Merge pull request #492 from autonomoussoftware/develop

1.4.3-2

README.md

@@ -11,13 +11,20 @@
 
 ## Development
 
+Create a local `.env` file with the following content:
+
+```shell
+ENABLED_CHAINS=
+ROPSTEN_NODE_URL=
+```
+
 ### Requirements
 
 * [Node.js](https://nodejs.org) LTS (v12 minimum, v14 recommended)
 
 ### Launch
 
-```bash
+```sh
 # Install dependencies
 npm i
 
@@ -27,10 +34,10 @@ npm run dev
 
 #### Troubleshooting
 
-- If you get an error when installing the dependencies related to `node-gyp`, try using `sudo` to postinstall the deps
-- For  windows, you might need to install the windows-build-tools. To do so, run 
+- For errors related to `node-gyp` when installing the dependencies, try using `sudo` to postinstall the dependencies.
+- For Windows, installing `windows-build-tools` may be required. To do so, run:
 
-```bash
+```sh
 npm i --global --production windows-build-tools
 ```
 
@@ -44,7 +51,7 @@ The log output is in the next directories:
 
 `process-type` being equal to `main`, `renderer` or `worker`
 
-More info [github.com/megahertz/electron-log](https://github.com/megahertz/electron-log)
+More info [github.com/megahertz/electron-log](https://github.com/megahertz/electron-log).
 
 ### Settings
 
@@ -56,18 +63,67 @@ To completely remove the application and start over, remove the settings file to
 
 ### Production Build
 
-```bash
+```sh
 # Run build process
 npm run dist
 
+# or
+
 # Run build process and publish to GitHub releases
 npm run release
 ```
 
-To sign the macOS installers, execute `npm run dist:mac`.
-The signing certificate shall be in the root folder and be named `met.p12`.
-The certificate password will be required before signing.
+#### macOs
+
+The app needs to be signed and notarized.
+To do so, install the `.p12` file in the local keychain (double click on it).
+
+The certificate is obtained from the Apple Developer website.
+The Developer ID Application is required.
+The Developer ID Installer may be required too.
+Once obtained, the `.cer` files have to be converted to `.p12` by providing the certificate passwords/private keys.
+
+In addition to that, the following environment variables have to be set to publish:
+
+```sh
+# See below to complete these two:
+APPLE_ID=
+APPLE_ID_PASSWORD=
+# See `electron-build` docs on how to complete these two:
+CSC_LINK=
+CSC_KEY_PASSWORD=
+# Github personal access token to upload the files to repo releases.
+GH_TOKEN=
+```
+
+Follow [these steps to create an app specific password](https://support.apple.com/en-us/HT204397).
+The `APPLE_ID` variable is the Apple ID used to create the password.
+`APPLE_ID_PASSWORD` is the password Apple created for the app.
+
+The GitHub personal access token needs `repo` permissions.
+See the docs on [how to create a personal access access token](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token) for more information.
+
+The signing certificate shall be in the root folder of the repository.
+The certificate password will be required during the signing process.
+The signing process may take several minutes because notarization requieres uploading the app to Apple.
+
+In order to verify that the application has been successfully signed and notarized, run:
+
+```sh
+# Verifies the app has been signed
+codesign --verify --verbose ./dist/mac/Metronome\ Wallet.app
+
+# Verifies the app has been notarized
+spctl -a -t exec -vvv ./dist/mac/Metronome\ Wallet.app
+```
+
+#### Windows
+
+To sign the application, a certificate for the Microsoft Authenticode platform is required.
+The certificate, a `.p7b` file, will then be required during the build process.
+
+Current provider is [DigiCert](https://www.digicert.com).
 
 ## License
 
-MIT
+MIT

entitlements.mac.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+  </dict>
+</plist>

package.json

@@ -73,6 +73,7 @@
     "electron": "13.1.4",
     "electron-builder": "22.11.7",
     "electron-devtools-installer": "3.2.0",
+    "electron-notarize": "1.0.0",
     "eslint-config-bloq": "2.4.0",
     "eslint-config-prettier": "8.3.0",
     "eslint-config-standard": "16.0.3",
@@ -107,14 +108,19 @@
     "directories": {
       "buildResources": "assets"
     },
+    "afterSign": "scripts/notarize.js",
     "mac": {
       "artifactName": "${name}_v${version}.${ext}",
       "category": "public.app-category.finance",
       "icon": "./assets/icon.icns",
       "extendInfo": {
         "NSUserNotificationAlertStyle": "alert"
       },
-      "electronUpdaterCompatibility": ">= 2.16"
+      "electronUpdaterCompatibility": ">= 2.16",
+      "hardenedRuntime": true,
+      "gatekeeperAssess": false,
+      "entitlements": "./entitlements.mac.plist",
+      "entitlementsInherit": "./entitlements.mac.plist"
     },
     "dmg": {
       "backgroundColor": "#7e61f8",

scripts/notarize.js

@@ -0,0 +1,19 @@
+require('dotenv').config();
+const { notarize } = require('electron-notarize');
+
+exports.default = function notarizing(context) {
+  const { electronPlatformName, appOutDir } = context;  
+  if (electronPlatformName !== 'darwin') {
+    return;
+  }
+
+  const appName = context.packager.appInfo.productFilename;
+
+  return notarize({
+    appBundleId: 'sh.autonomous.metronome.wallet.desktop',
+    appPath: `${appOutDir}/${appName}.app`,
+    appleId: process.env.APPLE_ID,
+    appleIdPassword: process.env.APPLE_ID_PASSWORD,
+    ascProvider: '99Y6CF5TBP'
+  });
+};