feat(mac): Add option to enable hardened-runtime

[loremattei]

This PR adds the option to enable the hardened runtime option during code sign for Mac builds.
The option is already supported by electron-osx-sign, so it's just a matter of passing the flag down.

Hardened runtime is a requirement for app notarization.

[sindresorhus]

I would recommend defaulting it to true as most will want to enable it since notarization (which requires hardened runtime) is required for apps with a new Developer ID and will be required for everyone in a future macOS release.

https://developer.apple.com/documentation/security/notarizing_your_app_before_distribution

[loremattei]

I would recommend defaulting it to true as most will want to enable it since notarization (which requires hardened runtime) is required for apps with a new Developer ID and will be required for everyone in a future macOS release.

Yep! It's true that it will be required for everyone, though I defaulted it to false because:

• codesign and electron-osx-sign default to false, so it may be a bit confusing to have a different default here.
• It seems that a lot of Electron apps break when hardened runtime is enabled if proper entitlements are not provided, so I think that setting the default to true would be disruptive for many people.

Does it make sense?

[thelifenadine]

Thanks @loremattei, I'll be using this as soon as it gets released!

[NickTikhonov]

This is both excellent and exciting @loremattei

[easyCZ]

This feature is a must. Without it, electron-builder likely loses users as it would no longer provide the ability to support MacOS apps, which is its tagline...

Please consider merging this feature soon to continue enabling awesome cross platform packaging tools.

[lottec]

Thanks for this @loremattei 💯 What's holding up merging? Keen to start using this...

[develar]

Thanks @loremattei, sorry for delay.

[martani]

Setting this flag to true causes the app to crash on startup. It's mentioned above that this could be the case of the proper entitlements are not set. I'm not setting any, are there examples of what entitlements need to be set to use this flag?

Thanks.

[loremattei]

Hi @martani! You can find some info about the Hardened Runtime Entitlements here: https://developer.apple.com/documentation/security/hardened_runtime_entitlements.

I'd suggest to start with looking at allow-jit, allow-unsigned-executable-memory and allow-dyld-environment-variables.

[martani]

Thanks @loremattei. Adding those entitlements did the trick when Hardened Runtime is enabled.

[1009466147]

hi I see you said you added a option, is electron-osx-sign?, Where should I use it.

[loremattei]

Hey @1009466147! It's hardenedRuntime. It defaults to false and you can enable it if you need to sign your app with the Hardened Runtime, for example if you want to notarize the app.