From 42a22918a3be7519281272c4a1e7b9fbd87b96c6 Mon Sep 17 00:00:00 2001 From: TZGyn Date: Sat, 1 Aug 2026 14:31:13 +0800 Subject: [PATCH] add code signing --- apps/desktop/.env.example | 15 +++++++++++++++ apps/desktop/.gitignore | 2 ++ apps/desktop/electrobun.config.ts | 2 ++ apps/desktop/package.json | 7 ++++--- apps/desktop/scripts/sign-native.ts | 10 ++++++++++ apps/desktop/src/bun/native/biometric-helper | Bin 54880 -> 72832 bytes 6 files changed, 33 insertions(+), 3 deletions(-) create mode 100644 apps/desktop/.env.example create mode 100644 apps/desktop/scripts/sign-native.ts diff --git a/apps/desktop/.env.example b/apps/desktop/.env.example new file mode 100644 index 0000000..77e587a --- /dev/null +++ b/apps/desktop/.env.example @@ -0,0 +1,15 @@ +# Code signing +# Get the exact value with: security find-identity -v -p codesigning +ELECTROBUN_DEVELOPER_ID="Developer ID Application: Teh Zi Gyn (YOUR_TEAM_ID_HERE)" + +# Notarization - Option A: App Store Connect API key (recommended) +# Get these at appstoreconnect.apple.com -> Users and Access -> Integrations -> API Keys -> "+" +# ELECTROBUN_APPLEAPIISSUER="UUID from the API key page (also in the downloaded .p8 filename)" +# ELECTROBUN_APPLEAPIKEY="8-char key ID from the API key page" +# ELECTROBUN_APPLEAPIKEYPATH="/path/to/AuthKey_XXXXXXXXXX.p8" + +# Notarization - Option B: Apple ID + app-specific password +# App-specific password: appleid.apple.com -> Sign-In and Security -> App-Specific Passwords +# ELECTROBUN_APPLEID="you@example.com" +# ELECTROBUN_APPLEIDPASS="xxxx-xxxx-xxxx-xxxx" +# ELECTROBUN_TEAMID="Your Team ID (developer.apple.com -> Membership)" diff --git a/apps/desktop/.gitignore b/apps/desktop/.gitignore index 1257b95..199288e 100644 --- a/apps/desktop/.gitignore +++ b/apps/desktop/.gitignore @@ -25,3 +25,5 @@ dist-ssr .router artifacts +.env +.env.local diff --git a/apps/desktop/electrobun.config.ts b/apps/desktop/electrobun.config.ts index 065c4cd..a7e86a3 100644 --- a/apps/desktop/electrobun.config.ts +++ b/apps/desktop/electrobun.config.ts @@ -18,6 +18,8 @@ export default { watchIgnore: ['dist/**'], mac: { bundleCEF: false, + codesign: true, + notarize: true, }, linux: { bundleCEF: false, diff --git a/apps/desktop/package.json b/apps/desktop/package.json index b759a14..06f63b4 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -8,10 +8,11 @@ "dev:hmr": "concurrently \"bun run hmr\" \"bun run start\"", "hmr": "vite --port 5173", "build:dev": "bun run build:native && vite build && electrobun build", - "build:canary": "bun run build:native && vite build && electrobun build --env=canary", - "build:stable": "bun run build:native && vite build && electrobun build --env=stable", + "build:canary": "bun run build:native && bun run sign:native && vite build && electrobun build --env=canary", + "build:stable": "bun run build:native && bun run sign:native && vite build && electrobun build --env=stable", "build:win": "vite build && electrobun build --env=stable", - "build:native": "swiftc -O -o src/bun/native/biometric-helper src/bun/native/biometric-helper.swift" + "build:native": "swiftc -O -o src/bun/native/biometric-helper src/bun/native/biometric-helper.swift", + "sign:native": "bun scripts/sign-native.ts" }, "dependencies": { "@koins/utils": "workspace:*", diff --git a/apps/desktop/scripts/sign-native.ts b/apps/desktop/scripts/sign-native.ts new file mode 100644 index 0000000..a6377fb --- /dev/null +++ b/apps/desktop/scripts/sign-native.ts @@ -0,0 +1,10 @@ +const id = process.env.ELECTROBUN_DEVELOPER_ID +if (!id) { + console.error('ELECTROBUN_DEVELOPER_ID not set') + process.exit(1) +} +const r = Bun.spawnSync( + ['codesign', '--force', '--options', 'runtime', '--timestamp', '--sign', id, 'src/bun/native/biometric-helper'], + { stdout: 'inherit', stderr: 'inherit' }, +) +process.exit(r.exitCode ?? 1) \ No newline at end of file diff --git a/apps/desktop/src/bun/native/biometric-helper b/apps/desktop/src/bun/native/biometric-helper index d6875f9ba759315c9c349342807009e480d9f300..cf4ea97d7a33cdb61de8d14e88495805db6c58c2 100755 GIT binary patch delta 9639 zcmc&)2Ut@{yG}yrU5bd5P^IUD4g%79Q@{d<#3Vwb1e4HY;gGnZ6mbC?qKJT?f&~G= zUO;Jfx*`Hr5F3an7VaFHu{(JA;^E@Z#O!;Oellk6xzjxA8%8_^mds383G!Zp< zU7ma-`j;zm`C>7Fj#)%8>+;Kd>l&7+1cNe;$#Rr3cw$f}bRY_i*u5ZqW4ss)F`poGBt^tB<2#V743I<6egWY(hjDCMo{Re zWh)Jh42`@DtyiGKc?FM4(?&a6i_=-Fl^-18D0Qo=la{~iy){H&#mK$AF_l;L94 zv0#)3>s&B+l|Q&mu`ju`;e zP8=1xr?WNQYLK?&91&3sxUR=cFjoGdwJx* zc;&$2eS_2+W?%8g+=rkr8`9Qd3M>OA1DS%8;6|Rvq=|z(@IdVYH)uAQOhv=hH}XOd2JTxiE<3X#Q3ZtB0?!Rr*M)EK^0O)GWo@1Co^p*bS8Bjl|*DxY2i4lNM z0cBfC6eW}f797sW7WZd8O^umf0OO!LGiHI=W9ElveJzNMR-FCC!Sr#k(ZVQ@&xc{7 z(Wqvvoxuv;87Y@28?H*Zf4C{wo1qrj&T)39eDl2QWwzak_Ca6NQ&F3@ra)WVT*I9! z>YidAx076t-WV8sV2#g+SLt6<=%V3Gn_mhYP*>A0gtx;_V;-+o(onF!lU%drt=|#_tq6p8=ab04b`Vdj-TB?1sA;2#6_Gg}F zYg;XMRvP)=SSZx{rt8qtZ4I7PmIwHhRO~Fb?+A+P*)d?!9CJwj?$xFqJy_?oR?Sn@ zR+U>vw`oLw$raxP@9r5{qcilPcti2xf^64~iUn?OB1Bu;l346_L3&wwzLsT~wMQAd zWNZD$dtVx1IM66`0qYIK8ieM7pF&m)jULDHKwRK~L8BmfBu@z|1xY4~Yu=$c?1vS`(q5!_nqb5afxLdu1a?}7zh!3BwM&G;yW3kzU!_PPKL0oDZ?b>*uK z->OUR%BpNceA}dSA@Sv^y`qjJO)7o2qkOtwV}Po}XQoo3p10nDgNjMM9n~(>qs6y& z?YhcWXR!Vb?N$nP(^@#p*<|F~Cb#zdmaX!ywq6$g_(@N$LZs@dzo?O|5%y%E?f$f2 z!MJ$Ygd3GvZ`)|*5*rf_F`Ik0$KTuff>6BYn*5_a_NwEFtU!Co!Q3+`mPZ$A^b(W! z(jtUAowWvC^EpM^V$%+hR1}mjv@Ad06$jhx!XDiig%7NGQ1^;l4AX4!G&l2@7{28d zi`z}>H7WU70}oaXq_>=@y$pTPm3BLuDWGh!hi#gd-TnN@lk-C7H=pn=@xSxs!3~ib z043)DloU)r2|$zCv&8uy!3O+a;>KLq01HW9*Fcw`59t{quwek{0vwr4{xx>N{{*~d z4dQ3e@g(C2uYAS>IS0>|oUa06f7O0zn7_i+XAn+Zklg*rC3J+lL=nQgkh1vb$=eKD z9p3ZlZsWRr$|0h63eG)Qs8J)oGk2pvp+l-)i=>fWQ?0PuEph7Ih6VJI)k3ZCnw%jO zj-E-qD~v2_0)hffH!L32^{NoaM4V1d^X34I7Q@QL;EJ8_ff{ z#DW_&wW*QFoM?zO1Zi;bz>{c%K}*UZ2*Lp96CE8r3qmGPheX6fteR=0!eAiQX=zsZ zGD;|w7*3+#!1l%rrZRA(nH`UUTN{fbhR5O}h;$}+V=yAaC=48tM5076CvDaN8ww5v zAK^Hp6R=UP1q+G+ipfMe8ONm1!+=FN8Aqaplc~ri%D~aq;UXCntvNkK(10z{8>l%m z0A$OJpc6?e2N(lsplSyH`$cxg=;phExWYW zgD+%U^UJDYPTpVUTP_!sV>VZ%DlK*>Xr(Fly}Vl$@krRNcTwZJu$WiRE9cKY+yy5n z8Z@f3b_%zJwB#!*iH;sD-OgYIUSH_Pi_bju(bn;8pmDCmh`DMIE=6zss37}x_satO zC$IH>rK83o8iSKg(F)QQ2t-U)kc*S)6@F*ZOlu>xSHfgUhNGUdXam zo~KbKEPL8*UjV7zC2_vz(UjKvPrlsYg}IGRMn);~ZkcacbXf)u)LP z|C|=58J_^(q#a^5hZ6$#`fKuZnxJ63tF@%W`(D1@2f>l<+8h)8hkId;qZyv+<-jTC}9UmSPR%xX*)wHt~b_I7kD zSX8aEIK#V=a##loF6MzRJoC5>RWlq22D3cV0J`F#B zIjw`pfC5c1DF~CKIL&^5|1)NR7nu@8B?sy1kSTOXccwl%Np*&3!9QYJQ)XcGvC(qV zASwY8qTrs63?@Nz{P(yh@b_>L{xe|wf5Jt01{jT|=LhTsnm^tPzQZepI33R5AxUJ0 zRFL0M0OFf&go9(&2F9yTi;UlfPjeEjIe1p8uTjOLL@QuL z1%!1W-AN3XihsmrRS=w5H$Ud3S)=ihr0uV3LRFnN4O|HrjXj1*;Jz3(f9EGWhm%j$ z+c#D^=N3y)m$O11VBrXqYyEubi!yO(W6Fq%j2>-nlOHjn(+8sCS zew@2S?c%xeLuG5EC7aq+DHZArQIVZ{Zn<@x?t#pv3`k^N3;_>m&k_XwU=9D#oQ+oh z-T<1wMoR+3=*EUvMV!>yoVC!My zy~@)L2N(^5iSzWac6GABDQe^K$nHbI<88fdah|SDUfwv+1|G)SxhvwP@oO&i0yPT7JR&BA(U7P5;>U22&OR1@JI?|66tgz z^1^FICNhc03juGGFJMVmGyT&@mQ)I2w)cV;&e^+94@|X(! zj#Z0fK|{eBTzZ|V@GeS9E%pg}?8FiEPMun<_Dphj5xg#Hl}bXaeYR_|a9WbjUV=L# zc;$Y13Hh)4Efcp}AG7Vdb-Q}M7`%@qzawO+EX?Dbb}78*iHtQ?;dS0uQO~H}LxVzujk~=S4`+zIcDQ!y>f)uUVh38kj%^0)j=6s+r{sR4X|3UOe7vr5b$O$P7Mw$Cl}b6=E_`H9BUxN;L-e;cC^)!4WY5= zcMaN$&N}+ZT3+tZJGG?Fxdg+5A04@&Dy`=r^&MCZ2=Ii9ftVkS;aPv2GQ9^C=>X#3g!*CEH_zMA=&>{fUS~Rh~ao$uw^qIu4h(A@Orgbs_ zL?=V^FPk~6{ku^1opVh#J)yGwfF>I0>O+S526~8M2B5!J_(IkMIRGvbOi<$c zz`UqI;XpWZU*V!lfPdb}&xl=4vzO_z@D_rn0l~sml;g;eD3(o3#vNDuhs%1LL0RpV z)_(aX34FvgZO=Mfi1A&=hM3nM5{LX-|!id$nq?qs_j+}r!O^3Eu06n@eMeKgW>-2A`xZmtH+H8DqrRv8| zed^sqGH@2KnNXjQK$R0DKxF!D27i$_^(~|}%_;yjk(r`ybD@%mU@OqYeix+voQ%Q$ zQIz_BN5brY3{~6`+vk>9ydIt;~a&8)3Iqh1s&H4Rv zhYDT?5RlSJV+|zeZ5iU`iKJJa{Ojf3ioa}RbUK@AoR2R5oPnLUOVd}$*r0!)cXWHk z0-0wehjyHFTd^+D8eU%LzC&s8Yk#G~2jgGGAhp$Bn)o1Rx7_uaq z6`_)>1f7xb{m`)t|23=o(UKAK2K&xsHP01}M$tfY%njm}H&cKZ@4A9?VEAp-?eDp8?>UlY&`d8#pK+fKV7R0H3=0`Uvb9%}V|qREDQ{{LJyi1T6m}RQ?%Y zHb+Yx9L*L9^1r8(3s-Mf3bOcO-Nzfxmr^bDg<*-mP}|{oZBhNVYW;{jK{2xnJnnn5 zXeLJYb15Sgr1!toJB6*rHJg0pJ^S8t_?9!3%$aT9bKjtrA|-cSvS1#uLTBV{vS3=5 z`3J7sv?LW*-m44ig<`gDyP{ZqRzWPM@pVe>!#Kb3g8sV&tb}jy__H*pCyV($i4@WG z&S}*;`_lPLJed#G!eiGY6dxA9y}W#R=%N0%wZ}gV;L@e))R=udZpo_Fu>l_fAKR@w z_<5;QK&G?XnKvzr%KO;3$IA{h6)ad?8nP!ew{MWCZEMj(wBWW&(2rEzW0@0~TMxZ* zxfH#9>KLI2V!;Ko;-nwoV;1xWVeqHQ-`_bLfRWRIx$1w?9QB{~&(wdzdn4T&yto^b zI%0At=Z9PU`m5oEN_F|SD~_o3e|#9RRl#KVf!@9vx=ow8_0rvEkIANI-iu7FS-o$h zDXnY$deet5z2jfO;vvIr7FqRS8@<;I*`$lyiSo}u3COxPn%x|GHhR^9URB-wLjR~l z-f{n+!vdu_a+LDN!jQFo|M6yYbMZrKM&vI`Z8q->6zMv?=w3)rgPt9&VUJwiUf4}E ztCu=H=wdhQ-l!d=3V0 z9av`3@V@2Q*pk90s)?1RA#F8JKk2gSb@Ls2)42*3JSlHl?DDARhR~@Kd+u)f=jy)> z0iI?Oat5|NEoMS%dhQ$N!o7pSl44SJi*%diY;e|HrZL))Xd z|Cl{Y;?L}$4)Z=963|B!6HB|ZfhwGz8X@d{FomQ*3l}kRT$mVT#-FLFdZ`qnIZ0V(z?vS&W zsyMCTlCFhz%z{?G<;q@hB!XPPM|_G8UqEU93f1f*A80!+c>8319^^SEowCScD1EHZ zz_YCXjCnD(PRM}JM(1%#*VwrC7el|OrxsziXL+7xXY$pNt9e{wy}(JN~}to1YUQ*41oz2OX+-%teWuupKo@vF(xx{*lW& MTHIew6#J(5KV>9r6#xJL delta 585 zcmZqJ$?{+g^9DgSK?ep1H~^s%#5OCjMX@kBFilPrcG`S^EA6BilPyq=5hBkZ^6MTC z69WU2CIb@-kOD#mhD;!ifXeeRFkDekU}E5z+{mR?&pHJv%$Ss!pPO1zl$orXk(yJG zTEwvKwW5Smsr$YdWs4R)2H#U5>lmDZlfS%xKyI^;>S|H3n%QYtQxK#Do!eO3{Bx+XI$I5f|c#g;YGw)fX{rO{(8JFJkU_$ z`bxq6oAy6rjfmJIoGizp?{4$mx?tOfl0Wb79==Pt0}}BEQBkUwPM73FAGdQdD-DHg zS0CN^{^;J47hanV_1sOCNZ#M|h>c~bmz?kH