Merge pull request #11119 from vector-im/dbkr/notarise

Notarise the macOS app

scripts/electron-package.sh

@@ -67,6 +67,14 @@ if [ ! -f package.json ]; then
     exit
 fi
 
+if [ -z "$NOTARIZE_APPLE_ID" ]; then
+    echo "NOTARIZE_APPLE_ID is not set"
+    exit
+fi
+
+# Test that altool can get its credentials for notarising the mac app
+xcrun altool -u "$NOTARIZE_APPLE_ID" -p '@keychain:NOTARIZE_CREDS' --list-apps || exit
+
 echo "Building $version using Update base URL $update_base_url"
 
 projdir=`pwd`

scripts/electron_afterSign.js

@@ -0,0 +1,26 @@
+const { notarize } = require('electron-notarize');
+
+exports.default = async function(context) {
+    const { electronPlatformName, appOutDir } = context;
+    if (electronPlatformName !== 'darwin') {
+        return;
+    }
+
+    // We get the password from keychain. The keychain stores
+    // user IDs too, but apparently altool can't get the user ID
+    // from the keychain, so we need to get it from the environment.
+    const userId = process.env.NOTARIZE_APPLE_ID;
+    if (userId === undefined) {
+        throw new Exception("User ID not found. Set NOTARIZE_APPLE_ID.");
+    }
+
+    const appName = context.packager.appInfo.productFilename;
+
+    console.log("Notarising macOS app. This may be some time.");
+    return await notarize({
+        appBundleId: 'im.riot.app',
+        appPath: `${appOutDir}/${appName}.app`,
+        appleId: userId,
+        appleIdPassword: '@keychain:NOTARIZE_CREDS',
+    });
+};