Skip to content

Commit 3e857d6

Browse files
dpwatrousgingi
dpwatrous
authored and
gingi
committed
MacOS Notarization
Notarizes the MacOS build of the desktop app for distribution on MacOS 10.15 and later. Fixes #2182
1 parent 52c7888 commit 3e857d6

6 files changed

Lines changed: 77 additions & 15 deletions

File tree

‎.vsts/darwin/distribution.yml‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,23 @@ steps:
1414
displayName: Build packages
1515
1616
- script: |
17+
set -e
18+
dir=$(Agent.TempDirectory)
19+
keychain=$dir/buildagent.keychain
20+
security create-keychain -p pwd $keychain
21+
security default-keychain -s $keychain
22+
security unlock-keychain -p pwd $keychain
23+
echo "$(apple-developer-certificate)" | base64 -D > $dir/cert.p12
24+
security import $dir/cert.p12 -k $keychain -P "$(apple-developer-certificate-key)" -T /usr/bin/codesign
25+
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd $keychain
26+
27+
echo "##vso[task.setvariable variable=CSC_LINK]$dir/cert.p12
28+
echo "##vso[task.setvariable variable=CSC_KEY_PASSWORD]$(apple-developer-certificate-key)
29+
displayName: Prepare Apple Developer certificate
30+
31+
- script: |
32+
set -e
33+
. "$(Agent.WorkFolder)/.venv/batchexplorer/bin/activate"
1734
npm run build-python
1835
npm run package darwin-app
1936
cd ./release/mac
@@ -25,24 +42,27 @@ steps:
2542
workingDirectory: desktop
2643
displayName: Build .app
2744
28-
- template: ./sign.yml
2945
- script: |
3046
set -e
3147
. "$(Agent.WorkFolder)/.venv/batchexplorer/bin/activate"
3248
unzip ./release/BatchExplorer*.zip -d ./release/mac
3349
ls ./release/mac
3450
rm -f ./release/mac/*.pkg
35-
# rm -rf ./release/*.zip
36-
mv ./release/*.zip ./release/code-sign-results.zip
3751
npm run package darwin-dmg
3852
rm -rf ./release/mac/*
3953
workingDirectory: desktop
4054
displayName: Build dmg
4155
56+
- template: ./sign.yml
57+
58+
- template: ./notarize.yml
59+
4260
- script: npm run package darwin-manifest
4361
workingDirectory: desktop
4462
displayName: Create manifest
63+
4564
- template: ../common/generate-sbom.yml
65+
4666
- template: ../common/publish-artifacts.yml
4767
parameters:
4868
folder: darwin

‎.vsts/darwin/entitlements.plist‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.allow-jit</key>
6+
<true/>
7+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
8+
<true/>
9+
<key>com.apple.security.cs.disable-library-validation</key>
10+
<true/>
11+
</dict>
12+
</plist>

‎.vsts/darwin/notarize.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
steps:
2+
- task: EsrpCodeSigning@2
3+
inputs:
4+
ConnectedServiceName: 'ESRP CodeSign'
5+
FolderPath: ./desktop/release
6+
Pattern: 'BatchExplorer-mac.zip,*.dmg'
7+
signConfigType: inlineSignParams
8+
inlineOperation: |
9+
[
10+
{
11+
"KeyCode" : "CP-401337-Apple",
12+
"OperationCode" : "MacAppNotarize",
13+
"Parameters" : {
14+
"BundleId": "com.microsoft.azure.BatchExplorer"
15+
},
16+
"ToolName" : "sign",
17+
"ToolVersion" : "1.0"
18+
}
19+
]
20+
SessionTimeout: 120
21+
displayName: Notarization

‎.vsts/darwin/sign.yml‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
11
steps:
2-
- task: UseDotNet@2
3-
displayName: 'Use .NET Core sdk'
4-
inputs:
5-
packageType: sdk
6-
version: 2.1.x
7-
8-
- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
2+
- task: EsrpCodeSigning@2
93
inputs:
104
ConnectedServiceName: 'ESRP CodeSign'
115
FolderPath: ./desktop/release
12-
Pattern: 'BatchExplorer-mac.zip'
6+
Pattern: 'BatchExplorer-mac.zip,*.dmg'
137
signConfigType: inlineSignParams
148
inlineOperation: |
159
[
1610
{
1711
"keyCode": "CP-401337-Apple",
18-
"operationSetCode": "MacAppDeveloperSign",
19-
"parameters": [ ],
12+
"operationCode": "MacAppDeveloperSign",
13+
"parameters": {
14+
"Hardening": "--options=runtime"
15+
},
2016
"toolName": "sign",
2117
"toolVersion": "1.0"
2218
}

‎.vsts/distribution.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ stages:
3939
vmImage: macOS-11
4040
demands: xcode
4141
variables:
42+
- group: BatchExplorer-Signing
4243
- name: EOCompliance-Mac
4344
value: true
4445
steps:

‎desktop/electron-builder.yml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
productName: "BatchExplorer"
2-
appId: "microsoft.azure.batch-explorer"
2+
appId: "com.microsoft.azure.BatchExplorer"
33

4-
# Package electron code into a asar archive. Set to false to debug issues.
4+
# Package electron code into a asar archive, except for .node binaries
5+
# (see https://github.com/electron-userland/electron-builder/issues/4656)
56
asar: true
7+
asarUnpack: "**/*.node"
68

79
files:
810
- "build/"
@@ -31,6 +33,16 @@ protocols:
3133
# Mac OS configuration
3234
mac:
3335
icon: "src/app/assets/images/icon.icns"
36+
target:
37+
- "dmg"
38+
- "zip"
39+
hardenedRuntime: true
40+
gatekeeperAssess: false
41+
entitlements: "../.vsts/darwin/entitlements.plist"
42+
entitlementsInherit: "../.vsts/darwin/entitlements.plist"
43+
extendInfo:
44+
# Required for hardening via ESRP
45+
- CSFlags: 65536
3446

3547
# Config for OSX dmg
3648
dmg:

0 commit comments

Comments
 (0)