Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit f8a020e

Browse filesBrowse files
rvaggMylesBorins
rvagg
authored and
MylesBorins
committed
build: macOS package notarization
Includes hardened-runtime patch from gdams from #29216 (comment) PR-URL: #31459 Refs: #29216 Reviewed-By: Christian Clauss <cclauss@me.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ash Cripps <ashley.cripps@ibm.com> Signed-off-by: Rod Vagg <rod@vagg.org>
1 parent 6387cf8 commit f8a020e
Copy full SHA for f8a020e

File tree

Expand file treeCollapse file tree

6 files changed

+77
-1
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

6 files changed

+77
-1
lines changed
Open diff view settings
Collapse file

‎.gitignore‎

Copy file name to clipboardExpand all lines: .gitignore
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
/doc/api.xml
3434
/node
3535
/node_g
36+
/gon-config.json
3637
/*.exe
3738
/*.swp
3839
/out
Collapse file

‎Makefile‎

Copy file name to clipboardExpand all lines: Makefile
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1003,6 +1003,7 @@ $(PKG): release-only
10031003
--resources $(MACOSOUTDIR)/installer/productbuild/Resources \
10041004
--package-path $(MACOSOUTDIR)/pkgs ./$(PKG)
10051005
SIGN="$(PRODUCTSIGN_CERT)" PKG="$(PKG)" bash tools/osx-productsign.sh
1006+
bash tools/osx-notarize.sh $(FULLVERSION)
10061007

10071008
.PHONY: pkg
10081009
# Builds the macOS installer for releases.
Collapse file

‎tools/osx-codesign.sh‎

Copy file name to clipboardExpand all lines: tools/osx-codesign.sh
+10-1Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,13 @@ if [ "X$SIGN" == "X" ]; then
88
exit 0
99
fi
1010

11-
codesign -s "$SIGN" "$PKGDIR"/bin/node
11+
# All macOS executable binaries in the bundle must be codesigned with the
12+
# hardened runtime enabled.
13+
# See https://github.com/nodejs/node/pull/31459
14+
15+
codesign \
16+
--sign "$SIGN" \
17+
--entitlements tools/osx-entitlements.plist \
18+
--options runtime \
19+
--timestamp \
20+
"$PKGDIR"/bin/node
Collapse file

‎tools/osx-entitlements.plist‎

Copy file name to clipboard
+16Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.allow-jit</key>
6+
<true/>
7+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
8+
<true/>
9+
<key>com.apple.security.cs.disable-executable-page-protection</key>
10+
<true/>
11+
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
12+
<true/>
13+
<key>com.apple.security.cs.disable-library-validation</key>
14+
<true/>
15+
</dict>
16+
</plist>
Collapse file

‎tools/osx-gon-config.json.tmpl‎

Copy file name to clipboard
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"notarize": [{
3+
"path": "node-{{pkgid}}.pkg",
4+
"bundle_id": "org.nodejs.pkg.{{pkgid}}",
5+
"staple": true
6+
}],
7+
8+
"apple_id": {
9+
"username": "{{appleid}}",
10+
"password": "@env:NOTARIZATION_PASSWORD"
11+
}
12+
}
Collapse file

‎tools/osx-notarize.sh‎

Copy file name to clipboard
+37Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/bin/bash
2+
3+
# Uses gon, from https://github.com/mitchellh/gon, to notarize a generated node-<version>.pkg file
4+
# with Apple for installation on macOS Catalina and later as validated by Gatekeeper.
5+
6+
set -e
7+
8+
gon_version="0.2.2"
9+
gon_exe="${HOME}/.gon/gon_${gon_version}"
10+
11+
__dirname="$(CDPATH= cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
12+
pkgid="$1"
13+
14+
if [ "X${pkgid}" == "X" ]; then
15+
echo "Usage: $0 <pkgid>"
16+
exit 1
17+
fi
18+
19+
if [ "X$NOTARIZATION_ID" == "X" ]; then
20+
echo "No NOTARIZATION_ID environment var. Skipping notarization."
21+
exit 0
22+
fi
23+
24+
set -x
25+
26+
mkdir -p "${HOME}/.gon/"
27+
28+
if [ ! -f "${gon_exe}" ]; then
29+
curl -sL "https://github.com/mitchellh/gon/releases/download/v${gon_version}/gon_${gon_version}_macos.zip" -o "${gon_exe}.zip"
30+
(cd "${HOME}/.gon/" && rm -f gon && unzip "${gon_exe}.zip" && mv gon "${gon_exe}")
31+
fi
32+
33+
cat tools/osx-gon-config.json.tmpl \
34+
| sed -e "s/{{appleid}}/${NOTARIZATION_ID}/" -e "s/{{pkgid}}/${pkgid}/" \
35+
> gon-config.json
36+
37+
"${gon_exe}" -log-level=info gon-config.json

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.