From 6fb6407f6a7b5a272fc339f90289fdf9e5c7ffe5 Mon Sep 17 00:00:00 2001
From: Andrew Gundersen <gundersena@xavier.edu>
Date: Thu, 10 Mar 2022 07:16:42 -0600
Subject: [PATCH] Refine notatize.js and update README.md

---
 README.md          | 34 +++++++++++++++++++++++++++++++++-
 entitlements.plist |  6 ++----
 notarize.js        | 43 ++++++++++++++++++-------------------------
 src/config.js      |  6 ++----
 4 files changed, 55 insertions(+), 34 deletions(-)

diff --git a/README.md b/README.md
index d5220b2..ea78a49 100644
--- a/README.md
+++ b/README.md
@@ -29,4 +29,36 @@ yarn lint
 See [Configuration Reference](https://cli.vuejs.org/config/).
 
 ## Sign and Notarize
-Running notarize.js will sign and notarize the app. Further information is in that file.
+
+Prerequisites:
+*  Apple Developer Account ($99)
+*  Valid Apple Developer ID Application Certificate on keychain
+
+Clear debris from app before signing:
+
+    xattr -cr Electron.app
+
+Sign and Notarize:
+
+    node notarize.js
+
+Debug electron-osx-sign:
+
+    export DEBUG=electron-osx-sign*
+
+### Some things to note:
+
+#### Gatekeeper Assess
+Electron-osx-sign seems to have a bug where the sign will fail if "gatekeeper-assess" is true (default).
+
+#### Entitlements.plist
+Not to be confused with Info.plist, this file specifies entitlements the app can have in hardened runtime (e.g. Can I use the microphone?).  Only including the ones Electron reccommends seems to work (including audio of course and omitting allow-unsigned-executable-memory).
+
+#### The Benifit of Electron OSX Sign
+Without this package, we would have to manually go in and figure out how to sign each level of the app.  While it didn't work out of the box (gatekeeper-assess) it's proven to be good otherwise.  However, there is a bug where it puts multiple runtime flags on each command - not catastrophic though. 
+
+#### Apple Password
+This must be an app specific password, not your normal Apple ID password.
+
+#### --Signiture-Flags OSX Sign
+Not exactly sure what this does or why its important, but Electron includes it.
diff --git a/entitlements.plist b/entitlements.plist
index 06bbc8d..0555172 100644
--- a/entitlements.plist
+++ b/entitlements.plist
@@ -6,11 +6,9 @@
     <true/>
     <key>com.apple.security.cs.debugger</key>
     <true/>
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-    <true/>
     <key>com.apple.security.device.audio-input</key>
     <true/>
-    <key>com.apple.security.cs.disable-library-validation</key>
-    <true/>
   </dict>
 </plist>
+<!--<key>com.apple.security.cs.disable-library-validation</key>
+    <true/>-->
diff --git a/notarize.js b/notarize.js
index 9b40917..8f87192 100644
--- a/notarize.js
+++ b/notarize.js
@@ -1,36 +1,41 @@
+const exec = require('child_process').exec;
 const sign = require("electron-osx-sign").signAsync;
 const notarize = require("electron-notarize").notarize;
 
-const path = __dirname + "/Electron.app/Contents/Resources/app/node_modules";
+const app = "Electron.app";
 
-const addons = [
-    `${path}/@crimata/nodeaudio/build/Release/libportaudio.dylib`,
-    `${path}/@crimata/nodeaudio/build/Release/nodeAudio.node`
-];
+const runShellCommand = (cmd) => (new Promise((resolve, reject) => {
+    exec(cmd, (error, stdout, stderr) => {
+        error ? reject(stderr) : resolve(stdout);
+    });
+}));
 
 const signConfig = {
-    "app": "Electron.app",
-    "platform": "darwin",
-    "binaries": addons,
+    "app": app,
     "hardened-runtime": true,
+    "gatekeeper-assess": false,
+    "signature-flags": "library",
     "entitlements": "entitlements.plist",
     "entitlements-inherit": "entitlements.plist",
-    "signature-flags": "library",
-    "gatekeeper-assess": false
 };
 
 const notarizeConfig = {
-    appBundleId: "com.github.Electron",
-    appPath: "Electron.app",
+    appPath: app,
     appleId: "gundersena@crimata.com",
-    appleIdPassword: "wdeb-cbcq-rujb-ldgo"
+    appBundleId: "com.github.Electron",
+    appleIdPassword: process.env["AC_PASSWORD"]
 };
 
 (async function () {
 
     try 
     {
+        console.log("Cleaning App...");
+        await runShellCommand(`xattr -cr ${app}`);
+
+        console.log("Signing...");
         await sign(signConfig);
+
         console.log("Notarizing...");
         await notarize(notarizeConfig);
     }
@@ -40,15 +45,3 @@ const notarizeConfig = {
     }
 
 })();
-
-/* Clear debris from .app before running or it will complain:
- *     xattr -cr Electron.app 
- *
- * Paste this in terminal to debug electron-osx-sign:
- *     export DEBUG=electron-osx-sign*
- *
- * Some important things to note:
- *     - In order to notarize, you need a valid Apple Developer ID Application *       Certificate.
- *     - All flags in current signing config are required for notarization (to 
- *       my knowledge).
- */
\ No newline at end of file
diff --git a/src/config.js b/src/config.js
index 61dfdfd..b3b1104 100644
--- a/src/config.js
+++ b/src/config.js
@@ -5,8 +5,6 @@ const DOMAIN = "crimata.com";
 const prod = !process.defaultApp;
 
 module.exports = {
-
-PLATFORM: prod ? `http://app.${DOMAIN}` : `http://localhost:8760`,
-API: prod ? `https://${DOMAIN}/api` : `http://localhost:8761`
-
+    PLATFORM: prod ? `http://app.${DOMAIN}` : `http://localhost:8760`,
+    API: prod ? `https://${DOMAIN}/api` : `http://localhost:8761`
 }
-- 
2.43.0