feat(1.90): update patches and notarize macos (#1864)

.github/workflows/insider-macos.yml

@@ -84,9 +84,10 @@ jobs:
 
       - name: Prepare assets
         env:
-          CERTIFICATE_OSX_P12: ${{ secrets.CERTIFICATE_OSX_P12 }}
-          CERTIFICATE_OSX_PASSWORD: ${{ secrets.CERTIFICATE_OSX_PASSWORD }}
-          CERTIFICATE_OSX_ID: ${{ secrets.CERTIFICATE_OSX_ID }}
+          CERTIFICATE_OSX_APP_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_APP_PASSWORD }}
+          CERTIFICATE_OSX_ID: ${{ secrets.CERTIFICATE_OSX_NEW_ID }}
+          CERTIFICATE_OSX_P12_DATA: ${{ secrets.CERTIFICATE_OSX_NEW_P12_DATA }}
+          CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
         run: ./prepare_assets.sh
         if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
 

.github/workflows/stable-macos.yml

@@ -83,9 +83,10 @@ jobs:
 
       - name: Prepare assets
         env:
-          CERTIFICATE_OSX_P12: ${{ secrets.CERTIFICATE_OSX_P12 }}
-          CERTIFICATE_OSX_PASSWORD: ${{ secrets.CERTIFICATE_OSX_PASSWORD }}
-          CERTIFICATE_OSX_ID: ${{ secrets.CERTIFICATE_OSX_ID }}
+          CERTIFICATE_OSX_APP_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_APP_PASSWORD }}
+          CERTIFICATE_OSX_ID: ${{ secrets.CERTIFICATE_OSX_NEW_ID }}
+          CERTIFICATE_OSX_P12_DATA: ${{ secrets.CERTIFICATE_OSX_NEW_P12_DATA }}
+          CERTIFICATE_OSX_P12_PASSWORD: ${{ secrets.CERTIFICATE_OSX_NEW_P12_PASSWORD }}
         run: ./prepare_assets.sh
         if: env.SHOULD_BUILD == 'yes' && (env.SHOULD_DEPLOY == 'yes' || github.event.inputs.generate_assets == 'true')
 

insider.json

@@ -1,4 +1,4 @@
 {
-  "tag": "1.88.0",
-  "commit": "d994aede3529f4d1af9eeaeb234d32fd936243e7"
+  "tag": "1.90.0",
+  "commit": "ca688da9fb6dad00996cee7d5342490daa7bb1fb"
 }

patches/fix-build-linux.patch

@@ -19,21 +19,21 @@ index 8c2b62f..843e8d4 100644
 +	const buildRpmTask = task.define(`vscode-linux-${arch}-build-rpm`, task.series(prepareRpmTask, buildRpmPackage(arch)));
  	gulp.task(buildRpmTask);
 diff --git a/build/linux/dependencies-generator.js b/build/linux/dependencies-generator.js
-index 80c247d..40f1df2 100644
+index bff0c9a..57c12e0 100644
 --- a/build/linux/dependencies-generator.js
 +++ b/build/linux/dependencies-generator.js
 @@ -24,3 +24,3 @@ const product = require("../../product.json");
  // are valid, are in dep-lists.ts
 -const FAIL_BUILD_FOR_NEW_DEPENDENCIES = true;
 +const FAIL_BUILD_FOR_NEW_DEPENDENCIES = false;
- // Based on https://source.chromium.org/chromium/chromium/src/+/refs/tags/120.0.6099.268:chrome/installer/linux/BUILD.gn;l=64-80
+ // Based on https://source.chromium.org/chromium/chromium/src/+/refs/tags/122.0.6261.156:chrome/installer/linux/BUILD.gn;l=64-80
 @@ -56,3 +56,3 @@ async function getDependencies(packageType, buildDir, applicationName, arch) {
      // Add the tunnel binary.
 -    files.push(path.join(buildDir, 'bin', product.tunnelApplicationName));
 +    // files.push(path.join(buildDir, 'bin', product.tunnelApplicationName));
      // Add the main executable.
 diff --git a/build/linux/dependencies-generator.ts b/build/linux/dependencies-generator.ts
-index 9f1a068..48e3d52 100644
+index 226310e..e75f652 100644
 --- a/build/linux/dependencies-generator.ts
 +++ b/build/linux/dependencies-generator.ts
 @@ -25,3 +25,3 @@ import product = require('../../product.json');

patches/linux/reh-node16.patch

@@ -20,41 +20,41 @@ index c2b81d0..2e94d99 100644
 -
  		return result.pipe(vfs.dest(destination));
 diff --git a/remote/.yarnrc b/remote/.yarnrc
-index 4e7208c..f7304bc 100644
+index 4c99388..71a7164 100644
 --- a/remote/.yarnrc
 +++ b/remote/.yarnrc
 @@ -1,3 +1,3 @@
  disturl "https://nodejs.org/dist"
--target "18.18.2"
+-target "20.11.1"
 +target "16.20.2"
- ms_build_id "256117"
+ ms_build_id "275039"
 diff --git a/remote/package.json b/remote/package.json
-index 974450e..513856f 100644
+index b84f513..42d8e41 100644
 --- a/remote/package.json
 +++ b/remote/package.json
 @@ -31,3 +31,3 @@
      "native-watchdog": "^1.4.1",
 -    "node-pty": "1.1.0-beta11",
 +    "node-pty": "1.1.0-beta4",
-     "tas-client-umd": "0.1.8",
+     "tas-client-umd": "0.2.0",
 diff --git a/remote/yarn.lock b/remote/yarn.lock
-index d62eb4b..f175b85 100644
+index 4241bf0..5ce4431 100644
 --- a/remote/yarn.lock
 +++ b/remote/yarn.lock
-@@ -391,2 +391,7 @@ [email protected]:
+@@ -412,2 +412,7 @@ [email protected]:
 
 +nan@^2.17.0:
 +  version "2.18.0"
 +  resolved "https://registry.npmjs.org/nan/-/nan-2.18.0.tgz#26a6faae7ffbeb293a39660e88a76b82e30b7554"
 +  integrity sha512-W7tfG7vMOGtD30sHoZSSc/JVYiyDPEyQVso/Zz+/uQd0B0L46gtC+pHha5FFMRpil6fm/AoEcRWyOVi4+E/f8w==
 +
  napi-build-utils@^1.0.1:
-@@ -408,3 +413,3 @@ node-abi@^3.3.0:
+@@ -429,3 +434,3 @@ node-abi@^3.3.0:
 
 -[email protected], node-addon-api@^7.1.0:
 +[email protected]:
    version "7.1.0"
-@@ -433,8 +438,8 @@ node-gyp-build@^4.3.0:
+@@ -454,8 +459,8 @@ [email protected], node-gyp-build@^4.3.0:
 
 -[email protected]:
 -  version "1.1.0-beta11"

patches/report-issue.patch

@@ -1,39 +1,25 @@
-diff --git a/src/vs/code/electron-sandbox/issue/issueReporterModel.ts b/src/vs/code/electron-sandbox/issue/issueReporterModel.ts
-index 74f9939..341ef06 100644
---- a/src/vs/code/electron-sandbox/issue/issueReporterModel.ts
-+++ b/src/vs/code/electron-sandbox/issue/issueReporterModel.ts
-@@ -79,3 +79,3 @@ ${this._data.issueDescription}
- ${this.getExtensionVersion()}
--VS Code version: ${this._data.versionInfo && this._data.versionInfo.vscodeVersion}
-+VSCodium version: ${this._data.versionInfo && this._data.versionInfo.vscodeVersion}
- OS version: ${this._data.versionInfo && this._data.versionInfo.os}
-diff --git a/src/vs/code/electron-sandbox/issue/issueReporterPage.ts b/src/vs/code/electron-sandbox/issue/issueReporterPage.ts
-index 96ec5f7..5c091d9 100644
---- a/src/vs/code/electron-sandbox/issue/issueReporterPage.ts
-+++ b/src/vs/code/electron-sandbox/issue/issueReporterPage.ts
-@@ -18,3 +18,3 @@ const reviewGuidanceLabel = localize( // intentionally not escaped because of it
- 		comment: [
--			'{Locked="<a href=\"https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions\" target=\"_blank\">"}',
-+			'{Locked="<a href=\"https://github.com/VSCodium/vscodium/wiki/Submitting-Bugs-and-Suggestions\" target=\"_blank\">"}',
- 			'{Locked="</a>"}'
-@@ -22,3 +22,3 @@ const reviewGuidanceLabel = localize( // intentionally not escaped because of it
- 	},
--	'Before you report an issue here please <a href="https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions" target="_blank">review the guidance we provide</a>.'
-+	'Before you report an issue here please <a href="https://github.com/VSCodium/vscodium/wiki/Submitting-Bugs-and-Suggestions" target="_blank">review the guidance we provide</a>.'
- );
-diff --git a/src/vs/code/electron-sandbox/issue/issueReporterService.ts b/src/vs/code/electron-sandbox/issue/issueReporterService.ts
-index d7f98f6..ed54042 100644
---- a/src/vs/code/electron-sandbox/issue/issueReporterService.ts
-+++ b/src/vs/code/electron-sandbox/issue/issueReporterService.ts
-@@ -517,5 +517,5 @@ export class IssueReporter extends Disposable {
+diff --git a/src/vs/workbench/contrib/extensions/electron-sandbox/extensionsSlowActions.ts b/src/vs/workbench/contrib/extensions/electron-sandbox/extensionsSlowActions.ts
+index 87839a6..49727fc 100644
+--- a/src/vs/workbench/contrib/extensions/electron-sandbox/extensionsSlowActions.ts
++++ b/src/vs/workbench/contrib/extensions/electron-sandbox/extensionsSlowActions.ts
+@@ -153,3 +153,3 @@ class ReportExtensionSlowAction extends Action {
+ - OS Version: \`${osVersion}\`
+-- VS Code version: \`${this._productService.version}\`\n\n${message}`);
++- VSCodium version: \`${this._productService.version}\`\n\n${message}`);
+
+diff --git a/src/vs/workbench/contrib/issue/browser/issue.ts b/src/vs/workbench/contrib/issue/browser/issue.ts
+index 79e4485..33f09a4 100644
+--- a/src/vs/workbench/contrib/issue/browser/issue.ts
++++ b/src/vs/workbench/contrib/issue/browser/issue.ts
+@@ -451,5 +451,5 @@ export class BaseIssueReporterService extends Disposable {
 
--	private searchVSCodeIssues(title: string, issueDescription?: string): void {
-+	private searchVSCodeIssues(title: string, _issueDescription?: string): void {
+-	public searchVSCodeIssues(title: string, issueDescription?: string): void {
++	public searchVSCodeIssues(title: string, _issueDescription?: string): void {
  		if (title) {
 -			this.searchDuplicates(title, issueDescription);
 +			this.searchGitHub('VSCodium/vscodium', title);
  		} else {
-@@ -611,33 +611,2 @@ export class IssueReporter extends Disposable {
+@@ -545,33 +545,2 @@ export class BaseIssueReporterService extends Disposable {
 
 -	@debounce(300)
 -	private searchDuplicates(title: string, body?: string): void {
@@ -67,17 +53,38 @@ index d7f98f6..ed54042 100644
 -	}
 -
  	private displaySearchResults(results: SearchResult[]) {
-@@ -729,3 +698,3 @@ export class IssueReporter extends Disposable {
+@@ -667,4 +636,4 @@ export class BaseIssueReporterService extends Disposable {
  		sourceSelect.append(this.makeOption('', localize('selectSource', "Select source"), true));
--		sourceSelect.append(this.makeOption('vscode', localize('vscode', "Visual Studio Code"), false));
-+		sourceSelect.append(this.makeOption('vscode', localize('vscode', "VSCodium"), false));
- 		sourceSelect.append(this.makeOption('extension', localize('extension', "An extension"), false));
-diff --git a/src/vs/workbench/contrib/extensions/electron-sandbox/extensionsSlowActions.ts b/src/vs/workbench/contrib/extensions/electron-sandbox/extensionsSlowActions.ts
-index 87839a6..49727fc 100644
---- a/src/vs/workbench/contrib/extensions/electron-sandbox/extensionsSlowActions.ts
-+++ b/src/vs/workbench/contrib/extensions/electron-sandbox/extensionsSlowActions.ts
-@@ -153,3 +153,3 @@ class ReportExtensionSlowAction extends Action {
- - OS Version: \`${osVersion}\`
--- VS Code version: \`${this._productService.version}\`\n\n${message}`);
-+- VSCodium version: \`${this._productService.version}\`\n\n${message}`);
-
+-		sourceSelect.append(this.makeOption(IssueSource.VSCode, localize('vscode', "Visual Studio Code"), false));
+-		sourceSelect.append(this.makeOption(IssueSource.Extension, localize('extension', "A VS Code extension"), false));
++		sourceSelect.append(this.makeOption(IssueSource.VSCode, localize('vscode', "VSCodium"), false));
++		sourceSelect.append(this.makeOption(IssueSource.Extension, localize('extension', "A VSCodium extension"), false));
+ 		if (this.product.reportMarketplaceIssueUrl) {
+@@ -728,3 +697,3 @@ export class BaseIssueReporterService extends Disposable {
+ 			hide(descriptionTextArea);
+-			reset(descriptionTitle, localize('handlesIssuesElsewhere', "This extension handles issues outside of VS Code"));
++			reset(descriptionTitle, localize('handlesIssuesElsewhere', "This extension handles issues outside of VSCodium"));
+ 			reset(descriptionSubtitle, localize('elsewhereDescription', "The '{0}' extension prefers to use an external issue reporter. To be taken to that issue reporting experience, click the button below.", selectedExtension.displayName));
+diff --git a/src/vs/workbench/contrib/issue/browser/issueReporterModel.ts b/src/vs/workbench/contrib/issue/browser/issueReporterModel.ts
+index f8274d9..15fcc8b 100644
+--- a/src/vs/workbench/contrib/issue/browser/issueReporterModel.ts
++++ b/src/vs/workbench/contrib/issue/browser/issueReporterModel.ts
+@@ -92,3 +92,3 @@ ${this._data.issueDescription}
+ ${this.getExtensionVersion()}
+-VS Code version: ${this._data.versionInfo && this._data.versionInfo.vscodeVersion}
++VSCodium version: ${this._data.versionInfo && this._data.versionInfo.vscodeVersion}
+ OS version: ${this._data.versionInfo && this._data.versionInfo.os}
+diff --git a/src/vs/workbench/contrib/issue/browser/issueReporterPage.ts b/src/vs/workbench/contrib/issue/browser/issueReporterPage.ts
+index 195857e..68163c0 100644
+--- a/src/vs/workbench/contrib/issue/browser/issueReporterPage.ts
++++ b/src/vs/workbench/contrib/issue/browser/issueReporterPage.ts
+@@ -18,3 +18,3 @@ const reviewGuidanceLabel = localize( // intentionally not escaped because of it
+ 		comment: [
+-			'{Locked="<a href=\"https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions\" target=\"_blank\">"}',
++			'{Locked="<a href=\"https://github.com/VSCodium/vscodium/wiki/Submitting-Bugs-and-Suggestions\" target=\"_blank\">"}',
+ 			'{Locked="</a>"}'
+@@ -22,3 +22,3 @@ const reviewGuidanceLabel = localize( // intentionally not escaped because of it
+ 	},
+-	'Before you report an issue here please <a href="https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions" target="_blank">review the guidance we provide</a>.'
++	'Before you report an issue here please <a href="https://github.com/VSCodium/vscodium/wiki/Submitting-Bugs-and-Suggestions" target="_blank">review the guidance we provide</a>.'
+ );

prepare_assets.sh

@@ -19,32 +19,46 @@ mkdir -p assets
 
 if [[ "${OS_NAME}" == "osx" ]]; then
   if [[ "${CI_BUILD}" != "no" ]]; then
-    cd "VSCode-darwin-${VSCODE_ARCH}"
-
     CERTIFICATE_P12="${APP_NAME}.p12"
-    KEYCHAIN="${RUNNER_TEMP}/build.keychain"
+    KEYCHAIN="${RUNNER_TEMP}/buildagent.keychain"
 
-    echo "${CERTIFICATE_OSX_P12}" | base64 --decode > "${CERTIFICATE_P12}"
+    echo "AGENT_TEMPDIRECTORY: ${AGENT_TEMPDIRECTORY}"
+    echo "RUNNER_TEMP: ${RUNNER_TEMP}"
+
+    echo "${CERTIFICATE_OSX_P12_DATA}" | base64 --decode > "${CERTIFICATE_P12}"
 
     echo "+ create temporary keychain"
-    security create-keychain -p mysecretpassword "${KEYCHAIN}"
+    security create-keychain -p pwd "${KEYCHAIN}"
     security set-keychain-settings -lut 21600 "${KEYCHAIN}"
-    security unlock-keychain -p mysecretpassword "${KEYCHAIN}"
-    security list-keychains -s "$(security list-keychains | xargs)" "${KEYCHAIN}"
-    # security list-keychains -d user
-    # security show-keychain-info ${KEYCHAIN}
+    security unlock-keychain -p pwd "${KEYCHAIN}"
+    security show-keychain-info "${KEYCHAIN}"
 
     echo "+ import certificate to keychain"
-    security import "${CERTIFICATE_P12}" -k "${KEYCHAIN}" -P "${CERTIFICATE_OSX_PASSWORD}" -T /usr/bin/codesign
-    security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k mysecretpassword "${KEYCHAIN}" > /dev/null
-    # security find-identity "${KEYCHAIN}"
+    security import "${CERTIFICATE_P12}" -k "${KEYCHAIN}" -P "${CERTIFICATE_OSX_P12_PASSWORD}" -T /usr/bin/codesign
+
+    CODESIGN_IDENTITY="$( security find-identity -v -p codesigning "${KEYCHAIN}" | grep -oEi "([0-9A-F]{40})" | head -n 1 )"
+    export CODESIGN_IDENTITY
+
+    security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k pwd "${KEYCHAIN}" > /dev/null
+    security find-identity "${KEYCHAIN}"
 
     echo "+ signing"
-    if [[ "${VSCODE_QUALITY}" == "insider" ]]; then
-      codesign --deep --force --verbose --sign "${CERTIFICATE_OSX_ID}" "${APP_NAME} - Insiders.app"
-    else
-      codesign --deep --force --verbose --sign "${CERTIFICATE_OSX_ID}" "${APP_NAME}.app"
-    fi
+    DEBUG="electron-osx-sign*" node vscode/build/darwin/sign.js "$( pwd )"
+
+    echo "+ notarize"
+
+    cd "VSCode-darwin-${VSCODE_ARCH}"
+    ZIP_FILE="./${APP_NAME}-darwin-${VSCODE_ARCH}-${RELEASE_VERSION}.zip"
+
+    zip -r -X -y "${ZIP_FILE}" ./*.app
+
+    xcrun notarytool store-credentials "notarytool-profile" --apple-id "${CERTIFICATE_OSX_ID}" --password "${CERTIFICATE_OSX_APP_PASSWORD}"
+    xcrun notarytool submit "${ZIP_FILE}" ---keychain-profile "notarytool-profile"  --wait
+
+    echo "+ attach staple"
+    xcrun stapler staple ./*.app
+
+    rm "${ZIP_FILE}"
 
     cd ..
   fi