crossbind 2.0.0-beta.67 → 2.0.0-beta.69

package/src/actions/appInstaller.js

@@ -1,177 +1,93 @@
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
-import run from './run.js';
+import extensionApi from './extensionApi.js';
 import { appleSigning } from './appleSigning.js';
-import { updaterSigning } from './appUpdate.js';
-import { inWindowsImage, jsignScript, windowsSigning } from './windowsSigning.js';
+import { DESKTOP_PLATFORMS, recordAppOutput } from './buildApp.js';
+import { windowsSigning } from './windowsSigning.js';
 import state from '../state/index.js';
-import { appCategory, appDisplayName, appId, appUrlSchemes } from '../utils/appOptions.js';
-import { readAppIcon, windowsIcon } from '../utils/appIcon.js';
-import { imageRoleFor } from '../utils/pullDockerImage.js';
-import { isUnderBase } from '../utils/replaceBasePathForDocker.js';
+import { hasTerminal } from '../utils/ask.js';
+import { appInstallers } from '../utils/appOptions.js';
+import {
+    extensionStep, ownExtensions, withListed, withoutNamed,
+} from '../utils/appExtensions.js';
 import resolveAppHostRoot from '../utils/resolveAppHost.js';
 
-const DEBIAN_ARCH = { x64: 'amd64', arm64: 'arm64' };
-// What a Linux app runs on: WebKitGTK 4.1 from its 2.40 release, and the GTK its window is.
-const DEBIAN_DEPENDS = 'libwebkit2gtk-4.1-0 (>= 2.40), libgtk-3-0';
+const listed = (names) => (names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names.at(-1)}` : names[0]);
 
-const packageVersion = () => state.config.package?.version ?? '1.0.0';
+// crossbind's own installers, which the host brings as it brings its other extensions.
+export const builtInInstallers = () => withoutNamed(ownExtensions(resolveAppHostRoot()), state.config?.app).filter(({ installer }) => installer);
 
-// The container that packages a Linux or Windows app sees the project's base alone.
-export function assertUnderBase(app, target) {
-    if (isUnderBase(app, state.config.paths.base)) return;
-    const kind = target.platform === 'win32' ? 'Windows' : 'Linux';
-    throw new Error(`crossbind: the ${kind} app ${app} is outside ${state.config.paths.base}, the project's base and all the ${imageRoleFor(target)} container sees. Build the app into a directory under it.`);
+// The installers an app has: crossbind's own, but for those whose role the app's extensions take, each in the place of the
+// app's extension of its name that has an installer, then those of the app's other extensions.
+export function installersOf(extensions) {
+    const taken = extensions.flatMap(({ replaces }) => replaces ?? []);
+    return withListed(builtInInstallers().filter(({ name }) => !taken.includes(name)), extensions.filter((extension) => extension.installer));
 }
 
-// A Debian package's name: the project's, in lower case, with a hyphen for each underscore and from its first letter
-// or digit.
-export function debianName(name) {
-    const debian = name.toLowerCase().replaceAll('_', '-').replace(/^[^a-z0-9]+/, '');
-    if (!/^[a-z0-9][a-z0-9+.-]+$/.test(debian)) {
-        throw new Error(`crossbind: general.name ${JSON.stringify(name)} makes no Debian package name, which is two or more lowercase letters, digits, +, . and -, starting with a letter or digit. Change general.name in crossbind.config.js.`);
-    }
-    return debian;
+// The installers of the target's platform that make what installs its app: every one, or those app.installers names,
+// which names none that is no installer, and those that run last whatever it names.
+export function installersFor(target) {
+    const all = installersOf(state.config.extensions ?? []);
+    const named = appInstallers(state.config);
+    const unknown = named?.find((name) => !all.some((extension) => extension.name === name));
+    if (unknown) throw new Error(`crossbind: app.installers names ${unknown}, which is no installer: ${listed(all.filter(({ installer }) => !installer.isLast).map(({ name }) => name))} are.`);
+    const platform = DESKTOP_PLATFORMS[target.platform];
+    const taken = all.filter(({ name, installer }) => installer.platforms.includes(platform) && (!named || named.includes(name) || installer.isLast));
+    return [...taken.filter(({ installer }) => !installer.isLast), ...taken.filter(({ installer }) => installer.isLast)];
 }
 
-// A Debian version sorts the pre-releases of a release before it, as semver does: 1.0.0-beta.1 is 1.0.0~beta.1.
-export const debianVersion = (version) => version.replace('-', '~');
-
-// package.json's author as Debian names a maintainer, by name and email address.
-export function maintainer(author) {
-    if (typeof author === 'string') return author.replace(/\(.*\)/, '').trim() || null;
-    if (!author?.name) return null;
-    return author.email ? `${author.name} <${author.email}>` : author.name;
-}
+const apiOf = (name, target) => extensionApi(name, { platform: DESKTOP_PLATFORMS[target.platform], isGuided: hasTerminal(), target });
 
-// The control file of a Linux app's package. dpkg warns of a package without a maintainer in every command it runs
-// afterwards, so without package.json's author the app's name stands for one.
-export function debianControl({ name, version, arch, author, description, label }) {
-    return [
-        `Package: ${name}`,
-        `Version: ${debianVersion(version)}`,
-        `Architecture: ${DEBIAN_ARCH[arch]}`,
-        `Maintainer: ${maintainer(author) ?? label}`,
-        `Depends: ${DEBIAN_DEPENDS}`,
-        `Description: ${(description || label).replace(/\s+/g, ' ').trim()}`,
-        '',
-    ].join('\n');
-}
+// The installers an extension replaces, told once a run, which checks them for each of its targets.
+const toldReplacing = new Set();
 
-// The desktop entry a Linux menu shows an app by. GTK names the app's window after the command that started it, and
-// GNOME on Wayland shows the icon of the entry whose file has that name.
-// A link of one of its schemes opens it with the link as its argument, %u. A menu shows it under its categories.
-export function desktopEntry({ label, command, hasIcon, urlSchemes = [], categories = null }) {
-    const isLinked = urlSchemes.length > 0;
-    return [
-        '[Desktop Entry]', 'Type=Application', `Name=${label}`, `Exec=${command}${isLinked ? ' %u' : ''}`, ...(hasIcon ? [`Icon=${command}`] : []),
-        ...(isLinked ? [`MimeType=${urlSchemes.map((scheme) => `x-scheme-handler/${scheme};`).join('')}`] : []),
-        ...(categories ? [`Categories=${categories};`] : []), 'Terminal=false', '',
-    ].join('\n');
-}
-
-// A disk image of a macOS app beside a link to /Applications, onto which its user drags it. hdiutil copies a link
-// inside the folder it is given as a link, where it would copy all of /Applications for the link itself. The image is
-// not signed: Gatekeeper would then judge it as well, where the app in it is what Apple notarizes.
-function diskImage(app, target) {
-    const image = app.replace(/\.app$/, '.dmg');
-    const folder = fs.mkdtempSync(path.join(os.tmpdir(), 'crossbind-dmg-'));
-    try {
-        // The image's root takes the folder's permissions, which mkdtemp keeps to its owner.
-        fs.chmodSync(folder, 0o755);
-        fs.cpSync(app, path.join(folder, path.basename(app)), { recursive: true, verbatimSymlinks: true });
-        fs.symlinkSync('/Applications', path.join(folder, 'Applications'));
-        fs.rmSync(image, { force: true });
-        run(null, ['hdiutil', 'create', '-quiet', '-volname', appDisplayName(state.config), '-srcfolder', folder, '-fs', 'HFS+', '-format', 'UDZO', image], null, target);
-    } finally {
-        fs.rmSync(folder, { recursive: true, force: true });
+// What a desktop app ships with stops a build that could not make it here, before anything compiles: the keys that sign
+// the app, the installers app.installers names, and what each installer checks, which it does knowing those that run.
+export async function checkInstaller(target) {
+    if (!DESKTOP_PLATFORMS[target.platform]) return;
+    if (target.platform === 'darwin') appleSigning();
+    if (target.platform === 'win32') windowsSigning();
+    const installers = installersFor(target);
+    const own = builtInInstallers().map(({ name }) => name);
+    installers.filter((extension) => own.includes(extension.name) && state.config.extensions?.includes(extension) && !toldReplacing.has(extension.name))
+        .forEach(({ name, root }) => {
+            toldReplacing.add(name);
+            console.log(`crossbind: the extension ${name} of ${root} replaces crossbind's own installer of its name.`);
+        });
+    const names = Object.freeze(installers.map(({ name }) => name));
+    for (const { name, installer } of installers) {
+        if (installer.check) await extensionStep(name, 'check', () => installer.check(apiOf(name, target), Object.freeze({ installers: names })));
     }
 }
 
-// A Debian package of a Linux app, which dpkg-deb builds in the linux image: the app in /usr/lib/<name>, its command
-// in /usr/bin, and the desktop entry and icon a menu shows it by.
-function debianPackage(app, target) {
-    assertUnderBase(app, target);
-    const { general, paths } = state.config;
-    const name = debianName(general.name);
-    const label = appDisplayName(state.config);
-    const root = `${paths.build}/${path.basename(app)}.deb`;
-    const dir = (relative) => {
-        fs.mkdirSync(`${root}/${relative}`, { recursive: true });
-        return `${root}/${relative}`;
-    };
-    fs.rmSync(root, { recursive: true, force: true });
-    fs.cpSync(app, `${dir('usr/lib')}/${name}`, { recursive: true, verbatimSymlinks: true });
-    fs.symlinkSync(`../lib/${name}/${general.name}`, `${dir('usr/bin')}/${name}`);
-    const icon = `${app}/resources/icon.png`;
-    const hasIcon = fs.existsSync(icon);
-    if (hasIcon) fs.copyFileSync(icon, `${dir('usr/share/icons/hicolor/512x512/apps')}/${name}.png`);
-    fs.writeFileSync(`${dir('usr/share/applications')}/${name}.desktop`, desktopEntry({
-        label, command: name, hasIcon, urlSchemes: appUrlSchemes(state.config), categories: appCategory(state.config)?.linux,
-    }));
-    const { author, description } = state.config.package ?? {};
-    fs.writeFileSync(`${dir('DEBIAN')}/control`, debianControl({ name, version: packageVersion(), arch: target.arch, author, description, label }));
-    run(null, ['dpkg-deb', '--build', '--root-owner-group', root, `${app}.deb`], null, target);
-    fs.rmSync(root, { recursive: true, force: true });
-}
-
-// The name a Windows app's setup program gives its Start menu shortcut and folder, which Windows takes as a file name.
-function windowsName() {
-    const label = appDisplayName(state.config);
-    if (/[<>:/|?*]|[ .]$/.test(label)) {
-        throw new Error(`crossbind: ${JSON.stringify(label)}, the name of a Windows app's Start menu shortcut and folder, is no file name Windows takes, which holds none of < > : / | ? * and ends in neither a space nor a dot. Change app.name in crossbind.config.js.`);
+// The files an installer made, by their paths, a relative one beside the app.
+function madeFiles(name, app, files) {
+    if (!Array.isArray(files) || !files.every((file) => typeof file === 'string')) {
+        throw new Error(`crossbind: the installer ${name} made no list of files, which its make returns.`);
     }
-    return label;
+    return files.map((file) => {
+        const made = path.resolve(path.dirname(app), file);
+        if (!fs.statSync(made, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: the installer ${name} made ${made}, which is no file.`);
+        return made;
+    });
 }
 
-// A Windows setup program reads a dollar sign in its text as the start of a variable.
-const nsisText = (text) => text.replaceAll('$', () => '$$');
-
-// The schemes a Windows app's setup program registers, as a macro that calls the one it is given on each.
-const schemesMacro = (schemes) => ['!macro CROSSBIND_URL_SCHEMES DO', ...schemes.map((scheme) => `  !insertmacro \${DO} "${scheme}"`), '!macroend', ''].join('\n');
-
-// A Windows app's setup program, which NSIS builds in the windows image from the host's installer.nsi; with a key in
-// the environment, jsign signs it and its uninstaller as NSIS writes them.
-function windowsSetup(app) {
-    const signing = windowsSigning();
-    const icon = readAppIcon(state.config);
-    const iconFile = `${state.config.paths.build}/${path.basename(app)}.ico`;
-    if (icon) fs.writeFileSync(iconFile, windowsIcon(icon));
-    const urlSchemes = appUrlSchemes(state.config);
-    const schemesFile = `${state.config.paths.build}/${path.basename(app)}.schemes.nsh`;
-    if (urlSchemes.length > 0) fs.writeFileSync(schemesFile, schemesMacro(urlSchemes));
-    inWindowsImage([
-        'makensis', '-V2', '-INPUTCHARSET', 'UTF8',
-        `-DNAME=${nsisText(windowsName())}`,
-        `-DEXE=${nsisText(`${state.config.general.name}.exe`)}`,
-        `-DID=${appId(state.config)}`,
-        `-DVERSION=${nsisText(packageVersion())}`,
-        `-DAPP=${app}`,
-        `-DOUTFILE=${app}-setup.exe`,
-        ...(icon ? [`-DICON=${iconFile}`] : []),
-        ...(urlSchemes.length > 0 ? [`-DSCHEMES=${schemesFile}`] : []),
-        ...(signing ? [`-DSIGNER=${jsignScript()}`] : []),
-        `${resolveAppHostRoot()}/windows/installer.nsi`,
-    ], path.dirname(app), signing);
-}
-
-// What an app's installer takes from the app and the environment, checked before anything compiles: the names, the keys
-// that sign a macOS or Windows app, and the one that signs a desktop app's update.
-export function checkInstaller(target) {
-    if (target.platform === 'darwin') appleSigning();
-    else if (target.platform === 'linux') debianName(state.config.general.name);
-    else if (target.platform === 'win32') {
-        windowsName();
-        windowsSigning();
+// What installs a desktop app, beside it: each installer's that made any, by its name, with the files it made, in the
+// order they run, each seeing what those before it made.
+export async function writeInstallers(app, target) {
+    const made = [];
+    for (const { name, installer } of installersFor(target)) {
+        const files = await extensionStep(name, 'make', () => installer.make(apiOf(name, target), Object.freeze({ app, arch: target.arch, made: structuredClone(made) })));
+        const madeNow = madeFiles(name, app, files);
+        if (madeNow.length > 0) made.push({ name, files: madeNow });
     }
-    if (['darwin', 'linux', 'win32'].includes(target.platform)) updaterSigning();
+    return made;
 }
 
-// What installs a desktop app, written beside it: a disk image on macOS, a Debian package on Linux and a setup program
-// on Windows.
-export default function writeInstaller(app, target) {
-    if (target.platform === 'darwin') diskImage(app, target);
-    else if (target.platform === 'linux') debianPackage(app, target);
-    else if (target.platform === 'win32') windowsSetup(app);
+// A desktop app with its page ships with what installs it. Installers write beside the app, in the page's own folder, so
+// they run once every app of the build has its page.
+export async function shipApp(target, to) {
+    if (!DESKTOP_PLATFORMS[target.platform]) return;
+    const app = path.resolve(to);
+    recordAppOutput(target, app, { installers: await writeInstallers(app, target) });
 }

package/src/actions/appSwift.js

@@ -0,0 +1,66 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { DARWIN_DEPLOYMENT_TARGET } from '../utils/darwinToolchain.js';
+import { IOS_DEPLOYMENT_TARGET } from '../utils/iosToolchain.js';
+
+// An Apple app's extensions' Swift, which CMake's Makefiles generator compiles none of: swiftc makes each extension's a
+// static library first, with the Objective-C header its own sources import, before the host builds.
+
+// The module an extension's Swift makes: its name, with underscores for dashes, as a Swift module's name takes it.
+export const swiftModule = (name) => name.replace(/-/g, '_');
+
+// What swiftc compiles an Apple target's Swift for: the target's triple, at the app's deployment target, and its SDK.
+export function swiftTarget(target) {
+    if (target.platform === 'darwin') return { triple: `${target.arch === 'x64' ? 'x86_64' : 'arm64'}-apple-macos${DARWIN_DEPLOYMENT_TARGET}`, sdk: 'macosx' };
+    const isDevice = target.arch === 'iphoneos';
+    return { triple: `arm64-apple-ios${IOS_DEPLOYMENT_TARGET}${isDevice ? '' : '-simulator'}`, sdk: isDevice ? 'iphoneos' : 'iphonesimulator' };
+}
+
+// The swiftc arguments that make one extension's Swift a static library and the Objective-C header of its @objc classes
+// and @_cdecl functions.
+export function swiftArgs({ module, sources, library, header, triple, sdkPath, isRelease }) {
+    return [
+        'swiftc', '-parse-as-library', ...(isRelease ? ['-O'] : ['-Onone', '-g']), '-module-name', module,
+        '-emit-library', '-static', '-o', library, '-emit-objc-header', '-emit-objc-header-path', header,
+        '-target', triple, '-sdk', sdkPath, ...sources,
+    ];
+}
+
+function xcrun(args, what) {
+    const result = spawnSync('xcrun', args, { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    if (result.error) throw new Error(`crossbind: ${what} needs Xcode's xcrun: ${result.error.message}`);
+    if (result.status !== 0) throw new Error(`crossbind: ${what} failed:\n${`${result.stdout}${result.stderr}`.trim()}`);
+    return result.stdout.trim();
+}
+
+// Compiles each extension's Swift for an Apple target into its folder of workDir: the library, and the header beside it,
+// which the folder, added to the extension's includes, gives its sources as <module>-Swift.h.
+export function compileSwift(target, compiled, workDir, isRelease) {
+    const withSwift = compiled.filter(({ swift }) => swift.length > 0);
+    if (withSwift.length === 0) return [];
+    const { triple, sdk } = swiftTarget(target);
+    const sdkPath = xcrun(['--sdk', sdk, '--show-sdk-path'], `the ${sdk} SDK's path`);
+    return withSwift.map(({ name, swift }) => {
+        const module = swiftModule(name);
+        const dir = path.join(workDir, 'swift', module);
+        fs.mkdirSync(dir, { recursive: true });
+        const library = path.join(dir, `lib${module}.a`);
+        const header = path.join(dir, `${module}-Swift.h`);
+        xcrun(swiftArgs({ module, sources: swift, library, header, triple, sdkPath, isRelease }), `the extension ${name}'s Swift`);
+        return { name, library, includes: [dir] };
+    });
+}
+
+// What links the libraries: each whole, as an @objc class may be reached by its name alone, and Swift's own libraries,
+// which the system holds on the app's deployment targets, beside the toolchain's back-deployed parts. An iOS app's
+// Xcode project names them by its own settings, the back-deployed parts in Xcode's default toolchain, whose swiftc
+// compiled them: TOOLCHAIN_DIR may name another, as the Metal toolchain.
+export function swiftLinkArgs(target, libraries) {
+    if (libraries.length === 0) return [];
+    const searched = target.platform === 'darwin'
+        ? [`-L${xcrun(['--sdk', 'macosx', '--show-sdk-path'], "the macosx SDK's path")}/usr/lib/swift`,
+            `-L${path.dirname(path.dirname(xcrun(['--find', 'swiftc'], "Swift's compiler")))}/lib/swift/macosx`]
+        : ['-L$(SDKROOT)/usr/lib/swift', '-L$(DEVELOPER_DIR)/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/$(PLATFORM_NAME)'];
+    return [...libraries.map((library) => `-Wl,-force_load,${library}`), ...searched, '-Wl,-rpath,/usr/lib/swift'];
+}

package/src/actions/appleSigning.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { secretFile } from '../utils/secretFile.js';
 
 // The Developer ID that signs a macOS app and the App Store Connect API key Apple notarizes it with, named by the
 // environment alone so that no secret reaches a file.
@@ -12,6 +13,10 @@ export const APPLE_SIGNING = {
     issuer: 'CROSSBIND_APPLE_API_ISSUER',
 };
 const NOTARY = [APPLE_SIGNING.key, APPLE_SIGNING.keyId, APPLE_SIGNING.issuer];
+// App Store Connect gives a key's file as AuthKey_<key id>.p8, so the file's own name tells its ID.
+const KEY_FILE = /^AuthKey_([A-Z0-9]{10})\.p8$/;
+// A key's own text, as CI's secrets give it, in place of its file's path.
+const KEY_TEXT = /^\s*-----BEGIN /;
 
 const listed = (names) => `${names.join(' and ')} ${names.length > 1 ? 'are' : 'is'}`;
 
@@ -30,16 +35,32 @@ function signingIdentities() {
         .map(([, hash, name]) => ({ hash, name }));
 }
 
+// The App Store Connect API key the environment names, with which Apple notarizes a macOS app and xcodebuild uploads an
+// iOS one in place of Xcode's account, or null: all of it or none, but for its ID where its file's name tells it. The key
+// is its file, or its text, which goes to a file as the tools take files.
+export function appStoreKey(env = process.env) {
+    const set = NOTARY.filter((name) => env[name]);
+    if (!set.length) return null;
+    const given = env[APPLE_SIGNING.key] ?? '';
+    const isText = KEY_TEXT.test(given);
+    const keyId = env[APPLE_SIGNING.keyId] || (isText ? undefined : path.basename(given).match(KEY_FILE)?.[1]);
+    const missing = NOTARY.filter((name) => !env[name] && !(name === APPLE_SIGNING.keyId && keyId));
+    if (missing.length) {
+        const byName = missing.includes(APPLE_SIGNING.keyId) && !isText ? ', the ID unless its file keeps the name App Store Connect gives it, AuthKey_<key id>.p8' : '';
+        throw new Error(`crossbind: ${listed(set)} set, but ${listed(missing)} not: an App Store Connect API key takes all three${byName}.`);
+    }
+    const key = isText ? secretFile('AuthKey.p8', `${given.trim()}\n`) : path.resolve(given);
+    if (!fs.statSync(key, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: ${APPLE_SIGNING.key} names ${key}, which is no file.`);
+    return { key, keyId, issuer: env[APPLE_SIGNING.issuer] };
+}
+
 // The identity a macOS app is signed with and the key Apple notarizes it with, or null without an identity: the app is
-// then signed ad hoc, which opens it on the Mac that built it alone. codesign takes the identity's hash, which the
-// renewed certificates of one name do not share.
+// then signed ad hoc, which opens it on the Mac that built it alone, even with the key, which iOS uploads take too.
+// codesign takes the identity's hash, which the renewed certificates of one name do not share.
 export function appleSigning(env = process.env) {
-    const notary = NOTARY.filter((name) => env[name]);
     const identity = env[APPLE_SIGNING.identity];
-    if (!identity) {
-        if (notary.length) throw new Error(`crossbind: ${listed(notary)} set without ${APPLE_SIGNING.identity}, the Developer ID that signs the app Apple notarizes.`);
-        return null;
-    }
+    if (!identity) return null;
+    const notary = appStoreKey(env);
     const found = signingIdentities().filter(({ hash, name }) => hash === identity.toUpperCase() || name.includes(identity));
     const matches = [...new Map(found.map((match) => [match.hash, match])).values()];
     if (!matches.length) throw new Error(`crossbind: ${APPLE_SIGNING.identity} names ${JSON.stringify(identity)}, which no valid code signing identity in the keychain is; \`security find-identity -v -p codesigning\` lists them.`);
@@ -47,13 +68,10 @@ export function appleSigning(env = process.env) {
         throw new Error(`crossbind: ${APPLE_SIGNING.identity} names ${JSON.stringify(identity)}, which ${matches.length} identities in the keychain are: ${matches.map(({ hash, name }) => `${hash} "${name}"`).join(', ')}. Set it to one of their hashes.`);
     }
     const [{ hash, name }] = matches;
-    if (!notary.length) return { identity: hash, notary: null };
-    const missing = NOTARY.filter((variable) => !env[variable]);
-    if (missing.length) throw new Error(`crossbind: ${listed(notary)} set, but ${listed(missing)} not: notarizing takes all three.`);
-    if (!name.startsWith('Developer ID Application:')) throw new Error(`crossbind: Apple notarizes an app signed with a Developer ID Application certificate, which ${JSON.stringify(name)} is not.`);
-    const key = path.resolve(env[APPLE_SIGNING.key]);
-    if (!fs.statSync(key, { throwIfNoEntry: false })?.isFile()) throw new Error(`crossbind: ${APPLE_SIGNING.key} names ${key}, which is no file.`);
-    return { identity: hash, notary: { key, keyId: env[APPLE_SIGNING.keyId], issuer: env[APPLE_SIGNING.issuer] } };
+    if (notary && !name.startsWith('Developer ID Application:')) {
+        throw new Error(`crossbind: Apple notarizes an app signed with a Developer ID Application certificate, which ${JSON.stringify(name)} is not.`);
+    }
+    return { identity: hash, notary };
 }
 
 // The ticket Apple issues can take a moment to reach the servers stapler asks for it.