mirror of
https://github.com/4gray/iptvnator.git
synced 2026-10-11 19:46:16 -08:00
feat(macOS): add notarization support and entitlements for Electron app
This commit is contained in:
4gray committed
1 parent
1e9f5d9d05
commit
ec84eea924
4 files changed
+105
-4
No files matched your search
@@ -79,7 +79,84 @@ jobs:
|
||||
fs.writeFileSync('electron-builder.json', JSON.stringify(pkg, null, 4));
|
||||
"
|
||||
|
||||
- name: Validate macOS signing configuration
|
||||
if: matrix.os == 'macos' && github.event_name != 'pull_request'
|
||||
shell: bash
|
||||
env:
|
||||
CSC_LINK: ${{ secrets.CSC_LINK }}
|
||||
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
|
||||
APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY }}
|
||||
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
||||
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
|
||||
APPLE_ID: ${{ secrets.APPLE_ID }}
|
||||
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
||||
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
||||
run: |
|
||||
if [ -z "${CSC_LINK}" ] || [ -z "${CSC_KEY_PASSWORD}" ]; then
|
||||
echo "::error::Missing CSC_LINK or CSC_KEY_PASSWORD secret for macOS code signing."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
has_api_key_credentials=false
|
||||
if [ -n "${APPLE_API_KEY_CONTENT}" ] || [ -n "${APPLE_API_KEY_ID}" ] || [ -n "${APPLE_API_ISSUER}" ]; then
|
||||
if [ -z "${APPLE_API_KEY_CONTENT}" ] || [ -z "${APPLE_API_KEY_ID}" ] || [ -z "${APPLE_API_ISSUER}" ]; then
|
||||
echo "::error::APPLE_API_KEY, APPLE_API_KEY_ID, and APPLE_API_ISSUER must all be set for App Store Connect API key notarization."
|
||||
exit 1
|
||||
fi
|
||||
has_api_key_credentials=true
|
||||
fi
|
||||
|
||||
has_apple_id_credentials=false
|
||||
if [ -n "${APPLE_ID}" ] || [ -n "${APPLE_APP_SPECIFIC_PASSWORD}" ] || [ -n "${APPLE_TEAM_ID}" ]; then
|
||||
if [ -z "${APPLE_ID}" ] || [ -z "${APPLE_APP_SPECIFIC_PASSWORD}" ] || [ -z "${APPLE_TEAM_ID}" ]; then
|
||||
echo "::error::APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, and APPLE_TEAM_ID must all be set for Apple ID notarization."
|
||||
exit 1
|
||||
fi
|
||||
has_apple_id_credentials=true
|
||||
fi
|
||||
|
||||
if [ "${has_api_key_credentials}" = false ] && [ "${has_apple_id_credentials}" = false ]; then
|
||||
echo "::error::Missing notarization credentials. Configure either APPLE_API_KEY + APPLE_API_KEY_ID + APPLE_API_ISSUER, or APPLE_ID + APPLE_APP_SPECIFIC_PASSWORD + APPLE_TEAM_ID."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Prepare macOS notarization credentials
|
||||
if: matrix.os == 'macos'
|
||||
shell: bash
|
||||
env:
|
||||
APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY }}
|
||||
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
|
||||
APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
|
||||
APPLE_ID: ${{ secrets.APPLE_ID }}
|
||||
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
|
||||
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
|
||||
run: |
|
||||
if [ -n "${APPLE_API_KEY_CONTENT}" ]; then
|
||||
APPLE_API_KEY_PATH="${RUNNER_TEMP}/AuthKey_${APPLE_API_KEY_ID}.p8"
|
||||
printf '%s' "${APPLE_API_KEY_CONTENT}" > "${APPLE_API_KEY_PATH}"
|
||||
chmod 600 "${APPLE_API_KEY_PATH}"
|
||||
echo "APPLE_API_KEY=${APPLE_API_KEY_PATH}" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_API_KEY_ID=${APPLE_API_KEY_ID}" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_API_ISSUER=${APPLE_API_ISSUER}" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_ID=" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_APP_SPECIFIC_PASSWORD=" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_TEAM_ID=" >> "${GITHUB_ENV}"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -n "${APPLE_ID}" ]; then
|
||||
echo "APPLE_API_KEY=" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_API_KEY_ID=" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_API_ISSUER=" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_ID=${APPLE_ID}" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_APP_SPECIFIC_PASSWORD=${APPLE_APP_SPECIFIC_PASSWORD}" >> "${GITHUB_ENV}"
|
||||
echo "APPLE_TEAM_ID=${APPLE_TEAM_ID}" >> "${GITHUB_ENV}"
|
||||
fi
|
||||
|
||||
- name: Make Electron app
|
||||
env:
|
||||
CSC_LINK: ${{ secrets.CSC_LINK }}
|
||||
CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
|
||||
run: pnpm run make:app
|
||||
|
||||
- name: Upload artifacts (macOS)
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>com.apple.security.cs.allow-jit</key>
|
||||
<true/>
|
||||
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
|
||||
<true/>
|
||||
<key>com.apple.security.cs.disable-library-validation</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</plist>
|
||||
@@ -0,0 +1,12 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>com.apple.security.cs.allow-jit</key>
|
||||
<true/>
|
||||
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
|
||||
<true/>
|
||||
<key>com.apple.security.cs.disable-library-validation</key>
|
||||
<true/>
|
||||
</dict>
|
||||
</plist>
|
||||
@@ -31,11 +31,11 @@
|
||||
"arch": ["x64", "arm64"]
|
||||
},
|
||||
"category": "public.app-category.video",
|
||||
"identity": null,
|
||||
"gatekeeperAssess": false,
|
||||
"hardenedRuntime": false,
|
||||
"entitlements": null,
|
||||
"entitlementsInherit": null,
|
||||
"hardenedRuntime": true,
|
||||
"entitlements": "apps/electron-backend/macos/entitlements.mac.plist",
|
||||
"entitlementsInherit": "apps/electron-backend/macos/entitlements.mac.inherit.plist",
|
||||
"notarize": true,
|
||||
"icon": "apps/web/src/assets/icons/favicon.icns"
|
||||
},
|
||||
"linux": {
|
||||
|
||||
Reference in new issue
Block a user