chore(desktop): Developer ID signing + notarization - #254
Merged
Conversation
- Pin mac signing identity to the Developer ID Application cert
(team A933C2TJXU). Name is given WITHOUT the "Developer ID
Application:" prefix — electron-builder rejects the prefix and
picks the cert type automatically.
- notarize.js now prefers a keychain profile (APPLE_KEYCHAIN_PROFILE →
notarytool keychainProfile) so no app-specific password lands in
env/CI logs; falls back to APPLE_ID/APPLE_APP_SPECIFIC_PASSWORD/
APPLE_TEAM_ID for CI.
Build (both arches, signed + notarized + stapled), with the corporate
proxy unset so codesign's timestamp requests reach Apple's TSA:
cd desktop && env -u HTTPS_PROXY -u HTTP_PROXY -u ALL_PROXY \
APPLE_KEYCHAIN_PROFILE=codbash-notary CSC_IDENTITY_AUTO_DISCOVERY=true \
./node_modules/.bin/electron-builder --mac --arm64 --x64
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enables real signing + notarization for the desktop DMG (v7.14.4 is the first signed & notarized release).
desktop/package.json— pinmac.identityto the Developer ID Application cert (teamA933C2TJXU), given without theDeveloper ID Application:prefix (electron-builder rejects the prefix).desktop/scripts/notarize.js— prefer a keychain profile (APPLE_KEYCHAIN_PROFILE→ notarytoolkeychainProfile) so no app-specific password ends up in env/CI logs; env-var mode kept as a CI fallback.Note on the timestamp gotcha: on the build machine
HTTPS_PROXYis set, butcodesign --timestampignores env proxies and hitstimestamp.apple.comdirectly → "The timestamp service is not available" for every nested file. Fix: build over a VPN with the proxy env vars unset so codesign + notarytool share one direct route.Verified: both arch
.apps →spctl -t exec: accepted, source=Notarized Developer ID, stapled; both DMGs notarized (Apple Accepted) + stapled; a quarantined-DMG mount test confirms the app opens without a Gatekeeper warning.🤖 Generated with Claude Code