Update CI codesign

scripts/entitlements.mac.plist

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+  <key>com.apple.security.cs.disable-library-validation</key>
+  <true/>
+  <key>com.apple.security.network.client</key>
+  <true/>
+  <key>com.apple.security.network.server</key>
+  <true/>
+</dict>
+</plist>

scripts/sign-macos-app.cjs

@@ -0,0 +1,330 @@
+#!/usr/bin/env node
+/**
+ * Deep-sign a peardock .app so macOS Gatekeeper does not report
+ * "is damaged and can't be opened. You should move it to the Trash."
+ *
+ * That message almost always means an *invalid* signature (Electron binary
+ * still has a partial linker-signed ad-hoc stamp after packager rewrites the
+ * bundle, with no sealed resources).
+ *
+ * Usage:
+ *   node scripts/sign-macos-app.cjs path/to/peardock.app
+ *   node scripts/sign-macos-app.cjs path/to/out/peardock-darwin-arm64
+ *
+ * Identity (first match wins):
+ *   MAC_CODESIGN_IDENTITY / CSC_NAME  — "Developer ID Application: …" or team identity
+ *   otherwise ad-hoc (`-`) which is enough to make the app *valid* (not "damaged")
+ *
+ * Tools:
+ *   macOS: /usr/bin/codesign (required for production identities)
+ *   Linux CI: rcodesign (apple-codesign) for ad-hoc when present
+ */
+'use strict'
+
+const fs = require('fs')
+const path = require('path')
+const { spawnSync, execFileSync } = require('child_process')
+
+const ENTITLEMENTS = path.join(__dirname, 'entitlements.mac.plist')
+
+function log(...a) {
+  console.log('[sign-macos]', ...a)
+}
+
+function findApps(input) {
+  const st = fs.statSync(input)
+  if (st.isFile() && input.endsWith('.app')) return [input]
+  if (st.isDirectory() && input.endsWith('.app')) return [input]
+  if (st.isDirectory()) {
+    return fs
+      .readdirSync(input)
+      .filter((n) => n.endsWith('.app'))
+      .map((n) => path.join(input, n))
+  }
+  return []
+}
+
+function which(cmd) {
+  try {
+    const r = spawnSync(process.platform === 'win32' ? 'where' : 'which', [cmd], {
+      encoding: 'utf8',
+    })
+    if (r.status === 0) return r.stdout.trim().split(/\r?\n/)[0]
+  } catch {
+    // ignore
+  }
+  return null
+}
+
+function identity() {
+  const id = process.env.MAC_CODESIGN_IDENTITY || process.env.CSC_NAME || ''
+  if (id && id !== '-' && id.toLowerCase() !== 'null') return id
+  return '-' // ad-hoc
+}
+
+function ensureEntitlements() {
+  if (fs.existsSync(ENTITLEMENTS)) return ENTITLEMENTS
+  // Minimal Electron-friendly entitlements (JIT, unsigned memory for V8)
+  const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+  <key>com.apple.security.cs.disable-library-validation</key>
+  <true/>
+  <key>com.apple.security.network.client</key>
+  <true/>
+  <key>com.apple.security.network.server</key>
+  <true/>
+</dict>
+</plist>
+`
+  fs.writeFileSync(ENTITLEMENTS, xml)
+  return ENTITLEMENTS
+}
+
+/**
+ * Walk Mach-O / nested code to sign inside-out (required for valid deep signatures).
+ */
+function listSignTargets(appPath) {
+  const targets = []
+  const walk = (dir) => {
+    let entries
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true })
+    } catch {
+      return
+    }
+    for (const ent of entries) {
+      const p = path.join(dir, ent.name)
+      if (ent.isDirectory()) {
+        if (ent.name === 'node_modules' || ent.name.startsWith('.')) {
+          // still need natives under node_modules
+          if (ent.name === 'node_modules') walk(p)
+          else if (!ent.name.startsWith('.')) walk(p)
+          continue
+        }
+        if (ent.name.endsWith('.app') || ent.name.endsWith('.framework')) {
+          // nested apps/frameworks signed as units later — still recurse for helpers
+          walk(p)
+          targets.push(p)
+          continue
+        }
+        walk(p)
+      } else if (ent.isFile() || ent.isSymbolicLink()) {
+        const base = ent.name
+        if (
+          base.endsWith('.dylib') ||
+          base.endsWith('.so') ||
+          base.endsWith('.node') ||
+          base.endsWith('.bare') ||
+          base === 'peardock-client' ||
+          base.startsWith('peardock Helper') ||
+          base === 'Electron Framework' ||
+          base === 'Squirrel' ||
+          base === 'ReactiveObjC' ||
+          base === 'Mantle' ||
+          base === 'chrome_crashpad_handler'
+        ) {
+          targets.push(p)
+        }
+      }
+    }
+  }
+  walk(appPath)
+  // De-dupe, nested bundles last (app itself last)
+  const uniq = [...new Set(targets)]
+  uniq.sort((a, b) => {
+    // deeper paths first
+    const da = a.split(path.sep).length
+    const db = b.split(path.sep).length
+    if (da !== db) return db - da
+    return b.length - a.length
+  })
+  // Ensure root .app is last
+  const rootIdx = uniq.indexOf(appPath)
+  if (rootIdx >= 0) uniq.splice(rootIdx, 1)
+  uniq.push(appPath)
+  return uniq
+}
+
+function codesignDarwin(appPath, id) {
+  const entitlements = ensureEntitlements()
+  const hardened = id !== '-'
+
+  // Clear broken signatures / quarantine that confuse Gatekeeper
+  try {
+    execFileSync('xattr', ['-cr', appPath], { stdio: 'pipe' })
+  } catch {
+    // ignore
+  }
+
+  // Deep re-sign seals Info.plist + resources (fixes "damaged / Trash").
+  // Nested-first pass is only needed when --deep alone fails verification.
+  log(`deep codesign identity=${id === '-' ? 'ad-hoc' : id}`)
+  const rootArgs = [
+    '--force',
+    '--deep',
+    '--sign',
+    id,
+    '--entitlements',
+    entitlements,
+  ]
+  if (hardened) rootArgs.push('--options', 'runtime', '--timestamp')
+  else rootArgs.push('--timestamp=none')
+  rootArgs.push(appPath)
+
+  let root = spawnSync('codesign', rootArgs, { encoding: 'utf8' })
+  if (root.status !== 0) {
+    throw new Error(`codesign failed for app:\n${root.stderr || root.stdout}`)
+  }
+
+  let v = spawnSync('codesign', ['--verify', '--deep', '--strict', '--verbose=2', appPath], {
+    encoding: 'utf8',
+  })
+  if (v.status !== 0) {
+    // Inside-out sign nested Mach-O then re-seal the app
+    log('strict verify failed — signing nested code then app…')
+    const targets = listSignTargets(appPath)
+    for (const target of targets) {
+      if (target === appPath) continue
+      const args = ['--force', '--sign', id]
+      if (hardened) args.push('--options', 'runtime', '--timestamp')
+      else args.push('--timestamp=none')
+      args.push(target)
+      spawnSync('codesign', args, { encoding: 'utf8' })
+    }
+    root = spawnSync('codesign', rootArgs, { encoding: 'utf8' })
+    if (root.status !== 0) {
+      throw new Error(`codesign failed for app (retry):\n${root.stderr || root.stdout}`)
+    }
+    v = spawnSync('codesign', ['--verify', '--deep', '--strict', '--verbose=2', appPath], {
+      encoding: 'utf8',
+    })
+    if (v.status !== 0) {
+      throw new Error(`codesign verify failed:\n${v.stderr || v.stdout}`)
+    }
+  }
+  log('verify ok:', (v.stderr || v.stdout || '').trim().split('\n').slice(0, 3).join(' | '))
+}
+
+function codesignRcodesign(appPath, id) {
+  const bin = which('rcodesign')
+  if (!bin) {
+    throw new Error(
+      'rcodesign not found (needed to ad-hoc sign macOS .app on Linux). ' +
+        'Install apple-codesign / rcodesign in CI, or package darwin clients on macOS.'
+    )
+  }
+  if (id !== '-') {
+    log('WARN: rcodesign path only used for ad-hoc here; Developer ID needs codesign on macOS + certs')
+  }
+  // Clear extended attrs if possible (mac only usually)
+  const args = ['sign', '--ad-hoc', appPath]
+  log('rcodesign', args.join(' '))
+  const r = spawnSync(bin, args, { encoding: 'utf8', stdio: 'pipe' })
+  if (r.status !== 0) {
+    // newer CLI variants
+    const r2 = spawnSync(bin, ['sign', appPath, '--ad-hoc'], { encoding: 'utf8', stdio: 'pipe' })
+    if (r2.status !== 0) {
+      throw new Error(`rcodesign failed:\n${r.stderr || r.stdout}\n${r2.stderr || r2.stdout}`)
+    }
+  }
+  log('rcodesign ad-hoc sign complete')
+}
+
+function signApp(appPath) {
+  if (!fs.existsSync(appPath)) throw new Error(`App not found: ${appPath}`)
+  const id = identity()
+  log('app:', appPath)
+  log('identity:', id === '-' ? 'ad-hoc (-)' : id)
+
+  if (process.platform === 'darwin') {
+    // Ad-hoc: always use codesign -s - (osx-sign rejects identity "-" / "no identity")
+    // Developer ID: prefer @electron/osx-sign for Electron's nested helper layout
+    if (id === '-') {
+      codesignDarwin(appPath, id)
+      try {
+        execFileSync('xattr', ['-cr', appPath], { stdio: 'pipe' })
+      } catch {
+        // ignore
+      }
+      return Promise.resolve()
+    }
+
+    try {
+      const { signAsync } = require('@electron/osx-sign')
+      return signAsync({
+        app: appPath,
+        identity: id,
+        platform: 'darwin',
+        hardenedRuntime: true,
+        gatekeeperAssess: false,
+        optionsForFile: () => ({
+          entitlements: ensureEntitlements(),
+          hardenedRuntime: true,
+        }),
+      }).then(() => {
+        try {
+          execFileSync('xattr', ['-cr', appPath], { stdio: 'pipe' })
+        } catch {
+          // ignore
+        }
+        const v = spawnSync(
+          'codesign',
+          ['--verify', '--deep', '--strict', '--verbose=2', appPath],
+          { encoding: 'utf8' }
+        )
+        if (v.status !== 0) {
+          log('osx-sign verify soft-fail, falling back to codesign deep…')
+          codesignDarwin(appPath, id)
+        } else {
+          log('osx-sign + verify ok')
+        }
+      })
+    } catch (err) {
+      log('osx-sign unavailable or failed, using codesign:', err.message || err)
+      codesignDarwin(appPath, id)
+      try {
+        execFileSync('xattr', ['-cr', appPath], { stdio: 'pipe' })
+      } catch {
+        // ignore
+      }
+      return Promise.resolve()
+    }
+  }
+
+  // Linux (CI cross-package of darwin)
+  codesignRcodesign(appPath, id)
+  return Promise.resolve()
+}
+
+async function main() {
+  const input = process.argv[2]
+  if (!input) {
+    console.error('Usage: node scripts/sign-macos-app.cjs <path-to.app|dir>')
+    process.exit(2)
+  }
+  const resolved = path.resolve(input)
+  const apps = findApps(resolved)
+  if (!apps.length) {
+    console.error('No .app found at', resolved)
+    process.exit(1)
+  }
+  for (const app of apps) {
+    await signApp(app)
+  }
+  log('done')
+}
+
+module.exports = { signApp, findApps, identity }
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('[sign-macos] FAILED:', err.message || err)
+    process.exit(1)
+  })
+}