wip: macOS notarizing

This runs electron-notarize as additional step on darvin runtime, loosly following
https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/

This is work in progress (I have no Mac, so we need to use CI)

Context:
#1211

License: MIT
Signed-off-by: Marcin Rataj <[email protected]>

.gitignore

@@ -2,6 +2,7 @@ node_modules
 out
 dist
 .cache
+.env
 config.gypi
 assets/webui
 *.nupkg

electron-builder.yml

@@ -6,9 +6,16 @@ directories:
 
 asarUnpack: 'out/**/scripts/**/*'
 
+build:
+  afterSign: './pkgs/macos/notarize.js'
+
 mac:
   category: public.app-category.utilities
   darkModeSupport: true
+  hardenedRuntime: true
+  gatekeeperAssess: false
+  entitlements: './pkgs/macos/entitlements.mac.plist'
+  entitlementsInherit: './pkgs/macos/entitlements.mac.plist'
 
 dmg:
   iconSize: 160

package.json

@@ -58,8 +58,10 @@
     "cross-env": "^6.0.3",
     "delay": "^4.3.0",
     "dirty-chai": "^2.0.1",
+    "dotenv": "^8.2.0",
     "electron": "^7.1.11",
     "electron-builder": "^22.3.2",
+    "electron-notarize": "^0.2.1",
     "mocha": "^6.2.2",
     "npm-run-all": "^4.1.5",
     "pre-commit": "^1.2.2",

pkgs/macos/entitlements.mac.plist

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+  </dict>
+</plist>

pkgs/macos/notarize.js

@@ -0,0 +1,20 @@
+require('dotenv').config()
+const { notarize } = require('electron-notarize')
+
+exports.default = async function notarizing (context) {
+  const { electronPlatformName, appOutDir } = context
+  if (electronPlatformName !== 'darwin') return
+  // TODO: ensure we notarize only master and release tags
+
+  const appName = context.packager.appInfo.productFilename
+
+  return notarize({
+    appBundleId: 'io.ipfs.desktop',
+    appPath: `${appOutDir}/${appName}.app`,
+    // TODO: figure out how to get credentials ( https://github.com/electron/electron-notarize#method-notarizeopts-promisevoid)
+    //        Q: use user & pass (below) or appleApiKey & appleApiIssuer?
+    appleId: process.env.APPLEID, // TODO: set this on CI?
+    appleIdPassword: process.env.APPLEIDPASS // TODO: set this on CI? it needs to be app-specific, generated on https://appleid.apple.com/
+
+  })
+}