🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →

@electron/osx-sign

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

@electron/osx-sign - npm Package Compare versions

Comparing version

1.3.3

2.0.0

+43

bin/electron-osx-flat.mjs

		#!/usr/bin/env node
		// @ts-check
		import fs from 'node:fs';
		import path from 'node:path';
		import { parseArgs } from 'node:util';
		import { flat } from '../dist/flat.js';

		const { values, positionals } = parseArgs({
		options: {
		help: {
		type: 'boolean',
		default: false,
		},
		},
		allowPositionals: true,
		});

		const app = positionals.shift();

		if (!app \|\| values.help \|\| positionals.length > 0) {
		const usage = fs
		.readFileSync(path.join(import.meta.dirname, 'electron-osx-flat-usage.txt'))
		.toString();
		console.log(usage);
		process.exit(0);
		}

		try {
		await flat({ app });
		// This is the default value inferred in the `flat` function.
		console.log(
		`Application flattened, saved to: ${path.join(path.dirname(app), path.basename(app, '.app') + '.pkg')}`,
		);
		process.exit(0);
		} catch (err) {
		if (err) {
		console.error('Flat failed:');
		if (err.message) console.error(err.message);
		else if (err.stack) console.error(err.stack);
		else console.log(err);
		process.exit(1);
		}
		}

+41

bin/electron-osx-sign.mjs

		#!/usr/bin/env node
		// @ts-check
		import fs from 'node:fs';
		import path from 'node:path';
		import { parseArgs } from 'node:util';
		import { sign } from '../dist/sign.js';

		const { values, positionals } = parseArgs({
		options: {
		'signature-flags': { type: 'string' },
		help: { type: 'boolean' },
		'pre-auto-entitlements': { type: 'boolean', default: true },
		'pre-embed-provisioning-profile': { type: 'boolean', default: true },
		'hardened-runtime': { type: 'boolean' },
		restrict: { type: 'boolean' },
		},
		allowPositionals: true,
		});

		const app = positionals.shift();
		const binaries = positionals;

		if (!app \|\| values.help) {
		const usage = fs
		.readFileSync(path.join(import.meta.dirname, 'electron-osx-sign-usage.txt'))
		.toString();
		console.log(usage);
		process.exit(0);
		} else {
		try {
		await sign({ app, binaries });
		console.log(`Application signed: ${app}`);
		process.exit(0);
		} catch (err) {
		console.error('Sign failed:');
		if (err.message) console.error(err.message);
		else if (err.stack) console.error(err.stack);
		else console.log(err);
		process.exit(1);
		}
		}

+8

dist/flat.d.ts

		import type { FlatOptions } from './types.js';
		/**
		* Generates a flat `.pkg` installer for a packaged Electron `.app` bundle.
		* @returns A void Promise once the flattening operation is complete.
		*
		* @category Flat
		*/
		export declare function flat(_opts: FlatOptions): Promise<void>;

+128

dist/flat.js

		import path from 'node:path';
		import { debugLog, debugWarn, execFileAsync, validateOptsApp, validateOptsPlatform, } from './util.js';
		import { findIdentities } from './util-identities.js';
		/**
		* This function returns a promise validating all options passed in opts.
		* @function
		* @param {Object} opts - Options.
		* @returns {Promise} Promise.
		*/
		async function validateFlatOpts(opts) {
		await validateOptsApp(opts);
		let pkg = opts.pkg;
		if (pkg) {
		if (typeof pkg !== 'string')
		throw new Error('`pkg` must be a string.');
		if (path.extname(pkg) !== '.pkg') {
		throw new Error('Extension of output package must be `.pkg`.');
		}
		}
		else {
		debugWarn('No `pkg` passed in arguments, will fallback to default inferred from the given application.');
		pkg = path.join(path.dirname(opts.app), path.basename(opts.app, '.app') + '.pkg');
		}
		let install = opts.install;
		if (install) {
		if (typeof install !== 'string') {
		return Promise.reject(new Error('`install` must be a string.'));
		}
		}
		else {
		debugWarn('No `install` passed in arguments, will fallback to default `/Applications`.');
		install = '/Applications';
		}
		if (typeof opts.scripts === 'string' && opts.platform === 'mas') {
		debugWarn('Mac App Store packages cannot have `scripts`, ignoring option.');
		}
		return {
		...opts,
		pkg,
		install,
		platform: await validateOptsPlatform(opts),
		};
		}
		/**
		* This function returns a promise flattening the application.
		* @param opts - Options for building the .pkg archive
		*/
		async function buildApplicationPkg(opts, identity) {
		if (opts.platform === 'mas') {
		const args = ['--component', opts.app, opts.install, '--sign', identity.name, opts.pkg];
		if (opts.keychain) {
		args.unshift('--keychain', opts.keychain);
		}
		debugLog('Flattening Mac App Store package... ' + opts.app);
		await execFileAsync('productbuild', args);
		}
		else {
		const componentPkgPath = path.join(path.dirname(opts.app), path.basename(opts.app, '.app') + '-component.pkg');
		const pkgbuildArgs = [
		'--install-location',
		opts.install,
		'--component',
		opts.app,
		componentPkgPath,
		];
		if (opts.scripts) {
		pkgbuildArgs.unshift('--scripts', opts.scripts);
		}
		debugLog('Building component package... ' + opts.app);
		await execFileAsync('pkgbuild', pkgbuildArgs);
		const args = ['--package', componentPkgPath, opts.install, '--sign', identity.name, opts.pkg];
		if (opts.keychain) {
		args.unshift('--keychain', opts.keychain);
		}
		debugLog('Flattening OS X Installer package... ' + opts.app);
		await execFileAsync('productbuild', args);
		await execFileAsync('rm', [componentPkgPath]);
		}
		}
		/**
		* Generates a flat `.pkg` installer for a packaged Electron `.app` bundle.
		* @returns A void Promise once the flattening operation is complete.
		*
		* @category Flat
		*/
		export async function flat(_opts) {
		const validatedOptions = await validateFlatOpts(_opts);
		let identities = [];
		let identityInUse = null;
		if (validatedOptions.identity) {
		debugLog('`identity` passed in arguments.');
		if (validatedOptions.identityValidation === false) {
		// Do nothing
		}
		else {
		identities = await findIdentities(validatedOptions.keychain \|\| null, validatedOptions.identity);
		}
		}
		else {
		debugWarn('No `identity` passed in arguments...');
		if (validatedOptions.platform === 'mas') {
		debugLog('Finding `3rd Party Mac Developer Installer` certificate for flattening app distribution in the Mac App Store...');
		identities = await findIdentities(validatedOptions.keychain \|\| null, '3rd Party Mac Developer Installer:');
		}
		else {
		debugLog('Finding `Developer ID Application` certificate for distribution outside the Mac App Store...');
		identities = await findIdentities(validatedOptions.keychain \|\| null, 'Developer ID Installer:');
		}
		}
		if (identities.length > 0) {
		// Provisioning profile(s) found
		if (identities.length > 1) {
		debugWarn('Multiple identities found, will use the first discovered.');
		}
		else {
		debugLog('Found 1 identity.');
		}
		identityInUse = identities[0];
		}
		else {
		// No identity found
		throw new Error('No identity found for signing.');
		}
		debugLog('Flattening application...', '\n', '> Application:', validatedOptions.app, '\n', '> Package output:', validatedOptions.pkg, '\n', '> Install path:', validatedOptions.install, '\n', '> Identity:', validatedOptions.identity, '\n', '> Scripts:', validatedOptions.scripts);
		await buildApplicationPkg(validatedOptions, identityInUse);
		debugLog('Application flattened.');
		}
		//# sourceMappingURL=flat.js.map

+1

dist/flat.js.map

+5

dist/index.d.ts

		import { sign } from './sign.js';
		import { flat } from './flat.js';
		import { walk } from './util.js';
		export { sign, flat, walk };
		export type * from './types.js';

+5

dist/index.js

		import { sign } from './sign.js';
		import { flat } from './flat.js';
		import { walk } from './util.js';
		export { sign, flat, walk };
		//# sourceMappingURL=index.js.map

+1

dist/index.js.map

{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC"}

+8

dist/sign.d.ts

		import type { SignOptions } from './types.js';
		/**
		* Signs a macOS application.
		* @returns A void Promise once the signing operation is complete.
		*
		* @category Codesign
		*/
		export declare function sign(_opts: SignOptions): Promise<void>;

+326

dist/sign.js

		import os from 'node:os';
		import path from 'node:path';
		import util from 'node:util';
		import fs from 'graceful-fs';
		import plist from 'plist';
		import semver from 'semver';
		import { debugLog, debugWarn, getAppContentsPath, execFileAsync, validateOptsApp, validateOptsPlatform, walk, } from './util.js';
		import { Identity, findIdentities } from './util-identities.js';
		import { preEmbedProvisioningProfile, getProvisioningProfile, } from './util-provisioning-profiles.js';
		import { preAutoEntitlements } from './util-entitlements.js';
		const osRelease = os.release();
		/**
		* This function returns a promise validating opts.binaries, the additional binaries to be signed along with the discovered enclosed components.
		*/
		async function validateOptsBinaries(opts) {
		if (opts.binaries) {
		if (!Array.isArray(opts.binaries)) {
		throw new Error('Additional binaries should be an Array.');
		}
		// TODO: Presence check for binary files, reject if any does not exist
		}
		}
		function validateOptsIgnore(ignore) {
		if (ignore && !(ignore instanceof Array)) {
		return [ignore];
		}
		}
		/**
		* This function returns a promise validating all options passed in opts.
		*/
		async function validateSignOpts(opts) {
		await validateOptsBinaries(opts);
		await validateOptsApp(opts);
		if (opts.provisioningProfile && typeof opts.provisioningProfile !== 'string') {
		throw new Error('Path to provisioning profile should be a string.');
		}
		if (opts.type && opts.type !== 'development' && opts.type !== 'distribution') {
		throw new Error('Type must be either `development` or `distribution`.');
		}
		const platform = await validateOptsPlatform(opts);
		const cloned = {
		...opts,
		ignore: validateOptsIgnore(opts.ignore),
		type: opts.type \|\| 'distribution',
		platform,
		};
		return cloned;
		}
		/**
		* This function returns a promise verifying the code sign of application bundle.
		*/
		async function verifySignApplication(opts) {
		// Verify with codesign
		debugLog('Verifying application bundle with codesign...');
		const strictVerify = opts.strictVerify !== undefined ? opts.strictVerify : true;
		await execFileAsync('codesign', ['--verify', '--deep'].concat(strictVerify !== false && semver.gte(osRelease, '15.0.0') // Strict flag since darwin 15.0.0 --> OS X 10.11.0 El Capitan
		? ['--strict' + (strictVerify !== true ? '=' + strictVerify : '')]
		: [], ['--verbose=2', opts.app]));
		}
		function defaultOptionsForFile(filePath, platform) {
		const entitlementsFolder = path.resolve(import.meta.dirname, '..', 'entitlements');
		let entitlementsFile;
		if (platform === 'darwin') {
		// Default Entitlements
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/app-entitlements.plist
		// Also include JIT for main process V8
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.plist');
		// Plugin helper
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/helper-plugin-entitlements.plist
		if (filePath.includes('(Plugin).app')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.plugin.plist');
		// GPU Helper
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/helper-gpu-entitlements.plist
		}
		else if (filePath.includes('(GPU).app')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.gpu.plist');
		// Renderer Helper
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/helper-renderer-entitlements.plist
		}
		else if (filePath.includes('(Renderer).app')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.renderer.plist');
		}
		}
		else {
		// Default entitlements
		// TODO: Can these be more scoped like the non-mas variant?
		entitlementsFile = path.resolve(entitlementsFolder, 'default.mas.plist');
		// If it is not the top level app bundle, we sign with inherit
		if (filePath.includes('.app/')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.mas.child.plist');
		}
		}
		return {
		entitlements: entitlementsFile,
		hardenedRuntime: true,
		requirements: undefined,
		signatureFlags: undefined,
		timestamp: undefined,
		additionalArguments: [],
		};
		}
		async function mergeOptionsForFile(opts, defaults) {
		const mergedPerFileOptions = { ...defaults };
		if (opts) {
		if (opts.entitlements !== undefined) {
		if (Array.isArray(opts.entitlements)) {
		const entitlements = opts.entitlements.reduce((dict, entitlementKey) => ({
		...dict,
		[entitlementKey]: true,
		}), {});
		const dir = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'tmp-entitlements-'));
		const entitlementsPath = path.join(dir, 'entitlements.plist');
		await util.promisify(fs.writeFile)(entitlementsPath, plist.build(entitlements), 'utf8');
		opts.entitlements = entitlementsPath;
		}
		mergedPerFileOptions.entitlements = opts.entitlements;
		}
		if (opts.hardenedRuntime !== undefined) {
		mergedPerFileOptions.hardenedRuntime = opts.hardenedRuntime;
		}
		if (opts.requirements !== undefined)
		mergedPerFileOptions.requirements = opts.requirements;
		if (opts.signatureFlags !== undefined) {
		mergedPerFileOptions.signatureFlags = opts.signatureFlags;
		}
		if (opts.timestamp !== undefined)
		mergedPerFileOptions.timestamp = opts.timestamp;
		if (opts.additionalArguments !== undefined)
		mergedPerFileOptions.additionalArguments = opts.additionalArguments;
		}
		return mergedPerFileOptions;
		}
		/**
		* This function returns a promise codesigning only.
		*/
		async function signApplication(opts, identity) {
		function shouldIgnoreFilePath(filePath) {
		if (opts.ignore) {
		return opts.ignore.some(function (ignore) {
		if (typeof ignore === 'function') {
		return ignore(filePath);
		}
		return filePath.match(ignore);
		});
		}
		return false;
		}
		const children = await walk(getAppContentsPath(opts));
		if (opts.binaries)
		children.push(...opts.binaries);
		const args = ['--sign', identity.hash \|\| identity.name, '--force'];
		if (opts.keychain) {
		args.push('--keychain', opts.keychain);
		}
		/**
		* Sort the child paths by how deep they are in the file tree. Some arcane apple
		* logic expects the deeper files to be signed first otherwise strange errors get
		* thrown our way
		*/
		children.sort((a, b) => {
		const aDepth = a.split(path.sep).length;
		const bDepth = b.split(path.sep).length;
		return bDepth - aDepth;
		});
		for (const filePath of [...children, opts.app]) {
		if (shouldIgnoreFilePath(filePath)) {
		debugLog('Skipped... ' + filePath);
		continue;
		}
		const perFileOptions = await mergeOptionsForFile(opts.optionsForFile ? opts.optionsForFile(filePath) : null, defaultOptionsForFile(filePath, opts.platform));
		// preAutoEntitlements should only be applied to the top level app bundle.
		// Applying it other files will cause the app to crash and be rejected by Apple.
		if (!filePath.includes('.app/')) {
		if (opts.preAutoEntitlements === false) {
		debugWarn('Pre-sign operation disabled for entitlements automation.');
		}
		else {
		debugLog('Pre-sign operation enabled for entitlements automation with versions >= `1.1.1`:', '\n', '* Disable by setting `pre-auto-entitlements` to `false`.');
		if (!opts.version \|\| semver.gte(opts.version, '1.1.1')) {
		// Enable Mac App Store sandboxing without using temporary-exception, introduced in Electron v1.1.1. Relates to electron#5601
		const newEntitlements = await preAutoEntitlements(opts, perFileOptions, {
		identity,
		provisioningProfile: opts.provisioningProfile
		? await getProvisioningProfile(opts.provisioningProfile, opts.keychain)
		: undefined,
		});
		// preAutoEntitlements may provide us new entitlements, if so we update our options
		// and ensure that entitlements-loginhelper has a correct default value
		if (newEntitlements) {
		perFileOptions.entitlements = newEntitlements;
		}
		}
		}
		}
		debugLog('Signing... ' + filePath);
		const perFileArgs = [...args];
		if (perFileOptions.requirements) {
		if (perFileOptions.requirements.charAt(0) === '=') {
		perFileArgs.push(`-r${perFileOptions.requirements}`);
		}
		else {
		perFileArgs.push('--requirements', perFileOptions.requirements);
		}
		}
		if (perFileOptions.timestamp) {
		perFileArgs.push('--timestamp=' + perFileOptions.timestamp);
		}
		else {
		perFileArgs.push('--timestamp');
		}
		let optionsArguments = [];
		if (perFileOptions.signatureFlags) {
		if (Array.isArray(perFileOptions.signatureFlags)) {
		optionsArguments.push(...perFileOptions.signatureFlags);
		}
		else {
		const flags = perFileOptions.signatureFlags.split(',').map(function (flag) {
		return flag.trim();
		});
		optionsArguments.push(...flags);
		}
		}
		if (perFileOptions.hardenedRuntime \|\| optionsArguments.includes('runtime')) {
		// Hardened runtime since darwin 17.7.0 --> macOS 10.13.6
		if (semver.gte(osRelease, '17.7.0')) {
		optionsArguments.push('runtime');
		}
		else {
		// Remove runtime if passed in with --signature-flags
		debugLog('Not enabling hardened runtime, current macOS version too low, requires 10.13.6 and higher');
		optionsArguments = optionsArguments.filter((arg) => {
		return arg !== 'runtime';
		});
		}
		}
		if (optionsArguments.length) {
		perFileArgs.push('--options', [...new Set(optionsArguments)].join(','));
		}
		if (perFileOptions.additionalArguments) {
		perFileArgs.push(...perFileOptions.additionalArguments);
		}
		await execFileAsync('codesign', perFileArgs.concat('--entitlements', perFileOptions.entitlements, filePath));
		}
		// Verify code sign
		debugLog('Verifying...');
		await verifySignApplication(opts);
		debugLog('Verified.');
		// Check entitlements if applicable
		debugLog('Displaying entitlements...');
		const result = await execFileAsync('codesign', [
		'--display',
		'--entitlements',
		':-', // Write to standard output and strip off the blob header
		opts.app,
		]);
		debugLog('Entitlements:', '\n', result);
		}
		/**
		* Signs a macOS application.
		* @returns A void Promise once the signing operation is complete.
		*
		* @category Codesign
		*/
		export async function sign(_opts) {
		const validatedOpts = await validateSignOpts(_opts);
		let identities = [];
		let identityInUse = null;
		// Determine identity for signing
		if (validatedOpts.identity) {
		debugLog('`identity` passed in arguments.');
		if (validatedOpts.identityValidation === false) {
		identityInUse = new Identity(validatedOpts.identity);
		}
		else {
		identities = await findIdentities(validatedOpts.keychain \|\| null, validatedOpts.identity);
		}
		}
		else {
		debugWarn('No `identity` passed in arguments...');
		if (validatedOpts.platform === 'mas') {
		if (validatedOpts.type === 'distribution') {
		debugLog('Finding `3rd Party Mac Developer Application` certificate for signing app distribution in the Mac App Store...');
		identities = await findIdentities(validatedOpts.keychain \|\| null, '3rd Party Mac Developer Application:');
		}
		else {
		debugLog('Finding `Mac Developer` certificate for signing app in development for the Mac App Store signing...');
		identities = await findIdentities(validatedOpts.keychain \|\| null, 'Mac Developer:');
		}
		}
		else {
		debugLog('Finding `Developer ID Application` certificate for distribution outside the Mac App Store...');
		identities = await findIdentities(validatedOpts.keychain \|\| null, 'Developer ID Application:');
		}
		}
		if (!identityInUse) {
		if (identities.length > 0) {
		// Identity(/ies) found
		if (identities.length > 1) {
		debugWarn('Multiple identities found, will use the first discovered.');
		}
		else {
		debugLog('Found 1 identity.');
		}
		identityInUse = identities[0];
		}
		else {
		// No identity found
		throw new Error('No identity found for signing.');
		}
		}
		// Pre-sign operations
		if (validatedOpts.preEmbedProvisioningProfile === false) {
		debugWarn('Pre-sign operation disabled for provisioning profile embedding:', '\n', '* Enable by setting `pre-embed-provisioning-profile` to `true`.');
		}
		else {
		debugLog('Pre-sign operation enabled for provisioning profile:', '\n', '* Disable by setting `pre-embed-provisioning-profile` to `false`.');
		await preEmbedProvisioningProfile(validatedOpts, validatedOpts.provisioningProfile
		? await getProvisioningProfile(validatedOpts.provisioningProfile, validatedOpts.keychain)
		: null);
		}
		debugLog('Signing application...', '\n', '> Application:', validatedOpts.app, '\n', '> Platform:', validatedOpts.platform, '\n', '> Additional binaries:', validatedOpts.binaries, '\n', '> Identity:', validatedOpts.identity);
		await signApplication(validatedOpts, identityInUse);
		// Post-sign operations
		debugLog('Application signed.');
		}
		//# sourceMappingURL=sign.js.map

+1

dist/sign.js.map

+258

dist/types.d.ts

		/**
		* macOS applications can be distributed via the Mac App Store (MAS) or directly
		* downloaded from the developer's website. @electron/osx-sign distinguishes between
		* MAS apps (`mas`) or non-MAS apps (`darwin`).
		* @category Utility
		*/
		export type ElectronMacPlatform = 'darwin' \| 'mas';
		/**
		* MAS apps can be signed using Development or Distribution certificates.

		* See [Apple Documentation](https://developer.apple.com/help/account/create-certificates/certificates-overview/) for more info.
		* @category Utility
		*/
		export type SigningDistributionType = 'development' \| 'distribution';
		/**
		* @interface
		* @internal
		*/
		export type BaseSignOptions = Readonly<{
		/**
		* Path to the application package.
		* Needs to end with the file extension `.app`.
		*/
		app: string;
		/**
		* The keychain name.
		*
		* @defaultValue `login`
		*/
		keychain?: string;
		/**
		* Build platform of your Electron app.
		* Allowed values: `darwin` (Direct Download App), `mas` (Mac App Store).
		*
		* @defaultValue Determined by presence of `Squirrel.framework` within the application bundle,
		* which is used for non-MAS apps.
		*/
		platform?: ElectronMacPlatform;
		/**
		* Name of the certificate to use when signing.
		*
		* @defaultValue Selected with respect to {@link SignOptions.provisioningProfile \| provisioningProfile}
		* and {@link SignOptions.platform \| platform} from the selected {@link SignOptions.keychain \| keychain}.
		* * `mas` will look for `3rd Party Mac Developer Application: * (*)`
		* * `darwin` will look for `Developer ID Application: * (*)` by default.
		*/
		identity?: string;
		}>;
		type OnlyValidatedBaseSignOptions = {
		platform: ElectronMacPlatform;
		};
		/**
		* A set of signing options that can be overriden on a per-file basis.
		* Any missing options will use the default values, and providing a partial structure
		* will shallow merge with the default values.
		* @interface
		* @category Codesign
		*/
		export type PerFileSignOptions = {
		/**
		* String specifying the path to an `entitlements.plist` file.
		* Can also be an array of entitlement keys that osx-sign will write to an entitlements file for you.
		*
		* @defaultValue `@electron/osx-sign`'s built-in entitlements files.
		*/
		entitlements?: string \| string[];
		/**
		* Whether to enable [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime)
		* for this file.
		*
		* Note: Hardened Runtime is a pre-requisite for notarization, which is mandatory for apps running on macOS 10.15 and above.
		*
		* @defaultValue `true`
		*/
		hardenedRuntime?: boolean;
		/**
		* Either a string beginning with `=` which specifies in plain text the
		* [signing requirements](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html)
		* that you recommend to be used to evaluate the code signature, or a string specifying a path to a text or
		* properly encoded `.rqset` file which contains those requirements.
		*/
		requirements?: string;
		/**
		* When signing, a set of option flags can be specified to change the behavior of the system when using the signed code.
		* Accepts an array of strings or a comma-separated string.
		*
		* See --options of the `codesign` command.
		*
		* https://keith.github.io/xcode-man-pages/codesign.1.html#OPTION_FLAGS
		*/
		signatureFlags?: string \| string[];
		/**
		* String specifying the URL of the timestamp authority server.
		* Please note that this default server may not support signatures not furnished by Apple.
		* Disable the timestamp service with `none`.
		*
		* @defaultValue Uses the Apple-provided timestamp server.
		*/
		timestamp?: string;
		/**
		* Additional raw arguments to pass to the `codesign` command.
		*
		* These can be things like `--deep` for instance when code signing specific resources that may
		* require such arguments.
		*
		* https://keith.github.io/xcode-man-pages/codesign.1.html#OPTIONS
		*/
		additionalArguments?: string[];
		};
		/**
		* @interface
		* @internal
		*/
		export type OnlySignOptions = {
		/**
		* Array of paths to additional binaries that will be signed along with built-ins of Electron.
		*
		* @defaultValue `undefined`
		*/
		binaries?: string[];
		/**
		* Function that receives the path to a file and can return the entitlements to use for that file to override the default behavior. The
		* object this function returns can include any of the following optional keys. Any properties that are returned override the default
		* values that `@electron/osx-sign` generates. Any properties not returned use the default value.
		*
		* @param filePath Path to file
		* @returns Override signing options
		*/
		optionsForFile?: (filePath: string) => PerFileSignOptions;
		/**
		* Flag to enable/disable validation for the signing identity.
		* If enabled, the {@link SignOptions.identity \| identity} provided
		* will be validated in the {@link BaseSignOptions.keychain \| keychain} specified.
		*
		* @defaultValue `true`
		*/
		identityValidation?: boolean;
		/**
		* Defines files that will be skipped during the code signing process.
		* This property accepts a regex, function or an array of regexes and functions.
		* Elements of other types are treated as `RegExp`.
		*
		* File paths matching a regex or returning a `true` value from a function will be ignored.
		*
		* @defaultValue `undefined`
		*/
		ignore?: string \| string[] \| ((file: string) => boolean);
		/**
		* Flag to enable/disable entitlements automation tasks necessary for code signing most Electron apps.
		* * Adds [`com.apple.security.application-groups`](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_application-groups) to the entitlements file
		* * Fills in the `ElectronTeamID` property in `Info.plist` with the provisioning profile's Team Identifier or by parsing the identity name.
		*
		* @defaultValue `true`
		*/
		preAutoEntitlements?: boolean;
		/**
		* Flag to enable/disable the embedding of a provisioning profile into the app's `Contents` folder.
		* Will use the profile from {@link OnlySignOptions.provisioningProfile} if provided. Otherwise, it
		* searches for a `.provisionprofile` file in the current working directory.
		*
		* @defaultValue `true`
		*/
		preEmbedProvisioningProfile?: boolean;
		/**
		* Path to a provisioning profile, which can be used to grant restricted entitlements to your app.
		*
		* See [Apple Documentation](https://developer.apple.com/documentation/technotes/tn3125-inside-code-signing-provisioning-profiles) for more details.
		*/
		provisioningProfile?: string;
		/**
		* Flag to enable/disable the `--strict` flag when verifying the signed application bundle.
		* Also supports string values to specify which strict restrictions to use, see codesign man page for supported values.
		*
		* @defaultValue `true`
		*/
		strictVerify?: boolean \| string;
		/**
		* Type of certificate to use when signing a MAS app.
		* @defaultValue `"distribution"`
		*/
		type?: SigningDistributionType;
		/**
		* Build version of Electron. Values may be like: `1.1.1`, `1.2.0`. For use for signing legacy versions
		* of Electron to ensure backwards compatibility.
		*/
		version?: string;
		};
		type OnlyValidatedSignOptions = {
		ignore?: (string \| ((file: string) => boolean))[];
		type: SigningDistributionType;
		};
		type OnlyFlatOptions = {
		/**
		* Flag to enable/disable validation for the signing identity.
		* If enabled, the {@link BaseSignOptions.identity \| identity} provided
		* will be validated in the {@link BaseSignOptions.keychain \| keychain} specified.
		*
		* @defaultValue `true`
		*/
		identityValidation?: boolean;
		/**
		* Path to install the bundle.
		* @defaultValue `"/Applications"`
		*/
		install?: string;
		/**
		* Output path for the flattened installer package.
		* Needs file extension `.pkg`.
		*
		* @defaultValue Inferred from the app name passed into `opts.app`.
		*/
		pkg?: string;
		/**
		* Path to a directory containing `preinstall.sh` or `postinstall.sh` scripts.
		* These must be executable and will run on pre/postinstall depending on the file
		* name.
		*
		* This option is only valid if {@link FlatOptions.platform} is set to `darwin`.
		*/
		scripts?: string;
		};
		type OnlyValidatedFlatOptions = {
		install: string;
		pkg: string;
		};
		/**
		* Utility type that represents an `UnValidated` type after validation,
		* replacing any properties in the unvalidated type that also exist in the
		* `Validated` type with the validated versions.
		*
		* @template UnValidated - The type representing the unvalidated form.
		* @template Validated - The type representing the validated form.
		*/
		type ValidatedForm<UnValidated, Validated> = Omit<UnValidated, keyof Validated> & Validated;
		type ValidatedBaseSignOptions = Readonly<ValidatedForm<BaseSignOptions, OnlyValidatedBaseSignOptions>>;
		type _SignOptions = Readonly<OnlySignOptions & BaseSignOptions>;
		/**
		* Options for codesigning a packaged `.app` bundle.
		* @category Codesign
		*/
		export interface SignOptions extends _SignOptions {
		}
		/**
		* @internal
		*/
		export type ValidatedSignOptions = Readonly<ValidatedForm<OnlySignOptions, OnlyValidatedSignOptions> & ValidatedBaseSignOptions>;
		type _FlatOptions = Readonly<OnlyFlatOptions & BaseSignOptions>;
		/**
		* Options for creating a flat `.pkg` installer.
		* @category Flat
		*/
		export interface FlatOptions extends _FlatOptions {
		}
		/**
		* @internal
		*/
		export type ValidatedFlatOptions = Readonly<ValidatedForm<OnlyFlatOptions, OnlyValidatedFlatOptions> & ValidatedBaseSignOptions>;
		export {};

+2

dist/types.js

		export {};
		//# sourceMappingURL=types.js.map

+1

dist/types.js.map

{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

+17

dist/util-entitlements.d.ts

		import type { PerFileSignOptions, ValidatedSignOptions } from './types.js';
		import type { Identity } from './util-identities.js';
		import type { ProvisioningProfile } from './util-provisioning-profiles.js';
		type ComputedOptions = {
		identity: Identity;
		provisioningProfile?: ProvisioningProfile;
		};
		/**
		* This function returns a promise completing the entitlements automation: The
		* process includes checking in `Info.plist` for `ElectronTeamID` or setting
		* parsed value from identity, and checking in entitlements file for
		* `com.apple.security.application-groups` or inserting new into array. A
		* temporary entitlements file may be created to replace the input for any
		* changes introduced.
		*/
		export declare function preAutoEntitlements(opts: ValidatedSignOptions, perFileOpts: PerFileSignOptions, computed: ComputedOptions): Promise<void \| string>;
		export {};

+109

dist/util-entitlements.js

		import os from 'node:os';
		import path from 'node:path';
		import util from 'node:util';
		import fs from 'graceful-fs';
		import plist from 'plist';
		import { debugLog, getAppContentsPath } from './util.js';
		const preAuthMemo = new Map();
		/**
		* This function returns a promise completing the entitlements automation: The
		* process includes checking in `Info.plist` for `ElectronTeamID` or setting
		* parsed value from identity, and checking in entitlements file for
		* `com.apple.security.application-groups` or inserting new into array. A
		* temporary entitlements file may be created to replace the input for any
		* changes introduced.
		*/
		export async function preAutoEntitlements(opts, perFileOpts, computed) {
		if (!perFileOpts.entitlements)
		return;
		const memoKey = [opts.app, perFileOpts.entitlements].join('---');
		if (preAuthMemo.has(memoKey))
		return preAuthMemo.get(memoKey);
		// If entitlements file not provided, default will be used. Fixes #41
		const appInfoPath = path.join(getAppContentsPath(opts), 'Info.plist');
		debugLog('Automating entitlement app group...', '\n', '> Info.plist:', appInfoPath, '\n');
		let entitlements;
		if (typeof perFileOpts.entitlements === 'string') {
		const entitlementsContents = await util.promisify(fs.readFile)(perFileOpts.entitlements, 'utf8');
		entitlements = plist.parse(entitlementsContents);
		}
		else {
		entitlements = perFileOpts.entitlements.reduce((dict, entitlementKey) => ({
		...dict,
		[entitlementKey]: true,
		}), {});
		}
		if (!entitlements['com.apple.security.app-sandbox']) {
		// Only automate when app sandbox enabled by user
		return;
		}
		const appInfoContents = await util.promisify(fs.readFile)(appInfoPath, 'utf8');
		const appInfo = plist.parse(appInfoContents);
		// Use ElectronTeamID in Info.plist if already specified
		if (appInfo.ElectronTeamID) {
		debugLog('`ElectronTeamID` found in `Info.plist`: ' + appInfo.ElectronTeamID);
		}
		else {
		// The team identifier in signing identity should not be trusted
		if (computed.provisioningProfile) {
		appInfo.ElectronTeamID =
		computed.provisioningProfile.message.Entitlements['com.apple.developer.team-identifier'];
		debugLog('`ElectronTeamID` not found in `Info.plist`, use parsed from provisioning profile: ' +
		appInfo.ElectronTeamID);
		}
		else {
		const teamID = /^.+$(.+?)$$/g.exec(computed.identity.name)?.[1];
		if (!teamID) {
		throw new Error(`Could not automatically determine ElectronTeamID from identity: ${computed.identity.name}`);
		}
		appInfo.ElectronTeamID = teamID;
		debugLog('`ElectronTeamID` not found in `Info.plist`, use parsed from signing identity: ' +
		appInfo.ElectronTeamID);
		}
		await util.promisify(fs.writeFile)(appInfoPath, plist.build(appInfo), 'utf8');
		debugLog('`Info.plist` updated:', '\n', '> Info.plist:', appInfoPath);
		}
		const appIdentifier = appInfo.ElectronTeamID + '.' + appInfo.CFBundleIdentifier;
		// Insert application identifier if not exists
		if (entitlements['com.apple.application-identifier']) {
		debugLog('`com.apple.application-identifier` found in entitlements file: ' +
		entitlements['com.apple.application-identifier']);
		}
		else {
		debugLog('`com.apple.application-identifier` not found in entitlements file, new inserted: ' +
		appIdentifier);
		entitlements['com.apple.application-identifier'] = appIdentifier;
		}
		// Insert developer team identifier if not exists
		if (entitlements['com.apple.developer.team-identifier']) {
		debugLog('`com.apple.developer.team-identifier` found in entitlements file: ' +
		entitlements['com.apple.developer.team-identifier']);
		}
		else {
		debugLog('`com.apple.developer.team-identifier` not found in entitlements file, new inserted: ' +
		appInfo.ElectronTeamID);
		entitlements['com.apple.developer.team-identifier'] = appInfo.ElectronTeamID;
		}
		// Init entitlements app group key to array if not exists
		if (!entitlements['com.apple.security.application-groups']) {
		entitlements['com.apple.security.application-groups'] = [];
		}
		// Insert app group if not exists
		if (Array.isArray(entitlements['com.apple.security.application-groups']) &&
		entitlements['com.apple.security.application-groups'].indexOf(appIdentifier) === -1) {
		debugLog('`com.apple.security.application-groups` not found in entitlements file, new inserted: ' +
		appIdentifier);
		entitlements['com.apple.security.application-groups'].push(appIdentifier);
		}
		else {
		debugLog('`com.apple.security.application-groups` found in entitlements file: ' + appIdentifier);
		}
		// Create temporary entitlements file
		const dir = await fs.promises.mkdtemp(path.resolve(os.tmpdir(), 'tmp-entitlements-'));
		const entitlementsPath = path.join(dir, 'entitlements.plist');
		await util.promisify(fs.writeFile)(entitlementsPath, plist.build(entitlements), 'utf8');
		debugLog('Entitlements file updated:', '\n', '> Entitlements:', entitlementsPath);
		preAuthMemo.set(memoKey, entitlementsPath);
		return entitlementsPath;
		}
		//# sourceMappingURL=util-entitlements.js.map

+1

dist/util-entitlements.js.map

{"version":3,"file":"util-entitlements.js","sourceRoot":"","sources":["../src/util-entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AASzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,WAA+B,EAC/B,QAAyB;IAEzB,IAAI,CAAC,WAAW,CAAC,YAAY;QAAE,OAAO;IAEtC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE9D,qEAAqE;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAEtE,QAAQ,CAAC,qCAAqC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC1F,IAAI,YAAiC,CAAC;IACtC,IAAI,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,CAC5D,WAAW,CAAC,YAAY,EACxB,MAAM,CACP,CAAC;QACF,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAwB,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAC5C,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YACzB,GAAG,IAAI;YACP,CAAC,cAAc,CAAC,EAAE,IAAI;SACvB,CAAC,EACF,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,gCAAgC,CAAC,EAAE,CAAC;QACpD,iDAAiD;QACjD,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAwB,CAAC;IACpE,wDAAwD;IACxD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,QAAQ,CAAC,0CAA0C,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,gEAAgE;QAChE,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACjC,OAAO,CAAC,cAAc;gBACpB,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,qCAAqC,CAAC,CAAC;YAC3F,QAAQ,CACN,oFAAoF;gBAClF,OAAO,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,mEAAmE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAC5F,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC;YAChC,QAAQ,CACN,gFAAgF;gBAC9E,OAAO,CAAC,cAAc,CACzB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAE9E,QAAQ,CAAC,uBAAuB,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,GAAG,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAChF,8CAA8C;IAC9C,IAAI,YAAY,CAAC,kCAAkC,CAAC,EAAE,CAAC;QACrD,QAAQ,CACN,iEAAiE;YAC/D,YAAY,CAAC,kCAAkC,CAAC,CACnD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,QAAQ,CACN,mFAAmF;YACjF,aAAa,CAChB,CAAC;QACF,YAAY,CAAC,kCAAkC,CAAC,GAAG,aAAa,CAAC;IACnE,CAAC;IACD,iDAAiD;IACjD,IAAI,YAAY,CAAC,qCAAqC,CAAC,EAAE,CAAC;QACxD,QAAQ,CACN,oEAAoE;YAClE,YAAY,CAAC,qCAAqC,CAAC,CACtD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,QAAQ,CACN,sFAAsF;YACpF,OAAO,CAAC,cAAc,CACzB,CAAC;QACF,YAAY,CAAC,qCAAqC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/E,CAAC;IACD,yDAAyD;IACzD,IAAI,CAAC,YAAY,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC3D,YAAY,CAAC,uCAAuC,CAAC,GAAG,EAAE,CAAC;IAC7D,CAAC;IACD,iCAAiC;IACjC,IACE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,uCAAuC,CAAC,CAAC;QACpE,YAAY,CAAC,uCAAuC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EACnF,CAAC;QACD,QAAQ,CACN,wFAAwF;YACtF,aAAa,CAChB,CAAC;QACF,YAAY,CAAC,uCAAuC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,QAAQ,CACN,sEAAsE,GAAG,aAAa,CACvF,CAAC;IACJ,CAAC;IACD,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC9D,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACxF,QAAQ,CAAC,4BAA4B,EAAE,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAElF,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3C,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

+6

dist/util-identities.d.ts

		export declare class Identity {
		name: string;
		hash?: string \| undefined;
		constructor(name: string, hash?: string \| undefined);
		}
		export declare function findIdentities(keychain: string \| null, identity: string): Promise<Identity[]>;

+29

dist/util-identities.js

		import { debugLog, compactFlattenedList, execFileAsync } from './util.js';
		export class Identity {
		name;
		hash;
		constructor(name, hash) {
		this.name = name;
		this.hash = hash;
		}
		}
		export async function findIdentities(keychain, identity) {
		// Only to look for valid identities, excluding those flagged with
		// CSSMERR_TP_CERT_EXPIRED or CSSMERR_TP_NOT_TRUSTED. Fixes #9
		const args = ['find-identity', '-v'];
		if (keychain) {
		args.push(keychain);
		}
		const result = await execFileAsync('security', args);
		const identities = result.split('\n').map(function (line) {
		if (line.indexOf(identity) >= 0) {
		const identityFound = line.substring(line.indexOf('"') + 1, line.lastIndexOf('"'));
		const identityHashFound = line.substring(line.indexOf(')') + 2, line.indexOf('"') - 1);
		debugLog('Identity:', '\n', '> Name:', identityFound, '\n', '> Hash:', identityHashFound);
		return new Identity(identityFound, identityHashFound);
		}
		return null;
		});
		return compactFlattenedList(identities);
		}
		//# sourceMappingURL=util-identities.js.map

+1

dist/util-identities.js.map

{"version":3,"file":"util-identities.js","sourceRoot":"","sources":["../src/util-identities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1E,MAAM,OAAO,QAAQ;IAEV;IACA;IAFT,YACS,IAAY,EACZ,IAAa;QADb,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAS;IACnB,CAAC;CACL;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAuB,EAAE,QAAgB;IAC5E,kEAAkE;IAClE,8DAA8D;IAE9D,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI;QACtD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACnF,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACvF,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAC1F,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC"}

+25

dist/util-provisioning-profiles.d.ts

		import type { ElectronMacPlatform, ValidatedSignOptions } from './types.js';
		export declare class ProvisioningProfile {
		filePath: string;
		message: any;
		constructor(filePath: string, message: any);
		get name(): string;
		get platforms(): ElectronMacPlatform[];
		get type(): "development" \| "distribution";
		}
		/**
		* Returns a promise resolving to a ProvisioningProfile instance based on file.
		* @function
		* @param {string} filePath - Path to provisioning profile.
		* @param {string} keychain - Keychain to use when unlocking provisioning profile.
		* @returns {Promise} Promise.
		*/
		export declare function getProvisioningProfile(filePath: string, keychain?: string \| null): Promise<ProvisioningProfile>;
		/**
		* Returns a promise resolving to a list of suitable provisioning profile within the current working directory.
		*/
		export declare function findProvisioningProfiles(opts: ValidatedSignOptions): Promise<ProvisioningProfile[]>;
		/**
		* Returns a promise embedding the provisioning profile in the app Contents folder.
		*/
		export declare function preEmbedProvisioningProfile(opts: ValidatedSignOptions, profile: ProvisioningProfile \| null): Promise<void>;

+118

dist/util-provisioning-profiles.js

		import path from 'node:path';
		import util from 'node:util';
		import fs from 'graceful-fs';
		import plist from 'plist';
		import { debugLog, debugWarn, getAppContentsPath, compactFlattenedList, execFileAsync, } from './util.js';
		export class ProvisioningProfile {
		filePath;
		message;
		constructor(filePath, message) {
		this.filePath = filePath;
		this.message = message;
		}
		get name() {
		return this.message.Name;
		}
		get platforms() {
		if ('ProvisionsAllDevices' in this.message)
		return ['darwin'];
		// Developer ID
		else if (this.type === 'distribution')
		return ['mas'];
		// Mac App Store
		else
		return ['darwin', 'mas']; // Mac App Development
		}
		get type() {
		if ('ProvisionedDevices' in this.message)
		return 'development';
		// Mac App Development
		else
		return 'distribution'; // Developer ID or Mac App Store
		}
		}
		/**
		* Returns a promise resolving to a ProvisioningProfile instance based on file.
		* @function
		* @param {string} filePath - Path to provisioning profile.
		* @param {string} keychain - Keychain to use when unlocking provisioning profile.
		* @returns {Promise} Promise.
		*/
		export async function getProvisioningProfile(filePath, keychain = null) {
		const securityArgs = [
		'cms',
		'-D', // Decode a CMS message
		'-i',
		filePath, // Use infile as source of data
		];
		if (keychain) {
		securityArgs.push('-k', keychain);
		}
		const result = await execFileAsync('security', securityArgs);
		const provisioningProfile = new ProvisioningProfile(filePath, plist.parse(result));
		debugLog('Provisioning profile:', '\n', '> Name:', provisioningProfile.name, '\n', '> Platforms:', provisioningProfile.platforms, '\n', '> Type:', provisioningProfile.type, '\n', '> Path:', provisioningProfile.filePath, '\n', '> Message:', provisioningProfile.message);
		return provisioningProfile;
		}
		/**
		* Returns a promise resolving to a list of suitable provisioning profile within the current working directory.
		*/
		export async function findProvisioningProfiles(opts) {
		const cwd = process.cwd();
		const children = await util.promisify(fs.readdir)(cwd);
		const foundProfiles = compactFlattenedList(await Promise.all(children.map(async (child) => {
		const filePath = path.resolve(cwd, child);
		const stat = await fs.promises.stat(filePath);
		if (stat.isFile() && path.extname(filePath) === '.provisionprofile') {
		return filePath;
		}
		return null;
		})));
		return compactFlattenedList(await Promise.all(foundProfiles.map(async (filePath) => {
		const profile = await getProvisioningProfile(filePath);
		if (profile.platforms.indexOf(opts.platform) >= 0 && profile.type === opts.type) {
		return profile;
		}
		debugWarn('Provisioning profile above ignored, not for ' + opts.platform + ' ' + opts.type + '.');
		return null;
		})));
		}
		/**
		* Returns a promise embedding the provisioning profile in the app Contents folder.
		*/
		export async function preEmbedProvisioningProfile(opts, profile) {
		async function embedProvisioningProfile(profile) {
		debugLog('Looking for existing provisioning profile...');
		const embeddedFilePath = path.join(getAppContentsPath(opts), 'embedded.provisionprofile');
		if (fs.existsSync(embeddedFilePath)) {
		debugLog('Found embedded provisioning profile:', '\n', '* Please manually remove the existing file if not wanted.', '\n', '* Current file at:', embeddedFilePath);
		}
		else {
		debugLog('Embedding provisioning profile...');
		await util.promisify(fs.copyFile)(profile.filePath, embeddedFilePath);
		}
		}
		if (profile) {
		// User input provisioning profile
		return await embedProvisioningProfile(profile);
		}
		else {
		// Discover provisioning profile
		debugLog('No `provisioning-profile` passed in arguments, will find in current working directory and in user library...');
		const profiles = await findProvisioningProfiles(opts);
		if (profiles.length > 0) {
		// Provisioning profile(s) found
		if (profiles.length > 1) {
		debugLog('Multiple provisioning profiles found, will use the first discovered.');
		}
		else {
		debugLog('Found 1 provisioning profile.');
		}
		await embedProvisioningProfile(profiles[0]);
		}
		else {
		// No provisioning profile found
		debugLog('No provisioning profile found, will not embed profile in app contents.');
		}
		}
		}
		//# sourceMappingURL=util-provisioning-profiles.js.map

+1

dist/util-provisioning-profiles.js.map

{"version":3,"file":"util-provisioning-profiles.js","sourceRoot":"","sources":["../src/util-provisioning-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EACL,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,MAAM,OAAO,mBAAmB;IAErB;IACA;IAFT,YACS,QAAgB,EAChB,OAAY;QADZ,aAAQ,GAAR,QAAQ,CAAQ;QAChB,YAAO,GAAP,OAAO,CAAK;IAClB,CAAC;IAEJ,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,IAAI,SAAS;QACX,IAAI,sBAAsB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,eAAe;aACV,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,gBAAgB;;YACX,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,sBAAsB;IACvD,CAAC;IAED,IAAI,IAAI;QACN,IAAI,oBAAoB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,aAAa,CAAC;QAC/D,sBAAsB;;YACjB,OAAO,cAAc,CAAC,CAAC,gCAAgC;IAC9D,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,WAA0B,IAAI;IAC3F,MAAM,YAAY,GAAG;QACnB,KAAK;QACL,IAAI,EAAE,uBAAuB;QAC7B,IAAI;QACJ,QAAQ,EAAE,+BAA+B;KAC1C,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,QAAQ,CACN,uBAAuB,EACvB,IAAI,EACJ,SAAS,EACT,mBAAmB,CAAC,IAAI,EACxB,IAAI,EACJ,cAAc,EACd,mBAAmB,CAAC,SAAS,EAC7B,IAAI,EACJ,SAAS,EACT,mBAAmB,CAAC,IAAI,EACxB,IAAI,EACJ,SAAS,EACT,mBAAmB,CAAC,QAAQ,EAC5B,IAAI,EACJ,YAAY,EACZ,mBAAmB,CAAC,OAAO,CAC5B,CAAC;IACF,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAA0B;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,oBAAoB,CACxC,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,mBAAmB,EAAE,CAAC;YACpE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CACF,CAAC;IAEF,OAAO,oBAAoB,CACzB,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAChF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,SAAS,CACP,8CAA8C,GAAG,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CACvF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAA0B,EAC1B,OAAmC;IAEnC,KAAK,UAAU,wBAAwB,CAAC,OAA4B;QAClE,QAAQ,CAAC,8CAA8C,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAE1F,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,QAAQ,CACN,sCAAsC,EACtC,IAAI,EACJ,2DAA2D,EAC3D,IAAI,EACJ,oBAAoB,EACpB,gBAAgB,CACjB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,mCAAmC,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,kCAAkC;QAClC,OAAO,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,gCAAgC;QAChC,QAAQ,CACN,8GAA8G,CAC/G,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,gCAAgC;YAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,sEAAsE,CAAC,CAAC;YACnF,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,+BAA+B,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,QAAQ,CAAC,wEAAwE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}

+36

dist/util.d.ts

		/// <reference types="node" resolution-mode="require"/>
		import child from 'node:child_process';
		import debug from 'debug';
		import type { BaseSignOptions, ElectronMacPlatform } from './types.js';
		export declare const debugLog: debug.Debugger;
		export declare const debugWarn: debug.Debugger;
		export declare function execFileAsync(file: string, args: string[], options?: child.ExecFileOptions): Promise<string>;
		type DeepListItem<T> = null \| T \| DeepListItem<T>[];
		type DeepList<T> = DeepListItem<T>[];
		export declare function compactFlattenedList<T>(list: DeepList<T>): T[];
		/**
		* Returns the path to the "Contents" folder inside the application bundle
		*/
		export declare function getAppContentsPath(opts: BaseSignOptions): string;
		/**
		* Returns the path to app "Frameworks" within contents.
		*/
		export declare function getAppFrameworksPath(opts: BaseSignOptions): string;
		export declare function detectElectronPlatform(opts: BaseSignOptions): Promise<ElectronMacPlatform>;
		/**
		* This function returns a promise validating opts.app, the application to be signed or flattened.
		*/
		export declare function validateOptsApp(opts: BaseSignOptions): Promise<void>;
		/**
		* This function returns a promise validating opts.platform, the platform of Electron build. It allows auto-discovery if no opts.platform is specified.
		*/
		export declare function validateOptsPlatform(opts: BaseSignOptions): Promise<ElectronMacPlatform>;
		/**
		* This function returns a promise resolving all child paths within the directory specified.
		* @function
		* @param {string} dirPath - Path to directory.
		* @returns {Promise} Promise resolving child paths needing signing in order.
		* @internal
		*/
		export declare function walk(dirPath: string): Promise<string[]>;
		export {};

+147

dist/util.js

		import child from 'node:child_process';
		import path from 'node:path';
		import util from 'node:util';
		import fs from 'graceful-fs';
		import { isBinaryFile } from 'isbinaryfile';
		import debug from 'debug';
		export const debugLog = debug('electron-osx-sign');
		debugLog.log = console.log.bind(console);
		export const debugWarn = debug('electron-osx-sign:warn');
		debugWarn.log = console.warn.bind(console);
		const removePassword = function (input) {
		return input.replace(/(-P \|pass:\|\/p\|-pass )([^ ]+)/, function (_, p1) {
		return `${p1}***`;
		});
		};
		export async function execFileAsync(file, args, options = {}) {
		if (debugLog.enabled) {
		debugLog('Executing...', file, args && Array.isArray(args) ? removePassword(args.join(' ')) : '');
		}
		return new Promise(function (resolve, reject) {
		child.execFile(file, args, options, function (err, stdout, stderr) {
		if (err) {
		debugLog('Error executing file:', '\n', '> Stdout:', stdout, '\n', '> Stderr:', stderr);
		reject(err);
		return;
		}
		resolve(stdout);
		});
		});
		}
		export function compactFlattenedList(list) {
		const result = [];
		function populateResult(list) {
		if (!Array.isArray(list)) {
		if (list)
		result.push(list);
		}
		else if (list.length > 0) {
		for (const item of list)
		if (item)
		populateResult(item);
		}
		}
		populateResult(list);
		return result;
		}
		/**
		* Returns the path to the "Contents" folder inside the application bundle
		*/
		export function getAppContentsPath(opts) {
		return path.join(opts.app, 'Contents');
		}
		/**
		* Returns the path to app "Frameworks" within contents.
		*/
		export function getAppFrameworksPath(opts) {
		return path.join(getAppContentsPath(opts), 'Frameworks');
		}
		export async function detectElectronPlatform(opts) {
		const appFrameworksPath = getAppFrameworksPath(opts);
		if (fs.existsSync(path.resolve(appFrameworksPath, 'Squirrel.framework'))) {
		return 'darwin';
		}
		else {
		return 'mas';
		}
		}
		/**
		* This function returns a promise resolving the file path if file binary.
		*/
		async function getFilePathIfBinary(filePath) {
		if (await isBinaryFile(filePath)) {
		return filePath;
		}
		return null;
		}
		/**
		* This function returns a promise validating opts.app, the application to be signed or flattened.
		*/
		export async function validateOptsApp(opts) {
		if (!opts.app) {
		throw new Error('Path to application must be specified.');
		}
		if (path.extname(opts.app) !== '.app') {
		throw new Error('Extension of application must be `.app`.');
		}
		if (!fs.existsSync(opts.app)) {
		throw new Error(`Application at path "${opts.app}" could not be found`);
		}
		}
		/**
		* This function returns a promise validating opts.platform, the platform of Electron build. It allows auto-discovery if no opts.platform is specified.
		*/
		export async function validateOptsPlatform(opts) {
		if (opts.platform) {
		if (opts.platform === 'mas' \|\| opts.platform === 'darwin') {
		return opts.platform;
		}
		else {
		debugWarn('`platform` passed in arguments not supported, checking Electron platform...');
		}
		}
		else {
		debugWarn('No `platform` passed in arguments, checking Electron platform...');
		}
		return await detectElectronPlatform(opts);
		}
		/**
		* This function returns a promise resolving all child paths within the directory specified.
		* @function
		* @param {string} dirPath - Path to directory.
		* @returns {Promise} Promise resolving child paths needing signing in order.
		* @internal
		*/
		export async function walk(dirPath) {
		debugLog('Walking... ' + dirPath);
		async function _walkAsync(dirPath) {
		const children = await util.promisify(fs.readdir)(dirPath);
		return await Promise.all(children.map(async (child) => {
		const filePath = path.resolve(dirPath, child);
		const stat = await fs.promises.stat(filePath);
		if (stat.isFile()) {
		switch (path.extname(filePath)) {
		case '.cstemp': // Temporary file generated from past codesign
		debugLog('Removing... ' + filePath);
		await fs.promises.rm(filePath, { recursive: true, force: true });
		return null;
		default:
		return await getFilePathIfBinary(filePath);
		}
		}
		else if (stat.isDirectory() && !stat.isSymbolicLink()) {
		const walkResult = await _walkAsync(filePath);
		switch (path.extname(filePath)) {
		case '.app': // Application
		case '.framework': // Framework
		walkResult.push(filePath);
		}
		return walkResult;
		}
		return null;
		}));
		}
		const allPaths = await _walkAsync(dirPath);
		return compactFlattenedList(allPaths);
		}
		//# sourceMappingURL=util.js.map

+1

dist/util.js.map

+37

-37

package.json

		{
		"name": "@electron/osx-sign",
		"version": "1.3.3",
		"version": "2.0.0",
		"description": "Codesign Electron macOS apps",
		"main": "dist/cjs/index.js",
		"module": "dist/esm/index.js",
		"type": "module",
		"exports": "./dist/index.js",
		"files": [
		@@ -15,4 +15,4 @@ "dist",
		"bin": {
		"electron-osx-flat": "bin/electron-osx-flat.js",
		"electron-osx-sign": "bin/electron-osx-sign.js"
		"electron-osx-flat": "bin/electron-osx-flat.mjs",
		"electron-osx-sign": "bin/electron-osx-sign.mjs"
		},
		@@ -33,21 +33,21 @@ "repository": {
		"dependencies": {
		"compare-version": "^0.1.2",
		"@types/graceful-fs": "^4.1.9",
		"debug": "^4.3.4",
		"fs-extra": "^10.0.0",
		"graceful-fs": "^4.2.11",
		"isbinaryfile": "^4.0.8",
		"minimist": "^1.2.6",
		"plist": "^3.0.5"
		"plist": "^3.0.5",
		"semver": "^7.7.1"
		},
		"devDependencies": {
		"@electron/get": "^2.0.2",
		"@types/compare-version": "^0.1.31",
		"@electron/get": "^4.0.0",
		"@tsconfig/node22": "^22.0.0",
		"@types/debug": "^4.1.7",
		"@types/fs-extra": "^9.0.13",
		"@types/node": "^16.11.6",
		"@types/node": "~22.10.7",
		"@types/plist": "^3.0.2",
		"@typescript-eslint/eslint-plugin": "^5.45.0",
		"@typescript-eslint/parser": "^5.45.0",
		"eslint": "^8.29.0",
		"eslint-config-eslint": "^7.0.0",
		"eslint-config-standard": "^17.0.0",
		"@types/semver": "^7.5.8",
		"@typescript-eslint/eslint-plugin": "^8.27.0",
		"@typescript-eslint/parser": "^8.27.0",
		"eslint": "^8.57.0",
		"eslint-config-prettier": "^10.1.1",
		"eslint-import-resolver-typescript": "^4.2.2",
		"eslint-plugin-import": "^2.26.0",
		@@ -57,27 +57,27 @@ "eslint-plugin-node": "^11.1.0",
		"extract-zip": "^2.0.1",
		"mkdirp": "^1.0.4",
		"rimraf": "^3.0.2",
		"run-series": "^1.1.9",
		"run-waterfall": "^1.1.7",
		"standard": "^17.0.0",
		"tape": "^4.7.1",
		"husky": "^9.1.7",
		"prettier": "^3.5.3",
		"typedoc": "~0.25.13",
		"typescript": "^4.9.3"
		"typescript": "~5.4.5",
		"vitest": "^3.0.9"
		},
		"scripts": {
		"build": "tsc && tsc -p tsconfig.esm.json",
		"docs:build": "npx typedoc",
		"lint": "eslint --ext .ts,.js src bin test",
		"pretest": "rimraf test/work",
		"test": "yarn lint && tape test",
		"prepublishOnly": "yarn build"
		"build": "tsc",
		"build:docs": "npx typedoc",
		"lint": "prettier --check */.{ts,mjs} && eslint --ext .ts,.mjs src bin spec",
		"pretest": "node -e 'fs.rmSync(\"spec/work\", { recursive: true, force: true })'",
		"test": "vitest run",
		"prepublishOnly": "yarn build",
		"prepare": "husky"
		},
		"standard": {
		"ignore": [
		"test/work"
		"engines": {
		"node": ">=22.12.0"
		},
		"lint-staged": {
		"*.{json}": "prettier --write",
		"*.{js,ts}": [
		"prettier --write",
		"eslint --fix"
		]
		},
		"engines": {
		"node": ">=12.0.0"
		}
		}

+13

-60

README.md

		@@ -72,7 +72,7 @@ # @electron/osx-sign [![npm][npm_img]][npm_url] [![Test][gha_img]][gha_url]
		```javascript
		const { signAsync } = require('@electron/osx-sign')
		import { sign } = from '@electron/osx-sign'
		const opts = {
		app: 'path/to/my.app'
		};
		signAsync(opts)
		sign(opts)
		.then(function () {
		@@ -86,3 +86,3 @@ // Application signed

		The only mandatory option for `signAsync` is a path to your `.app` package.
		The only mandatory option for `sign` is a path to your `.app` package.
		Configuration for most Electron apps should work out of the box.
		@@ -96,3 +96,3 @@ For full configuration options, see the [API documentation].
		```javascript
		const { signAsync } = require('@electron/osx-sign')
		import { sign } from '@electron/osx-sign'
		const opts = {
		@@ -106,3 +106,3 @@ app: 'path/to/my.app',
		};
		signAsync(opts)
		sign(opts)
		.then(function () {
		@@ -141,3 +141,3 @@ // Application signed
		```javascript
		signAsync({
		sign({
		app: 'path/to/my.app',
		@@ -168,3 +168,3 @@ optionsForFile: (filePath) => {
		```javascript
		signAsync({
		sign({
		app: 'path/to/my.app',
		@@ -188,4 +188,4 @@ version: '0.34.0',
		```javascript
		const { flatAsync } = require('@electron/osx-sign')
		flatAsync({
		import { flat } = '@electron/osx-sign'
		flat({
		app: 'path/to/my.app'
		@@ -201,3 +201,3 @@ })

		The only mandatory option for `flatAsync` is a path to your `.app` package.
		The only mandatory option for `flat` is a path to your `.app` package.
		For full configuration options, see the [API documentation].
		@@ -233,54 +233,7 @@

		The project's configured to run automated tests on CircleCI.
		The project's configured to run automated tests on GitHub Actions.

		If you wish to manually test the module, first comment out `opts.identity` in `test/basic.js` to enable
		auto discovery. Then run the command `npm test` from the dev directory.
		If you wish to manually test the module, you need to first generate a self-signed certificate
		via the `spec/ci/generate-identity.sh` script.

		When this command is run for the first time: `@electron/get` will download macOS Electron releases defined
		in `test/config.json`, and save to `~/.electron/`, which might take up less than 1GB of disk space.

		A successful testing should look something like:

		```
		$ npm test

		> electron-osx-sign@0.4.17 pretest electron-osx-sign
		> rimraf test/work

		> electron-osx-sign@0.4.17 test electron-osx-sign
		> standard && tape test

		Calling @electron/get before running tests...
		Running tests...
		TAP version 13
		# setup
		# defaults-test:v7.0.0-beta.3-darwin-x64
		ok 1 app signed
		# defaults-test:v7.0.0-beta.3-mas-x64
		ok 2 app signed
		# defaults-test:v6.0.3-darwin-x64
		ok 3 app signed
		# defaults-test:v6.0.3-mas-x64
		ok 4 app signed
		# defaults-test:v5.0.10-darwin-x64
		ok 5 app signed
		# defaults-test:v5.0.10-mas-x64
		ok 6 app signed
		# defaults-test:v4.2.9-darwin-x64
		ok 7 app signed
		# defaults-test:v4.2.9-mas-x64
		ok 8 app signed
		# defaults-test:v3.1.2-darwin-x64
		ok 9 app signed
		# defaults-test:v3.1.2-mas-x64
		ok 10 app signed
		# teardown

		1..10
		# tests 10
		# pass 10

		# ok
		```

		[Electron]: https://github.com/electron/electron
		@@ -287,0 +240,0 @@ [electron-osx-sign]: https://github.com/electron/osx-sign

-34

bin/electron-osx-flat.js

		#!/usr/bin/env node

		const fs = require('fs');
		const path = require('path');
		const args = require('minimist')(process.argv.slice(2), {
		boolean: [
		'help'
		]
		});
		const usage = fs.readFileSync(path.join(__dirname, 'electron-osx-flat-usage.txt')).toString();
		const flat = require('../').flat;

		args.app = args._.shift();

		if (!args.app \|\| args.help) {
		console.log(usage);
		process.exit(0);
		}

		// Remove excess arguments
		delete args._;
		delete args.help;

		flat(args, function done (err) {
		if (err) {
		console.error('Flat failed:');
		if (err.message) console.error(err.message);
		else if (err.stack) console.error(err.stack);
		else console.log(err);
		process.exit(1);
		}
		console.log('Application flattened, saved to:', args.pkg);
		process.exit(0);
		});

-46

bin/electron-osx-sign.js

		#!/usr/bin/env node

		const fs = require('fs');
		const path = require('path');
		const args = require('minimist')(process.argv.slice(2), {
		string: [
		'signature-flags'
		],
		boolean: [
		'help',
		'pre-auto-entitlements',
		'pre-embed-provisioning-profile',
		'hardened-runtime',
		'restrict'
		],
		default: {
		'pre-auto-entitlements': true,
		'pre-embed-provisioning-profile': true
		}
		});
		const usage = fs.readFileSync(path.join(__dirname, 'electron-osx-sign-usage.txt')).toString();
		const sign = require('../').sign;

		args.app = args._.shift();
		args.binaries = args._;

		if (!args.app \|\| args.help) {
		console.log(usage);
		process.exit(0);
		}

		// Remove excess arguments
		delete args._;
		delete args.help;

		sign(args, function done (err) {
		if (err) {
		console.error('Sign failed:');
		if (err.message) console.error(err.message);
		else if (err.stack) console.error(err.stack);
		else console.log(err);
		process.exit(1);
		}
		console.log('Application signed:', args.app);
		process.exit(0);
		});

-15

dist/cjs/flat.d.ts

		import { FlatOptions } from './types';
		/**
		* Generates a flat `.pkg` installer for a packaged Electron `.app` bundle.
		* @returns A void Promise once the flattening operation is complete.
		*
		* @category Flat
		*/
		export declare function buildPkg(_opts: FlatOptions): Promise<void>;
		/**
		* This function is exported with normal callback implementation.
		*
		* @deprecated Please use the Promise-based {@link flatAsync} method instead.
		* @category Flat
		*/
		export declare const flat: (opts: FlatOptions, cb?: ((error?: Error) => void) \| undefined) => void;

-179

dist/cjs/flat.js

		"use strict";
		var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		var desc = Object.getOwnPropertyDescriptor(m, k);
		if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {
		desc = { enumerable: true, get: function() { return m[k]; } };
		}
		Object.defineProperty(o, k2, desc);
		}) : (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		o[k2] = m[k];
		}));
		var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {
		Object.defineProperty(o, "default", { enumerable: true, value: v });
		}) : function(o, v) {
		o["default"] = v;
		});
		var __importStar = (this && this.__importStar) \|\| function (mod) {
		if (mod && mod.__esModule) return mod;
		var result = {};
		if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
		__setModuleDefault(result, mod);
		return result;
		};
		Object.defineProperty(exports, "__esModule", { value: true });
		exports.flat = exports.buildPkg = void 0;
		const path = __importStar(require("path"));
		const util_1 = require("./util");
		const util_identities_1 = require("./util-identities");
		const pkgVersion = require('../../package.json').version;
		/**
		* This function returns a promise validating all options passed in opts.
		* @function
		* @param {Object} opts - Options.
		* @returns {Promise} Promise.
		*/
		async function validateFlatOpts(opts) {
		await (0, util_1.validateOptsApp)(opts);
		let pkg = opts.pkg;
		if (pkg) {
		if (typeof pkg !== 'string')
		throw new Error('`pkg` must be a string.');
		if (path.extname(pkg) !== '.pkg') {
		throw new Error('Extension of output package must be `.pkg`.');
		}
		}
		else {
		(0, util_1.debugWarn)('No `pkg` passed in arguments, will fallback to default inferred from the given application.');
		pkg = path.join(path.dirname(opts.app), path.basename(opts.app, '.app') + '.pkg');
		}
		let install = opts.install;
		if (install) {
		if (typeof install !== 'string') {
		return Promise.reject(new Error('`install` must be a string.'));
		}
		}
		else {
		(0, util_1.debugWarn)('No `install` passed in arguments, will fallback to default `/Applications`.');
		install = '/Applications';
		}
		if (typeof opts.scripts === 'string' && opts.platform === 'mas') {
		(0, util_1.debugWarn)('Mac App Store packages cannot have `scripts`, ignoring option.');
		}
		return Object.assign(Object.assign({}, opts), { pkg,
		install, platform: await (0, util_1.validateOptsPlatform)(opts) });
		}
		/**
		* This function returns a promise flattening the application.
		* @param opts - Options for building the .pkg archive
		*/
		async function buildApplicationPkg(opts, identity) {
		if (opts.platform === 'mas') {
		const args = ['--component', opts.app, opts.install, '--sign', identity.name, opts.pkg];
		if (opts.keychain) {
		args.unshift('--keychain', opts.keychain);
		}
		(0, util_1.debugLog)('Flattening Mac App Store package... ' + opts.app);
		await (0, util_1.execFileAsync)('productbuild', args);
		}
		else {
		const componentPkgPath = path.join(path.dirname(opts.app), path.basename(opts.app, '.app') + '-component.pkg');
		const pkgbuildArgs = [
		'--install-location',
		opts.install,
		'--component',
		opts.app,
		componentPkgPath
		];
		if (opts.scripts) {
		pkgbuildArgs.unshift('--scripts', opts.scripts);
		}
		(0, util_1.debugLog)('Building component package... ' + opts.app);
		await (0, util_1.execFileAsync)('pkgbuild', pkgbuildArgs);
		const args = ['--package', componentPkgPath, opts.install, '--sign', identity.name, opts.pkg];
		if (opts.keychain) {
		args.unshift('--keychain', opts.keychain);
		}
		(0, util_1.debugLog)('Flattening OS X Installer package... ' + opts.app);
		await (0, util_1.execFileAsync)('productbuild', args);
		await (0, util_1.execFileAsync)('rm', [componentPkgPath]);
		}
		}
		/**
		* Generates a flat `.pkg` installer for a packaged Electron `.app` bundle.
		* @returns A void Promise once the flattening operation is complete.
		*
		* @category Flat
		*/
		async function buildPkg(_opts) {
		(0, util_1.debugLog)('@electron/osx-sign@%s', pkgVersion);
		const validatedOptions = await validateFlatOpts(_opts);
		let identities = [];
		let identityInUse = null;
		if (validatedOptions.identity) {
		(0, util_1.debugLog)('`identity` passed in arguments.');
		if (validatedOptions.identityValidation === false) {
		// Do nothing
		}
		else {
		identities = await (0, util_identities_1.findIdentities)(validatedOptions.keychain \|\| null, validatedOptions.identity);
		}
		}
		else {
		(0, util_1.debugWarn)('No `identity` passed in arguments...');
		if (validatedOptions.platform === 'mas') {
		(0, util_1.debugLog)('Finding `3rd Party Mac Developer Installer` certificate for flattening app distribution in the Mac App Store...');
		identities = await (0, util_identities_1.findIdentities)(validatedOptions.keychain \|\| null, '3rd Party Mac Developer Installer:');
		}
		else {
		(0, util_1.debugLog)('Finding `Developer ID Application` certificate for distribution outside the Mac App Store...');
		identities = await (0, util_identities_1.findIdentities)(validatedOptions.keychain \|\| null, 'Developer ID Installer:');
		}
		}
		if (identities.length > 0) {
		// Provisioning profile(s) found
		if (identities.length > 1) {
		(0, util_1.debugWarn)('Multiple identities found, will use the first discovered.');
		}
		else {
		(0, util_1.debugLog)('Found 1 identity.');
		}
		identityInUse = identities[0];
		}
		else {
		// No identity found
		throw new Error('No identity found for signing.');
		}
		(0, util_1.debugLog)('Flattening application...', '\n', '> Application:', validatedOptions.app, '\n', '> Package output:', validatedOptions.pkg, '\n', '> Install path:', validatedOptions.install, '\n', '> Identity:', validatedOptions.identity, '\n', '> Scripts:', validatedOptions.scripts);
		await buildApplicationPkg(validatedOptions, identityInUse);
		(0, util_1.debugLog)('Application flattened.');
		}
		exports.buildPkg = buildPkg;
		/**
		* This function is exported with normal callback implementation.
		*
		* @deprecated Please use the Promise-based {@link flatAsync} method instead.
		* @category Flat
		*/
		const flat = (opts, cb) => {
		buildPkg(opts)
		.then(() => {
		(0, util_1.debugLog)('Application flattened, saved to: ' + opts.app);
		if (cb)
		cb();
		})
		.catch((err) => {
		(0, util_1.debugLog)('Flat failed:');
		if (err.message)
		(0, util_1.debugLog)(err.message);
		else if (err.stack)
		(0, util_1.debugLog)(err.stack);
		else
		(0, util_1.debugLog)(err);
		if (cb)
		cb(err);
		});
		};
		exports.flat = flat;
		//# sourceMappingURL=flat.js.map

-1

dist/cjs/flat.js.map

-5

dist/cjs/index.d.ts

		import { sign, signApp } from './sign';
		import { flat, buildPkg } from './flat';
		import { walkAsync } from './util';
		export { sign, flat, signApp as signAsync, signApp, buildPkg as flatAsync, buildPkg, walkAsync };
		export * from './types';

-39

dist/cjs/index.js

		"use strict";
		var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		var desc = Object.getOwnPropertyDescriptor(m, k);
		if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {
		desc = { enumerable: true, get: function() { return m[k]; } };
		}
		Object.defineProperty(o, k2, desc);
		}) : (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		o[k2] = m[k];
		}));
		var __exportStar = (this && this.__exportStar) \|\| function(m, exports) {
		for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
		};
		Object.defineProperty(exports, "__esModule", { value: true });
		exports.walkAsync = exports.buildPkg = exports.flatAsync = exports.signApp = exports.signAsync = exports.flat = exports.sign = void 0;
		const sign_1 = require("./sign");
		Object.defineProperty(exports, "sign", { enumerable: true, get: function () { return sign_1.sign; } });
		Object.defineProperty(exports, "signAsync", { enumerable: true, get: function () { return sign_1.signApp; } });
		Object.defineProperty(exports, "signApp", { enumerable: true, get: function () { return sign_1.signApp; } });
		const flat_1 = require("./flat");
		Object.defineProperty(exports, "flat", { enumerable: true, get: function () { return flat_1.flat; } });
		Object.defineProperty(exports, "flatAsync", { enumerable: true, get: function () { return flat_1.buildPkg; } });
		Object.defineProperty(exports, "buildPkg", { enumerable: true, get: function () { return flat_1.buildPkg; } });
		const util_1 = require("./util");
		Object.defineProperty(exports, "walkAsync", { enumerable: true, get: function () { return util_1.walkAsync; } });
		// TODO: Remove and leave only proper named exports, but for non-breaking change reasons
		// we need to keep this weirdness for now
		module.exports = sign_1.sign;
		module.exports.sign = sign_1.sign;
		module.exports.signAsync = sign_1.signApp;
		module.exports.signApp = sign_1.signApp;
		module.exports.flat = flat_1.flat;
		module.exports.flatAsync = flat_1.buildPkg;
		module.exports.buildPkg = flat_1.buildPkg;
		module.exports.walkAsync = util_1.walkAsync;
		__exportStar(require("./types"), exports);
		//# sourceMappingURL=index.js.map

-1

dist/cjs/index.js.map

{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iCAAuC;AAe9B,qFAfA,WAAI,OAeA;AAAmB,0FAfjB,cAAO,OAemB;AAAE,wFAf5B,cAAO,OAe4B;AAdlD,iCAAwC;AAczB,qFAdN,WAAI,OAcM;AAA6C,0FAdjD,eAAQ,OAckD;AAAE,yFAd5D,eAAQ,OAc4D;AAbnF,iCAAmC;AAakD,0FAb5E,gBAAS,OAa4E;AAX9F,wFAAwF;AACxF,yCAAyC;AACzC,MAAM,CAAC,OAAO,GAAG,WAAI,CAAC;AACtB,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,WAAI,CAAC;AAC3B,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,cAAO,CAAC;AACnC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,cAAO,CAAC;AACjC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,WAAI,CAAC;AAC3B,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,eAAQ,CAAC;AACpC,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,eAAQ,CAAC;AACnC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,gBAAS,CAAC;AAGrC,0CAAwB"}

-15

dist/cjs/sign.d.ts

		import { SignOptions } from './types';
		/**
		* Signs a macOS application.
		* @returns A void Promise once the signing operation is complete.
		*
		* @category Codesign
		*/
		export declare function signApp(_opts: SignOptions): Promise<void>;
		/**
		* This function is a legacy callback implementation.
		*
		* @deprecated Please use the Promise-based {@link signAsync} method instead.
		* @category Codesign
		*/
		export declare const sign: (opts: SignOptions, cb?: ((error?: Error) => void) \| undefined) => void;

-377

dist/cjs/sign.js

		"use strict";
		var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		var desc = Object.getOwnPropertyDescriptor(m, k);
		if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {
		desc = { enumerable: true, get: function() { return m[k]; } };
		}
		Object.defineProperty(o, k2, desc);
		}) : (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		o[k2] = m[k];
		}));
		var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {
		Object.defineProperty(o, "default", { enumerable: true, value: v });
		}) : function(o, v) {
		o["default"] = v;
		});
		var __importStar = (this && this.__importStar) \|\| function (mod) {
		if (mod && mod.__esModule) return mod;
		var result = {};
		if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
		__setModuleDefault(result, mod);
		return result;
		};
		var __importDefault = (this && this.__importDefault) \|\| function (mod) {
		return (mod && mod.__esModule) ? mod : { "default": mod };
		};
		Object.defineProperty(exports, "__esModule", { value: true });
		exports.sign = exports.signApp = void 0;
		const fs = __importStar(require("fs-extra"));
		const os = __importStar(require("os"));
		const path = __importStar(require("path"));
		const plist = __importStar(require("plist"));
		const compare_version_1 = __importDefault(require("compare-version"));
		const util_1 = require("./util");
		const util_identities_1 = require("./util-identities");
		const util_provisioning_profiles_1 = require("./util-provisioning-profiles");
		const util_entitlements_1 = require("./util-entitlements");
		const pkgVersion = require('../../package.json').version;
		const osRelease = os.release();
		/**
		* This function returns a promise validating opts.binaries, the additional binaries to be signed along with the discovered enclosed components.
		*/
		async function validateOptsBinaries(opts) {
		if (opts.binaries) {
		if (!Array.isArray(opts.binaries)) {
		throw new Error('Additional binaries should be an Array.');
		}
		// TODO: Presence check for binary files, reject if any does not exist
		}
		}
		function validateOptsIgnore(ignore) {
		if (ignore && !(ignore instanceof Array)) {
		return [ignore];
		}
		}
		/**
		* This function returns a promise validating all options passed in opts.
		*/
		async function validateSignOpts(opts) {
		await validateOptsBinaries(opts);
		await (0, util_1.validateOptsApp)(opts);
		if (opts.provisioningProfile && typeof opts.provisioningProfile !== 'string') {
		throw new Error('Path to provisioning profile should be a string.');
		}
		if (opts.type && opts.type !== 'development' && opts.type !== 'distribution') {
		throw new Error('Type must be either `development` or `distribution`.');
		}
		const platform = await (0, util_1.validateOptsPlatform)(opts);
		const cloned = Object.assign(Object.assign({}, opts), { ignore: validateOptsIgnore(opts.ignore), type: opts.type \|\| 'distribution', platform });
		return cloned;
		}
		/**
		* This function returns a promise verifying the code sign of application bundle.
		*/
		async function verifySignApplication(opts) {
		// Verify with codesign
		(0, util_1.debugLog)('Verifying application bundle with codesign...');
		const strictVerify = opts.strictVerify !== undefined ? opts.strictVerify : true;
		await (0, util_1.execFileAsync)('codesign', ['--verify', '--deep'].concat(strictVerify !== false && (0, compare_version_1.default)(osRelease, '15.0.0') >= 0 // Strict flag since darwin 15.0.0 --> OS X 10.11.0 El Capitan
		? [
		'--strict' +
		(strictVerify !== true ? '=' + strictVerify : '')
		]
		: [], ['--verbose=2', opts.app]));
		}
		function defaultOptionsForFile(filePath, platform) {
		const entitlementsFolder = path.resolve(__dirname, '..', '..', 'entitlements');
		let entitlementsFile;
		if (platform === 'darwin') {
		// Default Entitlements
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/app-entitlements.plist
		// Also include JIT for main process V8
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.plist');
		// Plugin helper
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/helper-plugin-entitlements.plist
		if (filePath.includes('(Plugin).app')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.plugin.plist');
		// GPU Helper
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/helper-gpu-entitlements.plist
		}
		else if (filePath.includes('(GPU).app')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.gpu.plist');
		// Renderer Helper
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/helper-renderer-entitlements.plist
		}
		else if (filePath.includes('(Renderer).app')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.renderer.plist');
		}
		}
		else {
		// Default entitlements
		// TODO: Can these be more scoped like the non-mas variant?
		entitlementsFile = path.resolve(entitlementsFolder, 'default.mas.plist');
		// If it is not the top level app bundle, we sign with inherit
		if (filePath.includes('.app/')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.mas.child.plist');
		}
		}
		return {
		entitlements: entitlementsFile,
		hardenedRuntime: true,
		requirements: undefined,
		signatureFlags: undefined,
		timestamp: undefined,
		additionalArguments: []
		};
		}
		async function mergeOptionsForFile(opts, defaults) {
		const mergedPerFileOptions = Object.assign({}, defaults);
		if (opts) {
		if (opts.entitlements !== undefined) {
		if (Array.isArray(opts.entitlements)) {
		const entitlements = opts.entitlements.reduce((dict, entitlementKey) => (Object.assign(Object.assign({}, dict), { [entitlementKey]: true })), {});
		const dir = await fs.mkdtemp(path.resolve(os.tmpdir(), 'tmp-entitlements-'));
		const entitlementsPath = path.join(dir, 'entitlements.plist');
		await fs.writeFile(entitlementsPath, plist.build(entitlements), 'utf8');
		opts.entitlements = entitlementsPath;
		}
		mergedPerFileOptions.entitlements = opts.entitlements;
		}
		if (opts.hardenedRuntime !== undefined) {
		mergedPerFileOptions.hardenedRuntime = opts.hardenedRuntime;
		}
		if (opts.requirements !== undefined)
		mergedPerFileOptions.requirements = opts.requirements;
		if (opts.signatureFlags !== undefined) {
		mergedPerFileOptions.signatureFlags = opts.signatureFlags;
		}
		if (opts.timestamp !== undefined)
		mergedPerFileOptions.timestamp = opts.timestamp;
		if (opts.additionalArguments !== undefined)
		mergedPerFileOptions.additionalArguments = opts.additionalArguments;
		}
		return mergedPerFileOptions;
		}
		/**
		* This function returns a promise codesigning only.
		*/
		async function signApplication(opts, identity) {
		function shouldIgnoreFilePath(filePath) {
		if (opts.ignore) {
		return opts.ignore.some(function (ignore) {
		if (typeof ignore === 'function') {
		return ignore(filePath);
		}
		return filePath.match(ignore);
		});
		}
		return false;
		}
		const children = await (0, util_1.walkAsync)((0, util_1.getAppContentsPath)(opts));
		if (opts.binaries)
		children.push(...opts.binaries);
		const args = ['--sign', identity.hash \|\| identity.name, '--force'];
		if (opts.keychain) {
		args.push('--keychain', opts.keychain);
		}
		/**
		* Sort the child paths by how deep they are in the file tree. Some arcane apple
		* logic expects the deeper files to be signed first otherwise strange errors get
		* thrown our way
		*/
		children.sort((a, b) => {
		const aDepth = a.split(path.sep).length;
		const bDepth = b.split(path.sep).length;
		return bDepth - aDepth;
		});
		for (const filePath of [...children, opts.app]) {
		if (shouldIgnoreFilePath(filePath)) {
		(0, util_1.debugLog)('Skipped... ' + filePath);
		continue;
		}
		const perFileOptions = await mergeOptionsForFile(opts.optionsForFile ? opts.optionsForFile(filePath) : null, defaultOptionsForFile(filePath, opts.platform));
		// preAutoEntitlements should only be applied to the top level app bundle.
		// Applying it other files will cause the app to crash and be rejected by Apple.
		if (!filePath.includes('.app/')) {
		if (opts.preAutoEntitlements === false) {
		(0, util_1.debugWarn)('Pre-sign operation disabled for entitlements automation.');
		}
		else {
		(0, util_1.debugLog)('Pre-sign operation enabled for entitlements automation with versions >= `1.1.1`:', '\n', '* Disable by setting `pre-auto-entitlements` to `false`.');
		if (!opts.version \|\| (0, compare_version_1.default)(opts.version, '1.1.1') >= 0) {
		// Enable Mac App Store sandboxing without using temporary-exception, introduced in Electron v1.1.1. Relates to electron#5601
		const newEntitlements = await (0, util_entitlements_1.preAutoEntitlements)(opts, perFileOptions, {
		identity,
		provisioningProfile: opts.provisioningProfile
		? await (0, util_provisioning_profiles_1.getProvisioningProfile)(opts.provisioningProfile, opts.keychain)
		: undefined
		});
		// preAutoEntitlements may provide us new entitlements, if so we update our options
		// and ensure that entitlements-loginhelper has a correct default value
		if (newEntitlements) {
		perFileOptions.entitlements = newEntitlements;
		}
		}
		}
		}
		(0, util_1.debugLog)('Signing... ' + filePath);
		const perFileArgs = [...args];
		if (perFileOptions.requirements) {
		if (perFileOptions.requirements.charAt(0) === '=') {
		perFileArgs.push(`-r${perFileOptions.requirements}`);
		}
		else {
		perFileArgs.push('--requirements', perFileOptions.requirements);
		}
		}
		if (perFileOptions.timestamp) {
		perFileArgs.push('--timestamp=' + perFileOptions.timestamp);
		}
		else {
		perFileArgs.push('--timestamp');
		}
		let optionsArguments = [];
		if (perFileOptions.signatureFlags) {
		if (Array.isArray(perFileOptions.signatureFlags)) {
		optionsArguments.push(...perFileOptions.signatureFlags);
		}
		else {
		const flags = perFileOptions.signatureFlags.split(',').map(function (flag) {
		return flag.trim();
		});
		optionsArguments.push(...flags);
		}
		}
		if (perFileOptions.hardenedRuntime \|\| optionsArguments.includes('runtime')) {
		// Hardened runtime since darwin 17.7.0 --> macOS 10.13.6
		if ((0, compare_version_1.default)(osRelease, '17.7.0') >= 0) {
		optionsArguments.push('runtime');
		}
		else {
		// Remove runtime if passed in with --signature-flags
		(0, util_1.debugLog)('Not enabling hardened runtime, current macOS version too low, requires 10.13.6 and higher');
		optionsArguments = optionsArguments.filter((arg) => {
		return arg !== 'runtime';
		});
		}
		}
		if (optionsArguments.length) {
		perFileArgs.push('--options', [...new Set(optionsArguments)].join(','));
		}
		if (perFileOptions.additionalArguments) {
		perFileArgs.push(...perFileOptions.additionalArguments);
		}
		await (0, util_1.execFileAsync)('codesign', perFileArgs.concat('--entitlements', perFileOptions.entitlements, filePath));
		}
		// Verify code sign
		(0, util_1.debugLog)('Verifying...');
		await verifySignApplication(opts);
		(0, util_1.debugLog)('Verified.');
		// Check entitlements if applicable
		(0, util_1.debugLog)('Displaying entitlements...');
		const result = await (0, util_1.execFileAsync)('codesign', [
		'--display',
		'--entitlements',
		':-',
		opts.app
		]);
		(0, util_1.debugLog)('Entitlements:', '\n', result);
		}
		/**
		* Signs a macOS application.
		* @returns A void Promise once the signing operation is complete.
		*
		* @category Codesign
		*/
		async function signApp(_opts) {
		(0, util_1.debugLog)('electron-osx-sign@%s', pkgVersion);
		const validatedOpts = await validateSignOpts(_opts);
		let identities = [];
		let identityInUse = null;
		// Determine identity for signing
		if (validatedOpts.identity) {
		(0, util_1.debugLog)('`identity` passed in arguments.');
		if (validatedOpts.identityValidation === false) {
		identityInUse = new util_identities_1.Identity(validatedOpts.identity);
		}
		else {
		identities = await (0, util_identities_1.findIdentities)(validatedOpts.keychain \|\| null, validatedOpts.identity);
		}
		}
		else {
		(0, util_1.debugWarn)('No `identity` passed in arguments...');
		if (validatedOpts.platform === 'mas') {
		if (validatedOpts.type === 'distribution') {
		(0, util_1.debugLog)('Finding `3rd Party Mac Developer Application` certificate for signing app distribution in the Mac App Store...');
		identities = await (0, util_identities_1.findIdentities)(validatedOpts.keychain \|\| null, '3rd Party Mac Developer Application:');
		}
		else {
		(0, util_1.debugLog)('Finding `Mac Developer` certificate for signing app in development for the Mac App Store signing...');
		identities = await (0, util_identities_1.findIdentities)(validatedOpts.keychain \|\| null, 'Mac Developer:');
		}
		}
		else {
		(0, util_1.debugLog)('Finding `Developer ID Application` certificate for distribution outside the Mac App Store...');
		identities = await (0, util_identities_1.findIdentities)(validatedOpts.keychain \|\| null, 'Developer ID Application:');
		}
		}
		if (!identityInUse) {
		if (identities.length > 0) {
		// Identity(/ies) found
		if (identities.length > 1) {
		(0, util_1.debugWarn)('Multiple identities found, will use the first discovered.');
		}
		else {
		(0, util_1.debugLog)('Found 1 identity.');
		}
		identityInUse = identities[0];
		}
		else {
		// No identity found
		throw new Error('No identity found for signing.');
		}
		}
		// Pre-sign operations
		if (validatedOpts.preEmbedProvisioningProfile === false) {
		(0, util_1.debugWarn)('Pre-sign operation disabled for provisioning profile embedding:', '\n', '* Enable by setting `pre-embed-provisioning-profile` to `true`.');
		}
		else {
		(0, util_1.debugLog)('Pre-sign operation enabled for provisioning profile:', '\n', '* Disable by setting `pre-embed-provisioning-profile` to `false`.');
		await (0, util_provisioning_profiles_1.preEmbedProvisioningProfile)(validatedOpts, validatedOpts.provisioningProfile
		? await (0, util_provisioning_profiles_1.getProvisioningProfile)(validatedOpts.provisioningProfile, validatedOpts.keychain)
		: null);
		}
		(0, util_1.debugLog)('Signing application...', '\n', '> Application:', validatedOpts.app, '\n', '> Platform:', validatedOpts.platform, '\n', '> Additional binaries:', validatedOpts.binaries, '\n', '> Identity:', validatedOpts.identity);
		await signApplication(validatedOpts, identityInUse);
		// Post-sign operations
		(0, util_1.debugLog)('Application signed.');
		}
		exports.signApp = signApp;
		/**
		* This function is a legacy callback implementation.
		*
		* @deprecated Please use the Promise-based {@link signAsync} method instead.
		* @category Codesign
		*/
		const sign = (opts, cb) => {
		signApp(opts)
		.then(() => {
		(0, util_1.debugLog)('Application signed: ' + opts.app);
		if (cb)
		cb();
		})
		.catch((err) => {
		if (err.message)
		(0, util_1.debugLog)(err.message);
		else if (err.stack)
		(0, util_1.debugLog)(err.stack);
		else
		(0, util_1.debugLog)(err);
		if (cb)
		cb(err);
		});
		};
		exports.sign = sign;
		//# sourceMappingURL=sign.js.map

-1

dist/cjs/sign.js.map

-258

dist/cjs/types.d.ts

		/**
		* macOS applications can be distributed via the Mac App Store (MAS) or directly
		* downloaded from the developer's website. @electron/osx-sign distinguishes between
		* MAS apps (`mas`) or non-MAS apps (`darwin`).
		* @category Utility
		*/
		export type ElectronMacPlatform = 'darwin' \| 'mas';
		/**
		* MAS apps can be signed using Development or Distribution certificates.

		* See [Apple Documentation](https://developer.apple.com/help/account/create-certificates/certificates-overview/) for more info.
		* @category Utility
		*/
		export type SigningDistributionType = 'development' \| 'distribution';
		/**
		* @interface
		* @internal
		*/
		export type BaseSignOptions = Readonly<{
		/**
		* Path to the application package.
		* Needs to end with the file extension `.app`.
		*/
		app: string;
		/**
		* The keychain name.
		*
		* @defaultValue `login`
		*/
		keychain?: string;
		/**
		* Build platform of your Electron app.
		* Allowed values: `darwin` (Direct Download App), `mas` (Mac App Store).
		*
		* @defaultValue Determined by presence of `Squirrel.framework` within the application bundle,
		* which is used for non-MAS apps.
		*/
		platform?: ElectronMacPlatform;
		/**
		* Name of the certificate to use when signing.
		*
		* @defaultValue Selected with respect to {@link SignOptions.provisioningProfile \| provisioningProfile}
		* and {@link SignOptions.platform \| platform} from the selected {@link SignOptions.keychain \| keychain}.
		* * `mas` will look for `3rd Party Mac Developer Application: * (*)`
		* * `darwin` will look for `Developer ID Application: * (*)` by default.
		*/
		identity?: string;
		}>;
		type OnlyValidatedBaseSignOptions = {
		platform: ElectronMacPlatform;
		};
		/**
		* A set of signing options that can be overriden on a per-file basis.
		* Any missing options will use the default values, and providing a partial structure
		* will shallow merge with the default values.
		* @interface
		* @category Codesign
		*/
		export type PerFileSignOptions = {
		/**
		* String specifying the path to an `entitlements.plist` file.
		* Can also be an array of entitlement keys that osx-sign will write to an entitlements file for you.
		*
		* @defaultValue `@electron/osx-sign`'s built-in entitlements files.
		*/
		entitlements?: string \| string[];
		/**
		* Whether to enable [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime)
		* for this file.
		*
		* Note: Hardened Runtime is a pre-requisite for notarization, which is mandatory for apps running on macOS 10.15 and above.
		*
		* @defaultValue `true`
		*/
		hardenedRuntime?: boolean;
		/**
		* Either a string beginning with `=` which specifies in plain text the
		* [signing requirements](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html)
		* that you recommend to be used to evaluate the code signature, or a string specifying a path to a text or
		* properly encoded `.rqset` file which contains those requirements.
		*/
		requirements?: string;
		/**
		* When signing, a set of option flags can be specified to change the behavior of the system when using the signed code.
		* Accepts an array of strings or a comma-separated string.
		*
		* See --options of the `codesign` command.
		*
		* https://keith.github.io/xcode-man-pages/codesign.1.html#OPTION_FLAGS
		*/
		signatureFlags?: string \| string[];
		/**
		* String specifying the URL of the timestamp authority server.
		* Please note that this default server may not support signatures not furnished by Apple.
		* Disable the timestamp service with `none`.
		*
		* @defaultValue Uses the Apple-provided timestamp server.
		*/
		timestamp?: string;
		/**
		* Additional raw arguments to pass to the `codesign` command.
		*
		* These can be things like `--deep` for instance when code signing specific resources that may
		* require such arguments.
		*
		* https://keith.github.io/xcode-man-pages/codesign.1.html#OPTIONS
		*/
		additionalArguments?: string[];
		};
		/**
		* @interface
		* @internal
		*/
		export type OnlySignOptions = {
		/**
		* Array of paths to additional binaries that will be signed along with built-ins of Electron.
		*
		* @defaultValue `undefined`
		*/
		binaries?: string[];
		/**
		* Function that receives the path to a file and can return the entitlements to use for that file to override the default behavior. The
		* object this function returns can include any of the following optional keys. Any properties that are returned override the default
		* values that `@electron/osx-sign` generates. Any properties not returned use the default value.
		*
		* @param filePath Path to file
		* @returns Override signing options
		*/
		optionsForFile?: (filePath: string) => PerFileSignOptions;
		/**
		* Flag to enable/disable validation for the signing identity.
		* If enabled, the {@link SignOptions.identity \| identity} provided
		* will be validated in the {@link BaseSignOptions.keychain \| keychain} specified.
		*
		* @defaultValue `true`
		*/
		identityValidation?: boolean;
		/**
		* Defines files that will be skipped during the code signing process.
		* This property accepts a regex, function or an array of regexes and functions.
		* Elements of other types are treated as `RegExp`.
		*
		* File paths matching a regex or returning a `true` value from a function will be ignored.
		*
		* @defaultValue `undefined`
		*/
		ignore?: string \| string[] \| ((file: string) => boolean);
		/**
		* Flag to enable/disable entitlements automation tasks necessary for code signing most Electron apps.
		* * Adds [`com.apple.security.application-groups`](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_application-groups) to the entitlements file
		* * Fills in the `ElectronTeamID` property in `Info.plist` with the provisioning profile's Team Identifier or by parsing the identity name.
		*
		* @defaultValue `true`
		*/
		preAutoEntitlements?: boolean;
		/**
		* Flag to enable/disable the embedding of a provisioning profile into the app's `Contents` folder.
		* Will use the profile from {@link OnlySignOptions.provisioningProfile} if provided. Otherwise, it
		* searches for a `.provisionprofile` file in the current working directory.
		*
		* @defaultValue `true`
		*/
		preEmbedProvisioningProfile?: boolean;
		/**
		* Path to a provisioning profile, which can be used to grant restricted entitlements to your app.
		*
		* See [Apple Documentation](https://developer.apple.com/documentation/technotes/tn3125-inside-code-signing-provisioning-profiles) for more details.
		*/
		provisioningProfile?: string;
		/**
		* Flag to enable/disable the `--strict` flag when verifying the signed application bundle.
		* Also supports string values to specify which strict restrictions to use, see codesign man page for supported values.
		*
		* @defaultValue `true`
		*/
		strictVerify?: boolean \| string;
		/**
		* Type of certificate to use when signing a MAS app.
		* @defaultValue `"distribution"`
		*/
		type?: SigningDistributionType;
		/**
		* Build version of Electron. Values may be like: `1.1.1`, `1.2.0`. For use for signing legacy versions
		* of Electron to ensure backwards compatibility.
		*/
		version?: string;
		};
		type OnlyValidatedSignOptions = {
		ignore?: (string \| ((file: string) => boolean))[];
		type: SigningDistributionType;
		};
		type OnlyFlatOptions = {
		/**
		* Flag to enable/disable validation for the signing identity.
		* If enabled, the {@link BaseSignOptions.identity \| identity} provided
		* will be validated in the {@link BaseSignOptions.keychain \| keychain} specified.
		*
		* @defaultValue `true`
		*/
		identityValidation?: boolean;
		/**
		* Path to install the bundle.
		* @defaultValue `"/Applications"`
		*/
		install?: string;
		/**
		* Output path for the flattened installer package.
		* Needs file extension `.pkg`.
		*
		* @defaultValue Inferred from the app name passed into `opts.app`.
		*/
		pkg?: string;
		/**
		* Path to a directory containing `preinstall.sh` or `postinstall.sh` scripts.
		* These must be executable and will run on pre/postinstall depending on the file
		* name.
		*
		* This option is only valid if {@link FlatOptions.platform} is set to `darwin`.
		*/
		scripts?: string;
		};
		type OnlyValidatedFlatOptions = {
		install: string;
		pkg: string;
		};
		/**
		* Utility type that represents an `UnValidated` type after validation,
		* replacing any properties in the unvalidated type that also exist in the
		* `Validated` type with the validated versions.
		*
		* @template UnValidated - The type representing the unvalidated form.
		* @template Validated - The type representing the validated form.
		*/
		type ValidatedForm<UnValidated, Validated> = Omit<UnValidated, keyof Validated> & Validated;
		type ValidatedBaseSignOptions = Readonly<ValidatedForm<BaseSignOptions, OnlyValidatedBaseSignOptions>>;
		type _SignOptions = Readonly<OnlySignOptions & BaseSignOptions>;
		/**
		* Options for codesigning a packaged `.app` bundle.
		* @category Codesign
		*/
		export interface SignOptions extends _SignOptions {
		}
		/**
		* @internal
		*/
		export type ValidatedSignOptions = Readonly<ValidatedForm<OnlySignOptions, OnlyValidatedSignOptions> & ValidatedBaseSignOptions>;
		type _FlatOptions = Readonly<OnlyFlatOptions & BaseSignOptions>;
		/**
		* Options for creating a flat `.pkg` installer.
		* @category Flat
		*/
		export interface FlatOptions extends _FlatOptions {
		}
		/**
		* @internal
		*/
		export type ValidatedFlatOptions = Readonly<ValidatedForm<OnlyFlatOptions, OnlyValidatedFlatOptions> & ValidatedBaseSignOptions>;
		export {};

-3

dist/cjs/types.js

		"use strict";
		Object.defineProperty(exports, "__esModule", { value: true });
		//# sourceMappingURL=types.js.map

-1

dist/cjs/types.js.map

{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}

-17

dist/cjs/util-entitlements.d.ts

		import { PerFileSignOptions, ValidatedSignOptions } from './types';
		import { Identity } from './util-identities';
		import { ProvisioningProfile } from './util-provisioning-profiles';
		type ComputedOptions = {
		identity: Identity;
		provisioningProfile?: ProvisioningProfile;
		};
		/**
		* This function returns a promise completing the entitlements automation: The
		* process includes checking in `Info.plist` for `ElectronTeamID` or setting
		* parsed value from identity, and checking in entitlements file for
		* `com.apple.security.application-groups` or inserting new into array. A
		* temporary entitlements file may be created to replace the input for any
		* changes introduced.
		*/
		export declare function preAutoEntitlements(opts: ValidatedSignOptions, perFileOpts: PerFileSignOptions, computed: ComputedOptions): Promise<void \| string>;
		export {};

-133

dist/cjs/util-entitlements.js

		"use strict";
		var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		var desc = Object.getOwnPropertyDescriptor(m, k);
		if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {
		desc = { enumerable: true, get: function() { return m[k]; } };
		}
		Object.defineProperty(o, k2, desc);
		}) : (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		o[k2] = m[k];
		}));
		var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {
		Object.defineProperty(o, "default", { enumerable: true, value: v });
		}) : function(o, v) {
		o["default"] = v;
		});
		var __importStar = (this && this.__importStar) \|\| function (mod) {
		if (mod && mod.__esModule) return mod;
		var result = {};
		if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
		__setModuleDefault(result, mod);
		return result;
		};
		Object.defineProperty(exports, "__esModule", { value: true });
		exports.preAutoEntitlements = void 0;
		const fs = __importStar(require("fs-extra"));
		const os = __importStar(require("os"));
		const path = __importStar(require("path"));
		const plist = __importStar(require("plist"));
		const util_1 = require("./util");
		const preAuthMemo = new Map();
		/**
		* This function returns a promise completing the entitlements automation: The
		* process includes checking in `Info.plist` for `ElectronTeamID` or setting
		* parsed value from identity, and checking in entitlements file for
		* `com.apple.security.application-groups` or inserting new into array. A
		* temporary entitlements file may be created to replace the input for any
		* changes introduced.
		*/
		async function preAutoEntitlements(opts, perFileOpts, computed) {
		var _a;
		if (!perFileOpts.entitlements)
		return;
		const memoKey = [opts.app, perFileOpts.entitlements].join('---');
		if (preAuthMemo.has(memoKey))
		return preAuthMemo.get(memoKey);
		// If entitlements file not provided, default will be used. Fixes #41
		const appInfoPath = path.join((0, util_1.getAppContentsPath)(opts), 'Info.plist');
		(0, util_1.debugLog)('Automating entitlement app group...', '\n', '> Info.plist:', appInfoPath, '\n');
		let entitlements;
		if (typeof perFileOpts.entitlements === 'string') {
		const entitlementsContents = await fs.readFile(perFileOpts.entitlements, 'utf8');
		entitlements = plist.parse(entitlementsContents);
		}
		else {
		entitlements = perFileOpts.entitlements.reduce((dict, entitlementKey) => (Object.assign(Object.assign({}, dict), { [entitlementKey]: true })), {});
		}
		if (!entitlements['com.apple.security.app-sandbox']) {
		// Only automate when app sandbox enabled by user
		return;
		}
		const appInfoContents = await fs.readFile(appInfoPath, 'utf8');
		const appInfo = plist.parse(appInfoContents);
		// Use ElectronTeamID in Info.plist if already specified
		if (appInfo.ElectronTeamID) {
		(0, util_1.debugLog)('`ElectronTeamID` found in `Info.plist`: ' + appInfo.ElectronTeamID);
		}
		else {
		// The team identifier in signing identity should not be trusted
		if (computed.provisioningProfile) {
		appInfo.ElectronTeamID =
		computed.provisioningProfile.message.Entitlements['com.apple.developer.team-identifier'];
		(0, util_1.debugLog)('`ElectronTeamID` not found in `Info.plist`, use parsed from provisioning profile: ' +
		appInfo.ElectronTeamID);
		}
		else {
		const teamID = (_a = /^.+$(.+?)$$/g.exec(computed.identity.name)) === null \|\| _a === void 0 ? void 0 : _a[1];
		if (!teamID) {
		throw new Error(`Could not automatically determine ElectronTeamID from identity: ${computed.identity.name}`);
		}
		appInfo.ElectronTeamID = teamID;
		(0, util_1.debugLog)('`ElectronTeamID` not found in `Info.plist`, use parsed from signing identity: ' +
		appInfo.ElectronTeamID);
		}
		await fs.writeFile(appInfoPath, plist.build(appInfo), 'utf8');
		(0, util_1.debugLog)('`Info.plist` updated:', '\n', '> Info.plist:', appInfoPath);
		}
		const appIdentifier = appInfo.ElectronTeamID + '.' + appInfo.CFBundleIdentifier;
		// Insert application identifier if not exists
		if (entitlements['com.apple.application-identifier']) {
		(0, util_1.debugLog)('`com.apple.application-identifier` found in entitlements file: ' +
		entitlements['com.apple.application-identifier']);
		}
		else {
		(0, util_1.debugLog)('`com.apple.application-identifier` not found in entitlements file, new inserted: ' +
		appIdentifier);
		entitlements['com.apple.application-identifier'] = appIdentifier;
		}
		// Insert developer team identifier if not exists
		if (entitlements['com.apple.developer.team-identifier']) {
		(0, util_1.debugLog)('`com.apple.developer.team-identifier` found in entitlements file: ' +
		entitlements['com.apple.developer.team-identifier']);
		}
		else {
		(0, util_1.debugLog)('`com.apple.developer.team-identifier` not found in entitlements file, new inserted: ' +
		appInfo.ElectronTeamID);
		entitlements['com.apple.developer.team-identifier'] = appInfo.ElectronTeamID;
		}
		// Init entitlements app group key to array if not exists
		if (!entitlements['com.apple.security.application-groups']) {
		entitlements['com.apple.security.application-groups'] = [];
		}
		// Insert app group if not exists
		if (Array.isArray(entitlements['com.apple.security.application-groups']) &&
		entitlements['com.apple.security.application-groups'].indexOf(appIdentifier) === -1) {
		(0, util_1.debugLog)('`com.apple.security.application-groups` not found in entitlements file, new inserted: ' +
		appIdentifier);
		entitlements['com.apple.security.application-groups'].push(appIdentifier);
		}
		else {
		(0, util_1.debugLog)('`com.apple.security.application-groups` found in entitlements file: ' + appIdentifier);
		}
		// Create temporary entitlements file
		const dir = await fs.mkdtemp(path.resolve(os.tmpdir(), 'tmp-entitlements-'));
		const entitlementsPath = path.join(dir, 'entitlements.plist');
		await fs.writeFile(entitlementsPath, plist.build(entitlements), 'utf8');
		(0, util_1.debugLog)('Entitlements file updated:', '\n', '> Entitlements:', entitlementsPath);
		preAuthMemo.set(memoKey, entitlementsPath);
		return entitlementsPath;
		}
		exports.preAutoEntitlements = preAutoEntitlements;
		//# sourceMappingURL=util-entitlements.js.map

-1

dist/cjs/util-entitlements.js.map

{"version":3,"file":"util-entitlements.js","sourceRoot":"","sources":["../../src/util-entitlements.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6CAA+B;AAC/B,uCAAyB;AACzB,2CAA6B;AAC7B,6CAA+B;AAE/B,iCAAsD;AAStD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE9C;;;;;;;GAOG;AACI,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,WAA+B,EAC/B,QAAyB;;IAEzB,IAAI,CAAC,WAAW,CAAC,YAAY;QAAE,OAAO;IAEtC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE9D,qEAAqE;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,yBAAkB,EAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAEtE,IAAA,eAAQ,EACN,qCAAqC,EACrC,IAAI,EACJ,eAAe,EACf,WAAW,EACX,IAAI,CACL,CAAC;IACF,IAAI,YAAiC,CAAC;IACtC,IAAI,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,EAAE;QAChD,MAAM,oBAAoB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACjF,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAwB,CAAC;KACzE;SAAM;QACL,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAsB,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,iCACzF,IAAI,KACP,CAAC,cAAc,CAAC,EAAE,IAAI,IACtB,EAAE,EAAE,CAAC,CAAC;KACT;IACD,IAAI,CAAC,YAAY,CAAC,gCAAgC,CAAC,EAAE;QACnD,iDAAiD;QACjD,OAAO;KACR;IAED,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAwB,CAAC;IACpE,wDAAwD;IACxD,IAAI,OAAO,CAAC,cAAc,EAAE;QAC1B,IAAA,eAAQ,EAAC,0CAA0C,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;KAC/E;SAAM;QACL,gEAAgE;QAChE,IAAI,QAAQ,CAAC,mBAAmB,EAAE;YAChC,OAAO,CAAC,cAAc;gBACpB,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,qCAAqC,CAAC,CAAC;YAC3F,IAAA,eAAQ,EACN,oFAAoF;gBAClF,OAAO,CAAC,cAAc,CACzB,CAAC;SACH;aAAM;YACL,MAAM,MAAM,GAAG,MAAA,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,0CAAG,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,EAAE;gBACX,MAAM,IAAI,KAAK,CAAC,mEAAmE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;aAC9G;YACD,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC;YAChC,IAAA,eAAQ,EACN,gFAAgF;gBAC9E,OAAO,CAAC,cAAc,CACzB,CAAC;SACH;QACD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAE9D,IAAA,eAAQ,EAAC,uBAAuB,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;KACvE;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,GAAG,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAChF,8CAA8C;IAC9C,IAAI,YAAY,CAAC,kCAAkC,CAAC,EAAE;QACpD,IAAA,eAAQ,EACN,iEAAiE;YAC/D,YAAY,CAAC,kCAAkC,CAAC,CACnD,CAAC;KACH;SAAM;QACL,IAAA,eAAQ,EACN,mFAAmF;YACjF,aAAa,CAChB,CAAC;QACF,YAAY,CAAC,kCAAkC,CAAC,GAAG,aAAa,CAAC;KAClE;IACD,iDAAiD;IACjD,IAAI,YAAY,CAAC,qCAAqC,CAAC,EAAE;QACvD,IAAA,eAAQ,EACN,oEAAoE;YAClE,YAAY,CAAC,qCAAqC,CAAC,CACtD,CAAC;KACH;SAAM;QACL,IAAA,eAAQ,EACN,sFAAsF;YACpF,OAAO,CAAC,cAAc,CACzB,CAAC;QACF,YAAY,CAAC,qCAAqC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;KAC9E;IACD,yDAAyD;IACzD,IAAI,CAAC,YAAY,CAAC,uCAAuC,CAAC,EAAE;QAC1D,YAAY,CAAC,uCAAuC,CAAC,GAAG,EAAE,CAAC;KAC5D;IACD,iCAAiC;IACjC,IACE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,uCAAuC,CAAC,CAAC;QACpE,YAAY,CAAC,uCAAuC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EACnF;QACA,IAAA,eAAQ,EACN,wFAAwF;YACtF,aAAa,CAChB,CAAC;QACF,YAAY,CAAC,uCAAuC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;KAC3E;SAAM;QACL,IAAA,eAAQ,EACN,sEAAsE,GAAG,aAAa,CACvF,CAAC;KACH;IACD,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC7E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,IAAA,eAAQ,EAAC,4BAA4B,EAAE,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAElF,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3C,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAvHD,kDAuHC"}

-6

dist/cjs/util-identities.d.ts

		export declare class Identity {
		name: string;
		hash?: string \| undefined;
		constructor(name: string, hash?: string \| undefined);
		}
		export declare function findIdentities(keychain: string \| null, identity: string): Promise<Identity[]>;

-35

dist/cjs/util-identities.js

		"use strict";
		Object.defineProperty(exports, "__esModule", { value: true });
		exports.findIdentities = exports.Identity = void 0;
		const util_1 = require("./util");
		class Identity {
		constructor(name, hash) {
		this.name = name;
		this.hash = hash;
		}
		}
		exports.Identity = Identity;
		async function findIdentities(keychain, identity) {
		// Only to look for valid identities, excluding those flagged with
		// CSSMERR_TP_CERT_EXPIRED or CSSMERR_TP_NOT_TRUSTED. Fixes #9
		const args = [
		'find-identity',
		'-v'
		];
		if (keychain) {
		args.push(keychain);
		}
		const result = await (0, util_1.execFileAsync)('security', args);
		const identities = result.split('\n').map(function (line) {
		if (line.indexOf(identity) >= 0) {
		const identityFound = line.substring(line.indexOf('"') + 1, line.lastIndexOf('"'));
		const identityHashFound = line.substring(line.indexOf(')') + 2, line.indexOf('"') - 1);
		(0, util_1.debugLog)('Identity:', '\n', '> Name:', identityFound, '\n', '> Hash:', identityHashFound);
		return new Identity(identityFound, identityHashFound);
		}
		return null;
		});
		return (0, util_1.compactFlattenedList)(identities);
		}
		exports.findIdentities = findIdentities;
		//# sourceMappingURL=util-identities.js.map

-1

dist/cjs/util-identities.js.map

{"version":3,"file":"util-identities.js","sourceRoot":"","sources":["../../src/util-identities.ts"],"names":[],"mappings":";;;AAAA,iCAAuE;AAEvE,MAAa,QAAQ;IACnB,YAAoB,IAAY,EAAS,IAAa;QAAlC,SAAI,GAAJ,IAAI,CAAQ;QAAS,SAAI,GAAJ,IAAI,CAAS;IAAG,CAAC;CAC3D;AAFD,4BAEC;AAEM,KAAK,UAAU,cAAc,CAAE,QAAuB,EAAE,QAAgB;IAC7E,kEAAkE;IAClE,8DAA8D;IAE9D,MAAM,IAAI,GAAG;QACX,eAAe;QACf,IAAI;KACL,CAAC;IACF,IAAI,QAAQ,EAAE;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;KACrB;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,oBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI;QACtD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACnF,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACvF,IAAA,eAAQ,EAAC,WAAW,EAAE,IAAI,EACxB,SAAS,EAAE,aAAa,EAAE,IAAI,EAC9B,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAChC,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;SACvD;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,IAAA,2BAAoB,EAAC,UAAU,CAAC,CAAC;AAC1C,CAAC;AA3BD,wCA2BC"}

-25

dist/cjs/util-provisioning-profiles.d.ts

		import { ElectronMacPlatform, ValidatedSignOptions } from './types';
		export declare class ProvisioningProfile {
		filePath: string;
		message: any;
		constructor(filePath: string, message: any);
		get name(): string;
		get platforms(): ElectronMacPlatform[];
		get type(): "development" \| "distribution";
		}
		/**
		* Returns a promise resolving to a ProvisioningProfile instance based on file.
		* @function
		* @param {string} filePath - Path to provisioning profile.
		* @param {string} keychain - Keychain to use when unlocking provisioning profile.
		* @returns {Promise} Promise.
		*/
		export declare function getProvisioningProfile(filePath: string, keychain?: string \| null): Promise<ProvisioningProfile>;
		/**
		* Returns a promise resolving to a list of suitable provisioning profile within the current working directory.
		*/
		export declare function findProvisioningProfiles(opts: ValidatedSignOptions): Promise<ProvisioningProfile[]>;
		/**
		* Returns a promise embedding the provisioning profile in the app Contents folder.
		*/
		export declare function preEmbedProvisioningProfile(opts: ValidatedSignOptions, profile: ProvisioningProfile \| null): Promise<void>;

-148

dist/cjs/util-provisioning-profiles.js

		"use strict";
		var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		var desc = Object.getOwnPropertyDescriptor(m, k);
		if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {
		desc = { enumerable: true, get: function() { return m[k]; } };
		}
		Object.defineProperty(o, k2, desc);
		}) : (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		o[k2] = m[k];
		}));
		var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {
		Object.defineProperty(o, "default", { enumerable: true, value: v });
		}) : function(o, v) {
		o["default"] = v;
		});
		var __importStar = (this && this.__importStar) \|\| function (mod) {
		if (mod && mod.__esModule) return mod;
		var result = {};
		if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
		__setModuleDefault(result, mod);
		return result;
		};
		var __importDefault = (this && this.__importDefault) \|\| function (mod) {
		return (mod && mod.__esModule) ? mod : { "default": mod };
		};
		Object.defineProperty(exports, "__esModule", { value: true });
		exports.preEmbedProvisioningProfile = exports.findProvisioningProfiles = exports.getProvisioningProfile = exports.ProvisioningProfile = void 0;
		const fs = __importStar(require("fs-extra"));
		const path = __importStar(require("path"));
		const plist_1 = __importDefault(require("plist"));
		const util_1 = require("./util");
		class ProvisioningProfile {
		constructor(filePath, message) {
		this.filePath = filePath;
		this.message = message;
		}
		get name() {
		return this.message.Name;
		}
		get platforms() {
		if ('ProvisionsAllDevices' in this.message)
		return ['darwin'];
		// Developer ID
		else if (this.type === 'distribution')
		return ['mas'];
		// Mac App Store
		else
		return ['darwin', 'mas']; // Mac App Development
		}
		get type() {
		if ('ProvisionedDevices' in this.message)
		return 'development';
		// Mac App Development
		else
		return 'distribution'; // Developer ID or Mac App Store
		}
		}
		exports.ProvisioningProfile = ProvisioningProfile;
		/**
		* Returns a promise resolving to a ProvisioningProfile instance based on file.
		* @function
		* @param {string} filePath - Path to provisioning profile.
		* @param {string} keychain - Keychain to use when unlocking provisioning profile.
		* @returns {Promise} Promise.
		*/
		async function getProvisioningProfile(filePath, keychain = null) {
		const securityArgs = [
		'cms',
		'-D',
		'-i',
		filePath // Use infile as source of data
		];
		if (keychain) {
		securityArgs.push('-k', keychain);
		}
		const result = await (0, util_1.execFileAsync)('security', securityArgs);
		const provisioningProfile = new ProvisioningProfile(filePath, plist_1.default.parse(result));
		(0, util_1.debugLog)('Provisioning profile:', '\n', '> Name:', provisioningProfile.name, '\n', '> Platforms:', provisioningProfile.platforms, '\n', '> Type:', provisioningProfile.type, '\n', '> Path:', provisioningProfile.filePath, '\n', '> Message:', provisioningProfile.message);
		return provisioningProfile;
		}
		exports.getProvisioningProfile = getProvisioningProfile;
		/**
		* Returns a promise resolving to a list of suitable provisioning profile within the current working directory.
		*/
		async function findProvisioningProfiles(opts) {
		const cwd = process.cwd();
		const children = await fs.readdir(cwd);
		const foundProfiles = (0, util_1.compactFlattenedList)(await Promise.all(children.map(async (child) => {
		const filePath = path.resolve(cwd, child);
		const stat = await fs.stat(filePath);
		if (stat.isFile() && path.extname(filePath) === '.provisionprofile') {
		return filePath;
		}
		return null;
		})));
		return (0, util_1.compactFlattenedList)(await Promise.all(foundProfiles.map(async (filePath) => {
		const profile = await getProvisioningProfile(filePath);
		if (profile.platforms.indexOf(opts.platform) >= 0 && profile.type === opts.type) {
		return profile;
		}
		(0, util_1.debugWarn)('Provisioning profile above ignored, not for ' + opts.platform + ' ' + opts.type + '.');
		return null;
		})));
		}
		exports.findProvisioningProfiles = findProvisioningProfiles;
		/**
		* Returns a promise embedding the provisioning profile in the app Contents folder.
		*/
		async function preEmbedProvisioningProfile(opts, profile) {
		async function embedProvisioningProfile(profile) {
		(0, util_1.debugLog)('Looking for existing provisioning profile...');
		const embeddedFilePath = path.join((0, util_1.getAppContentsPath)(opts), 'embedded.provisionprofile');
		if (await fs.pathExists(embeddedFilePath)) {
		(0, util_1.debugLog)('Found embedded provisioning profile:', '\n', '* Please manually remove the existing file if not wanted.', '\n', '* Current file at:', embeddedFilePath);
		}
		else {
		(0, util_1.debugLog)('Embedding provisioning profile...');
		await fs.copy(profile.filePath, embeddedFilePath);
		}
		}
		if (profile) {
		// User input provisioning profile
		return await embedProvisioningProfile(profile);
		}
		else {
		// Discover provisioning profile
		(0, util_1.debugLog)('No `provisioning-profile` passed in arguments, will find in current working directory and in user library...');
		const profiles = await findProvisioningProfiles(opts);
		if (profiles.length > 0) {
		// Provisioning profile(s) found
		if (profiles.length > 1) {
		(0, util_1.debugLog)('Multiple provisioning profiles found, will use the first discovered.');
		}
		else {
		(0, util_1.debugLog)('Found 1 provisioning profile.');
		}
		await embedProvisioningProfile(profiles[0]);
		}
		else {
		// No provisioning profile found
		(0, util_1.debugLog)('No provisioning profile found, will not embed profile in app contents.');
		}
		}
		}
		exports.preEmbedProvisioningProfile = preEmbedProvisioningProfile;
		//# sourceMappingURL=util-provisioning-profiles.js.map

-1

dist/cjs/util-provisioning-profiles.js.map

{"version":3,"file":"util-provisioning-profiles.js","sourceRoot":"","sources":["../../src/util-provisioning-profiles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6CAA+B;AAC/B,2CAA6B;AAC7B,kDAA0B;AAG1B,iCAAsG;AAEtG,MAAa,mBAAmB;IAC9B,YAAoB,QAAgB,EAAS,OAAY;QAArC,aAAQ,GAAR,QAAQ,CAAQ;QAAS,YAAO,GAAP,OAAO,CAAK;IAAG,CAAC;IAE7D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,IAAI,SAAS;QACX,IAAI,sBAAsB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,eAAe;aACV,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,gBAAgB;;YACX,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,sBAAsB;IACvD,CAAC;IAED,IAAI,IAAI;QACN,IAAI,oBAAoB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,aAAa,CAAC;QAC/D,sBAAsB;;YACjB,OAAO,cAAc,CAAC,CAAC,gCAAgC;IAC9D,CAAC;CACF;AApBD,kDAoBC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,sBAAsB,CAAE,QAAgB,EAAE,WAA0B,IAAI;IAC5F,MAAM,YAAY,GAAG;QACnB,KAAK;QACL,IAAI;QACJ,IAAI;QACJ,QAAQ,CAAC,+BAA+B;KACzC,CAAC;IAEF,IAAI,QAAQ,EAAE;QACZ,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;KACnC;IAED,MAAM,MAAM,GAAG,MAAM,IAAA,oBAAa,EAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,QAAQ,EAAE,eAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,IAAA,eAAQ,EACN,uBAAuB,EACvB,IAAI,EACJ,SAAS,EACT,mBAAmB,CAAC,IAAI,EACxB,IAAI,EACJ,cAAc,EACd,mBAAmB,CAAC,SAAS,EAC7B,IAAI,EACJ,SAAS,EACT,mBAAmB,CAAC,IAAI,EACxB,IAAI,EACJ,SAAS,EACT,mBAAmB,CAAC,QAAQ,EAC5B,IAAI,EACJ,YAAY,EACZ,mBAAmB,CAAC,OAAO,CAC5B,CAAC;IACF,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAjCD,wDAiCC;AAED;;GAEG;AACI,KAAK,UAAU,wBAAwB,CAAE,IAA0B;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,IAAA,2BAAoB,EACxC,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,mBAAmB,EAAE;YACnE,OAAO,QAAQ,CAAC;SACjB;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CACF,CAAC;IAEF,OAAO,IAAA,2BAAoB,EACzB,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,OAAO,CAAC;SAAE;QACpG,IAAA,gBAAS,EACP,8CAA8C,GAAG,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CACvF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AA5BD,4DA4BC;AAED;;GAEG;AACI,KAAK,UAAU,2BAA2B,CAAE,IAA0B,EAAE,OAAmC;IAChH,KAAK,UAAU,wBAAwB,CAAE,OAA4B;QACnE,IAAA,eAAQ,EAAC,8CAA8C,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,yBAAkB,EAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAE1F,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;YACzC,IAAA,eAAQ,EACN,sCAAsC,EACtC,IAAI,EACJ,2DAA2D,EAC3D,IAAI,EACJ,oBAAoB,EACpB,gBAAgB,CACjB,CAAC;SACH;aAAM;YACL,IAAA,eAAQ,EAAC,mCAAmC,CAAC,CAAC;YAC9C,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;SACnD;IACH,CAAC;IAED,IAAI,OAAO,EAAE;QACX,kCAAkC;QAClC,OAAO,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;KAChD;SAAM;QACL,gCAAgC;QAChC,IAAA,eAAQ,EACN,8GAA8G,CAC/G,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACvB,gCAAgC;YAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;gBACvB,IAAA,eAAQ,EAAC,sEAAsE,CAAC,CAAC;aAClF;iBAAM;gBACL,IAAA,eAAQ,EAAC,+BAA+B,CAAC,CAAC;aAC3C;YACD,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;SAC7C;aAAM;YACL,gCAAgC;YAChC,IAAA,eAAQ,EAAC,wEAAwE,CAAC,CAAC;SACpF;KACF;AACH,CAAC;AA1CD,kEA0CC"}

-36

dist/cjs/util.d.ts

		/// <reference types="node" />
		import * as child from 'child_process';
		import debug from 'debug';
		import { BaseSignOptions, ElectronMacPlatform } from './types';
		export declare const debugLog: debug.Debugger;
		export declare const debugWarn: debug.Debugger;
		export declare function execFileAsync(file: string, args: string[], options?: child.ExecFileOptions): Promise<string>;
		type DeepListItem<T> = null \| T \| DeepListItem<T>[];
		type DeepList<T> = DeepListItem<T>[];
		export declare function compactFlattenedList<T>(list: DeepList<T>): T[];
		/**
		* Returns the path to the "Contents" folder inside the application bundle
		*/
		export declare function getAppContentsPath(opts: BaseSignOptions): string;
		/**
		* Returns the path to app "Frameworks" within contents.
		*/
		export declare function getAppFrameworksPath(opts: BaseSignOptions): string;
		export declare function detectElectronPlatform(opts: BaseSignOptions): Promise<ElectronMacPlatform>;
		/**
		* This function returns a promise validating opts.app, the application to be signed or flattened.
		*/
		export declare function validateOptsApp(opts: BaseSignOptions): Promise<void>;
		/**
		* This function returns a promise validating opts.platform, the platform of Electron build. It allows auto-discovery if no opts.platform is specified.
		*/
		export declare function validateOptsPlatform(opts: BaseSignOptions): Promise<ElectronMacPlatform>;
		/**
		* This function returns a promise resolving all child paths within the directory specified.
		* @function
		* @param {string} dirPath - Path to directory.
		* @returns {Promise} Promise resolving child paths needing signing in order.
		* @internal
		*/
		export declare function walkAsync(dirPath: string): Promise<string[]>;
		export {};

-183

dist/cjs/util.js

		"use strict";
		var __createBinding = (this && this.__createBinding) \|\| (Object.create ? (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		var desc = Object.getOwnPropertyDescriptor(m, k);
		if (!desc \|\| ("get" in desc ? !m.__esModule : desc.writable \|\| desc.configurable)) {
		desc = { enumerable: true, get: function() { return m[k]; } };
		}
		Object.defineProperty(o, k2, desc);
		}) : (function(o, m, k, k2) {
		if (k2 === undefined) k2 = k;
		o[k2] = m[k];
		}));
		var __setModuleDefault = (this && this.__setModuleDefault) \|\| (Object.create ? (function(o, v) {
		Object.defineProperty(o, "default", { enumerable: true, value: v });
		}) : function(o, v) {
		o["default"] = v;
		});
		var __importStar = (this && this.__importStar) \|\| function (mod) {
		if (mod && mod.__esModule) return mod;
		var result = {};
		if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
		__setModuleDefault(result, mod);
		return result;
		};
		var __importDefault = (this && this.__importDefault) \|\| function (mod) {
		return (mod && mod.__esModule) ? mod : { "default": mod };
		};
		Object.defineProperty(exports, "__esModule", { value: true });
		exports.walkAsync = exports.validateOptsPlatform = exports.validateOptsApp = exports.detectElectronPlatform = exports.getAppFrameworksPath = exports.getAppContentsPath = exports.compactFlattenedList = exports.execFileAsync = exports.debugWarn = exports.debugLog = void 0;
		const child = __importStar(require("child_process"));
		const fs = __importStar(require("fs-extra"));
		const isbinaryfile_1 = require("isbinaryfile");
		const path = __importStar(require("path"));
		const debug_1 = __importDefault(require("debug"));
		exports.debugLog = (0, debug_1.default)('electron-osx-sign');
		exports.debugLog.log = console.log.bind(console);
		exports.debugWarn = (0, debug_1.default)('electron-osx-sign:warn');
		exports.debugWarn.log = console.warn.bind(console);
		const removePassword = function (input) {
		return input.replace(/(-P \|pass:\|\/p\|-pass )([^ ]+)/, function (_, p1) {
		return `${p1}***`;
		});
		};
		async function execFileAsync(file, args, options = {}) {
		if (exports.debugLog.enabled) {
		(0, exports.debugLog)('Executing...', file, args && Array.isArray(args) ? removePassword(args.join(' ')) : '');
		}
		return new Promise(function (resolve, reject) {
		child.execFile(file, args, options, function (err, stdout, stderr) {
		if (err) {
		(0, exports.debugLog)('Error executing file:', '\n', '> Stdout:', stdout, '\n', '> Stderr:', stderr);
		reject(err);
		return;
		}
		resolve(stdout);
		});
		});
		}
		exports.execFileAsync = execFileAsync;
		function compactFlattenedList(list) {
		const result = [];
		function populateResult(list) {
		if (!Array.isArray(list)) {
		if (list)
		result.push(list);
		}
		else if (list.length > 0) {
		for (const item of list)
		if (item)
		populateResult(item);
		}
		}
		populateResult(list);
		return result;
		}
		exports.compactFlattenedList = compactFlattenedList;
		/**
		* Returns the path to the "Contents" folder inside the application bundle
		*/
		function getAppContentsPath(opts) {
		return path.join(opts.app, 'Contents');
		}
		exports.getAppContentsPath = getAppContentsPath;
		/**
		* Returns the path to app "Frameworks" within contents.
		*/
		function getAppFrameworksPath(opts) {
		return path.join(getAppContentsPath(opts), 'Frameworks');
		}
		exports.getAppFrameworksPath = getAppFrameworksPath;
		async function detectElectronPlatform(opts) {
		const appFrameworksPath = getAppFrameworksPath(opts);
		if (await fs.pathExists(path.resolve(appFrameworksPath, 'Squirrel.framework'))) {
		return 'darwin';
		}
		else {
		return 'mas';
		}
		}
		exports.detectElectronPlatform = detectElectronPlatform;
		/**
		* This function returns a promise resolving the file path if file binary.
		*/
		async function getFilePathIfBinary(filePath) {
		if (await (0, isbinaryfile_1.isBinaryFile)(filePath)) {
		return filePath;
		}
		return null;
		}
		/**
		* This function returns a promise validating opts.app, the application to be signed or flattened.
		*/
		async function validateOptsApp(opts) {
		if (!opts.app) {
		throw new Error('Path to application must be specified.');
		}
		if (path.extname(opts.app) !== '.app') {
		throw new Error('Extension of application must be `.app`.');
		}
		if (!(await fs.pathExists(opts.app))) {
		throw new Error(`Application at path "${opts.app}" could not be found`);
		}
		}
		exports.validateOptsApp = validateOptsApp;
		/**
		* This function returns a promise validating opts.platform, the platform of Electron build. It allows auto-discovery if no opts.platform is specified.
		*/
		async function validateOptsPlatform(opts) {
		if (opts.platform) {
		if (opts.platform === 'mas' \|\| opts.platform === 'darwin') {
		return opts.platform;
		}
		else {
		(0, exports.debugWarn)('`platform` passed in arguments not supported, checking Electron platform...');
		}
		}
		else {
		(0, exports.debugWarn)('No `platform` passed in arguments, checking Electron platform...');
		}
		return await detectElectronPlatform(opts);
		}
		exports.validateOptsPlatform = validateOptsPlatform;
		/**
		* This function returns a promise resolving all child paths within the directory specified.
		* @function
		* @param {string} dirPath - Path to directory.
		* @returns {Promise} Promise resolving child paths needing signing in order.
		* @internal
		*/
		async function walkAsync(dirPath) {
		(0, exports.debugLog)('Walking... ' + dirPath);
		async function _walkAsync(dirPath) {
		const children = await fs.readdir(dirPath);
		return await Promise.all(children.map(async (child) => {
		const filePath = path.resolve(dirPath, child);
		const stat = await fs.stat(filePath);
		if (stat.isFile()) {
		switch (path.extname(filePath)) {
		case '.cstemp': // Temporary file generated from past codesign
		(0, exports.debugLog)('Removing... ' + filePath);
		await fs.remove(filePath);
		return null;
		default:
		return await getFilePathIfBinary(filePath);
		}
		}
		else if (stat.isDirectory() && !stat.isSymbolicLink()) {
		const walkResult = await _walkAsync(filePath);
		switch (path.extname(filePath)) {
		case '.app': // Application
		case '.framework': // Framework
		walkResult.push(filePath);
		}
		return walkResult;
		}
		return null;
		}));
		}
		const allPaths = await _walkAsync(dirPath);
		return compactFlattenedList(allPaths);
		}
		exports.walkAsync = walkAsync;
		//# sourceMappingURL=util.js.map

-1

dist/cjs/util.js.map

-15

dist/esm/flat.d.ts

		import { FlatOptions } from './types';
		/**
		* Generates a flat `.pkg` installer for a packaged Electron `.app` bundle.
		* @returns A void Promise once the flattening operation is complete.
		*
		* @category Flat
		*/
		export declare function buildPkg(_opts: FlatOptions): Promise<void>;
		/**
		* This function is exported with normal callback implementation.
		*
		* @deprecated Please use the Promise-based {@link flatAsync} method instead.
		* @category Flat
		*/
		export declare const flat: (opts: FlatOptions, cb?: ((error?: Error) => void) \| undefined) => void;

-151

dist/esm/flat.js

		import * as path from 'path';
		import { debugLog, debugWarn, execFileAsync, validateOptsApp, validateOptsPlatform } from './util';
		import { findIdentities } from './util-identities';
		const pkgVersion = require('../../package.json').version;
		/**
		* This function returns a promise validating all options passed in opts.
		* @function
		* @param {Object} opts - Options.
		* @returns {Promise} Promise.
		*/
		async function validateFlatOpts(opts) {
		await validateOptsApp(opts);
		let pkg = opts.pkg;
		if (pkg) {
		if (typeof pkg !== 'string')
		throw new Error('`pkg` must be a string.');
		if (path.extname(pkg) !== '.pkg') {
		throw new Error('Extension of output package must be `.pkg`.');
		}
		}
		else {
		debugWarn('No `pkg` passed in arguments, will fallback to default inferred from the given application.');
		pkg = path.join(path.dirname(opts.app), path.basename(opts.app, '.app') + '.pkg');
		}
		let install = opts.install;
		if (install) {
		if (typeof install !== 'string') {
		return Promise.reject(new Error('`install` must be a string.'));
		}
		}
		else {
		debugWarn('No `install` passed in arguments, will fallback to default `/Applications`.');
		install = '/Applications';
		}
		if (typeof opts.scripts === 'string' && opts.platform === 'mas') {
		debugWarn('Mac App Store packages cannot have `scripts`, ignoring option.');
		}
		return Object.assign(Object.assign({}, opts), { pkg,
		install, platform: await validateOptsPlatform(opts) });
		}
		/**
		* This function returns a promise flattening the application.
		* @param opts - Options for building the .pkg archive
		*/
		async function buildApplicationPkg(opts, identity) {
		if (opts.platform === 'mas') {
		const args = ['--component', opts.app, opts.install, '--sign', identity.name, opts.pkg];
		if (opts.keychain) {
		args.unshift('--keychain', opts.keychain);
		}
		debugLog('Flattening Mac App Store package... ' + opts.app);
		await execFileAsync('productbuild', args);
		}
		else {
		const componentPkgPath = path.join(path.dirname(opts.app), path.basename(opts.app, '.app') + '-component.pkg');
		const pkgbuildArgs = [
		'--install-location',
		opts.install,
		'--component',
		opts.app,
		componentPkgPath
		];
		if (opts.scripts) {
		pkgbuildArgs.unshift('--scripts', opts.scripts);
		}
		debugLog('Building component package... ' + opts.app);
		await execFileAsync('pkgbuild', pkgbuildArgs);
		const args = ['--package', componentPkgPath, opts.install, '--sign', identity.name, opts.pkg];
		if (opts.keychain) {
		args.unshift('--keychain', opts.keychain);
		}
		debugLog('Flattening OS X Installer package... ' + opts.app);
		await execFileAsync('productbuild', args);
		await execFileAsync('rm', [componentPkgPath]);
		}
		}
		/**
		* Generates a flat `.pkg` installer for a packaged Electron `.app` bundle.
		* @returns A void Promise once the flattening operation is complete.
		*
		* @category Flat
		*/
		export async function buildPkg(_opts) {
		debugLog('@electron/osx-sign@%s', pkgVersion);
		const validatedOptions = await validateFlatOpts(_opts);
		let identities = [];
		let identityInUse = null;
		if (validatedOptions.identity) {
		debugLog('`identity` passed in arguments.');
		if (validatedOptions.identityValidation === false) {
		// Do nothing
		}
		else {
		identities = await findIdentities(validatedOptions.keychain \|\| null, validatedOptions.identity);
		}
		}
		else {
		debugWarn('No `identity` passed in arguments...');
		if (validatedOptions.platform === 'mas') {
		debugLog('Finding `3rd Party Mac Developer Installer` certificate for flattening app distribution in the Mac App Store...');
		identities = await findIdentities(validatedOptions.keychain \|\| null, '3rd Party Mac Developer Installer:');
		}
		else {
		debugLog('Finding `Developer ID Application` certificate for distribution outside the Mac App Store...');
		identities = await findIdentities(validatedOptions.keychain \|\| null, 'Developer ID Installer:');
		}
		}
		if (identities.length > 0) {
		// Provisioning profile(s) found
		if (identities.length > 1) {
		debugWarn('Multiple identities found, will use the first discovered.');
		}
		else {
		debugLog('Found 1 identity.');
		}
		identityInUse = identities[0];
		}
		else {
		// No identity found
		throw new Error('No identity found for signing.');
		}
		debugLog('Flattening application...', '\n', '> Application:', validatedOptions.app, '\n', '> Package output:', validatedOptions.pkg, '\n', '> Install path:', validatedOptions.install, '\n', '> Identity:', validatedOptions.identity, '\n', '> Scripts:', validatedOptions.scripts);
		await buildApplicationPkg(validatedOptions, identityInUse);
		debugLog('Application flattened.');
		}
		/**
		* This function is exported with normal callback implementation.
		*
		* @deprecated Please use the Promise-based {@link flatAsync} method instead.
		* @category Flat
		*/
		export const flat = (opts, cb) => {
		buildPkg(opts)
		.then(() => {
		debugLog('Application flattened, saved to: ' + opts.app);
		if (cb)
		cb();
		})
		.catch((err) => {
		debugLog('Flat failed:');
		if (err.message)
		debugLog(err.message);
		else if (err.stack)
		debugLog(err.stack);
		else
		debugLog(err);
		if (cb)
		cb(err);
		});
		};
		//# sourceMappingURL=flat.js.map

-1

dist/esm/flat.js.map

-5

dist/esm/index.d.ts

		import { sign, signApp } from './sign';
		import { flat, buildPkg } from './flat';
		import { walkAsync } from './util';
		export { sign, flat, signApp as signAsync, signApp, buildPkg as flatAsync, buildPkg, walkAsync };
		export * from './types';

-16

dist/esm/index.js

		import { sign, signApp } from './sign';
		import { flat, buildPkg } from './flat';
		import { walkAsync } from './util';
		// TODO: Remove and leave only proper named exports, but for non-breaking change reasons
		// we need to keep this weirdness for now
		module.exports = sign;
		module.exports.sign = sign;
		module.exports.signAsync = signApp;
		module.exports.signApp = signApp;
		module.exports.flat = flat;
		module.exports.flatAsync = buildPkg;
		module.exports.buildPkg = buildPkg;
		module.exports.walkAsync = walkAsync;
		export { sign, flat, signApp as signAsync, signApp, buildPkg as flatAsync, buildPkg, walkAsync };
		export * from './types';
		//# sourceMappingURL=index.js.map

-1

dist/esm/index.js.map

{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEnC,wFAAwF;AACxF,yCAAyC;AACzC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;AACtB,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;AAC3B,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC;AACnC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;AACjC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;AAC3B,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;AACpC,MAAM,CAAC,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;AACnC,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;AAErC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,EAAE,QAAQ,IAAI,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjG,cAAc,SAAS,CAAC"}

-15

dist/esm/sign.d.ts

		import { SignOptions } from './types';
		/**
		* Signs a macOS application.
		* @returns A void Promise once the signing operation is complete.
		*
		* @category Codesign
		*/
		export declare function signApp(_opts: SignOptions): Promise<void>;
		/**
		* This function is a legacy callback implementation.
		*
		* @deprecated Please use the Promise-based {@link signAsync} method instead.
		* @category Codesign
		*/
		export declare const sign: (opts: SignOptions, cb?: ((error?: Error) => void) \| undefined) => void;

-346

dist/esm/sign.js

		import * as fs from 'fs-extra';
		import * as os from 'os';
		import * as path from 'path';
		import * as plist from 'plist';
		import compareVersion from 'compare-version';
		import { debugLog, debugWarn, getAppContentsPath, execFileAsync, validateOptsApp, validateOptsPlatform, walkAsync } from './util';
		import { Identity, findIdentities } from './util-identities';
		import { preEmbedProvisioningProfile, getProvisioningProfile } from './util-provisioning-profiles';
		import { preAutoEntitlements } from './util-entitlements';
		const pkgVersion = require('../../package.json').version;
		const osRelease = os.release();
		/**
		* This function returns a promise validating opts.binaries, the additional binaries to be signed along with the discovered enclosed components.
		*/
		async function validateOptsBinaries(opts) {
		if (opts.binaries) {
		if (!Array.isArray(opts.binaries)) {
		throw new Error('Additional binaries should be an Array.');
		}
		// TODO: Presence check for binary files, reject if any does not exist
		}
		}
		function validateOptsIgnore(ignore) {
		if (ignore && !(ignore instanceof Array)) {
		return [ignore];
		}
		}
		/**
		* This function returns a promise validating all options passed in opts.
		*/
		async function validateSignOpts(opts) {
		await validateOptsBinaries(opts);
		await validateOptsApp(opts);
		if (opts.provisioningProfile && typeof opts.provisioningProfile !== 'string') {
		throw new Error('Path to provisioning profile should be a string.');
		}
		if (opts.type && opts.type !== 'development' && opts.type !== 'distribution') {
		throw new Error('Type must be either `development` or `distribution`.');
		}
		const platform = await validateOptsPlatform(opts);
		const cloned = Object.assign(Object.assign({}, opts), { ignore: validateOptsIgnore(opts.ignore), type: opts.type \|\| 'distribution', platform });
		return cloned;
		}
		/**
		* This function returns a promise verifying the code sign of application bundle.
		*/
		async function verifySignApplication(opts) {
		// Verify with codesign
		debugLog('Verifying application bundle with codesign...');
		const strictVerify = opts.strictVerify !== undefined ? opts.strictVerify : true;
		await execFileAsync('codesign', ['--verify', '--deep'].concat(strictVerify !== false && compareVersion(osRelease, '15.0.0') >= 0 // Strict flag since darwin 15.0.0 --> OS X 10.11.0 El Capitan
		? [
		'--strict' +
		(strictVerify !== true ? '=' + strictVerify : '')
		]
		: [], ['--verbose=2', opts.app]));
		}
		function defaultOptionsForFile(filePath, platform) {
		const entitlementsFolder = path.resolve(__dirname, '..', '..', 'entitlements');
		let entitlementsFile;
		if (platform === 'darwin') {
		// Default Entitlements
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/app-entitlements.plist
		// Also include JIT for main process V8
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.plist');
		// Plugin helper
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/helper-plugin-entitlements.plist
		if (filePath.includes('(Plugin).app')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.plugin.plist');
		// GPU Helper
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/helper-gpu-entitlements.plist
		}
		else if (filePath.includes('(GPU).app')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.gpu.plist');
		// Renderer Helper
		// c.f. https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/helper-renderer-entitlements.plist
		}
		else if (filePath.includes('(Renderer).app')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.darwin.renderer.plist');
		}
		}
		else {
		// Default entitlements
		// TODO: Can these be more scoped like the non-mas variant?
		entitlementsFile = path.resolve(entitlementsFolder, 'default.mas.plist');
		// If it is not the top level app bundle, we sign with inherit
		if (filePath.includes('.app/')) {
		entitlementsFile = path.resolve(entitlementsFolder, 'default.mas.child.plist');
		}
		}
		return {
		entitlements: entitlementsFile,
		hardenedRuntime: true,
		requirements: undefined,
		signatureFlags: undefined,
		timestamp: undefined,
		additionalArguments: []
		};
		}
		async function mergeOptionsForFile(opts, defaults) {
		const mergedPerFileOptions = Object.assign({}, defaults);
		if (opts) {
		if (opts.entitlements !== undefined) {
		if (Array.isArray(opts.entitlements)) {
		const entitlements = opts.entitlements.reduce((dict, entitlementKey) => (Object.assign(Object.assign({}, dict), { [entitlementKey]: true })), {});
		const dir = await fs.mkdtemp(path.resolve(os.tmpdir(), 'tmp-entitlements-'));
		const entitlementsPath = path.join(dir, 'entitlements.plist');
		await fs.writeFile(entitlementsPath, plist.build(entitlements), 'utf8');
		opts.entitlements = entitlementsPath;
		}
		mergedPerFileOptions.entitlements = opts.entitlements;
		}
		if (opts.hardenedRuntime !== undefined) {
		mergedPerFileOptions.hardenedRuntime = opts.hardenedRuntime;
		}
		if (opts.requirements !== undefined)
		mergedPerFileOptions.requirements = opts.requirements;
		if (opts.signatureFlags !== undefined) {
		mergedPerFileOptions.signatureFlags = opts.signatureFlags;
		}
		if (opts.timestamp !== undefined)
		mergedPerFileOptions.timestamp = opts.timestamp;
		if (opts.additionalArguments !== undefined)
		mergedPerFileOptions.additionalArguments = opts.additionalArguments;
		}
		return mergedPerFileOptions;
		}
		/**
		* This function returns a promise codesigning only.
		*/
		async function signApplication(opts, identity) {
		function shouldIgnoreFilePath(filePath) {
		if (opts.ignore) {
		return opts.ignore.some(function (ignore) {
		if (typeof ignore === 'function') {
		return ignore(filePath);
		}
		return filePath.match(ignore);
		});
		}
		return false;
		}
		const children = await walkAsync(getAppContentsPath(opts));
		if (opts.binaries)
		children.push(...opts.binaries);
		const args = ['--sign', identity.hash \|\| identity.name, '--force'];
		if (opts.keychain) {
		args.push('--keychain', opts.keychain);
		}
		/**
		* Sort the child paths by how deep they are in the file tree. Some arcane apple
		* logic expects the deeper files to be signed first otherwise strange errors get
		* thrown our way
		*/
		children.sort((a, b) => {
		const aDepth = a.split(path.sep).length;
		const bDepth = b.split(path.sep).length;
		return bDepth - aDepth;
		});
		for (const filePath of [...children, opts.app]) {
		if (shouldIgnoreFilePath(filePath)) {
		debugLog('Skipped... ' + filePath);
		continue;
		}
		const perFileOptions = await mergeOptionsForFile(opts.optionsForFile ? opts.optionsForFile(filePath) : null, defaultOptionsForFile(filePath, opts.platform));
		// preAutoEntitlements should only be applied to the top level app bundle.
		// Applying it other files will cause the app to crash and be rejected by Apple.
		if (!filePath.includes('.app/')) {
		if (opts.preAutoEntitlements === false) {
		debugWarn('Pre-sign operation disabled for entitlements automation.');
		}
		else {
		debugLog('Pre-sign operation enabled for entitlements automation with versions >= `1.1.1`:', '\n', '* Disable by setting `pre-auto-entitlements` to `false`.');
		if (!opts.version \|\| compareVersion(opts.version, '1.1.1') >= 0) {
		// Enable Mac App Store sandboxing without using temporary-exception, introduced in Electron v1.1.1. Relates to electron#5601
		const newEntitlements = await preAutoEntitlements(opts, perFileOptions, {
		identity,
		provisioningProfile: opts.provisioningProfile
		? await getProvisioningProfile(opts.provisioningProfile, opts.keychain)
		: undefined
		});
		// preAutoEntitlements may provide us new entitlements, if so we update our options
		// and ensure that entitlements-loginhelper has a correct default value
		if (newEntitlements) {
		perFileOptions.entitlements = newEntitlements;
		}
		}
		}
		}
		debugLog('Signing... ' + filePath);
		const perFileArgs = [...args];
		if (perFileOptions.requirements) {
		if (perFileOptions.requirements.charAt(0) === '=') {
		perFileArgs.push(`-r${perFileOptions.requirements}`);
		}
		else {
		perFileArgs.push('--requirements', perFileOptions.requirements);
		}
		}
		if (perFileOptions.timestamp) {
		perFileArgs.push('--timestamp=' + perFileOptions.timestamp);
		}
		else {
		perFileArgs.push('--timestamp');
		}
		let optionsArguments = [];
		if (perFileOptions.signatureFlags) {
		if (Array.isArray(perFileOptions.signatureFlags)) {
		optionsArguments.push(...perFileOptions.signatureFlags);
		}
		else {
		const flags = perFileOptions.signatureFlags.split(',').map(function (flag) {
		return flag.trim();
		});
		optionsArguments.push(...flags);
		}
		}
		if (perFileOptions.hardenedRuntime \|\| optionsArguments.includes('runtime')) {
		// Hardened runtime since darwin 17.7.0 --> macOS 10.13.6
		if (compareVersion(osRelease, '17.7.0') >= 0) {
		optionsArguments.push('runtime');
		}
		else {
		// Remove runtime if passed in with --signature-flags
		debugLog('Not enabling hardened runtime, current macOS version too low, requires 10.13.6 and higher');
		optionsArguments = optionsArguments.filter((arg) => {
		return arg !== 'runtime';
		});
		}
		}
		if (optionsArguments.length) {
		perFileArgs.push('--options', [...new Set(optionsArguments)].join(','));
		}
		if (perFileOptions.additionalArguments) {
		perFileArgs.push(...perFileOptions.additionalArguments);
		}
		await execFileAsync('codesign', perFileArgs.concat('--entitlements', perFileOptions.entitlements, filePath));
		}
		// Verify code sign
		debugLog('Verifying...');
		await verifySignApplication(opts);
		debugLog('Verified.');
		// Check entitlements if applicable
		debugLog('Displaying entitlements...');
		const result = await execFileAsync('codesign', [
		'--display',
		'--entitlements',
		':-',
		opts.app
		]);
		debugLog('Entitlements:', '\n', result);
		}
		/**
		* Signs a macOS application.
		* @returns A void Promise once the signing operation is complete.
		*
		* @category Codesign
		*/
		export async function signApp(_opts) {
		debugLog('electron-osx-sign@%s', pkgVersion);
		const validatedOpts = await validateSignOpts(_opts);
		let identities = [];
		let identityInUse = null;
		// Determine identity for signing
		if (validatedOpts.identity) {
		debugLog('`identity` passed in arguments.');
		if (validatedOpts.identityValidation === false) {
		identityInUse = new Identity(validatedOpts.identity);
		}
		else {
		identities = await findIdentities(validatedOpts.keychain \|\| null, validatedOpts.identity);
		}
		}
		else {
		debugWarn('No `identity` passed in arguments...');
		if (validatedOpts.platform === 'mas') {
		if (validatedOpts.type === 'distribution') {
		debugLog('Finding `3rd Party Mac Developer Application` certificate for signing app distribution in the Mac App Store...');
		identities = await findIdentities(validatedOpts.keychain \|\| null, '3rd Party Mac Developer Application:');
		}
		else {
		debugLog('Finding `Mac Developer` certificate for signing app in development for the Mac App Store signing...');
		identities = await findIdentities(validatedOpts.keychain \|\| null, 'Mac Developer:');
		}
		}
		else {
		debugLog('Finding `Developer ID Application` certificate for distribution outside the Mac App Store...');
		identities = await findIdentities(validatedOpts.keychain \|\| null, 'Developer ID Application:');
		}
		}
		if (!identityInUse) {
		if (identities.length > 0) {
		// Identity(/ies) found
		if (identities.length > 1) {
		debugWarn('Multiple identities found, will use the first discovered.');
		}
		else {
		debugLog('Found 1 identity.');
		}
		identityInUse = identities[0];
		}
		else {
		// No identity found
		throw new Error('No identity found for signing.');
		}
		}
		// Pre-sign operations
		if (validatedOpts.preEmbedProvisioningProfile === false) {
		debugWarn('Pre-sign operation disabled for provisioning profile embedding:', '\n', '* Enable by setting `pre-embed-provisioning-profile` to `true`.');
		}
		else {
		debugLog('Pre-sign operation enabled for provisioning profile:', '\n', '* Disable by setting `pre-embed-provisioning-profile` to `false`.');
		await preEmbedProvisioningProfile(validatedOpts, validatedOpts.provisioningProfile
		? await getProvisioningProfile(validatedOpts.provisioningProfile, validatedOpts.keychain)
		: null);
		}
		debugLog('Signing application...', '\n', '> Application:', validatedOpts.app, '\n', '> Platform:', validatedOpts.platform, '\n', '> Additional binaries:', validatedOpts.binaries, '\n', '> Identity:', validatedOpts.identity);
		await signApplication(validatedOpts, identityInUse);
		// Post-sign operations
		debugLog('Application signed.');
		}
		/**
		* This function is a legacy callback implementation.
		*
		* @deprecated Please use the Promise-based {@link signAsync} method instead.
		* @category Codesign
		*/
		export const sign = (opts, cb) => {
		signApp(opts)
		.then(() => {
		debugLog('Application signed: ' + opts.app);
		if (cb)
		cb();
		})
		.catch((err) => {
		if (err.message)
		debugLog(err.message);
		else if (err.stack)
		debugLog(err.stack);
		else
		debugLog(err);
		if (cb)
		cb(err);
		});
		};
		//# sourceMappingURL=sign.js.map

-1

dist/esm/sign.js.map

-258

dist/esm/types.d.ts

		/**
		* macOS applications can be distributed via the Mac App Store (MAS) or directly
		* downloaded from the developer's website. @electron/osx-sign distinguishes between
		* MAS apps (`mas`) or non-MAS apps (`darwin`).
		* @category Utility
		*/
		export type ElectronMacPlatform = 'darwin' \| 'mas';
		/**
		* MAS apps can be signed using Development or Distribution certificates.

		* See [Apple Documentation](https://developer.apple.com/help/account/create-certificates/certificates-overview/) for more info.
		* @category Utility
		*/
		export type SigningDistributionType = 'development' \| 'distribution';
		/**
		* @interface
		* @internal
		*/
		export type BaseSignOptions = Readonly<{
		/**
		* Path to the application package.
		* Needs to end with the file extension `.app`.
		*/
		app: string;
		/**
		* The keychain name.
		*
		* @defaultValue `login`
		*/
		keychain?: string;
		/**
		* Build platform of your Electron app.
		* Allowed values: `darwin` (Direct Download App), `mas` (Mac App Store).
		*
		* @defaultValue Determined by presence of `Squirrel.framework` within the application bundle,
		* which is used for non-MAS apps.
		*/
		platform?: ElectronMacPlatform;
		/**
		* Name of the certificate to use when signing.
		*
		* @defaultValue Selected with respect to {@link SignOptions.provisioningProfile \| provisioningProfile}
		* and {@link SignOptions.platform \| platform} from the selected {@link SignOptions.keychain \| keychain}.
		* * `mas` will look for `3rd Party Mac Developer Application: * (*)`
		* * `darwin` will look for `Developer ID Application: * (*)` by default.
		*/
		identity?: string;
		}>;
		type OnlyValidatedBaseSignOptions = {
		platform: ElectronMacPlatform;
		};
		/**
		* A set of signing options that can be overriden on a per-file basis.
		* Any missing options will use the default values, and providing a partial structure
		* will shallow merge with the default values.
		* @interface
		* @category Codesign
		*/
		export type PerFileSignOptions = {
		/**
		* String specifying the path to an `entitlements.plist` file.
		* Can also be an array of entitlement keys that osx-sign will write to an entitlements file for you.
		*
		* @defaultValue `@electron/osx-sign`'s built-in entitlements files.
		*/
		entitlements?: string \| string[];
		/**
		* Whether to enable [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime)
		* for this file.
		*
		* Note: Hardened Runtime is a pre-requisite for notarization, which is mandatory for apps running on macOS 10.15 and above.
		*
		* @defaultValue `true`
		*/
		hardenedRuntime?: boolean;
		/**
		* Either a string beginning with `=` which specifies in plain text the
		* [signing requirements](https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/RequirementLang/RequirementLang.html)
		* that you recommend to be used to evaluate the code signature, or a string specifying a path to a text or
		* properly encoded `.rqset` file which contains those requirements.
		*/
		requirements?: string;
		/**
		* When signing, a set of option flags can be specified to change the behavior of the system when using the signed code.
		* Accepts an array of strings or a comma-separated string.
		*
		* See --options of the `codesign` command.
		*
		* https://keith.github.io/xcode-man-pages/codesign.1.html#OPTION_FLAGS
		*/
		signatureFlags?: string \| string[];
		/**
		* String specifying the URL of the timestamp authority server.
		* Please note that this default server may not support signatures not furnished by Apple.
		* Disable the timestamp service with `none`.
		*
		* @defaultValue Uses the Apple-provided timestamp server.
		*/
		timestamp?: string;
		/**
		* Additional raw arguments to pass to the `codesign` command.
		*
		* These can be things like `--deep` for instance when code signing specific resources that may
		* require such arguments.
		*
		* https://keith.github.io/xcode-man-pages/codesign.1.html#OPTIONS
		*/
		additionalArguments?: string[];
		};
		/**
		* @interface
		* @internal
		*/
		export type OnlySignOptions = {
		/**
		* Array of paths to additional binaries that will be signed along with built-ins of Electron.
		*
		* @defaultValue `undefined`
		*/
		binaries?: string[];
		/**
		* Function that receives the path to a file and can return the entitlements to use for that file to override the default behavior. The
		* object this function returns can include any of the following optional keys. Any properties that are returned override the default
		* values that `@electron/osx-sign` generates. Any properties not returned use the default value.
		*
		* @param filePath Path to file
		* @returns Override signing options
		*/
		optionsForFile?: (filePath: string) => PerFileSignOptions;
		/**
		* Flag to enable/disable validation for the signing identity.
		* If enabled, the {@link SignOptions.identity \| identity} provided
		* will be validated in the {@link BaseSignOptions.keychain \| keychain} specified.
		*
		* @defaultValue `true`
		*/
		identityValidation?: boolean;
		/**
		* Defines files that will be skipped during the code signing process.
		* This property accepts a regex, function or an array of regexes and functions.
		* Elements of other types are treated as `RegExp`.
		*
		* File paths matching a regex or returning a `true` value from a function will be ignored.
		*
		* @defaultValue `undefined`
		*/
		ignore?: string \| string[] \| ((file: string) => boolean);
		/**
		* Flag to enable/disable entitlements automation tasks necessary for code signing most Electron apps.
		* * Adds [`com.apple.security.application-groups`](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_application-groups) to the entitlements file
		* * Fills in the `ElectronTeamID` property in `Info.plist` with the provisioning profile's Team Identifier or by parsing the identity name.
		*
		* @defaultValue `true`
		*/
		preAutoEntitlements?: boolean;
		/**
		* Flag to enable/disable the embedding of a provisioning profile into the app's `Contents` folder.
		* Will use the profile from {@link OnlySignOptions.provisioningProfile} if provided. Otherwise, it
		* searches for a `.provisionprofile` file in the current working directory.
		*
		* @defaultValue `true`
		*/
		preEmbedProvisioningProfile?: boolean;
		/**
		* Path to a provisioning profile, which can be used to grant restricted entitlements to your app.
		*
		* See [Apple Documentation](https://developer.apple.com/documentation/technotes/tn3125-inside-code-signing-provisioning-profiles) for more details.
		*/
		provisioningProfile?: string;
		/**
		* Flag to enable/disable the `--strict` flag when verifying the signed application bundle.
		* Also supports string values to specify which strict restrictions to use, see codesign man page for supported values.
		*
		* @defaultValue `true`
		*/
		strictVerify?: boolean \| string;
		/**
		* Type of certificate to use when signing a MAS app.
		* @defaultValue `"distribution"`
		*/
		type?: SigningDistributionType;
		/**
		* Build version of Electron. Values may be like: `1.1.1`, `1.2.0`. For use for signing legacy versions
		* of Electron to ensure backwards compatibility.
		*/
		version?: string;
		};
		type OnlyValidatedSignOptions = {
		ignore?: (string \| ((file: string) => boolean))[];
		type: SigningDistributionType;
		};
		type OnlyFlatOptions = {
		/**
		* Flag to enable/disable validation for the signing identity.
		* If enabled, the {@link BaseSignOptions.identity \| identity} provided
		* will be validated in the {@link BaseSignOptions.keychain \| keychain} specified.
		*
		* @defaultValue `true`
		*/
		identityValidation?: boolean;
		/**
		* Path to install the bundle.
		* @defaultValue `"/Applications"`
		*/
		install?: string;
		/**
		* Output path for the flattened installer package.
		* Needs file extension `.pkg`.
		*
		* @defaultValue Inferred from the app name passed into `opts.app`.
		*/
		pkg?: string;
		/**
		* Path to a directory containing `preinstall.sh` or `postinstall.sh` scripts.
		* These must be executable and will run on pre/postinstall depending on the file
		* name.
		*
		* This option is only valid if {@link FlatOptions.platform} is set to `darwin`.
		*/
		scripts?: string;
		};
		type OnlyValidatedFlatOptions = {
		install: string;
		pkg: string;
		};
		/**
		* Utility type that represents an `UnValidated` type after validation,
		* replacing any properties in the unvalidated type that also exist in the
		* `Validated` type with the validated versions.
		*
		* @template UnValidated - The type representing the unvalidated form.
		* @template Validated - The type representing the validated form.
		*/
		type ValidatedForm<UnValidated, Validated> = Omit<UnValidated, keyof Validated> & Validated;
		type ValidatedBaseSignOptions = Readonly<ValidatedForm<BaseSignOptions, OnlyValidatedBaseSignOptions>>;
		type _SignOptions = Readonly<OnlySignOptions & BaseSignOptions>;
		/**
		* Options for codesigning a packaged `.app` bundle.
		* @category Codesign
		*/
		export interface SignOptions extends _SignOptions {
		}
		/**
		* @internal
		*/
		export type ValidatedSignOptions = Readonly<ValidatedForm<OnlySignOptions, OnlyValidatedSignOptions> & ValidatedBaseSignOptions>;
		type _FlatOptions = Readonly<OnlyFlatOptions & BaseSignOptions>;
		/**
		* Options for creating a flat `.pkg` installer.
		* @category Flat
		*/
		export interface FlatOptions extends _FlatOptions {
		}
		/**
		* @internal
		*/
		export type ValidatedFlatOptions = Readonly<ValidatedForm<OnlyFlatOptions, OnlyValidatedFlatOptions> & ValidatedBaseSignOptions>;
		export {};

-2

dist/esm/types.js

		export {};
		//# sourceMappingURL=types.js.map

-1

dist/esm/types.js.map

{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}

-17

dist/esm/util-entitlements.d.ts

		import { PerFileSignOptions, ValidatedSignOptions } from './types';
		import { Identity } from './util-identities';
		import { ProvisioningProfile } from './util-provisioning-profiles';
		type ComputedOptions = {
		identity: Identity;
		provisioningProfile?: ProvisioningProfile;
		};
		/**
		* This function returns a promise completing the entitlements automation: The
		* process includes checking in `Info.plist` for `ElectronTeamID` or setting
		* parsed value from identity, and checking in entitlements file for
		* `com.apple.security.application-groups` or inserting new into array. A
		* temporary entitlements file may be created to replace the input for any
		* changes introduced.
		*/
		export declare function preAutoEntitlements(opts: ValidatedSignOptions, perFileOpts: PerFileSignOptions, computed: ComputedOptions): Promise<void \| string>;
		export {};

-106

dist/esm/util-entitlements.js

		import * as fs from 'fs-extra';
		import * as os from 'os';
		import * as path from 'path';
		import * as plist from 'plist';
		import { debugLog, getAppContentsPath } from './util';
		const preAuthMemo = new Map();
		/**
		* This function returns a promise completing the entitlements automation: The
		* process includes checking in `Info.plist` for `ElectronTeamID` or setting
		* parsed value from identity, and checking in entitlements file for
		* `com.apple.security.application-groups` or inserting new into array. A
		* temporary entitlements file may be created to replace the input for any
		* changes introduced.
		*/
		export async function preAutoEntitlements(opts, perFileOpts, computed) {
		var _a;
		if (!perFileOpts.entitlements)
		return;
		const memoKey = [opts.app, perFileOpts.entitlements].join('---');
		if (preAuthMemo.has(memoKey))
		return preAuthMemo.get(memoKey);
		// If entitlements file not provided, default will be used. Fixes #41
		const appInfoPath = path.join(getAppContentsPath(opts), 'Info.plist');
		debugLog('Automating entitlement app group...', '\n', '> Info.plist:', appInfoPath, '\n');
		let entitlements;
		if (typeof perFileOpts.entitlements === 'string') {
		const entitlementsContents = await fs.readFile(perFileOpts.entitlements, 'utf8');
		entitlements = plist.parse(entitlementsContents);
		}
		else {
		entitlements = perFileOpts.entitlements.reduce((dict, entitlementKey) => (Object.assign(Object.assign({}, dict), { [entitlementKey]: true })), {});
		}
		if (!entitlements['com.apple.security.app-sandbox']) {
		// Only automate when app sandbox enabled by user
		return;
		}
		const appInfoContents = await fs.readFile(appInfoPath, 'utf8');
		const appInfo = plist.parse(appInfoContents);
		// Use ElectronTeamID in Info.plist if already specified
		if (appInfo.ElectronTeamID) {
		debugLog('`ElectronTeamID` found in `Info.plist`: ' + appInfo.ElectronTeamID);
		}
		else {
		// The team identifier in signing identity should not be trusted
		if (computed.provisioningProfile) {
		appInfo.ElectronTeamID =
		computed.provisioningProfile.message.Entitlements['com.apple.developer.team-identifier'];
		debugLog('`ElectronTeamID` not found in `Info.plist`, use parsed from provisioning profile: ' +
		appInfo.ElectronTeamID);
		}
		else {
		const teamID = (_a = /^.+$(.+?)$$/g.exec(computed.identity.name)) === null \|\| _a === void 0 ? void 0 : _a[1];
		if (!teamID) {
		throw new Error(`Could not automatically determine ElectronTeamID from identity: ${computed.identity.name}`);
		}
		appInfo.ElectronTeamID = teamID;
		debugLog('`ElectronTeamID` not found in `Info.plist`, use parsed from signing identity: ' +
		appInfo.ElectronTeamID);
		}
		await fs.writeFile(appInfoPath, plist.build(appInfo), 'utf8');
		debugLog('`Info.plist` updated:', '\n', '> Info.plist:', appInfoPath);
		}
		const appIdentifier = appInfo.ElectronTeamID + '.' + appInfo.CFBundleIdentifier;
		// Insert application identifier if not exists
		if (entitlements['com.apple.application-identifier']) {
		debugLog('`com.apple.application-identifier` found in entitlements file: ' +
		entitlements['com.apple.application-identifier']);
		}
		else {
		debugLog('`com.apple.application-identifier` not found in entitlements file, new inserted: ' +
		appIdentifier);
		entitlements['com.apple.application-identifier'] = appIdentifier;
		}
		// Insert developer team identifier if not exists
		if (entitlements['com.apple.developer.team-identifier']) {
		debugLog('`com.apple.developer.team-identifier` found in entitlements file: ' +
		entitlements['com.apple.developer.team-identifier']);
		}
		else {
		debugLog('`com.apple.developer.team-identifier` not found in entitlements file, new inserted: ' +
		appInfo.ElectronTeamID);
		entitlements['com.apple.developer.team-identifier'] = appInfo.ElectronTeamID;
		}
		// Init entitlements app group key to array if not exists
		if (!entitlements['com.apple.security.application-groups']) {
		entitlements['com.apple.security.application-groups'] = [];
		}
		// Insert app group if not exists
		if (Array.isArray(entitlements['com.apple.security.application-groups']) &&
		entitlements['com.apple.security.application-groups'].indexOf(appIdentifier) === -1) {
		debugLog('`com.apple.security.application-groups` not found in entitlements file, new inserted: ' +
		appIdentifier);
		entitlements['com.apple.security.application-groups'].push(appIdentifier);
		}
		else {
		debugLog('`com.apple.security.application-groups` found in entitlements file: ' + appIdentifier);
		}
		// Create temporary entitlements file
		const dir = await fs.mkdtemp(path.resolve(os.tmpdir(), 'tmp-entitlements-'));
		const entitlementsPath = path.join(dir, 'entitlements.plist');
		await fs.writeFile(entitlementsPath, plist.build(entitlements), 'utf8');
		debugLog('Entitlements file updated:', '\n', '> Entitlements:', entitlementsPath);
		preAuthMemo.set(memoKey, entitlementsPath);
		return entitlementsPath;
		}
		//# sourceMappingURL=util-entitlements.js.map

-1

dist/esm/util-entitlements.js.map

{"version":3,"file":"util-entitlements.js","sourceRoot":"","sources":["../../src/util-entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAStD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,WAA+B,EAC/B,QAAyB;;IAEzB,IAAI,CAAC,WAAW,CAAC,YAAY;QAAE,OAAO;IAEtC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE9D,qEAAqE;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAEtE,QAAQ,CACN,qCAAqC,EACrC,IAAI,EACJ,eAAe,EACf,WAAW,EACX,IAAI,CACL,CAAC;IACF,IAAI,YAAiC,CAAC;IACtC,IAAI,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ,EAAE;QAChD,MAAM,oBAAoB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACjF,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAwB,CAAC;KACzE;SAAM;QACL,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,CAAsB,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,iCACzF,IAAI,KACP,CAAC,cAAc,CAAC,EAAE,IAAI,IACtB,EAAE,EAAE,CAAC,CAAC;KACT;IACD,IAAI,CAAC,YAAY,CAAC,gCAAgC,CAAC,EAAE;QACnD,iDAAiD;QACjD,OAAO;KACR;IAED,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAwB,CAAC;IACpE,wDAAwD;IACxD,IAAI,OAAO,CAAC,cAAc,EAAE;QAC1B,QAAQ,CAAC,0CAA0C,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;KAC/E;SAAM;QACL,gEAAgE;QAChE,IAAI,QAAQ,CAAC,mBAAmB,EAAE;YAChC,OAAO,CAAC,cAAc;gBACpB,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,qCAAqC,CAAC,CAAC;YAC3F,QAAQ,CACN,oFAAoF;gBAClF,OAAO,CAAC,cAAc,CACzB,CAAC;SACH;aAAM;YACL,MAAM,MAAM,GAAG,MAAA,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,0CAAG,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,MAAM,EAAE;gBACX,MAAM,IAAI,KAAK,CAAC,mEAAmE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;aAC9G;YACD,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC;YAChC,QAAQ,CACN,gFAAgF;gBAC9E,OAAO,CAAC,cAAc,CACzB,CAAC;SACH;QACD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAE9D,QAAQ,CAAC,uBAAuB,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;KACvE;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,GAAG,GAAG,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAChF,8CAA8C;IAC9C,IAAI,YAAY,CAAC,kCAAkC,CAAC,EAAE;QACpD,QAAQ,CACN,iEAAiE;YAC/D,YAAY,CAAC,kCAAkC,CAAC,CACnD,CAAC;KACH;SAAM;QACL,QAAQ,CACN,mFAAmF;YACjF,aAAa,CAChB,CAAC;QACF,YAAY,CAAC,kCAAkC,CAAC,GAAG,aAAa,CAAC;KAClE;IACD,iDAAiD;IACjD,IAAI,YAAY,CAAC,qCAAqC,CAAC,EAAE;QACvD,QAAQ,CACN,oEAAoE;YAClE,YAAY,CAAC,qCAAqC,CAAC,CACtD,CAAC;KACH;SAAM;QACL,QAAQ,CACN,sFAAsF;YACpF,OAAO,CAAC,cAAc,CACzB,CAAC;QACF,YAAY,CAAC,qCAAqC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;KAC9E;IACD,yDAAyD;IACzD,IAAI,CAAC,YAAY,CAAC,uCAAuC,CAAC,EAAE;QAC1D,YAAY,CAAC,uCAAuC,CAAC,GAAG,EAAE,CAAC;KAC5D;IACD,iCAAiC;IACjC,IACE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,uCAAuC,CAAC,CAAC;QACpE,YAAY,CAAC,uCAAuC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EACnF;QACA,QAAQ,CACN,wFAAwF;YACtF,aAAa,CAChB,CAAC;QACF,YAAY,CAAC,uCAAuC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;KAC3E;SAAM;QACL,QAAQ,CACN,sEAAsE,GAAG,aAAa,CACvF,CAAC;KACH;IACD,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC7E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,QAAQ,CAAC,4BAA4B,EAAE,IAAI,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAElF,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3C,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

-6

dist/esm/util-identities.d.ts

		export declare class Identity {
		name: string;
		hash?: string \| undefined;
		constructor(name: string, hash?: string \| undefined);
		}
		export declare function findIdentities(keychain: string \| null, identity: string): Promise<Identity[]>;

-30

dist/esm/util-identities.js

		import { debugLog, compactFlattenedList, execFileAsync } from './util';
		export class Identity {
		constructor(name, hash) {
		this.name = name;
		this.hash = hash;
		}
		}
		export async function findIdentities(keychain, identity) {
		// Only to look for valid identities, excluding those flagged with
		// CSSMERR_TP_CERT_EXPIRED or CSSMERR_TP_NOT_TRUSTED. Fixes #9
		const args = [
		'find-identity',
		'-v'
		];
		if (keychain) {
		args.push(keychain);
		}
		const result = await execFileAsync('security', args);
		const identities = result.split('\n').map(function (line) {
		if (line.indexOf(identity) >= 0) {
		const identityFound = line.substring(line.indexOf('"') + 1, line.lastIndexOf('"'));
		const identityHashFound = line.substring(line.indexOf(')') + 2, line.indexOf('"') - 1);
		debugLog('Identity:', '\n', '> Name:', identityFound, '\n', '> Hash:', identityHashFound);
		return new Identity(identityFound, identityHashFound);
		}
		return null;
		});
		return compactFlattenedList(identities);
		}
		//# sourceMappingURL=util-identities.js.map

-1

dist/esm/util-identities.js.map

{"version":3,"file":"util-identities.js","sourceRoot":"","sources":["../../src/util-identities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEvE,MAAM,OAAO,QAAQ;IACnB,YAAoB,IAAY,EAAS,IAAa;QAAlC,SAAI,GAAJ,IAAI,CAAQ;QAAS,SAAI,GAAJ,IAAI,CAAS;IAAG,CAAC;CAC3D;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAE,QAAuB,EAAE,QAAgB;IAC7E,kEAAkE;IAClE,8DAA8D;IAE9D,MAAM,IAAI,GAAG;QACX,eAAe;QACf,IAAI;KACL,CAAC;IACF,IAAI,QAAQ,EAAE;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;KACrB;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI;QACtD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACnF,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACvF,QAAQ,CAAC,WAAW,EAAE,IAAI,EACxB,SAAS,EAAE,aAAa,EAAE,IAAI,EAC9B,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAChC,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;SACvD;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC"}

-25

dist/esm/util-provisioning-profiles.d.ts

		import { ElectronMacPlatform, ValidatedSignOptions } from './types';
		export declare class ProvisioningProfile {
		filePath: string;
		message: any;
		constructor(filePath: string, message: any);
		get name(): string;
		get platforms(): ElectronMacPlatform[];
		get type(): "development" \| "distribution";
		}
		/**
		* Returns a promise resolving to a ProvisioningProfile instance based on file.
		* @function
		* @param {string} filePath - Path to provisioning profile.
		* @param {string} keychain - Keychain to use when unlocking provisioning profile.
		* @returns {Promise} Promise.
		*/
		export declare function getProvisioningProfile(filePath: string, keychain?: string \| null): Promise<ProvisioningProfile>;
		/**
		* Returns a promise resolving to a list of suitable provisioning profile within the current working directory.
		*/
		export declare function findProvisioningProfiles(opts: ValidatedSignOptions): Promise<ProvisioningProfile[]>;
		/**
		* Returns a promise embedding the provisioning profile in the app Contents folder.
		*/
		export declare function preEmbedProvisioningProfile(opts: ValidatedSignOptions, profile: ProvisioningProfile \| null): Promise<void>;

-115

dist/esm/util-provisioning-profiles.js

		import * as fs from 'fs-extra';
		import * as path from 'path';
		import plist from 'plist';
		import { debugLog, debugWarn, getAppContentsPath, compactFlattenedList, execFileAsync } from './util';
		export class ProvisioningProfile {
		constructor(filePath, message) {
		this.filePath = filePath;
		this.message = message;
		}
		get name() {
		return this.message.Name;
		}
		get platforms() {
		if ('ProvisionsAllDevices' in this.message)
		return ['darwin'];
		// Developer ID
		else if (this.type === 'distribution')
		return ['mas'];
		// Mac App Store
		else
		return ['darwin', 'mas']; // Mac App Development
		}
		get type() {
		if ('ProvisionedDevices' in this.message)
		return 'development';
		// Mac App Development
		else
		return 'distribution'; // Developer ID or Mac App Store
		}
		}
		/**
		* Returns a promise resolving to a ProvisioningProfile instance based on file.
		* @function
		* @param {string} filePath - Path to provisioning profile.
		* @param {string} keychain - Keychain to use when unlocking provisioning profile.
		* @returns {Promise} Promise.
		*/
		export async function getProvisioningProfile(filePath, keychain = null) {
		const securityArgs = [
		'cms',
		'-D',
		'-i',
		filePath // Use infile as source of data
		];
		if (keychain) {
		securityArgs.push('-k', keychain);
		}
		const result = await execFileAsync('security', securityArgs);
		const provisioningProfile = new ProvisioningProfile(filePath, plist.parse(result));
		debugLog('Provisioning profile:', '\n', '> Name:', provisioningProfile.name, '\n', '> Platforms:', provisioningProfile.platforms, '\n', '> Type:', provisioningProfile.type, '\n', '> Path:', provisioningProfile.filePath, '\n', '> Message:', provisioningProfile.message);
		return provisioningProfile;
		}
		/**
		* Returns a promise resolving to a list of suitable provisioning profile within the current working directory.
		*/
		export async function findProvisioningProfiles(opts) {
		const cwd = process.cwd();
		const children = await fs.readdir(cwd);
		const foundProfiles = compactFlattenedList(await Promise.all(children.map(async (child) => {
		const filePath = path.resolve(cwd, child);
		const stat = await fs.stat(filePath);
		if (stat.isFile() && path.extname(filePath) === '.provisionprofile') {
		return filePath;
		}
		return null;
		})));
		return compactFlattenedList(await Promise.all(foundProfiles.map(async (filePath) => {
		const profile = await getProvisioningProfile(filePath);
		if (profile.platforms.indexOf(opts.platform) >= 0 && profile.type === opts.type) {
		return profile;
		}
		debugWarn('Provisioning profile above ignored, not for ' + opts.platform + ' ' + opts.type + '.');
		return null;
		})));
		}
		/**
		* Returns a promise embedding the provisioning profile in the app Contents folder.
		*/
		export async function preEmbedProvisioningProfile(opts, profile) {
		async function embedProvisioningProfile(profile) {
		debugLog('Looking for existing provisioning profile...');
		const embeddedFilePath = path.join(getAppContentsPath(opts), 'embedded.provisionprofile');
		if (await fs.pathExists(embeddedFilePath)) {
		debugLog('Found embedded provisioning profile:', '\n', '* Please manually remove the existing file if not wanted.', '\n', '* Current file at:', embeddedFilePath);
		}
		else {
		debugLog('Embedding provisioning profile...');
		await fs.copy(profile.filePath, embeddedFilePath);
		}
		}
		if (profile) {
		// User input provisioning profile
		return await embedProvisioningProfile(profile);
		}
		else {
		// Discover provisioning profile
		debugLog('No `provisioning-profile` passed in arguments, will find in current working directory and in user library...');
		const profiles = await findProvisioningProfiles(opts);
		if (profiles.length > 0) {
		// Provisioning profile(s) found
		if (profiles.length > 1) {
		debugLog('Multiple provisioning profiles found, will use the first discovered.');
		}
		else {
		debugLog('Found 1 provisioning profile.');
		}
		await embedProvisioningProfile(profiles[0]);
		}
		else {
		// No provisioning profile found
		debugLog('No provisioning profile found, will not embed profile in app contents.');
		}
		}
		}
		//# sourceMappingURL=util-provisioning-profiles.js.map

-1

dist/esm/util-provisioning-profiles.js.map

{"version":3,"file":"util-provisioning-profiles.js","sourceRoot":"","sources":["../../src/util-provisioning-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEtG,MAAM,OAAO,mBAAmB;IAC9B,YAAoB,QAAgB,EAAS,OAAY;QAArC,aAAQ,GAAR,QAAQ,CAAQ;QAAS,YAAO,GAAP,OAAO,CAAK;IAAG,CAAC;IAE7D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,IAAI,SAAS;QACX,IAAI,sBAAsB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,eAAe;aACV,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,gBAAgB;;YACX,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,sBAAsB;IACvD,CAAC;IAED,IAAI,IAAI;QACN,IAAI,oBAAoB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,aAAa,CAAC;QAC/D,sBAAsB;;YACjB,OAAO,cAAc,CAAC,CAAC,gCAAgC;IAC9D,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAE,QAAgB,EAAE,WAA0B,IAAI;IAC5F,MAAM,YAAY,GAAG;QACnB,KAAK;QACL,IAAI;QACJ,IAAI;QACJ,QAAQ,CAAC,+BAA+B;KACzC,CAAC;IAEF,IAAI,QAAQ,EAAE;QACZ,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;KACnC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,QAAQ,CACN,uBAAuB,EACvB,IAAI,EACJ,SAAS,EACT,mBAAmB,CAAC,IAAI,EACxB,IAAI,EACJ,cAAc,EACd,mBAAmB,CAAC,SAAS,EAC7B,IAAI,EACJ,SAAS,EACT,mBAAmB,CAAC,IAAI,EACxB,IAAI,EACJ,SAAS,EACT,mBAAmB,CAAC,QAAQ,EAC5B,IAAI,EACJ,YAAY,EACZ,mBAAmB,CAAC,OAAO,CAC5B,CAAC;IACF,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAE,IAA0B;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,oBAAoB,CACxC,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,mBAAmB,EAAE;YACnE,OAAO,QAAQ,CAAC;SACjB;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CACF,CAAC;IAEF,OAAO,oBAAoB,CACzB,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,OAAO,CAAC;SAAE;QACpG,SAAS,CACP,8CAA8C,GAAG,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CACvF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CACH,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAE,IAA0B,EAAE,OAAmC;IAChH,KAAK,UAAU,wBAAwB,CAAE,OAA4B;QACnE,QAAQ,CAAC,8CAA8C,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAE1F,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;YACzC,QAAQ,CACN,sCAAsC,EACtC,IAAI,EACJ,2DAA2D,EAC3D,IAAI,EACJ,oBAAoB,EACpB,gBAAgB,CACjB,CAAC;SACH;aAAM;YACL,QAAQ,CAAC,mCAAmC,CAAC,CAAC;YAC9C,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;SACnD;IACH,CAAC;IAED,IAAI,OAAO,EAAE;QACX,kCAAkC;QAClC,OAAO,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;KAChD;SAAM;QACL,gCAAgC;QAChC,QAAQ,CACN,8GAA8G,CAC/G,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACvB,gCAAgC;YAChC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;gBACvB,QAAQ,CAAC,sEAAsE,CAAC,CAAC;aAClF;iBAAM;gBACL,QAAQ,CAAC,+BAA+B,CAAC,CAAC;aAC3C;YACD,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;SAC7C;aAAM;YACL,gCAAgC;YAChC,QAAQ,CAAC,wEAAwE,CAAC,CAAC;SACpF;KACF;AACH,CAAC"}

-36

dist/esm/util.d.ts

		/// <reference types="node" />
		import * as child from 'child_process';
		import debug from 'debug';
		import { BaseSignOptions, ElectronMacPlatform } from './types';
		export declare const debugLog: debug.Debugger;
		export declare const debugWarn: debug.Debugger;
		export declare function execFileAsync(file: string, args: string[], options?: child.ExecFileOptions): Promise<string>;
		type DeepListItem<T> = null \| T \| DeepListItem<T>[];
		type DeepList<T> = DeepListItem<T>[];
		export declare function compactFlattenedList<T>(list: DeepList<T>): T[];
		/**
		* Returns the path to the "Contents" folder inside the application bundle
		*/
		export declare function getAppContentsPath(opts: BaseSignOptions): string;
		/**
		* Returns the path to app "Frameworks" within contents.
		*/
		export declare function getAppFrameworksPath(opts: BaseSignOptions): string;
		export declare function detectElectronPlatform(opts: BaseSignOptions): Promise<ElectronMacPlatform>;
		/**
		* This function returns a promise validating opts.app, the application to be signed or flattened.
		*/
		export declare function validateOptsApp(opts: BaseSignOptions): Promise<void>;
		/**
		* This function returns a promise validating opts.platform, the platform of Electron build. It allows auto-discovery if no opts.platform is specified.
		*/
		export declare function validateOptsPlatform(opts: BaseSignOptions): Promise<ElectronMacPlatform>;
		/**
		* This function returns a promise resolving all child paths within the directory specified.
		* @function
		* @param {string} dirPath - Path to directory.
		* @returns {Promise} Promise resolving child paths needing signing in order.
		* @internal
		*/
		export declare function walkAsync(dirPath: string): Promise<string[]>;
		export {};

-146

dist/esm/util.js

		import * as child from 'child_process';
		import * as fs from 'fs-extra';
		import { isBinaryFile } from 'isbinaryfile';
		import * as path from 'path';
		import debug from 'debug';
		export const debugLog = debug('electron-osx-sign');
		debugLog.log = console.log.bind(console);
		export const debugWarn = debug('electron-osx-sign:warn');
		debugWarn.log = console.warn.bind(console);
		const removePassword = function (input) {
		return input.replace(/(-P \|pass:\|\/p\|-pass )([^ ]+)/, function (_, p1) {
		return `${p1}***`;
		});
		};
		export async function execFileAsync(file, args, options = {}) {
		if (debugLog.enabled) {
		debugLog('Executing...', file, args && Array.isArray(args) ? removePassword(args.join(' ')) : '');
		}
		return new Promise(function (resolve, reject) {
		child.execFile(file, args, options, function (err, stdout, stderr) {
		if (err) {
		debugLog('Error executing file:', '\n', '> Stdout:', stdout, '\n', '> Stderr:', stderr);
		reject(err);
		return;
		}
		resolve(stdout);
		});
		});
		}
		export function compactFlattenedList(list) {
		const result = [];
		function populateResult(list) {
		if (!Array.isArray(list)) {
		if (list)
		result.push(list);
		}
		else if (list.length > 0) {
		for (const item of list)
		if (item)
		populateResult(item);
		}
		}
		populateResult(list);
		return result;
		}
		/**
		* Returns the path to the "Contents" folder inside the application bundle
		*/
		export function getAppContentsPath(opts) {
		return path.join(opts.app, 'Contents');
		}
		/**
		* Returns the path to app "Frameworks" within contents.
		*/
		export function getAppFrameworksPath(opts) {
		return path.join(getAppContentsPath(opts), 'Frameworks');
		}
		export async function detectElectronPlatform(opts) {
		const appFrameworksPath = getAppFrameworksPath(opts);
		if (await fs.pathExists(path.resolve(appFrameworksPath, 'Squirrel.framework'))) {
		return 'darwin';
		}
		else {
		return 'mas';
		}
		}
		/**
		* This function returns a promise resolving the file path if file binary.
		*/
		async function getFilePathIfBinary(filePath) {
		if (await isBinaryFile(filePath)) {
		return filePath;
		}
		return null;
		}
		/**
		* This function returns a promise validating opts.app, the application to be signed or flattened.
		*/
		export async function validateOptsApp(opts) {
		if (!opts.app) {
		throw new Error('Path to application must be specified.');
		}
		if (path.extname(opts.app) !== '.app') {
		throw new Error('Extension of application must be `.app`.');
		}
		if (!(await fs.pathExists(opts.app))) {
		throw new Error(`Application at path "${opts.app}" could not be found`);
		}
		}
		/**
		* This function returns a promise validating opts.platform, the platform of Electron build. It allows auto-discovery if no opts.platform is specified.
		*/
		export async function validateOptsPlatform(opts) {
		if (opts.platform) {
		if (opts.platform === 'mas' \|\| opts.platform === 'darwin') {
		return opts.platform;
		}
		else {
		debugWarn('`platform` passed in arguments not supported, checking Electron platform...');
		}
		}
		else {
		debugWarn('No `platform` passed in arguments, checking Electron platform...');
		}
		return await detectElectronPlatform(opts);
		}
		/**
		* This function returns a promise resolving all child paths within the directory specified.
		* @function
		* @param {string} dirPath - Path to directory.
		* @returns {Promise} Promise resolving child paths needing signing in order.
		* @internal
		*/
		export async function walkAsync(dirPath) {
		debugLog('Walking... ' + dirPath);
		async function _walkAsync(dirPath) {
		const children = await fs.readdir(dirPath);
		return await Promise.all(children.map(async (child) => {
		const filePath = path.resolve(dirPath, child);
		const stat = await fs.stat(filePath);
		if (stat.isFile()) {
		switch (path.extname(filePath)) {
		case '.cstemp': // Temporary file generated from past codesign
		debugLog('Removing... ' + filePath);
		await fs.remove(filePath);
		return null;
		default:
		return await getFilePathIfBinary(filePath);
		}
		}
		else if (stat.isDirectory() && !stat.isSymbolicLink()) {
		const walkResult = await _walkAsync(filePath);
		switch (path.extname(filePath)) {
		case '.app': // Application
		case '.framework': // Framework
		walkResult.push(filePath);
		}
		return walkResult;
		}
		return null;
		}));
		}
		const allPaths = await _walkAsync(dirPath);
		return compactFlattenedList(allPaths);
		}
		//# sourceMappingURL=util.js.map

-1

dist/esm/util.js.map

		export declare class Identity {
		name: string;
		hash?: string \| undefined;
		constructor(name: string, hash?: string \| undefined);
		}
		export declare function findIdentities(keychain: string \| null, identity: string): Promise<Identity[]>;

		export declare class Identity {
		name: string;
		hash?: string \| undefined;
		constructor(name: string, hash?: string \| undefined);
		}
		export declare function findIdentities(keychain: string \| null, identity: string): Promise<Identity[]>;

		export declare class Identity {
		name: string;
		hash?: string \| undefined;
		constructor(name: string, hash?: string \| undefined);
		}
		export declare function findIdentities(keychain: string \| null, identity: string): Promise<Identity[]>;

@electron/osx-sign - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics

Worsened metrics

Dependency changes