| 1 | {"version":3,"sources":["../src/codeSign.ts"],"names":[],"mappings":";;;;;;;;;;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AACA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;;4CAuKA,WAA8B,YAA9B,EAAkD;AAChD,QAAI;AACF,YAAM,yBAAK,UAAL,EAAiB,CAAC,iBAAD,EAAoB,YAApB,CAAjB,CAAN;AACD,KAFD,CAGA,OAAO,CAAP,EAAU;AACR,cAAQ,IAAR,CAAa,0BAA0B,YAAY,KAAK,EAAE,KAAF,IAAW,CAAC,EAApE;AACA,YAAM,0BAAe,YAAf,CAAN;AACD;AACF,G;;kBARI,c;;;;;;4CA8CL,WAA2B,YAA3B,EAAiD,KAAjD,EAAuE,YAAvE,EAAkG;AAChG,SAAK,IAAI,IAAI,CAAb,EAAgB,IAAI,MAAM,MAA1B,EAAkC,GAAlC,EAAuC;AACrC,YAAM,WAAW,aAAa,CAAb,CAAjB;AACA,YAAM,yBAAK,UAAL,EAAiB,CAAC,QAAD,EAAW,MAAM,CAAN,CAAX,EAAqB,IAArB,EAA2B,YAA3B,EAAyC,IAAzC,EAA+C,mBAA/C,EAAoE,IAApE,EAA0E,uBAA1E,EAAmG,IAAnG,EAAyG,QAAzG,CAAjB,CAAN,CAFqC,CAIrC;AACA;;AACA,UAAI,MAAM,mCAAV,EAA2B;AACzB,cAAM,yBAAK,UAAL,EAAiB,CAAC,wBAAD,EAA2B,IAA3B,EAAiC,oBAAjC,EAAuD,IAAvD,EAA6D,IAA7D,EAAmE,QAAnE,EAA6E,YAA7E,CAAjB,CAAN;AACD;AACF;;AAED,WAAO;AACL;AADK,KAAP;AAGD,G;;kBAfI,W;;;;AAiBL;;;;4CAWA,WAAkC,QAAlC,EAA0D;AACxD,aAAA,WAAA,CAAqB,IAArB,EAAwC;AACtC,UAAI,YAAY,IAAhB,EAAsB;AACpB,aAAK,IAAL,CAAU,QAAV;AACD;;AACD,aAAO,IAAP;AACD;;AAED,QAAI,SAAS,qBAAb;;AACA,QAAI,UAAU,IAAV,IAAkB,YAAY,IAAlC,EAAwC;AACtC;AACA;AACA,eAAS,QAAQ,GAAR,CAA2B,CAClC,yBAAK,UAAL,EAAiB,YAAY,CAAC,eAAD,EAAkB,IAAlB,CAAZ,CAAjB,EACG,IADH,CACQ,MAAM,GAAG,IAAH,GAAU,KAAV,CAAgB,IAAhB,EAAsB,MAAtB,CAA6B,MAAK;AAC5C,aAAK,MAAM,MAAX,IAAqB,wBAArB,EAA+C;AAC7C,cAAI,GAAG,QAAH,CAAY,MAAZ,CAAJ,EAAyB;AACvB,mBAAO,IAAP;AACD;AACF;;AACD,eAAO,KAAP;AACD,OAPW,CADd,CADkC,EAUlC,yBAAK,UAAL,EAAiB,YAAY,CAAC,eAAD,EAAkB,IAAlB,EAAwB,IAAxB,EAA8B,aAA9B,CAAZ,CAAjB,EACG,IADH,CACQ,MAAM,GAAG,IAAH,GAAU,KAAV,CAAiB,IAAjB,CADd,CAVkC,CAA3B,EAaN,IAbM,CAaD,MAAK;AACT,cAAM,QAAQ,GAAG,CAAH,EAAM,MAAN,CAAa,GAAG,CAAH,CAAb,EACX,MADW,CACJ,MAAM,CAAC,GAAG,QAAH,CAAY,8BAAZ,CAAD,IAAgD,CAAC,GAAG,QAAH,CAAY,wBAAZ,CAAjD,IAA0F,CAAC,GAAG,QAAH,CAAY,SAAZ,CAA3F,IAAqH,CAAC,GAAG,QAAH,CAAY,6BAAZ,CADxH,EAEZ;AAFY,SAGX,GAHW,CAGP,MAAM,GAAG,SAAH,CAAa,GAAG,OAAH,CAAW,GAAX,IAAkB,CAA/B,EAAkC,IAAlC,EAHC,CAAd;AAIA,eAAO,MAAM,IAAN,CAAW,IAAI,GAAJ,CAAQ,KAAR,CAAX,CAAP;AACD,OAnBM,CAAT;;AAqBA,UAAI,YAAY,IAAhB,EAAsB;AACpB,gEAAwB,MAAxB;AACD;AACF;;AACD,WAAO,MAAP;AACD,G;;kBAtCI,kB;;;;;;4CAwCL,WAA6B,IAA7B,EAA6C,SAA7C,EAAwE,QAAxE,EAAgG;AAC9F;AACA;AACA,UAAM,QAAQ,MAAM,mBAAmB,QAAnB,CAApB;AACA,UAAM,aAAa,GAAG,IAAI,GAA1B;;AACA,SAAK,MAAM,IAAX,IAAmB,KAAnB,EAA0B;AACxB,UAAI,aAAa,IAAb,IAAqB,CAAC,KAAK,QAAL,CAAc,SAAd,CAA1B,EAAoD;AAClD;AACD;;AAED,UAAI,KAAK,QAAL,CAAc,UAAd,CAAJ,EAA+B;AAC7B,eAAO,cAAc,IAAd,CAAP;AACD;AACF;;AAED,QAAI,SAAS,0BAAb,EAAyC;AACvC;AACA;AACA,SAAG,KAAK,MAAM,IAAX,IAAmB,KAAnB,EAA0B;AAC3B,YAAI,aAAa,IAAb,IAAqB,CAAC,KAAK,QAAL,CAAc,SAAd,CAA1B,EAAoD;AAClD;AACD;;AAED,YAAI,KAAK,QAAL,CAAc,gBAAd,CAAJ,EAAqC;AACnC;AACD;;AAED,aAAK,MAAM,MAAX,IAAqB,wBAArB,EAA+C;AAC7C,cAAI,KAAK,QAAL,CAAc,MAAd,CAAJ,EAA2B;AACzB,qBAAS,CAAT;AACD;AACF;;AAED,eAAO,cAAc,IAAd,CAAP;AACD;AACF;;AACD,WAAO,IAAP;AACD,G;;kBArCI,a;;;;;;;AAvRE,MAAM,2BAA2B,CAAC,2BAAD,EAA8B,yBAA9B,EAAyD,sCAAzD,EAAiG,oCAAjG,CAAjC;;;AAQD,SAAA,aAAA,CAAwB,cAAc,IAAtC,EAA0C;AAC9C,MAAI,QAAQ,QAAR,KAAqB,QAAzB,EAAmC;AACjC,QAAI,WAAJ,EAAiB;AACf,yBAAI,IAAJ,CAAS;AAAC,gBAAQ;AAAT,OAAT,EAA8C,wCAA9C;AACD;;AACD,WAAO,KAAP;AACD;;AAED,QAAM,oBAAoB,qKACxB,6LADF;;AAGA,MAAI,mCAAJ,EAAqB;AACnB,QAAI,8BAAU,QAAQ,GAAR,CAAY,oBAAtB,CAAJ,EAAiD;AAC/C,UAAI,WAAJ,EAAiB;AACf,2BAAI,IAAJ,CAAS,iBAAT;AACD;AACF,KAJD,MAKK;AACH,UAAI,WAAJ,EAAiB;AACf;AACA,2BAAI,IAAJ,CAAS,2EACP,+DADO,GAEP,KAAK,iBAAiB,EAFxB;AAGD;;AACD,aAAO,KAAP;AACD;AACF;;AACD,SAAO,IAAP;AACD;;;2CAEM,WAA2B,KAA3B,EAA2C,eAA3C,EAAsE,SAAtE,EAA4G,YAA5G,EAAqJ,kBAArJ,EAAgL;AACrL,UAAM,YAAoB,EAA1B;;AACA,QAAI,aAAa,IAAjB,EAAuB;AACrB,gBAAU,MAAV,GAAmB,EAAnB;;AACA,UAAI,+CAAJ,EAAuC;AACrC,kBAAU,MAAV,IAAoB,sBAAsB,eAAe,aAAc,QAAQ,EAAR,GAAa,+CAAgD,EAApI;AACD;;AACD,gBAAU,MAAV,IAAoB,2CAApB;;AACA,UAAI,CAAC,+CAAL,EAAwC;AACtC,kBAAU,2BAAV,GAAwC,KAAxC;AACD;AACF,KATD,MAUK;AACH,gBAAU,MAAV,GAAmB,kFAAnB;AACA,gBAAU,QAAV,GAAqB,SAArB;AACD;;AAED,UAAM,OAAO,CAAC,eAAD,CAAb;;AACA,QAAI,gBAAgB,IAApB,EAA0B;AACxB,WAAK,IAAL,CAAU,YAAV;AACD;;AAED,QAAI,aAAa,IAAb,IAAqB,+CAAzB,EAA4D;AAC1D,gBAAU,aAAV,GAA0B,CAAC,MAAM,yBAAK,UAAL,EAAiB,IAAjB,CAAP,EACvB,IADuB,GAEvB,KAFuB,CAEjB,IAFiB,EAGvB,MAHuB,CAGhB,MAAM,EAAE,GAAG,QAAH,CAAY,qBAAZ,KAAsC,GAAG,QAAH,CAAY,qBAAZ,CAAxC,CAHU,EAIvB,IAJuB,CAIlB,IAJkB,CAA1B;AAKD;;AAED,QAAI,SAAS,kBAAb,EAAiC;AAC/B,YAAM,IAAI,KAAJ,CAAU,cAAO,aAAP,CAAqB,wCAArB,EAA+D,SAA/D,EAA0E,OAA1E,EAAmF,MAAM,EAAzF,CAAV,CAAN;AACD,KAFD,MAGK;AACH,yBAAI,IAAJ,CAAS,SAAT,EAAoB,wCAApB;AACD;AACF,G;;kBApCW,W;;;;AAsCZ;;;;;;4CACO,WAAmC,WAAnC,EAAwD,MAAxD,EAAwE,UAAxE,EAA0F;AAC/F,kBAAc,YAAY,IAAZ,EAAd;AAEA,QAAI,OAAsB,IAA1B;;AACA,QAAK,YAAY,MAAZ,GAAqB,CAArB,IAA0B,YAAY,CAAZ,MAAmB,GAA9C,IAAsD,YAAY,UAAZ,CAAuB,GAAvB,CAAtD,IAAqF,YAAY,UAAZ,CAAuB,GAAvB,CAAzF,EAAsH;AACpH,aAAO,WAAP;AACD,KAFD,MAGK,IAAI,YAAY,UAAZ,CAAuB,SAAvB,CAAJ,EAAuC;AAC1C,aAAO,YAAY,SAAZ,CAAsB,UAAU,MAAhC,CAAP;AACD,KAFI,MAGA,IAAI,YAAY,UAAZ,CAAuB,IAAvB,CAAJ,EAAkC;AACrC,aAAO,KAAK,IAAL,CAAU,oBAAV,EAAqB,YAAY,SAAZ,CAAsB,KAAK,MAA3B,CAArB,CAAP;AACD,KAFI,MAGA;AACH,YAAM,QAAQ,YAAY,UAAZ,CAAuB,UAAvB,CAAd;;AACA,UAAI,SAAS,YAAY,MAAZ,GAAqB,IAA9B,IAAsC,YAAY,QAAZ,CAAqB,GAArB,CAA1C,EAAqE;AACnE,cAAM,WAAW,MAAM,OAAO,WAAP,CAAmB;AAAC,kBAAQ;AAAT,SAAnB,CAAvB;;AACA,YAAI,KAAJ,EAAW;AACT,gBAAM,6BAAS,WAAT,EAAsB,QAAtB,CAAN;AACD,SAFD,MAGK;AACH,gBAAM,4BAAW,QAAX,EAAqB,OAAO,IAAP,CAAY,WAAZ,EAAyB,QAAzB,CAArB,CAAN;AACD;;AACD,eAAO,QAAP;AACD,OATD,MAUK;AACH,eAAO,WAAP;AACD;AACF;;AAED,WAAO,KAAK,OAAL,CAAa,UAAb,EAAyB,IAAzB,CAAP;AACA,UAAM,OAAO,MAAM,sBAAW,IAAX,CAAnB;;AACA,QAAI,QAAQ,IAAZ,EAAkB;AAChB,YAAM,IAAI,KAAJ,CAAU,GAAG,IAAI,gBAAjB,CAAN;AACD,KAFD,MAGK,IAAI,CAAC,KAAK,MAAL,EAAL,EAAoB;AACvB,YAAM,IAAI,KAAJ,CAAU,GAAG,IAAI,aAAjB,CAAN;AACD,KAFI,MAGA;AACH,aAAO,IAAP;AACD;AACF,G;;kBAzCW,mB;;;MA2CZ;AACA;AACA;AACA;;;;AACA,MAAM,2BAA2B,KAAI,eAAJ,gCAAe,aAAW;AACzD;AACA,QAAM,WAAW,mBAAjB;AACA,QAAM,kBAAkB,KAAK,IAAL,CAAU,QAAV,EAAoB,6BAAY,6BAAZ,CAApB,CAAxB;AACA,QAAM,eAAe,KAAK,IAAL,CAAU,QAAV,EAAoB,sCAApB,CAArB;AACA,QAAM,UAAU,MAAM,QAAQ,GAAR,CAAiB,CACrC,mBADqC,EAErC,oBAAS,KAAK,IAAL,CAAU,SAAV,EAAqB,IAArB,EAA2B,OAA3B,EAAoC,qBAApC,CAAT,EAAqE,eAArE,EACG,IADH,CACQ,MAAM,wBAAO,eAAP,EAAwB,YAAxB,CADd,CAFqC,CAAjB,CAAtB;AAKA,QAAM,OAAO,QAAQ,CAAR,CAAb;;AACA,MAAI,CAAC,KAAK,QAAL,CAAc,YAAd,CAAL,EAAkC;AAChC,UAAM,yBAAK,UAAL,EAAiB,CAAC,gBAAD,EAAmB,IAAnB,EAAyB,MAAzB,EAAiC,IAAjC,EAAuC,YAAvC,EAAqD,MAArD,CAA4D,IAA5D,CAAjB,CAAN;AACD;AACF,CAdgC,EAAjC;;AAgBA,SAAA,iBAAA,GAAA;AACE,QAAM,MAAM,QAAQ,GAAR,CAAY,sBAAxB;AACA,SAAO,oCAAgB,GAAhB,IAAuB,KAAK,IAAL,CAAU,oBAAV,EAAqB,SAArB,EAAgC,QAAhC,EAA0C,kBAA1C,CAAvB,GAAuF,KAAK,OAAL,CAAa,GAAb,CAA9F;AACD;;AAED,SAAA,iBAAA,GAAA;AACE,SAAO,yBAAK,UAAL,EAAiB,CAAC,gBAAD,EAAmB,IAAnB,EAAyB,MAAzB,CAAjB,EACJ,IADI,CACC,MAAM,GACT,KADS,CACH,IADG,EAET,GAFS,CAEL,MAAK;AACR,UAAM,IAAI,GAAG,IAAH,EAAV;AACA,WAAO,EAAE,SAAF,CAAY,CAAZ,EAAe,EAAE,MAAF,GAAW,CAA1B,CAAP;AACD,GALS,EAMT,MANS,CAMF,MAAM,GAAG,MAAH,GAAY,CANhB,CADP,CAAP;AAQD;;;4CAqBM,WAA8B;AAAC,UAAD;AAAS,WAAT;AAAkB,kBAAlB;AAAkC,YAAlC;AAA4C,mBAA5C;AAA6D;AAA7D,GAA9B,EAA6H;AAClI;AACA,QAAI,QAAQ,GAAR,CAAY,MAAZ,KAAuB,MAA3B,EAAmC;AACjC,YAAM,yBAAyB,KAA/B;AACD;;AAED,UAAM,eAAe,MAAM,OAAO,WAAP,CAAmB;AAAC,cAAQ,WAAT;AAAsB,gBAAU;AAAhC,KAAnB,CAA3B;AAEA,UAAM,YAAY,CAAC,OAAD,CAAlB;;AACA,QAAI,YAAY,IAAhB,EAAsB;AACpB,gBAAU,IAAV,CAAe,QAAf;AACD;;AAED,UAAM,YAAY,IAAI,KAAJ,CAAU,UAAU,MAApB,CAAlB;AACA,UAAM,mBAAmB,2BAAY,CAAZ,EAAe,QAAf,CAAwB,QAAxB,CAAzB;AACA,UAAM,mBAAmB,CACvB,CAAC,iBAAD,EAAoB,IAApB,EAA0B,gBAA1B,EAA4C,YAA5C,CADuB,EAEvB,CAAC,iBAAD,EAAoB,IAApB,EAA0B,gBAA1B,EAA4C,YAA5C,CAFuB,EAGvB,CAAC,uBAAD,EAA0B,YAA1B,CAHuB,CAAzB,CAfkI,CAqBlI;AACA;;AACA,UAAM,OAAO,MAAM,mBAAnB;;AACA,QAAI,CAAC,KAAK,QAAL,CAAc,YAAd,CAAL,EAAkC;AAChC,uBAAiB,IAAjB,CAAsB,CAAC,gBAAD,EAAmB,IAAnB,EAAyB,MAAzB,EAAiC,IAAjC,EAAuC,YAAvC,EAAqD,MAArD,CAA4D,IAA5D,CAAtB;AACD;;AAED,UAAM,QAAQ,GAAR,CAAY,CAChB;AACA,2BAAgB,GAAhB,CAAoB,SAApB,EAA+B,CAAC,IAAD,EAAO,CAAP,KAAa,oBAAoB,IAApB,EAA0B,MAA1B,EAAkC,UAAlC,EAA8C,IAA9C,CAAmD,MAAM,UAAU,CAAV,IAAe,EAAxE,CAA5C,CAFgB,EAGhB,uBAAgB,SAAhB,CAA0B,gBAA1B,EAA4C,MAAM,yBAAK,UAAL,EAAiB,EAAjB,CAAlD,CAHgB,CAAZ,CAAN;AAKA,WAAO,MAAM,YAAY,YAAZ,EAA0B,SAA1B,EAAqC,CAAC,cAAD,EAAiB,eAAjB,EAAkC,MAAlC,CAAyC,MAAM,MAAM,IAArD,CAArC,CAAb;AACD,G;;kBAlCW,c;;;;;;;AAsDN,SAAA,IAAA,CAAe,IAAf,EAA6B,IAA7B,EAA2C,QAA3C,EAA2D;AAC/D,QAAM,OAAO,CAAC,QAAD,EAAW,SAAX,EAAsB,QAAtB,EAAgC,IAAhC,EAAsC,IAAtC,CAAb;;AACA,MAAI,YAAY,IAAhB,EAAsB;AACpB,SAAK,IAAL,CAAU,YAAV,EAAwB,QAAxB;AACD;;AACD,SAAO,yBAAK,UAAL,EAAiB,IAAjB,CAAP;AACD;;AAEM,IAAI,wBAAuD,IAA3D;;;AAwFP,MAAM,YAAY,QAAQ,mCAAR,EAA6C,QAA/D;;AAEA,SAAA,aAAA,CAAuB,IAAvB,EAAmC;AACjC,QAAM,kBAAkB,KAAK,OAAL,CAAa,GAAb,CAAxB;AACA,QAAM,OAAO,KAAK,SAAL,CAAe,kBAAkB,CAAjC,EAAoC,KAAK,WAAL,CAAiB,GAAjB,CAApC,CAAb;AACA,QAAM,OAAO,KAAK,SAAL,CAAe,CAAf,EAAkB,kBAAkB,CAApC,CAAb;AACA,SAAO,IAAI,SAAJ,CAAc,IAAd,EAAoB,IAApB,CAAP;AACD;;AAEK,SAAA,YAAA,CAAuB,QAAvB,EAA2C,SAA3C,EAAsE,QAAtE,EAA8F;AAClG,MAAI,WAAW,aAAa,QAAQ,GAAR,CAAY,QAAxC;;AACA,MAAI,oCAAgB,QAAhB,CAAJ,EAA+B;AAC7B,QAAI,+CAAJ,EAAuC;AACrC,aAAO,cAAc,QAAd,EAAwB,IAAxB,EAA8B,QAA9B,CAAP;AACD,KAFD,MAGK;AACH,aAAO,QAAQ,OAAR,CAAgB,IAAhB,CAAP;AACD;AACF,GAPD,MAQK;AACH,eAAW,SAAU,IAAV,EAAX;;AACA,SAAK,MAAM,MAAX,IAAqB,wBAArB,EAA+C;AAC7C,kBAAY,QAAZ,EAAsB,MAAtB;AACD;;AACD,WAAO,cAAc,QAAd,EAAwB,QAAxB,EAAkC,QAAlC,CAAP;AACD;AACF;;AAED,SAAA,WAAA,CAAqB,IAArB,EAAmC,MAAnC,EAAiD;AAC/C,MAAI,KAAK,UAAL,CAAgB,MAAhB,CAAJ,EAA6B;AAC3B,UAAM,KAAI,wCAAJ,EAA8B,yBAAyB,MAAM,kFAA7D,CAAN;AACD;AACF,C","sourcesContent":["import BluebirdPromise from \"bluebird-lst\"\nimport { exec, InvalidConfigurationError, isEmptyOrSpaces, isEnvTrue, isMacOsSierra, isPullRequest, log, TmpDir } from \"builder-util\"\nimport { copyFile, statOrNull, unlinkIfExists } from \"builder-util/out/fs\"\nimport { Fields, Logger } from \"builder-util/out/log\"\nimport { randomBytes } from \"crypto\"\nimport { outputFile, rename } from \"fs-extra-p\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { download } from \"builder-util/out/binDownload\"\nimport { isAutoDiscoveryCodeSignIdentity } from \"./util/flags\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType = \"Developer ID Application\" | \"Developer ID Installer\" | \"3rd Party Mac Developer Application\" | \"3rd Party Mac Developer Installer\" | \"Mac Developer\"\n\nexport interface CodeSigningInfo {\n keychainName?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n if (process.platform !== \"darwin\") {\n if (isPrintWarn) {\n log.warn({reason: \"supported only on macOS\"}, \"skipped macOS application code signing\")\n }\n return false\n }\n\n const buildForPrWarning = \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n if (isPullRequest()) {\n if (isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {\n if (isPrintWarn) {\n log.warn(buildForPrWarning)\n }\n }\n else {\n if (isPrintWarn) {\n // https://github.com/electron-userland/electron-builder/issues/1524\n log.warn(\"Current build is a part of pull request, code signing will be skipped.\" +\n \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" +\n `\\n${buildForPrWarning}`)\n }\n return false\n }\n }\n return true\n}\n\nexport async function reportError(isMas: boolean, certificateType: CertType, qualifier: string | null | undefined, keychainName: string | null | undefined, isForceCodeSigning: boolean) {\n const logFields: Fields = {}\n if (qualifier == null) {\n logFields.reason = \"\"\n if (isAutoDiscoveryCodeSignIdentity()) {\n logFields.reason += `cannot find valid \"${certificateType}\" identity${(isMas ? \"\" : ` or custom non-Apple code signing certificate`)}`\n }\n logFields.reason += \", see https://electron.build/code-signing\"\n if (!isAutoDiscoveryCodeSignIdentity()) {\n logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n }\n }\n else {\n logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n logFields.identity = qualifier\n }\n\n const args = [\"find-identity\"]\n if (keychainName != null) {\n args.push(keychainName)\n }\n\n if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n logFields.allIdentities = (await exec(\"security\", args))\n .trim()\n .split(\"\\n\")\n .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n .join(\"\\n\")\n }\n\n if (isMas || isForceCodeSigning) {\n throw new Error(Logger.createMessage(\"skipped macOS application code signing\", logFields, \"error\", it => it))\n }\n else {\n log.warn(logFields, \"skipped macOS application code signing\")\n }\n}\n\n/** @private */\nexport async function downloadCertificate(urlOrBase64: string, tmpDir: TmpDir, currentDir: string): Promise<string> {\n urlOrBase64 = urlOrBase64.trim()\n\n let file: string | null = null\n if ((urlOrBase64.length > 3 && urlOrBase64[1] === \":\") || urlOrBase64.startsWith(\"/\") || urlOrBase64.startsWith(\".\")) {\n file = urlOrBase64\n }\n else if (urlOrBase64.startsWith(\"file://\")) {\n file = urlOrBase64.substring(\"file://\".length)\n }\n else if (urlOrBase64.startsWith(\"~/\")) {\n file = path.join(homedir(), urlOrBase64.substring(\"~/\".length))\n }\n else {\n const isUrl = urlOrBase64.startsWith(\"https://\")\n if (isUrl || urlOrBase64.length > 2048 || urlOrBase64.endsWith(\"=\")) {\n const tempFile = await tmpDir.getTempFile({suffix: \".p12\"})\n if (isUrl) {\n await download(urlOrBase64, tempFile)\n }\n else {\n await outputFile(tempFile, Buffer.from(urlOrBase64, \"base64\"))\n }\n return tempFile\n }\n else {\n file = urlOrBase64\n }\n }\n\n file = path.resolve(currentDir, file)\n const stat = await statOrNull(file)\n if (stat == null) {\n throw new Error(`${file} doesn't exist`)\n }\n else if (!stat.isFile()) {\n throw new Error(`${file} not a file`)\n }\n else {\n return file\n }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n // copy to temp and then atomic rename to final path\n const cacheDir = getCacheDirectory()\n const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n const results = await Promise.all<any>([\n listUserKeychains(),\n copyFile(path.join(__dirname, \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath)\n .then(() => rename(tmpKeychainPath, keychainPath)),\n ])\n const list = results[0]\n if (!list.includes(keychainPath)) {\n await exec(\"security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n }\n})\n\nfunction getCacheDirectory(): string {\n const env = process.env.ELECTRON_BUILDER_CACHE\n return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env!!)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n return exec(\"security\", [\"list-keychains\", \"-d\", \"user\"])\n .then(it => it\n .split(\"\\n\")\n .map(it => {\n const r = it.trim()\n return r.substring(1, r.length - 1)\n })\n .filter(it => it.length > 0))\n}\n\nexport interface CreateKeychainOptions {\n tmpDir: TmpDir\n cscLink: string\n cscKeyPassword: string\n cscILink?: string | null\n cscIKeyPassword?: string | null\n currentDir: string\n}\n\nasync function removeKeychain(keychainFile: string) {\n try {\n await exec(\"security\", [\"delete-keychain\", keychainFile])\n }\n catch (e) {\n console.warn(`Cannot delete keychain ${keychainFile}: ${e.stack || e}`)\n await unlinkIfExists(keychainFile)\n }\n}\n\nexport async function createKeychain({tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir}: CreateKeychainOptions): Promise<CodeSigningInfo> {\n // travis has correct AppleWWDRCA cert\n if (process.env.TRAVIS !== \"true\") {\n await bundledCertKeychainAdded.value\n }\n\n const keychainFile = await tmpDir.getTempFile({suffix: \".keychain\", disposer: removeKeychain})\n\n const certLinks = [cscLink]\n if (cscILink != null) {\n certLinks.push(cscILink)\n }\n\n const certPaths = new Array(certLinks.length)\n const keychainPassword = randomBytes(8).toString(\"base64\")\n const securityCommands = [\n [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n [\"set-keychain-settings\", keychainFile]\n ]\n\n // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n // https://github.com/electron-userland/electron-builder/issues/1457\n const list = await listUserKeychains()\n if (!list.includes(keychainFile)) {\n securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n }\n\n await Promise.all([\n // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.\n BluebirdPromise.map(certLinks, (link, i) => downloadCertificate(link, tmpDir, currentDir).then(it => certPaths[i] = it)),\n BluebirdPromise.mapSeries(securityCommands, it => exec(\"security\", it))\n ])\n return await importCerts(keychainFile, certPaths, [cscKeyPassword, cscIKeyPassword].filter(it => it != null) as Array<string>)\n}\n\nasync function importCerts(keychainName: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n for (let i = 0; i < paths.length; i++) {\n const password = keyPasswords[i]\n await exec(\"security\", [\"import\", paths[i], \"-k\", keychainName, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n if (await isMacOsSierra()) {\n await exec(\"security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainName])\n }\n }\n\n return {\n keychainName,\n }\n}\n\n/** @private */\nexport function sign(path: string, name: string, keychain: string): Promise<any> {\n const args = [\"--deep\", \"--force\", \"--sign\", name, path]\n if (keychain != null) {\n args.push(\"--keychain\", keychain)\n }\n return exec(\"codesign\", args)\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n function addKeychain(args: Array<string>) {\n if (keychain != null) {\n args.push(keychain)\n }\n return args\n }\n\n let result = findIdentityRawResult\n if (result == null || keychain != null) {\n // https://github.com/electron-userland/electron-builder/issues/481\n // https://github.com/electron-userland/electron-builder/issues/535\n result = Promise.all<Array<string>>([\n exec(\"security\", addKeychain([\"find-identity\", \"-v\"]))\n .then(it => it.trim().split(\"\\n\").filter(it => {\n for (const prefix of appleCertificatePrefixes) {\n if (it.includes(prefix)) {\n return true\n }\n }\n return false\n })),\n exec(\"security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"]))\n .then(it => it.trim().split((\"\\n\"))),\n ])\n .then(it => {\n const array = it[0].concat(it[1])\n .filter(it => !it.includes(\"(Missing required extension)\") && !it.includes(\"valid identities found\") && !it.includes(\"iPhone \") && !it.includes(\"com.apple.idms.appleid.prd.\"))\n // remove 1)\n .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n return Array.from(new Set(array))\n })\n\n if (keychain == null) {\n findIdentityRawResult = result\n }\n }\n return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n // https://github.com/electron-userland/electron-builder/issues/484\n //noinspection SpellCheckingInspection\n const lines = await getValidIdentities(keychain)\n const namePrefix = `${type}:`\n for (const line of lines) {\n if (qualifier != null && !line.includes(qualifier)) {\n continue\n }\n\n if (line.includes(namePrefix)) {\n return parseIdentity(line)\n }\n }\n\n if (type === \"Developer ID Application\") {\n // find non-Apple certificate\n // https://github.com/electron-userland/electron-builder/issues/458\n l: for (const line of lines) {\n if (qualifier != null && !line.includes(qualifier)) {\n continue\n }\n\n if (line.includes(\"Mac Developer:\")) {\n continue\n }\n\n for (const prefix of appleCertificatePrefixes) {\n if (line.includes(prefix)) {\n continue l\n }\n }\n\n return parseIdentity(line)\n }\n }\n return null\n}\n\nexport declare class Identity {\n readonly name: string\n readonly hash: string\n\n constructor(name: string, hash: string)\n}\n\nconst _Identity = require(\"electron-osx-sign/util-identities\").Identity\n\nfunction parseIdentity(line: string): Identity {\n const firstQuoteIndex = line.indexOf('\"')\n const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n const hash = line.substring(0, firstQuoteIndex - 1)\n return new _Identity(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n let identity = qualifier || process.env.CSC_NAME\n if (isEmptyOrSpaces(identity)) {\n if (isAutoDiscoveryCodeSignIdentity()) {\n return _findIdentity(certType, null, keychain)\n }\n else {\n return Promise.resolve(null)\n }\n }\n else {\n identity = identity!.trim()\n for (const prefix of appleCertificatePrefixes) {\n checkPrefix(identity, prefix)\n }\n return _findIdentity(certType, identity, keychain)\n }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n if (name.startsWith(prefix)) {\n throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n }\n}"],"sourceRoot":""}
|