Merge pull request #8555 from desktop/chore/macos-notarize

add notarization for publishable macOS builds
2024-09-20 16:41:37 +00:00 · 2019-11-05 12:44:00 -08:00 · 2019-11-05 12:44:00 -08:00 · c9fd3e1790
parent 161c439565
commit c9fd3e1790
12 changed files with 214 additions and 35 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -3,7 +3,7 @@ version: 2
 defaults: &defaults
  working_directory: ~/desktop/desktop
  macos:
-    xcode: '9.4.1'
+    xcode: '10.0.0'

 jobs:
  build:
--- a/app/app-info.ts
+++ b/app/app-info.ts
@ -2,14 +2,14 @@ import * as fs from 'fs'
 import * as Path from 'path'

 import { getSHA } from './git-info'
-import { getUpdatesURL, getReleaseChannel } from '../script/dist-info'
+import { getUpdatesURL, getChannel } from '../script/dist-info'

 const projectRoot = Path.dirname(__dirname)

 const devClientId = '3a723b10ac5575cc5bb9'
 const devClientSecret = '22c34d87789a365981ed921352a7b9a8c3f69d54'

-const channel = getReleaseChannel()
+const channel = getChannel()

 export function getCLICommands() {
  return (
--- a/app/package.json
+++ b/app/package.json
@ -3,7 +3,7 @@
  "productName": "GitHub Desktop",
  "bundleID": "com.github.GitHubClient",
  "companyName": "GitHub, Inc.",
-  "version": "2.2.2",
+  "version": "2.2.3-test5",
  "main": "./main.js",
  "repository": {
    "type": "git",
--- a/app/webpack.common.ts
+++ b/app/webpack.common.ts
@ -3,10 +3,10 @@ import * as HtmlWebpackPlugin from 'html-webpack-plugin'
 import * as CleanWebpackPlugin from 'clean-webpack-plugin'
 import * as webpack from 'webpack'
 import * as merge from 'webpack-merge'
-import { getReleaseChannel } from '../script/dist-info'
+import { getChannel } from '../script/dist-info'
 import { getReplacements } from './app-info'

-const channel = getReleaseChannel()
+const channel = getChannel()

 export const externals = ['7zip']
 if (channel === 'development') {
--- a/changelog.json
+++ b/changelog.json
@ -1,5 +1,10 @@
 {
  "releases": {
+    "2.2.3-test5": ["Testing entitlements + notarization for mac app"],
+    "2.2.3-test4": ["Testing entitlements + notarization for mac app"],
+    "2.2.3-test3": ["Testing entitlements + notarization for mac app"],
+    "2.2.3-test2": ["Testing notarization for mac app"],
+    "2.2.3-test1": ["Testing notarization for mac app"],
    "2.2.2": [
      "[Added] Onboarding tutorial animations help guide users to the next action - #8487",
      "[Added] Prompt users to re-authenticate if they are unable to push changes to a workflow file - #8357",
--- a/package.json
+++ b/package.json
@ -15,7 +15,7 @@
    "test:setup": "ts-node -P script/tsconfig.json script/test-setup.ts",
    "test:review": "ts-node  -P script/tsconfig.json script/test-review.ts",
    "test:report": "codecov --disable=gcov -f app/coverage/coverage-final.json",
-    "postinstall": "ts-node -P script/tsconfig.json script/post-install.ts",
+    "postinstall": "patch-package && ts-node -P script/tsconfig.json script/post-install.ts",
    "start": "cross-env NODE_ENV=development ts-node -P script/tsconfig.json script/start.ts",
    "start:prod": "cross-env NODE_ENV=production ts-node -P script/tsconfig.json script/start.ts",
    "compile:dev": "cross-env NODE_ENV=development parallel-webpack --config app/webpack.development.ts",
@ -55,6 +55,7 @@
    "yarn": ">= 1.9"
  },
  "dependencies": {
+    "@primer/octicons": "^9.1.0",
    "@typescript-eslint/eslint-plugin": "1.10.2",
    "@typescript-eslint/parser": "1.10.2",
    "airbnb-browser-shims": "^3.0.0",
@ -93,8 +94,8 @@
    "legal-eagle": "0.16.0",
    "mini-css-extract-plugin": "^0.4.0",
    "node-sass": "^4.12.0",
-    "@primer/octicons": "^9.1.0",
    "parallel-webpack": "^2.3.0",
+    "patch-package": "^6.2.0",
    "prettier": "1.16.0",
    "request": "^2.72.0",
    "rimraf": "^2.5.2",
--- a/patches/electron-notarize+0.0.5.patch
+++ b/patches/electron-notarize+0.0.5.patch
@ -0,0 +1,42 @@
+# see https://github.com/desktop/electron-notarize/commit/2795347201ab8d32d1240147cebdd68c4a94d8fc for the underlying change for this patch
+diff --git a/node_modules/electron-notarize/lib/index.js b/node_modules/electron-notarize/lib/index.js
+index f57aaf7..a5211f2 100644
+--- a/node_modules/electron-notarize/lib/index.js
+++ b/node_modules/electron-notarize/lib/index.js
+@@ -120,17 +120,21 @@ function waitForNotarize(opts) {
+                         ])];
+                 case 1:
+                     result = _a.sent();
+-                    if (result.code !== 0) {
+-                        throw new Error("Failed to check status of notarization request: " + opts.uuid + "\n\n" + result.output);
+-                    }
+-                    notarizationInfo = helpers_1.parseNotarizationInfo(result.output);
+-                    if (!(notarizationInfo.status === 'in progress')) return [3 /*break*/, 3];
+-                    d('still in progress, waiting 30 seconds');
+                    if (!(result.code !== 0)) return [3 /*break*/, 3];
+                    d("Failed to check status of notarization request: " + opts.uuid + "\n\n" + result.output);
+                     return [4 /*yield*/, new Promise(function (r) { return setTimeout(r, 30000); })];
+                 case 2:
+                     _a.sent();
+                     return [2 /*return*/, waitForNotarize(opts)];
+                 case 3:
+                    notarizationInfo = helpers_1.parseNotarizationInfo(result.output);
+                    if (!(notarizationInfo.status === 'in progress')) return [3 /*break*/, 5];
+                    d('still in progress, waiting 30 seconds');
+                    return [4 /*yield*/, new Promise(function (r) { return setTimeout(r, 30000); })];
+                case 4:
+                    _a.sent();
+                    return [2 /*return*/, waitForNotarize(opts)];
+                case 5:
+                     d('notarzation done with info:', notarizationInfo);
+                     if (notarizationInfo.status === 'invalid') {
+                         d('notarization failed');
+diff --git a/node_modules/electron-notarize/lib/index.js.map b/node_modules/electron-notarize/lib/index.js.map
+index e6a9892..7199ad1 100644
+--- a/node_modules/electron-notarize/lib/index.js.map
+++ b/node_modules/electron-notarize/lib/index.js.map
+@@ -1 +1 @@
+-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6BAA+B;AAC/B,2BAA6B;AAE7B,iCAAgC;AAChC,qCAA2E;AAE3E,IAAM,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAqBrC,SAAsB,aAAa,CAAC,IAA0B;;;;;;oBAC5D,CAAC,CAAC,oCAAoC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC/C,qBAAM,qBAAW,CAAiB,UAAO,GAAG;;;;;wCAC3C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,SAAM,CAAC,CAAC;wCAChF,CAAC,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;wCACpB,qBAAM,aAAK,CAC3B,KAAK,EACL;gDACE,IAAI;gDACJ,IAAI;gDACJ,OAAO;gDACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;6CAC5B,EACD;gDACE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;6CAChC,CACF,EAAA;;wCAXK,SAAS,GAAG,SAWjB;wCACD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE;4CACxB,MAAM,IAAI,KAAK,CAAC,kDAAgD,SAAS,CAAC,IAAI,YAAO,SAAS,CAAC,MAAQ,CAAC,CAAC;yCAC1G;wCACD,CAAC,CAAC,8CAA8C,CAAC,CAAC;wCAEnC,qBAAM,aAAK,CACxB,OAAO,EACP;gDACE,QAAQ;gDACR,gBAAgB;gDAChB,IAAI;gDACJ,OAAO;gDACP,qBAAqB;gDACrB,IAAI,CAAC,WAAW;gDAChB,IAAI;gDACJ,oBAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gDACxB,IAAI;gDACJ,oBAAU,CAAC,IAAI,CAAC,eAAe,CAAC;6CACjC,CACF,EAAA;;wCAdK,MAAM,GAAG,SAcd;wCACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE;4CACrB,MAAM,IAAI,KAAK,CAAC,4DAA0D,MAAM,CAAC,MAAQ,CAAC,CAAC;yCAC5F;wCACD,CAAC,CAAC,gBAAgB,CAAC,CAAC;wCAEd,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wCACjE,IAAI,CAAC,SAAS,EAAE;4CACd,MAAM,IAAI,KAAK,CAAC,+CAA6C,MAAM,CAAC,MAAQ,CAAC,CAAC;yCAC/E;wCAED,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;wCAE/B,sBAAO;gDACL,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;6CACnB,EAAC;;;6BACH,CAAC,EAAA;wBAlDF,sBAAO,SAkDL,EAAC;;;;CACJ;AArDD,sCAqDC;AAED,SAAsB,eAAe,CAAC,IAAyB;;;;;;oBAC7D,CAAC,CAAC,+BAA+B,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/B,qBAAM,aAAK,CACxB,OAAO,EACP;4BACE,QAAQ;4BACR,qBAAqB;4BACrB,IAAI,CAAC,IAAI;4BACT,IAAI;4BACJ,oBAAU,CAAC,IAAI,CAAC,OAAO,CAAC;4BACxB,IAAI;4BACJ,oBAAU,CAAC,IAAI,CAAC,eAAe,CAAC;yBACjC,CACF,EAAA;;oBAXK,MAAM,GAAG,SAWd;oBACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE;wBACrB,MAAM,IAAI,KAAK,CAAC,qDAAmD,IAAI,CAAC,IAAI,YAAO,MAAM,CAAC,MAAQ,CAAC,CAAC;qBACrG;oBACK,gBAAgB,GAAG,+BAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;yBAE1D,CAAA,gBAAgB,CAAC,MAAM,KAAK,aAAa,CAAA,EAAzC,wBAAyC;oBAC3C,CAAC,CAAC,uCAAuC,CAAC,CAAC;oBAC3C,qBAAM,IAAI,OAAO,CAAC,UAAA,CAAC,IAAI,OAAA,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAApB,CAAoB,CAAC,EAAA;;oBAA5C,SAA4C,CAAC;oBAC7C,sBAAO,eAAe,CAAC,IAAI,CAAC,EAAC;;oBAG/B,CAAC,CAAC,6BAA6B,EAAE,gBAAgB,CAAC,CAAC;oBAEnD,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE;wBACzC,CAAC,CAAC,qBAAqB,CAAC,CAAC;wBACzB,MAAM,IAAI,KAAK,CAAC,8FAEL,gBAAgB,CAAC,UAAU,IAAI,SAAS,qBAC5C,gBAAgB,CAAC,aAAa,IAAI,YAAY,iBACjD,gBAAgB,CAAC,UAAY,CAAC,CAAC;qBACpC;oBAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE;wBACzC,MAAM,IAAI,KAAK,CAAC,yCAAsC,gBAAgB,CAAC,MAAM,OAAG,CAAC,CAAC;qBACnF;oBAED,CAAC,CAAC,6BAA6B,CAAC,CAAC;oBACjC,sBAAO;;;;CACR;AA1CD,0CA0CC;AAED,SAAsB,SAAS,CAAC,IAA2B;;;;;;oBACzD,CAAC,CAAC,2BAA2B,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC9B,qBAAM,aAAK,CACxB,OAAO,EACP;4BACE,SAAS;4BACT,QAAQ;4BACR,IAAI;4BACJ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;yBAC5B,EACD;4BACE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;yBAChC,CACF,EAAA;;oBAXK,MAAM,GAAG,SAWd;oBAED,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE;wBACrB,MAAM,IAAI,KAAK,CAAC,kDAAgD,MAAM,CAAC,IAAI,YAAO,MAAM,CAAC,MAAQ,CAAC,CAAC;qBACpG;oBAED,CAAC,CAAC,kBAAkB,CAAC,CAAC;oBACtB,sBAAO;;;;CACR;AArBD,8BAqBC;AAED,SAAsB,QAAQ,CAAC,EAKb;QAJhB,4BAAW,EACX,oBAAO,EACP,oBAAO,EACP,oCAAe;;;;;wBAEE,qBAAM,aAAa,CAAC;wBACnC,WAAW,aAAA;wBACX,OAAO,SAAA;wBACP,OAAO,SAAA;wBACP,eAAe,iBAAA;qBAChB,CAAC,EAAA;;oBALM,IAAI,GAAK,CAAA,SAKf,CAAA,KALU;oBAMZ,qBAAM,eAAe,CAAC,EAAE,IAAI,MAAA,EAAE,OAAO,SAAA,EAAE,eAAe,iBAAA,EAAE,CAAC,EAAA;;oBAAzD,SAAyD,CAAC;oBAC1D,qBAAM,SAAS,CAAC,EAAE,OAAO,SAAA,EAAE,CAAC,EAAA;;oBAA5B,SAA4B,CAAC;;;;;CAC9B;AAdD,4BAcC"}
+\ No newline at end of file
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6BAA+B;AAC/B,2BAA6B;AAE7B,iCAAgC;AAChC,qCAA2E;AAE3E,IAAM,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAqBrC,SAAsB,aAAa,CAAC,IAA0B;;;;;;oBAC5D,CAAC,CAAC,oCAAoC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC/C,qBAAM,qBAAW,CAAiB,UAAO,GAAG;;;;;wCAC3C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,SAAM,CAAC,CAAC;wCAChF,CAAC,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;wCACpB,qBAAM,aAAK,CAC3B,KAAK,EACL;gDACE,IAAI;gDACJ,IAAI;gDACJ,OAAO;gDACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;6CAC5B,EACD;gDACE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;6CAChC,CACF,EAAA;;wCAXK,SAAS,GAAG,SAWjB;wCACD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE;4CACxB,MAAM,IAAI,KAAK,CAAC,kDAAgD,SAAS,CAAC,IAAI,YAAO,SAAS,CAAC,MAAQ,CAAC,CAAC;yCAC1G;wCACD,CAAC,CAAC,8CAA8C,CAAC,CAAC;wCAEnC,qBAAM,aAAK,CACxB,OAAO,EACP;gDACE,QAAQ;gDACR,gBAAgB;gDAChB,IAAI;gDACJ,OAAO;gDACP,qBAAqB;gDACrB,IAAI,CAAC,WAAW;gDAChB,IAAI;gDACJ,oBAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gDACxB,IAAI;gDACJ,oBAAU,CAAC,IAAI,CAAC,eAAe,CAAC;6CACjC,CACF,EAAA;;wCAdK,MAAM,GAAG,SAcd;wCACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE;4CACrB,MAAM,IAAI,KAAK,CAAC,4DAA0D,MAAM,CAAC,MAAQ,CAAC,CAAC;yCAC5F;wCACD,CAAC,CAAC,gBAAgB,CAAC,CAAC;wCAEd,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wCACjE,IAAI,CAAC,SAAS,EAAE;4CACd,MAAM,IAAI,KAAK,CAAC,+CAA6C,MAAM,CAAC,MAAQ,CAAC,CAAC;yCAC/E;wCAED,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;wCAE/B,sBAAO;gDACL,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;6CACnB,EAAC;;;6BACH,CAAC,EAAA;wBAlDF,sBAAO,SAkDL,EAAC;;;;CACJ;AArDD,sCAqDC;AAED,SAAsB,eAAe,CAAC,IAAyB;;;;;;oBAC7D,CAAC,CAAC,+BAA+B,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/B,qBAAM,aAAK,CACxB,OAAO,EACP;4BACE,QAAQ;4BACR,qBAAqB;4BACrB,IAAI,CAAC,IAAI;4BACT,IAAI;4BACJ,oBAAU,CAAC,IAAI,CAAC,OAAO,CAAC;4BACxB,IAAI;4BACJ,oBAAU,CAAC,IAAI,CAAC,eAAe,CAAC;yBACjC,CACF,EAAA;;oBAXK,MAAM,GAAG,SAWd;yBACG,CAAA,MAAM,CAAC,IAAI,KAAK,CAAC,CAAA,EAAjB,wBAAiB;oBACnB,CAAC,CAAC,qDAAmD,IAAI,CAAC,IAAI,YAAO,MAAM,CAAC,MAAQ,CAAC,CAAC;oBACtF,qBAAM,IAAI,OAAO,CAAC,UAAA,CAAC,IAAI,OAAA,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAApB,CAAoB,CAAC,EAAA;;oBAA5C,SAA4C,CAAC;oBAC7C,sBAAO,eAAe,CAAC,IAAI,CAAC,EAAC;;oBAEzB,gBAAgB,GAAG,+BAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;yBAE1D,CAAA,gBAAgB,CAAC,MAAM,KAAK,aAAa,CAAA,EAAzC,wBAAyC;oBAC3C,CAAC,CAAC,uCAAuC,CAAC,CAAC;oBAC3C,qBAAM,IAAI,OAAO,CAAC,UAAA,CAAC,IAAI,OAAA,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAApB,CAAoB,CAAC,EAAA;;oBAA5C,SAA4C,CAAC;oBAC7C,sBAAO,eAAe,CAAC,IAAI,CAAC,EAAC;;oBAG/B,CAAC,CAAC,6BAA6B,EAAE,gBAAgB,CAAC,CAAC;oBAEnD,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE;wBACzC,CAAC,CAAC,qBAAqB,CAAC,CAAC;wBACzB,MAAM,IAAI,KAAK,CAAC,8FAEL,gBAAgB,CAAC,UAAU,IAAI,SAAS,qBAC5C,gBAAgB,CAAC,aAAa,IAAI,YAAY,iBACjD,gBAAgB,CAAC,UAAY,CAAC,CAAC;qBACpC;oBAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE;wBACzC,MAAM,IAAI,KAAK,CAAC,yCAAsC,gBAAgB,CAAC,MAAM,OAAG,CAAC,CAAC;qBACnF;oBAED,CAAC,CAAC,6BAA6B,CAAC,CAAC;oBACjC,sBAAO;;;;CACR;AA5CD,0CA4CC;AAED,SAAsB,SAAS,CAAC,IAA2B;;;;;;oBACzD,CAAC,CAAC,2BAA2B,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC9B,qBAAM,aAAK,CACxB,OAAO,EACP;4BACE,SAAS;4BACT,QAAQ;4BACR,IAAI;4BACJ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;yBAC5B,EACD;4BACE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;yBAChC,CACF,EAAA;;oBAXK,MAAM,GAAG,SAWd;oBAED,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE;wBACrB,MAAM,IAAI,KAAK,CAAC,kDAAgD,MAAM,CAAC,IAAI,YAAO,MAAM,CAAC,MAAQ,CAAC,CAAC;qBACpG;oBAED,CAAC,CAAC,kBAAkB,CAAC,CAAC;oBACtB,sBAAO;;;;CACR;AArBD,8BAqBC;AAED,SAAsB,QAAQ,CAAC,EAKb;QAJhB,4BAAW,EACX,oBAAO,EACP,oBAAO,EACP,oCAAe;;;;;wBAEE,qBAAM,aAAa,CAAC;wBACnC,WAAW,aAAA;wBACX,OAAO,SAAA;wBACP,OAAO,SAAA;wBACP,eAAe,iBAAA;qBAChB,CAAC,EAAA;;oBALM,IAAI,GAAK,CAAA,SAKf,CAAA,KALU;oBAMZ,qBAAM,eAAe,CAAC,EAAE,IAAI,MAAA,EAAE,OAAO,SAAA,EAAE,eAAe,iBAAA,EAAE,CAAC,EAAA;;oBAAzD,SAAyD,CAAC;oBAC1D,qBAAM,SAAS,CAAC,EAAE,OAAO,SAAA,EAAE,CAAC,EAAA;;oBAA5B,SAA4B,CAAC;;;;;CAC9B;AAdD,4BAcC"}
+\ No newline at end of file
--- a/script/build.ts
+++ b/script/build.ts
@ -37,18 +37,26 @@ import {
  getProductName,
 } from '../app/package-info'

-import { getReleaseChannel, getDistRoot, getExecutableName } from './dist-info'
+import {
+  getChannel,
+  getDistRoot,
+  getExecutableName,
+  isPublishable,
+} from './dist-info'
 import { isRunningOnFork, isCircleCI } from './build-platforms'

 import { updateLicenseDump } from './licenses/update-license-dump'
 import { verifyInjectedSassVariables } from './validate-sass/validate-all'

 const projectRoot = path.join(__dirname, '..')
+const entitlementsPath = `${projectRoot}/script/entitlements.plist`
+const extendInfoPath = `${projectRoot}/script/info.plist`
 const outRoot = path.join(projectRoot, 'out')

-const isPublishableBuild = getReleaseChannel() !== 'development'
+const isPublishableBuild = isPublishable()
+const isDevelopmentBuild = getChannel() === 'development'

-console.log(`Building for ${getReleaseChannel()}…`)
+console.log(`Building for ${getChannel()}…`)

 console.log('Removing old distribution…')
 fs.removeSync(getDistRoot())
@ -78,7 +86,7 @@ verifyInjectedSassVariables(outRoot)
      'Error verifying the Sass variables in the rendered app. This is fatal for a published build.'
    )

-    if (isPublishableBuild) {
+    if (!isDevelopmentBuild) {
      process.exit(1)
    }
  })
@ -90,7 +98,7 @@ verifyInjectedSassVariables(outRoot)
      )
      console.error(err)

-      if (isPublishableBuild) {
+      if (!isDevelopmentBuild) {
        process.exit(1)
      }
    })
@ -117,6 +125,9 @@ interface IPackageAdditionalOptions {
    readonly name: string
    readonly schemes: ReadonlyArray<string>
  }>
+  readonly osxSign: packager.ElectronOsXSignOptions & {
+    readonly hardenedRuntime?: boolean
+  }
 }

 function packageApp() {
@ -147,6 +158,21 @@ function packageApp() {
    )
  }

+  // get notarization deets, unless we're not going to publish this
+  const notarizationCredentials = isPublishableBuild
+    ? getNotarizationCredentials()
+    : undefined
+  if (
+    isPublishableBuild &&
+    isCircleCI() &&
+    notarizationCredentials === undefined
+  ) {
+    // we can't publish a mac build without these
+    throw new Error(
+      'Unable to retreive appleId and/or appleIdPassword to notarize macOS build'
+    )
+  }
+
  const options: packager.Options & IPackageAdditionalOptions = {
    name: getExecutableName(),
    platform: toPackagePlatform(process.platform),
@ -171,12 +197,18 @@ function packageApp() {
    appBundleId: getBundleID(),
    appCategoryType: 'public.app-category.developer-tools',
    darwinDarkModeSupport: true,
-    osxSign: true,
+    osxSign: {
+      hardenedRuntime: true,
+      entitlements: entitlementsPath,
+      'entitlements-inherit': entitlementsPath,
+      type: isPublishableBuild ? 'distribution' : 'development',
+    },
+    osxNotarize: notarizationCredentials,
    protocols: [
      {
        name: getBundleID(),
        schemes: [
-          isPublishableBuild
+          !isDevelopmentBuild
            ? 'x-github-desktop-auth'
            : 'x-github-desktop-dev-auth',
          'x-github-client',
@ -184,7 +216,7 @@ function packageApp() {
        ],
      },
    ],
-    extendInfo: `${projectRoot}/script/info.plist`,
+    extendInfo: extendInfoPath,

    // Windows
    win32metadata: {
@ -263,7 +295,7 @@ function copyDependencies() {
  const oldDevDependencies = originalPackage.devDependencies
  const newDevDependencies: PackageLookup = {}

-  if (!isPublishableBuild) {
+  if (isDevelopmentBuild) {
    for (const name of Object.keys(oldDevDependencies)) {
      const spec = oldDevDependencies[name]
      if (externals.indexOf(name) !== -1) {
@ -280,7 +312,7 @@ function copyDependencies() {
    devDependencies: newDevDependencies,
  })

-  if (isPublishableBuild) {
+  if (!isDevelopmentBuild) {
    delete updatedPackage.devDependencies
  }

@ -299,7 +331,7 @@ function copyDependencies() {
    cp.execSync('yarn install', { cwd: outRoot, env: process.env })
  }

-  if (!isPublishableBuild) {
+  if (isDevelopmentBuild) {
    console.log(
      '  Installing 7zip (dependency for electron-devtools-installer)'
    )
@ -410,3 +442,17 @@ ${licenseText}`
  // sweep up the choosealicense directory as the important bits have been bundled in the app
  fs.removeSync(chooseALicense)
 }
+
+function getNotarizationCredentials():
+  | packager.ElectronNotarizeOptions
+  | undefined {
+  const appleId = process.env.APPLE_ID
+  const appleIdPassword = process.env.APPLE_ID_PASSWORD
+  if (appleId === undefined || appleIdPassword === undefined) {
+    return undefined
+  }
+  return {
+    appleId,
+    appleIdPassword,
+  }
+}
--- a/script/dist-info.ts
+++ b/script/dist-info.ts
@ -9,6 +9,8 @@ const version = getVersion()

 const projectRoot = Path.join(__dirname, '..')

+const publishChannels = ['production', 'test', 'beta']
+
 export function getDistRoot() {
  return Path.join(projectRoot, 'dist')
 }
@ -98,13 +100,26 @@ export function getBundleSizes() {
  return { rendererSize: rendererStats.size, mainSize: mainStats.size }
 }

-export function getReleaseChannel() {
+export function isPublishable(): boolean {
+  const channelFromBranch = getChannelFromBranch()
+  return channelFromBranch !== undefined
+    ? publishChannels.includes(channelFromBranch)
+    : false
+}
+
+export function getChannel() {
+  const channelFromBranch = getChannelFromBranch()
+  return channelFromBranch !== undefined
+    ? channelFromBranch
+    : process.env.NODE_ENV || 'development'
+}
+
+function getChannelFromBranch(): string | undefined {
  // Branch name format: __release-CHANNEL-DEPLOY_ID
  const pieces = getReleaseBranchName().split('-')
  if (pieces.length < 3 || pieces[0] !== '__release') {
-    return process.env.NODE_ENV || 'development'
+    return
  }
-
  return pieces[1]
 }

@ -119,12 +134,12 @@ export function getReleaseSHA() {
 }

 export function getUpdatesURL() {
-  return `https://central.github.com/api/deployments/desktop/desktop/latest?version=${version}&env=${getReleaseChannel()}`
+  return `https://central.github.com/api/deployments/desktop/desktop/latest?version=${version}&env=${getChannel()}`
 }

 export function shouldMakeDelta() {
  // Only production and beta channels include deltas. Test releases aren't
  // necessarily sequential so deltas wouldn't make sense.
  const channelsWithDeltas = ['production', 'beta']
-  return channelsWithDeltas.indexOf(getReleaseChannel()) > -1
+  return channelsWithDeltas.indexOf(getChannel()) > -1
 }
--- a/script/entitlements.plist
+++ b/script/entitlements.plist
@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+  </dict>
+</plist>
--- a/script/publish.ts
+++ b/script/publish.ts
@ -1,10 +1,9 @@
-const PUBLISH_CHANNELS = ['production', 'test', 'beta']
 import * as distInfo from './dist-info'
 import * as gitInfo from '../app/git-info'
 import * as packageInfo from '../app/package-info'
 import * as platforms from './build-platforms'

-if (PUBLISH_CHANNELS.indexOf(distInfo.getReleaseChannel()) < 0) {
+if (!distInfo.isPublishable()) {
  console.log('Not a publishable build. Skipping publish.')
  process.exit(0)
 }
@ -40,7 +39,7 @@ function getSecret() {
  }

  throw new Error(
-    `Unable to get deployment seret environment variable. Deployment aborting...`
+    `Unable to get deployment secret environment variable. Deployment aborting...`
  )
 }

--- a/yarn.lock
+++ b/yarn.lock
@ -206,9 +206,9 @@
  integrity sha512-pCS41/Odn6GMQyqnt8aPTSTQFGriAryYQwVONKk1QhUEhulxueLPE1kDNqDOuJqiv34VLVWXxF4I1EKz3+ftzQ==

 "@types/electron-packager@^13.0.0":
-  version "13.0.0"
-  resolved "https://registry.yarnpkg.com/@types/electron-packager/-/electron-packager-13.0.0.tgz#d391366bc9722587f4c5e254f4071a2c71fc960c"
-  integrity sha512-Q0e/ja/TfSSPM5rV9RxaPz8yew7dWSSufFsziw08hCZYQuafXkbhxs83UvQ/Hte3+c3U+ogLQKXFasGn1umn5A==
+  version "13.0.1"
+  resolved "https://registry.yarnpkg.com/@types/electron-packager/-/electron-packager-13.0.1.tgz#55ec6fdfac1c2db86adcbfbc8e486b0ff8c2a8ee"
+  integrity sha512-K9CCdarh7JdWvIIWM+xCWoROYXgcRFmX3OgjgwaFIFOb87bMTvtQVLyVi8LO0NroURadaae5L1AaK1BxKhytoA==
  dependencies:
    "@types/node" "*"

@ -380,9 +380,9 @@
  integrity sha512-fMl88ZoZXOB7VKazJ6wUMpZc9QIn+jcigSFRf2K/rrw4DcXn+/uGxlWX8DDlcE7JkwgIZ7BDH+JgxZPlc/Ap3g==

 "@types/node@*":
-  version "10.1.4"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-10.1.4.tgz#606651d3f8a8bec08b8cb262161aab9209f4a29d"
-  integrity sha512-GpQxofkdlHYxjHad98UUdNoMO7JrmzQZoAaghtNg14Gwg7YkohcrCoJEcEMSgllx4VIZ+mYw7ZHjfaeIagP/rg==
+  version "12.12.5"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-12.12.5.tgz#66103d2eddc543d44a04394abb7be52506d7f290"
+  integrity sha512-KEjODidV4XYUlJBF3XdjSH5FWoMCtO0utnhtdLf1AgeuZLOrRbvmU/gaRCVg7ZaQDjVf3l84egiY0mRNe5xE4A==

 "@types/node@10.12.18":
  version "10.12.18"
@ -775,6 +775,11 @@
    "@webassemblyjs/wast-parser" "1.4.3"
    long "^3.2.0"

+"@yarnpkg/lockfile@^1.1.0":
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/@yarnpkg/lockfile/-/lockfile-1.1.0.tgz#e77a97fbd345b76d83245edcd17d393b1b41fb31"
+  integrity sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==
+
 abab@^2.0.0:
  version "2.0.0"
  resolved "https://registry.yarnpkg.com/abab/-/abab-2.0.0.tgz#aba0ab4c5eee2d4c79d3487d85450fb2376ebb0f"
@ -2371,6 +2376,11 @@ ci-info@^1.5.0:
  resolved "https://registry.yarnpkg.com/ci-info/-/ci-info-1.6.0.tgz#2ca20dbb9ceb32d4524a683303313f0304b1e497"
  integrity sha512-vsGdkwSCDpWmP80ncATX7iea5DWQemg1UgCW5J8tqjU3lYw4FBYuj89J0CTVomA7BEfvSZd84GmHko+MxFQU2A==

+ci-info@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/ci-info/-/ci-info-2.0.0.tgz#67a9e964be31a51e15e5010d58e6f12834002f46"
+  integrity sha512-5tK7EtrZ0N+OLFMthtqOj4fI2Jeb88C4CAZPu25LDVUgXJ0A3Js4PMGqrn0JU1W0Mh1/Z8wZzYPxqUrXeBboCQ==
+
 cipher-base@^1.0.0, cipher-base@^1.0.1, cipher-base@^1.0.3:
  version "1.0.4"
  resolved "https://registry.yarnpkg.com/cipher-base/-/cipher-base-1.0.4.tgz#8760e4ecc272f4c363532f926d874aae2c1397de"
@ -4160,6 +4170,14 @@ find-up@^3.0.0:
  dependencies:
    locate-path "^3.0.0"

+find-yarn-workspace-root@^1.2.1:
+  version "1.2.1"
+  resolved "https://registry.yarnpkg.com/find-yarn-workspace-root/-/find-yarn-workspace-root-1.2.1.tgz#40eb8e6e7c2502ddfaa2577c176f221422f860db"
+  integrity sha512-dVtfb0WuQG+8Ag2uWkbG79hOUzEsRrhBzgfn86g2sJPkzmcpGdghbNTfUKGTxymFrY/tLIodDzLoW9nOJ4FY8Q==
+  dependencies:
+    fs-extra "^4.0.3"
+    micromatch "^3.1.4"
+
 flat-cache@^2.0.1:
  version "2.0.1"
  resolved "https://registry.yarnpkg.com/flat-cache/-/flat-cache-2.0.1.tgz#5d296d6f04bda44a4630a301413bdbc2ec085ec0"
@ -4310,7 +4328,7 @@ fs-extra@^2.0.0:
    graceful-fs "^4.1.2"
    jsonfile "^2.1.0"

-fs-extra@^4.0.0, fs-extra@^4.0.1:
+fs-extra@^4.0.0, fs-extra@^4.0.1, fs-extra@^4.0.3:
  version "4.0.3"
  resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-4.0.3.tgz#0d852122e5bc5beb453fb028e9c0c9bf36340c94"
  integrity sha512-q6rbdDd1o2mAnQreO7YADIxf/Whx4AHBiRf6d+/cVT8h44ss+lHgxf1FemcqDnQt9X3ct4McHr+JMGlYSsK7Cg==
@ -4328,7 +4346,7 @@ fs-extra@^6.0.0:
    jsonfile "^4.0.0"
    universalify "^0.1.0"

-fs-extra@^7.0.0:
+fs-extra@^7.0.0, fs-extra@^7.0.1:
  version "7.0.1"
  resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-7.0.1.tgz#4f189c44aa123b895f722804f55ea23eadc348e9"
  integrity sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==
@ -5158,6 +5176,13 @@ is-ci@^1.2.0:
  dependencies:
    ci-info "^1.5.0"

+is-ci@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/is-ci/-/is-ci-2.0.0.tgz#6bc6334181810e04b5c22b3d589fdca55026404c"
+  integrity sha512-YfJT7rkpQB0updsdHLGWrvhBJfcfzNNawYDNIyQXJz0IViGf75O8EBPKSdvw2rF+LGCsX4FZ8tcr3b19LcZq4w==
+  dependencies:
+    ci-info "^2.0.0"
+
 is-data-descriptor@^0.1.4:
  version "0.1.4"
  resolved "https://registry.yarnpkg.com/is-data-descriptor/-/is-data-descriptor-0.1.4.tgz#0b5ee648388e2c860282e793f1856fec3f301b56"
@ -6254,6 +6279,13 @@ klaw-sync@^3.0.0:
  dependencies:
    graceful-fs "^4.1.11"

+klaw-sync@^6.0.0:
+  version "6.0.0"
+  resolved "https://registry.yarnpkg.com/klaw-sync/-/klaw-sync-6.0.0.tgz#1fd2cfd56ebb6250181114f0a581167099c2b28c"
+  integrity sha512-nIeuVSzdCCs6TDPTqI8w1Yre34sSq7AkZ4B3sfOBbI2CgVSB4Du4aLQijFU2+lhAFCwt9+42Hel6lQNIv6AntQ==
+  dependencies:
+    graceful-fs "^4.1.11"
+
 klaw@^1.0.0:
  version "1.3.1"
  resolved "https://registry.yarnpkg.com/klaw/-/klaw-1.3.1.tgz#4088433b46b3b1ba259d78785d8e96f73ba02439"
@ -7564,6 +7596,25 @@ pascalcase@^0.1.1:
  resolved "https://registry.yarnpkg.com/pascalcase/-/pascalcase-0.1.1.tgz#b363e55e8006ca6fe21784d2db22bd15d7917f14"
  integrity sha1-s2PlXoAGym/iF4TS2yK9FdeRfxQ=

+patch-package@^6.2.0:
+  version "6.2.0"
+  resolved "https://registry.yarnpkg.com/patch-package/-/patch-package-6.2.0.tgz#677de858e352b6ca4e6cb48a6efde2cec9fde566"
+  integrity sha512-HWlQflaBBMjLBfOWomfolF8aqsFDeNbSNro1JDUgYqnVvPM5OILJ9DQdwIRiKmGaOsmHvhkl1FYkvv1I9r2ZJw==
+  dependencies:
+    "@yarnpkg/lockfile" "^1.1.0"
+    chalk "^2.4.2"
+    cross-spawn "^6.0.5"
+    find-yarn-workspace-root "^1.2.1"
+    fs-extra "^7.0.1"
+    is-ci "^2.0.0"
+    klaw-sync "^6.0.0"
+    minimist "^1.2.0"
+    rimraf "^2.6.3"
+    semver "^5.6.0"
+    slash "^2.0.0"
+    tmp "^0.0.33"
+    update-notifier "^2.5.0"
+
 path-browserify@0.0.0:
  version "0.0.0"
  resolved "https://registry.yarnpkg.com/path-browserify/-/path-browserify-0.0.0.tgz#a0b870729aae214005b7d5032ec2cbbb0fb4451a"
@ -8562,6 +8613,13 @@ rimraf@2.6.3:
  dependencies:
    glob "^7.1.3"

+rimraf@^2.6.3:
+  version "2.7.1"
+  resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.7.1.tgz#35797f13a7fdadc566142c29d4f07ccad483e3ec"
+  integrity sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==
+  dependencies:
+    glob "^7.1.3"
+
 rimraf@~2.2.6:
  version "2.2.8"
  resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.2.8.tgz#e439be2aaee327321952730f99a8929e4fc50582"
@ -8741,6 +8799,11 @@ semver@^5.5.1:
  resolved "https://registry.yarnpkg.com/semver/-/semver-5.6.0.tgz#7e74256fbaa49c75aa7c7a205cc22799cac80004"
  integrity sha512-RS9R6R35NYgQn++fkDWaOmqGoj4Ek9gGs+DPxNUZKuwE183xjJroKvyo1IzVFeXvUrvmALy6FWD5xrdJT25gMg==

+semver@^5.6.0:
+  version "5.7.1"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-5.7.1.tgz#a954f931aeba508d307bbf069eff0c01c96116f7"
+  integrity sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==
+
 semver@~5.3.0:
  version "5.3.0"
  resolved "https://registry.yarnpkg.com/semver/-/semver-5.3.0.tgz#9b2ce5d3de02d17c6012ad326aa6b4d0cf54f94f"