Skip to content

Commit 7d25889

Browse files
AndrewAndrew
Andrew
authored and
Andrew
committed
fixed up store submissions
1 parent fe21c9b commit 7d25889

5 files changed

Lines changed: 148 additions & 50 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 86 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -71,48 +71,51 @@ jobs:
7171
env:
7272
CSC_IDENTITY_AUTO_DISCOVERY: false # Disable auto code signing
7373

74-
- name: Azure Login for Code Signing
75-
uses: azure/login@v2
76-
with:
77-
client-id: ${{ secrets.AZURE_CLIENT_ID }}
78-
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
79-
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
80-
81-
- name: Sign Windows AppX with Azure Trusted Signing
82-
uses: azure/trusted-signing-action@v0.5.0
83-
with:
84-
endpoint: https://eus.codesigning.azure.net/
85-
trusted-signing-account-name: Allow2
86-
certificate-profile-name: Allow2-Dev-Signing
87-
files-folder: ${{ github.workspace }}/dist
88-
files-folder-filter: appx,msix
89-
file-digest: SHA256
90-
timestamp-rfc3161: http://timestamp.acs.microsoft.com
91-
timestamp-digest: SHA256
92-
93-
- name: Verify Windows signature
94-
shell: pwsh
95-
run: |
96-
Write-Host "=== Verifying AppX/MSIX signatures ==="
97-
98-
# Find signtool
99-
$signtool = Get-ChildItem -Path "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter "signtool.exe" |
100-
Where-Object { $_.FullName -match "x64" } |
101-
Sort-Object { [version]($_.FullName -replace '.*\\(\d+\.\d+\.\d+\.\d+)\\.*', '$1') } -Descending |
102-
Select-Object -First 1 -ExpandProperty FullName
103-
104-
Write-Host "Using signtool: $signtool"
105-
106-
# Verify AppX/MSIX signatures
107-
Get-ChildItem -Path "dist" -Include "*.appx","*.msix" -Recurse | ForEach-Object {
108-
Write-Host "Verifying: $($_.Name)"
109-
& $signtool verify /pa $_.FullName
110-
if ($LASTEXITCODE -eq 0) {
111-
Write-Host " Signature valid"
112-
} else {
113-
Write-Host " WARNING: Signature verification failed"
114-
}
115-
}
74+
# DISABLED: Windows Store will sign the package during submission
75+
# Re-enable these steps when Azure Trusted Signing is configured
76+
# - name: Azure Login for Code Signing
77+
# uses: azure/login@v2
78+
# with:
79+
# client-id: ${{ secrets.AZURE_CLIENT_ID }}
80+
# tenant-id: ${{ secrets.AZURE_TENANT_ID }}
81+
# subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
82+
#
83+
# - name: Sign Windows AppX with Azure Trusted Signing
84+
# uses: azure/trusted-signing-action@v0.5.0
85+
# with:
86+
# endpoint: https://eus.codesigning.azure.net/
87+
# trusted-signing-account-name: Allow2
88+
# certificate-profile-name: Allow2-Dev-Signing
89+
# files-folder: ${{ github.workspace }}/dist
90+
# files-folder-filter: appx,msix
91+
# file-digest: SHA256
92+
# timestamp-rfc3161: http://timestamp.acs.microsoft.com
93+
# timestamp-digest: SHA256
94+
95+
# DISABLED: Signature verification skipped since Windows Store will sign
96+
# - name: Verify Windows signature
97+
# shell: pwsh
98+
# run: |
99+
# Write-Host "=== Verifying AppX/MSIX signatures ==="
100+
#
101+
# # Find signtool
102+
# $signtool = Get-ChildItem -Path "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Filter "signtool.exe" |
103+
# Where-Object { $_.FullName -match "x64" } |
104+
# Sort-Object { [version]($_.FullName -replace '.*\\(\d+\.\d+\.\d+\.\d+)\\.*', '$1') } -Descending |
105+
# Select-Object -First 1 -ExpandProperty FullName
106+
#
107+
# Write-Host "Using signtool: $signtool"
108+
#
109+
# # Verify AppX/MSIX signatures
110+
# Get-ChildItem -Path "dist" -Include "*.appx","*.msix" -Recurse | ForEach-Object {
111+
# Write-Host "Verifying: $($_.Name)"
112+
# & $signtool verify /pa $_.FullName
113+
# if ($LASTEXITCODE -eq 0) {
114+
# Write-Host " Signature valid"
115+
# } else {
116+
# Write-Host " WARNING: Signature verification failed"
117+
# }
118+
# }
116119

117120
- name: List built files
118121
shell: pwsh
@@ -218,7 +221,47 @@ jobs:
218221
- name: Build application
219222
run: npm run private:compile
220223

221-
- name: Build macOS app (MAS target)
224+
- name: Install provisioning profile
225+
env:
226+
PROVISIONING_PROFILE_BASE64: ${{ secrets.APPLE_PROVISIONING_PROFILE_BASE64 }}
227+
run: |
228+
if [ -n "$PROVISIONING_PROFILE_BASE64" ]; then
229+
echo "=== Installing Provisioning Profile ==="
230+
echo "$PROVISIONING_PROFILE_BASE64" | base64 -d > "./Allow2Automate_Distribution.provisionprofile"
231+
232+
# Verify the profile was created
233+
if [ -f "./Allow2Automate_Distribution.provisionprofile" ]; then
234+
echo "✅ Provisioning profile written to project root"
235+
ls -la ./Allow2Automate_Distribution.provisionprofile
236+
else
237+
echo "❌ Failed to create provisioning profile"
238+
exit 1
239+
fi
240+
241+
# Also install to system location for electron-builder
242+
mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
243+
244+
# Extract UUID from profile and install with that name
245+
PROFILE_UUID=$(security cms -D -i "./Allow2Automate_Distribution.provisionprofile" 2>/dev/null | plutil -extract UUID raw - 2>/dev/null || echo "embedded")
246+
if [ "$PROFILE_UUID" != "embedded" ] && [ -n "$PROFILE_UUID" ]; then
247+
cp "./Allow2Automate_Distribution.provisionprofile" ~/Library/MobileDevice/Provisioning\ Profiles/"${PROFILE_UUID}.provisionprofile"
248+
echo "✅ Provisioning profile installed to system location with UUID: ${PROFILE_UUID}"
249+
else
250+
cp "./Allow2Automate_Distribution.provisionprofile" ~/Library/MobileDevice/Provisioning\ Profiles/
251+
echo "✅ Provisioning profile installed to system location"
252+
fi
253+
else
254+
echo "❌ ERROR: APPLE_PROVISIONING_PROFILE_BASE64 secret not set"
255+
echo "Mac App Store build requires a provisioning profile."
256+
echo ""
257+
echo "To create this secret:"
258+
echo "1. Download your provisioning profile from Apple Developer Portal"
259+
echo "2. Base64 encode it: base64 -i Allow2Automate_Distribution.provisionprofile | pbcopy"
260+
echo "3. Add as GitHub secret: APPLE_PROVISIONING_PROFILE_BASE64"
261+
exit 1
262+
fi
263+
264+
- name: Build macOS app (MAS target - Universal)
222265
run: npm run private:build:mac
223266
env:
224267
# Enable code signing if certificates are available

‎dist-assets/.gitkeep‎

Whitespace-only changes.

‎electron-builder.json‎

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@
1616
"node_modules"
1717
],
1818

19+
"asar": true,
20+
"asarUnpack": [
21+
"**/*.node",
22+
"**/better-sqlite3/**"
23+
],
24+
1925
"dmg": {
2026
"contents": [{
2127
"type": "file",
@@ -30,13 +36,32 @@
3036
},
3137

3238
"mac": {
33-
"target": "mas",
39+
"target": [
40+
{
41+
"target": "mas",
42+
"arch": ["universal"]
43+
}
44+
],
3445
"provisioningProfile": "./Allow2Automate_Distribution.provisionprofile",
3546
"category": "public.app-category.lifestyle",
3647
"icon": "./app/assets/icons/mac/icon.icns",
3748
"entitlements": "./parent.plist",
3849
"entitlementsInherit": "./child.plist",
39-
"bundleVersion": 46
50+
"bundleVersion": 46,
51+
"hardenedRuntime": true,
52+
"gatekeeperAssess": false,
53+
"extendInfo": {
54+
"NSAppTransportSecurity": {
55+
"NSAllowsArbitraryLoads": true
56+
}
57+
}
58+
},
59+
60+
"mas": {
61+
"hardenedRuntime": false,
62+
"entitlements": "./parent.plist",
63+
"entitlementsInherit": "./child.plist",
64+
"provisioningProfile": "./Allow2Automate_Distribution.provisionprofile"
4065
},
4166

4267
"appx": {
@@ -53,7 +78,10 @@
5378
},
5479

5580
"linux": {
56-
"target": [ "snap", "AppImage" ],
81+
"target": ["snap", "AppImage"],
5782
"category": "Utility"
58-
}
83+
},
84+
85+
"nativeRebuilder": "sequential",
86+
"npmRebuild": true
5987
}

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
"browser-sync": "^2.26.7",
6363
"chai": "^4.2.0",
6464
"electron": "^25.0.0",
65-
"electron-builder": "^24.0.0",
65+
"electron-builder": "^26.0.0",
6666
"electron-devtools-installer": "^3.0.0",
6767
"electron-mocha": "^12.0.1",
6868
"electron-rebuild": "^3.2.9",

‎parent.plist‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,40 @@
22
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
33
<plist version="1.0">
44
<dict>
5+
<!-- Required: App Sandbox for Mac App Store -->
56
<key>com.apple.security.app-sandbox</key>
67
<true/>
8+
9+
<!-- Application group for shared data -->
710
<key>com.apple.security.application-groups</key>
8-
<string>L44G2T7U48.com.allow2.automate</string>
11+
<array>
12+
<string>L44G2T7U48.com.allow2.automate</string>
13+
</array>
14+
15+
<!-- Network access -->
916
<key>com.apple.security.network.client</key>
1017
<true/>
1118
<key>com.apple.security.network.server</key>
1219
<true/>
20+
21+
<!-- Required for Electron/V8 JIT compilation (better-sqlite3 and other native modules) -->
22+
<key>com.apple.security.cs.allow-jit</key>
23+
<true/>
24+
25+
<!-- Required for V8 to allocate executable memory -->
26+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
27+
<true/>
28+
29+
<!-- Required for loading native modules like better-sqlite3 -->
30+
<key>com.apple.security.cs.disable-library-validation</key>
31+
<true/>
32+
33+
<!-- File access for user-selected files (Open/Save dialogs) -->
34+
<key>com.apple.security.files.user-selected.read-write</key>
35+
<true/>
36+
37+
<!-- Downloads folder access -->
38+
<key>com.apple.security.files.downloads.read-write</key>
39+
<true/>
1340
</dict>
14-
</plist>
41+
</plist>

0 commit comments

Comments
 (0)