build: Notarize the app

.travis.yml

@@ -4,7 +4,7 @@ os:
 - linux
 - osx
 dist: trusty
-osx_image: xcode8.3
+osx_image: xcode10
 sudo: false
 
 cache:

forge.config.js

@@ -3,7 +3,8 @@ const package = require('./package.json');
 
 module.exports = {
   hooks: {
-    generateAssets: require('./tools/generateAssets')
+    generateAssets: require('./tools/generateAssets'),
+    postPackage: require('./tools/notarize')
   },
   packagerConfig: {
     asar: false,
@@ -12,10 +13,15 @@ module.exports = {
     appCategoryType: 'public.app-category.developer-tools',
     win32metadata: {
       CompanyName: 'Felix Rieseberg',
-      OriginalFilename: 'windows95',
+      OriginalFilename: 'windows95'
     },
     osxSign: {
-      identity: 'Developer ID Application: Felix Rieseberg (LT94ZKYDCJ)'
+      identity: 'Developer ID Application: Felix Rieseberg (LT94ZKYDCJ)',
+      'hardened-runtime': true,
+      'gatekeeper-assess': false,
+      'entitlements': 'static/entitlements.plist',
+      'entitlements-inherit': 'static/entitlements.plist',
+      'signature-flags': 'library'
     },
     ignore: [
       /\/assets(\/?)/,

package.json

@@ -39,6 +39,7 @@
     "@types/react": "^16.9.13",
     "@types/react-dom": "^16.9.4",
     "electron": "7.1.2",
+    "electron-notarize": "^0.2.1",
     "less": "^3.10.3",
     "node-abi": "^2.13.0",
     "parcel-bundler": "^1.12.4",

static/entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+  </dict>
+</plist>

tools/notarize.js

@@ -0,0 +1,29 @@
+const { notarize } = require('electron-notarize');
+const path = require('path');
+
+const buildOutput = path.resolve(
+  __dirname,
+  '..',
+  'out',
+  'windows95-darwin-x64',
+  'windows95.app'
+);
+
+module.exports = function () {
+  if (process.platform !== 'darwin') {
+    console.log('Not a Mac; skipping notarization');
+    return;
+  }
+
+  console.log('Notarizing...');
+
+  return notarize({
+    appBundleId: 'com.felixrieseberg.windows95',
+    appPath: buildOutput,
+    appleId: process.env.APPLE_ID,
+    appleIdPassword: process.env.APPLE_ID_PASSWORD
+  }).catch((e) => {
+    console.error(e);
+    throw e;
+  });
+}