Commit f8a020e
build: macOS package notarization
Includes hardened-runtime patch from gdams from
#29216 (comment)
PR-URL: #31459
Refs: #29216
Reviewed-By: Christian Clauss <cclauss@me.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Ash Cripps <ashley.cripps@ibm.com>
Signed-off-by: Rod Vagg <rod@vagg.org>1 parent 6387cf8 commit f8a020e
6 files changed
Lines changed: 77 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -33,6 +33,7 @@ | |||
| 33 | 33 | /doc/api.xml | |
| 34 | 34 | /node | |
| 35 | 35 | /node_g | |
| 36 | + /gon-config.json | ||
| 36 | 37 | /*.exe | |
| 37 | 38 | /*.swp | |
| 38 | 39 | /out | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1003,6 +1003,7 @@ $(PKG): release-only | |||
| 1003 | 1003 | --resources $(MACOSOUTDIR)/installer/productbuild/Resources \ | |
| 1004 | 1004 | --package-path $(MACOSOUTDIR)/pkgs ./$(PKG) | |
| 1005 | 1005 | SIGN="$(PRODUCTSIGN_CERT)" PKG="$(PKG)" bash tools/osx-productsign.sh | |
| 1006 | + bash tools/osx-notarize.sh $(FULLVERSION) | ||
| 1006 | 1007 | ||
| 1007 | 1008 | .PHONY: pkg | |
| 1008 | 1009 | # Builds the macOS installer for releases. | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -8,4 +8,13 @@ if [ "X$SIGN" == "X" ]; then | |||
| 8 | 8 | exit 0 | |
| 9 | 9 | fi | |
| 10 | 10 | ||
| 11 | - codesign -s "$SIGN" "$PKGDIR"/bin/node | ||
| 11 | + # All macOS executable binaries in the bundle must be codesigned with the | ||
| 12 | + # hardened runtime enabled. | ||
| 13 | + # See https://github.com/nodejs/node/pull/31459 | ||
| 14 | + | ||
| 15 | + codesign \ | ||
| 16 | + --sign "$SIGN" \ | ||
| 17 | + --entitlements tools/osx-entitlements.plist \ | ||
| 18 | + --options runtime \ | ||
| 19 | + --timestamp \ | ||
| 20 | + "$PKGDIR"/bin/node | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,16 @@ | |||
| 1 | + <?xml version="1.0" encoding="UTF-8"?> | ||
| 2 | + <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | ||
| 3 | + <plist version="1.0"> | ||
| 4 | + <dict> | ||
| 5 | + <key>com.apple.security.cs.allow-jit</key> | ||
| 6 | + <true/> | ||
| 7 | + <key>com.apple.security.cs.allow-unsigned-executable-memory</key> | ||
| 8 | + <true/> | ||
| 9 | + <key>com.apple.security.cs.disable-executable-page-protection</key> | ||
| 10 | + <true/> | ||
| 11 | + <key>com.apple.security.cs.allow-dyld-environment-variables</key> | ||
| 12 | + <true/> | ||
| 13 | + <key>com.apple.security.cs.disable-library-validation</key> | ||
| 14 | + <true/> | ||
| 15 | + </dict> | ||
| 16 | + </plist> | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,12 @@ | |||
| 1 | + { | ||
| 2 | + "notarize": [{ | ||
| 3 | + "path": "node-{{pkgid}}.pkg", | ||
| 4 | + "bundle_id": "org.nodejs.pkg.{{pkgid}}", | ||
| 5 | + "staple": true | ||
| 6 | + }], | ||
| 7 | + | ||
| 8 | + "apple_id": { | ||
| 9 | + "username": "{{appleid}}", | ||
| 10 | + "password": "@env:NOTARIZATION_PASSWORD" | ||
| 11 | + } | ||
| 12 | + } | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,37 @@ | |||
| 1 | + #!/bin/bash | ||
| 2 | + | ||
| 3 | + # Uses gon, from https://github.com/mitchellh/gon, to notarize a generated node-<version>.pkg file | ||
| 4 | + # with Apple for installation on macOS Catalina and later as validated by Gatekeeper. | ||
| 5 | + | ||
| 6 | + set -e | ||
| 7 | + | ||
| 8 | + gon_version="0.2.2" | ||
| 9 | + gon_exe="${HOME}/.gon/gon_${gon_version}" | ||
| 10 | + | ||
| 11 | + __dirname="$(CDPATH= cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" | ||
| 12 | + pkgid="$1" | ||
| 13 | + | ||
| 14 | + if [ "X${pkgid}" == "X" ]; then | ||
| 15 | + echo "Usage: $0 <pkgid>" | ||
| 16 | + exit 1 | ||
| 17 | + fi | ||
| 18 | + | ||
| 19 | + if [ "X$NOTARIZATION_ID" == "X" ]; then | ||
| 20 | + echo "No NOTARIZATION_ID environment var. Skipping notarization." | ||
| 21 | + exit 0 | ||
| 22 | + fi | ||
| 23 | + | ||
| 24 | + set -x | ||
| 25 | + | ||
| 26 | + mkdir -p "${HOME}/.gon/" | ||
| 27 | + | ||
| 28 | + if [ ! -f "${gon_exe}" ]; then | ||
| 29 | + curl -sL "https://github.com/mitchellh/gon/releases/download/v${gon_version}/gon_${gon_version}_macos.zip" -o "${gon_exe}.zip" | ||
| 30 | + (cd "${HOME}/.gon/" && rm -f gon && unzip "${gon_exe}.zip" && mv gon "${gon_exe}") | ||
| 31 | + fi | ||
| 32 | + | ||
| 33 | + cat tools/osx-gon-config.json.tmpl \ | ||
| 34 | + | sed -e "s/{{appleid}}/${NOTARIZATION_ID}/" -e "s/{{pkgid}}/${pkgid}/" \ | ||
| 35 | + > gon-config.json | ||
| 36 | + | ||
| 37 | + "${gon_exe}" -log-level=info gon-config.json | ||
0 commit comments