add code signing

apps/desktop/.env.example

@@ -0,0 +1,15 @@
+# Code signing
+# Get the exact value with: security find-identity -v -p codesigning
+ELECTROBUN_DEVELOPER_ID="Developer ID Application: Teh Zi Gyn (YOUR_TEAM_ID_HERE)"
+
+# Notarization - Option A: App Store Connect API key (recommended)
+# Get these at appstoreconnect.apple.com -> Users and Access -> Integrations -> API Keys -> "+"
+# ELECTROBUN_APPLEAPIISSUER="UUID from the API key page (also in the downloaded .p8 filename)"
+# ELECTROBUN_APPLEAPIKEY="8-char key ID from the API key page"
+# ELECTROBUN_APPLEAPIKEYPATH="/path/to/AuthKey_XXXXXXXXXX.p8"
+
+# Notarization - Option B: Apple ID + app-specific password
+# App-specific password: appleid.apple.com -> Sign-In and Security -> App-Specific Passwords
+# ELECTROBUN_APPLEID="you@example.com"
+# ELECTROBUN_APPLEIDPASS="xxxx-xxxx-xxxx-xxxx"
+# ELECTROBUN_TEAMID="Your Team ID (developer.apple.com -> Membership)"

apps/desktop/.gitignore

@@ -25,3 +25,5 @@ dist-ssr
 
 .router
 artifacts
+.env
+.env.local

apps/desktop/electrobun.config.ts

@@ -18,6 +18,8 @@ export default {
 		watchIgnore: ['dist/**'],
 		mac: {
 			bundleCEF: false,
+			codesign: true,
+			notarize: true,
 		},
 		linux: {
 			bundleCEF: false,

apps/desktop/package.json

@@ -8,10 +8,11 @@
 		"dev:hmr": "concurrently \"bun run hmr\" \"bun run start\"",
 		"hmr": "vite --port 5173",
 		"build:dev": "bun run build:native && vite build && electrobun build",
-		"build:canary": "bun run build:native && vite build && electrobun build --env=canary",
+		"build:canary": "bun run build:native && bun run sign:native && vite build && electrobun build --env=canary",
-		"build:stable": "bun run build:native && vite build && electrobun build --env=stable",
+		"build:stable": "bun run build:native && bun run sign:native && vite build && electrobun build --env=stable",
 		"build:win": "vite build && electrobun build --env=stable",
-		"build:native": "swiftc -O -o src/bun/native/biometric-helper src/bun/native/biometric-helper.swift"
+		"build:native": "swiftc -O -o src/bun/native/biometric-helper src/bun/native/biometric-helper.swift",
+		"sign:native": "bun scripts/sign-native.ts"
 	},
 	"dependencies": {
 		"@koins/utils": "workspace:*",

apps/desktop/scripts/sign-native.ts

@@ -0,0 +1,10 @@
+const id = process.env.ELECTROBUN_DEVELOPER_ID
+if (!id) {
+	console.error('ELECTROBUN_DEVELOPER_ID not set')
+	process.exit(1)
+}
+const r = Bun.spawnSync(
+	['codesign', '--force', '--options', 'runtime', '--timestamp', '--sign', id, 'src/bun/native/biometric-helper'],
+	{ stdout: 'inherit', stderr: 'inherit' },
+)
+process.exit(r.exitCode ?? 1)