bare-build 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/platform/apple/sign.js +58 -9
- package/package.json +1 -1
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
const path = require('path')
|
|
2
|
+
const fs = require('../../fs')
|
|
2
3
|
const run = require('../../run')
|
|
3
4
|
|
|
4
5
|
module.exports = async function sign(resource, opts = {}) {
|
|
@@ -11,17 +12,65 @@ module.exports = async function sign(resource, opts = {}) {
|
|
|
11
12
|
hardenedRuntime = false
|
|
12
13
|
} = opts
|
|
13
14
|
|
|
14
|
-
|
|
15
|
-
const args = ['--timestamp', '--force', '--sign', applicationIdentity]
|
|
15
|
+
const temp = []
|
|
16
16
|
|
|
17
|
-
|
|
18
|
-
if (
|
|
19
|
-
|
|
17
|
+
try {
|
|
18
|
+
if (sign) {
|
|
19
|
+
const args = ['--timestamp', '--force', '--sign', applicationIdentity]
|
|
20
20
|
|
|
21
|
-
|
|
21
|
+
if (keychain) args.push('--keychain', keychain)
|
|
22
22
|
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
23
|
+
if (entitlements) args.push('--entitlements', path.resolve(entitlements))
|
|
24
|
+
else {
|
|
25
|
+
const out = await fs.tempDir()
|
|
26
|
+
|
|
27
|
+
temp.push(out)
|
|
28
|
+
|
|
29
|
+
const entitlements = path.join(out, 'Entitlements.plist')
|
|
30
|
+
|
|
31
|
+
await fs.writeFile(entitlements, createEntitlements(opts))
|
|
32
|
+
|
|
33
|
+
args.push('--entitlements', entitlements)
|
|
34
|
+
}
|
|
35
|
+
|
|
36
|
+
if (hardenedRuntime) args.push('--options', 'runtime')
|
|
37
|
+
|
|
38
|
+
args.push(resource)
|
|
39
|
+
|
|
40
|
+
await run('codesign', args)
|
|
41
|
+
} else {
|
|
42
|
+
await run('codesign', ['--timestamp=none', '--force', '--sign', '-', resource])
|
|
43
|
+
}
|
|
44
|
+
} finally {
|
|
45
|
+
for (const dir of temp) await fs.rm(dir)
|
|
26
46
|
}
|
|
27
47
|
}
|
|
48
|
+
|
|
49
|
+
function createEntitlements(opts = {}) {
|
|
50
|
+
const entitlements = []
|
|
51
|
+
|
|
52
|
+
const { hardenedRuntime = false } = opts
|
|
53
|
+
|
|
54
|
+
if (hardenedRuntime) {
|
|
55
|
+
entitlements.push(
|
|
56
|
+
'com.apple.security.cs.allow-jit',
|
|
57
|
+
'com.apple.security.cs.allow-unsigned-executable-memory'
|
|
58
|
+
)
|
|
59
|
+
}
|
|
60
|
+
|
|
61
|
+
return `\
|
|
62
|
+
<?xml version="1.0" encoding="UTF-8"?>
|
|
63
|
+
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
64
|
+
<plist version="1.0">
|
|
65
|
+
<dict>${entitlements
|
|
66
|
+
.map(
|
|
67
|
+
(entitlement) => `
|
|
68
|
+
<key>${entitlement}</key>
|
|
69
|
+
<true/>
|
|
70
|
+
`
|
|
71
|
+
)
|
|
72
|
+
.join('\n')}
|
|
73
|
+
</dict>
|
|
74
|
+
</plist>
|
|
75
|
+
`
|
|
76
|
+
}
|