mirror of
https://github.com/mountain-loop/yaak.git
synced 2026-11-08 02:14:53 -06:00
73 lines
2.5 KiB
JavaScript
73 lines
2.5 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
/**
|
|
* Builds Yaak Proxy as a `.app` with its privileged helper inside, signed when a Developer
|
|
* ID Application identity is in the keychain (or named by APPLE_SIGNING_IDENTITY). The helper
|
|
* only registers from a signed bundle, and only answers an app signed by the same team, so
|
|
* the team is taken from the identity and built into the helper.
|
|
*/
|
|
|
|
import { execFileSync, spawnSync } from "child_process";
|
|
import path from "path";
|
|
import { fileURLToPath } from "url";
|
|
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
const rootDir = path.join(__dirname, "..");
|
|
|
|
/**
|
|
* The keychain's Developer ID Application identities, by hash, since names can repeat. With
|
|
* `wanted`, only the one with that hash or name.
|
|
*/
|
|
function findIdentity(wanted) {
|
|
try {
|
|
const output = execFileSync("security", ["find-identity", "-v", "-p", "codesigning"]);
|
|
const pattern =
|
|
/^\s*\d+\) ([0-9A-F]{40}) "(Developer ID Application: .+ \(([A-Z0-9]{10})\))"$/gm;
|
|
for (const match of output.toString().matchAll(pattern)) {
|
|
if (wanted == null || wanted === match[1] || wanted === match[2]) {
|
|
return { hash: match[1], name: match[2], team: match[3] };
|
|
}
|
|
}
|
|
return null;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
const env = { ...process.env };
|
|
const args = ["--bundles", "app", "--config", "crates-tauri/yaak-app-proxy/tauri.bundle.conf.json"];
|
|
|
|
if (env.APPLE_SIGNING_IDENTITY) {
|
|
console.log("Signing with APPLE_SIGNING_IDENTITY");
|
|
const team =
|
|
env.APPLE_SIGNING_IDENTITY.match(/\(([A-Z0-9]{10})\)$/)?.[1] ??
|
|
findIdentity(env.APPLE_SIGNING_IDENTITY)?.team;
|
|
env.YAAK_PROXY_TEAM_ID ??= env.APPLE_TEAM_ID ?? team;
|
|
if (env.YAAK_PROXY_TEAM_ID == null) {
|
|
console.error(
|
|
"Could not tell the signing team, which the helper must know. Set YAAK_PROXY_TEAM_ID or APPLE_TEAM_ID.",
|
|
);
|
|
process.exit(1);
|
|
}
|
|
} else {
|
|
const identity = process.platform === "darwin" ? findIdentity() : null;
|
|
if (identity) {
|
|
console.log(`Signing with "${identity.name}"`);
|
|
env.APPLE_SIGNING_IDENTITY = identity.hash;
|
|
env.YAAK_PROXY_TEAM_ID ??= identity.team;
|
|
} else {
|
|
console.warn(
|
|
"No Developer ID Application identity found, so the bundle is unsigned and its helper cannot be registered",
|
|
);
|
|
args.push("--no-sign");
|
|
}
|
|
}
|
|
if (env.YAAK_PROXY_TEAM_ID == null) delete env.YAAK_PROXY_TEAM_ID;
|
|
|
|
const result = spawnSync(
|
|
process.execPath,
|
|
[path.join(__dirname, "run-build.mjs"), "proxy", ...args, ...process.argv.slice(2)],
|
|
{ cwd: rootDir, stdio: "inherit", env },
|
|
);
|
|
process.exit(result.status ?? 1);
|