wehub-resource-sync
53 lines
1.8 KiB
JavaScript
53 lines
1.8 KiB
JavaScript
const { execSync } = require("child_process");
|
|
const path = require("path");
|
|
|
|
// Sign a single path, ignoring "not an Mach-O" errors for non-binary files.
|
|
function sign(target) {
|
|
try {
|
|
execSync(`codesign --force --sign - "${target}"`, { stdio: "pipe" });
|
|
} catch (e) {
|
|
// Ignore files that aren't signable (scripts, plists, etc.)
|
|
const msg = (e.stderr || e.stdout || "").toString();
|
|
if (
|
|
!msg.includes("is not an Mach-O file") &&
|
|
!msg.includes("bundle format unrecognized")
|
|
) {
|
|
throw e;
|
|
}
|
|
}
|
|
}
|
|
|
|
exports.default = async function afterPack(context) {
|
|
if (context.electronPlatformName !== "darwin") return;
|
|
|
|
const appPath = path.join(
|
|
context.appOutDir,
|
|
`${context.packager.appInfo.productFilename}.app`,
|
|
);
|
|
|
|
console.log(`Ad-hoc re-signing (inside-out): ${appPath}`);
|
|
|
|
// Step 1: sign .dylib files (deepest leaves first)
|
|
execSync(
|
|
`find "${appPath}" -name "*.dylib" | while IFS= read -r f; do codesign --force --sign - "$f" 2>/dev/null || true; done`,
|
|
{ stdio: "inherit", shell: "/bin/bash" },
|
|
);
|
|
|
|
// Step 2: sign XPC services and nested .app bundles inside Frameworks
|
|
execSync(
|
|
`find "${appPath}/Contents/Frameworks" -mindepth 1 -maxdepth 4 \\( -name "*.xpc" -o -name "*.app" \\) -prune | while IFS= read -r f; do codesign --force --sign - "$f" 2>/dev/null || true; done`,
|
|
{ stdio: "inherit", shell: "/bin/bash" },
|
|
);
|
|
|
|
// Step 3: sign each .framework (the versioned bundle, not through symlinks)
|
|
execSync(
|
|
`find "${appPath}/Contents/Frameworks" -mindepth 1 -maxdepth 1 -name "*.framework" | while IFS= read -r f; do codesign --force --sign - "$f" 2>/dev/null || true; done`,
|
|
{ stdio: "inherit", shell: "/bin/bash" },
|
|
);
|
|
|
|
// Step 4: sign the outer .app
|
|
execSync(`codesign --force --sign - "${appPath}"`, { stdio: "inherit" });
|
|
|
|
console.log("Ad-hoc re-signing complete.");
|
|
};
|