+B,CAAC,CAAA;YACrF,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,IAAI,+BAA+B,CAAC,CAAA;YAC7E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAEvC,+EAA+E;QAC/E,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEnD,wFAAwF;QACxF,4FAA4F;QAC5F,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAA;YAC5E,IAAI,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QAC1C,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { InvalidConfigurationError } from \"builder-util\"\nimport { MemoLazy } from \"builder-util-runtime\"\nimport { resolveWindowsSigningConfiguration, WindowsConfiguration, WindowsPkcs11SigningConfig } from \"../../options/winOptions.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport type { WinPackager } from \"../../winPackager.js\"\nimport {\n  CustomWindowsSign,\n  CertificateFromStoreInfo,\n  FileCodeSigningInfo,\n  getSigntoolFamilyConfig,\n  SigntoolBaseSignManager,\n  WindowsSignTaskConfiguration,\n} from \"./signtoolBaseSignManager.js\"\n\nexport class Pkcs11SignManager extends SigntoolBaseSignManager {\n  private readonly signingConfig: WindowsPkcs11SigningConfig\n\n  constructor(packager: WinPackager) {\n    super(packager)\n    const signing = resolveWindowsSigningConfiguration(packager.platformOptions)\n    if (signing?.type !== \"pkcs11\") {\n      throw new Error(`Pkcs11SignManager requires signing.type = \"pkcs11\", got: ${signing?.type}`)\n    }\n    this.signingConfig = signing\n\n    // publisherName == null means \"auto-discover\", but for PKCS#11 without a certificateFile\n    // the cert lives inside the hardware token and cannot be read at build time. The result would be\n    // a null publisherName in app-update.yml, silently disabling updater signature verification.\n    if (signing.publisherName == null && !signing.certificateFile) {\n      throw new InvalidConfigurationError(\n        \"PKCS#11 signing requires either `win.sign.publisherName` or `win.sign.certificateFile` to be set. \" +\n          \"Without one of these the publisher name cannot be determined at build time, and auto-updater signature verification will be silently skipped. \" +\n          \"Set publisherName to the CN from your signing certificate, or provide certificateFile pointing to a certificate chain file (.crt / .cer).\"\n      )\n    }\n  }\n\n  // PKCS#11: key and cert are in the hardware token; cert file is optional (chain only).\n  // When a cert file is supplied, the PIN (if any) is read from WIN_CSC_KEY_PASSWORD / CSC_KEY_PASSWORD.\n  override readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.platformSpecificBuildOptions,\n    _platformSpecificBuildOptions => {\n      const { certificateFile } = this.signingConfig\n      if (certificateFile) {\n        const pin = this.packager.getCscPassword() ?? null\n        return Promise.resolve({ file: certificateFile, password: pin })\n      }\n      return Promise.resolve(null)\n    }\n  )\n\n  // PKCS#11: always proceed — the key URI is sufficient, no cert file required.\n  protected override handleNullCscInfo(_customSign: CustomWindowsSign | string | null | undefined): boolean {\n    return false\n  }\n\n  protected computeWindowsSignArgs(_options: WindowsSignTaskConfiguration, _vm: VmManager): Array<string> {\n    throw new InvalidConfigurationError('PKCS#11 signing is only supported via osslsigncode (non-Windows). Use type: \"signtool\" or type: \"hsm\" on Windows.')\n  }\n\n  protected computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const signing = getSigntoolFamilyConfig(options.options) as WindowsPkcs11SigningConfig\n\n    // Runtime guard: JSON configs can produce partial objects that bypass TypeScript.\n    if (!signing.pkcs11Module || !signing.pkcs11KeyUri) {\n      throw new InvalidConfigurationError('pkcs11Module and pkcs11KeyUri must both be set for type: \"pkcs11\" signing.')\n    }\n\n    const inputFile = vm.toVmFile(options.path)\n    const outputPath = this.getOutputPath(inputFile, options.hash)\n    options.resultOutputPath = outputPath\n\n    const args = [\"sign\", \"-in\", inputFile, \"-out\", outputPath]\n\n    // RFC 3161 for sha256/nested (mirrors signtool /tr); HTTP Authenticode for sha1 (/t).\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const isRfc3161 = options.isNest || options.hash === \"sha256\"\n      if (isRfc3161) {\n        args.push(\"-ts\", signing.rfc3161TimeStampServer || \"http://timestamp.digicert.com\")\n      } else {\n        args.push(\"-t\", signing.timeStampServer || \"http://timestamp.digicert.com\")\n      }\n    }\n\n    args.push(\"-pkcs11module\", signing.pkcs11Module)\n    args.push(\"-key\", signing.pkcs11KeyUri)\n\n    // External certificate chain (optional — token may carry the cert internally).\n    if (signing.certificateFile) {\n      args.push(\"-certs\", vm.toVmFile(signing.certificateFile))\n    }\n\n    args.push(\"-h\", options.hash.toLowerCase())\n    this.addCommonSigningArgs(args, options, vm, false)\n\n    // When cscInfo is null the token holds the cert; addCommonSigningArgs won't emit -pass.\n    // Read the PIN from env vars so CI workflows can inject it without embedding it in the URI.\n    if (!options.cscInfo) {\n      const pin = process.env.WIN_CSC_KEY_PASSWORD ?? process.env.CSC_KEY_PASSWORD\n      if (pin?.trim()) {\n        args.push(\"-pass\", pin.trim())\n      }\n    }\n\n    const httpsProxy = process.env.HTTPS_PROXY\n    if (httpsProxy?.length) {\n      args.push(\"-p\", httpsProxy)\n    }\n\n    return args\n  }\n}\n"]}

package/dist/codeSign/{signManager.d.ts → win/signManager.d.ts}

@@ -1,14 +1,16 @@
-import { MemoLazy, Nullish } from "builder-util-runtime";
+import { MemoLazy } from "builder-util-runtime";
 import { Lazy } from "lazy-val";
-import { Target } from "../core.js";
-import { WindowsConfiguration } from "../options/winOptions.js";
-import { WindowsSignOptions } from "./win/windowsCodeSign.js";
-import { CertificateFromStoreInfo, FileCodeSigningInfo } from "./win/windowsSignToolManager.js";
+import { Target } from "../../core.js";
+import { WindowsConfiguration } from "../../options/winOptions.js";
+import type { WinPackager } from "../../winPackager.js";
+import { CertificateFromStoreInfo, FileCodeSigningInfo } from "./signtoolBaseSignManager.js";
+import { WindowsSignOptions } from "./windowsCodeSign.js";
 export interface SignManager {
     readonly computedPublisherName: Lazy<Array<string> | null>;
     readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
-    computePublisherName(target: Target, publisherName: string | Nullish): Promise<string>;
+    computePublisherName(target: Target, publisherName: string | null): Promise<string>;
     initialize(): Promise<void>;
     signFile(options: WindowsSignOptions): Promise<boolean>;
 }
+export declare function createSignManager(packager: WinPackager): SignManager;
 //# sourceMappingURL=signManager.d.ts.map

package/dist/codeSign/win/signManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/signManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAsC,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGvD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAuB,MAAM,8BAA8B,CAAA;AAEjH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAA;IAC1D,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,IAAI,CAAC,CAAA;IACvG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACnF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,GAAG,WAAW,CAYpE"}

package/dist/codeSign/win/signManager.js

@@ -0,0 +1,19 @@
+import { resolveWindowsSigningConfiguration } from "../../options/winOptions.js";
+import { HsmSignManager } from "./hsmSignManager.js";
+import { Pkcs11SignManager } from "./pkcs11SignManager.js";
+import { SigntoolSignManager } from "./signtoolBaseSignManager.js";
+import { WindowsSignAzureManager } from "./windowsSignAzureManager.js";
+export function createSignManager(packager) {
+    switch (resolveWindowsSigningConfiguration(packager.platformOptions)?.type) {
+        case "azure":
+            return new WindowsSignAzureManager(packager);
+        case "hsm":
+            return new HsmSignManager(packager);
+        case "pkcs11":
+            return new Pkcs11SignManager(packager);
+        case "signtool":
+        default:
+            return new SigntoolSignManager(packager);
+    }
+}
+//# sourceMappingURL=signManager.js.map

package/dist/codeSign/win/signManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/signManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kCAAkC,EAAwB,MAAM,6BAA6B,CAAA;AAEtG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAiD,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AACjH,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAWtE,MAAM,UAAU,iBAAiB,CAAC,QAAqB;IACrD,QAAQ,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3E,KAAK,OAAO;YACV,OAAO,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QAC9C,KAAK,KAAK;YACR,OAAO,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAA;QACrC,KAAK,QAAQ;YACX,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QACxC,KAAK,UAAU,CAAC;QAChB;YACE,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC","sourcesContent":["import { MemoLazy } from \"builder-util-runtime\"\nimport { Lazy } from \"lazy-val\"\nimport { Target } from \"../../core.js\"\nimport { resolveWindowsSigningConfiguration, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport type { WinPackager } from \"../../winPackager.js\"\nimport { HsmSignManager } from \"./hsmSignManager.js\"\nimport { Pkcs11SignManager } from \"./pkcs11SignManager.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo, SigntoolSignManager } from \"./signtoolBaseSignManager.js\"\nimport { WindowsSignAzureManager } from \"./windowsSignAzureManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\n\nexport interface SignManager {\n  readonly computedPublisherName: Lazy<Array<string> | null>\n  readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>\n  computePublisherName(target: Target, publisherName: string | null): Promise<string>\n  initialize(): Promise<void>\n  signFile(options: WindowsSignOptions): Promise<boolean>\n}\n\nexport function createSignManager(packager: WinPackager): SignManager {\n  switch (resolveWindowsSigningConfiguration(packager.platformOptions)?.type) {\n    case \"azure\":\n      return new WindowsSignAzureManager(packager)\n    case \"hsm\":\n      return new HsmSignManager(packager)\n    case \"pkcs11\":\n      return new Pkcs11SignManager(packager)\n    case \"signtool\":\n    default:\n      return new SigntoolSignManager(packager)\n  }\n}\n"]}

package/dist/codeSign/win/signtoolBaseSignManager.d.ts

@@ -0,0 +1,71 @@
+import { MemoLazy } from "builder-util-runtime";
+import { Lazy } from "lazy-val";
+import { Target } from "../../core.js";
+import { WindowsConfiguration, WindowsSigntoolFamilyConfig } from "../../options/winOptions.js";
+import { ToolInfo } from "../../util/bundledTool.js";
+import { VmManager } from "../../vm/vm.js";
+import type { WinPackager } from "../../winPackager.js";
+import type { SignManager } from "./signManager.js";
+import { WindowsSignOptions } from "./windowsCodeSign.js";
+export type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>;
+export interface WindowsSignToolOptions extends WindowsSignOptions {
+    readonly name: string;
+    readonly site: string | null;
+}
+export interface FileCodeSigningInfo {
+    readonly file: string;
+    readonly password: string | null;
+}
+export interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {
+    readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null;
+    resultOutputPath?: string;
+    hash: string;
+    isNest: boolean;
+}
+export interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {
+    computeSignToolArgs(isWin: boolean): Array<string>;
+}
+export interface CertificateInfo {
+    readonly commonName: string;
+    readonly bloodyMicrosoftSubjectDn: string;
+}
+export interface CertificateFromStoreInfo {
+    thumbprint: string;
+    subject: string;
+    store: string;
+    isLocalMachineStore: boolean;
+}
+/** Extracts the non-Azure signing config from WindowsConfiguration, or null for Azure/unset/disabled. */
+export declare function getSigntoolFamilyConfig(config: WindowsConfiguration): WindowsSigntoolFamilyConfig | null;
+export declare abstract class SigntoolBaseSignManager implements SignManager {
+    protected readonly packager: WinPackager;
+    protected readonly platformSpecificBuildOptions: WindowsConfiguration;
+    constructor(packager: WinPackager);
+    readonly computedPublisherName: Lazy<string[] | null>;
+    readonly lazyCertInfo: MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>;
+    readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
+    initialize(): Promise<void>;
+    computePublisherName(target: Target, publisherName: string | null): Promise<string>;
+    /**
+     * Called when cscInfo is null. Returns true to skip signing, false to proceed, or throws.
+     * Override in subclasses with different null-cert behaviour (HSM throws, PKCS#11 proceeds).
+     */
+    protected handleNullCscInfo(customSign: CustomWindowsSign | string | null | undefined): boolean;
+    signFile(options: WindowsSignOptions): Promise<boolean>;
+    getCertInfo(file: string, password: string): Promise<CertificateInfo>;
+    computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm?: VmManager): Array<string>;
+    protected isLegacyToolset(): boolean;
+    protected abstract computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>;
+    protected abstract computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>;
+    protected addCertificateArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean, allowX509?: boolean): void;
+    protected addCommonSigningArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void;
+    getOutputPath(inputPath: string, hash: string): string;
+    getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo>;
+    getToolPath(isWin?: boolean): Promise<ToolInfo>;
+    doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager): Promise<void>;
+}
+export declare class SigntoolSignManager extends SigntoolBaseSignManager {
+    protected computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>;
+    protected computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>;
+}
+//# sourceMappingURL=signtoolBaseSignManager.d.ts.map

package/dist/codeSign/win/signtoolBaseSignManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signtoolBaseSignManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/signtoolBaseSignManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAEL,oBAAoB,EAEpB,2BAA2B,EAE5B,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAIpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAGzD,MAAM,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;AAE3H,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,IAAI,CAAA;IAGvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,kCAAmC,SAAQ,4BAA4B;IACtF,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,mBAAmB,EAAE,OAAO,CAAA;CAC7B;AAQD,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,2BAA2B,GAAG,IAAI,CAMxG;AAED,8BAAsB,uBAAwB,YAAW,WAAW;IAGtD,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW;IAFpD,SAAS,CAAC,QAAQ,CAAC,4BAA4B,EAAE,oBAAoB,CAAA;gBAEtC,QAAQ,EAAE,WAAW;IAIpD,QAAQ,CAAC,qBAAqB,wBAW5B;IAEF,QAAQ,CAAC,YAAY,0HA6BpB;IAED,QAAQ,CAAC,OAAO,wFA0Df;IAED,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAkBvE;;;OAGG;IACH,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAIzF,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgEvD,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAU3E,mBAAmB,CAAC,OAAO,EAAE,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAE,SAA2B,GAAG,KAAK,CAAC,MAAM,CAAC;IAI1H,SAAS,CAAC,eAAe,IAAI,OAAO;IAKpC,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9G,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAG/G,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,UAAQ,GAAG,IAAI;IA+BhJ,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAyB/H,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAKvC,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAsC5G,WAAW,CAAC,KAAK,UAA+B,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIpE,MAAM,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,EAAE,WAAW;CA2CtF;AAED,qBAAa,mBAAoB,SAAQ,uBAAuB;IAC9D,SAAS,CAAC,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IA6CrG,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;CAgCvG"}