Notarize your Electron DMG
npm install electron-notarize-dmgElectron Notarize fork for notarizing dmg files
-----------
This fork changes a few lines to allow notarizing dmg files.
- Does not zip the dmg file before sending it to apple.
- Changes appPath parameter to dmgPath.
- added boolean parameter "staple" (default: true)
Keep in mind that stapling the dmg file changes its contents
so you have to update the blockmap and auto update files.
(You can notarize and not staple to keep the file intact.
This would require end users to have connectivity to validate the file)
(Use dmgPath instead of appPath)
``javascript`
return await notarize({
appBundleId: THE APP BUNDLE ID TO USE,
dmgPath: dmgPath,
appleId: THE APPLE ID,
appleIdPassword: PASSWORD,
staple: true,
});
Create a new file and set it as a hook after building all artifacts.
Example:
`
require("dotenv").config();
const { notarize } = require("electron-notarize-dmg");
const config = require("../package.json");
exports.default = async function notarizing(context) {
console.log("Notarizing DMG...");
const dmgPath = context.artifactPaths.find(p => p.endsWith(".dmg"));
if(!dmgPath)
return;
return await notarize({
appBundleId: config.build.appId,
dmgPath: dmgPath,
appleId: process.env.APPLEID,
appleIdPassword: process.env.APPLEIDPASS
});
};
`
The rest of the code is the same.
---------------Original README--------------------
> Notarize your Electron apps seamlessly for macOS
`bashnpm
npm install electron-notarize --save-dev
What is app "notarization"?
From Apple's docs in XCode:
> A notarized app is a macOS app that was uploaded to Apple for processing before it was distributed. When you export a notarized app from Xcode, it code signs the app with a Developer ID certificate and staples a ticket from Apple to the app. The ticket confirms that you previously uploaded the app to Apple.
> On macOS 10.14 and later, the user can launch notarized apps when Gatekeeper is enabled. When the user first launches a notarized app, Gatekeeper looks for the app’s ticket online. If the user is offline, Gatekeeper looks for the ticket that was stapled to the app.
Apple has made this a hard requirement as of 10.15 (Catalina).
Prerequisites
For notarization, you need the following things:
1. Xcode 10 or later installed on your Mac.
2. An Apple Developer account.
3. An app-specific password for your ADC account’s Apple ID.
4. Your app may need to be signed with
and the following entitlements:
1. com.apple.security.cs.allow-jit
2. API
$3
*
Object
* appBundleId String - The app bundle identifier your Electron app is using. E.g. com.github.electron
* String - The absolute path to your .app file
* ascProvider String (optional) - Your Team Short Name.
* There are two methods available: user name with password:
* appleId String - The username of your apple developer account
* appleIdPassword String - The password for your apple developer account
* ... or apiKey with apiIssuer:
* appleApiKey String - Required for JWT authentication. See Note on JWT authentication below.
* appleApiIssuer String - Issuer ID. Required if appleApiKey is specified.Safety when using
appleIdPassword1. Never hard code your password into your packaging scripts, use an environment
variable at a minimum.
2. It is possible to provide a keychain reference instead of your actual password (assuming that you have already logged into
the Application Loader from Xcode). For example:
javascript
const password = @keychain:"Application Loader: ${appleId}";
`Another option is that you can add a new keychain item using either the Keychain Access app or from the command line using the
utility:`bash
security add-generic-password -a "AC_USERNAME" -w -s "AC_PASSWORD"
`
where should be replaced with your Apple ID, and then in your code you can use:`javascript
const password = @keychain:AC_PASSWORD;
`Notes on JWT authentication
You can obtain an API key from Appstore Connect. Create a key with _App Manager_ access. Note down the Issuer ID and download the
file. This file is your API key and comes with the name of AuthKey_. This is the string you have to supply when calling notarize.Based on the
ApiKey, altool will look in the following places for that file:*
./private_keys
*
*
* Notes on your Team Short Name
If you are a member of multiple teams or organizations, you have to tell Apple on behalf of which organization you're uploading. To find your team's short name), you can ask
, which is part of the now deprecated Application Loader as well as the newer Transporter.With
Transporter installed, run:
`sh
/Applications/Transporter.app/Contents/itms/bin/iTMSTransporter -m provider -u APPLE_DEV_ACCOUNT -p APP_PASSWORD
`Alternatively, with older versions of Xcode, run:
sh
/Applications/Xcode.app/Contents/Applications/Application Loader.app/Contents/itms/bin/iTMSTransporter -m provider -u APPLE_DEV_ACCOUNT -p APP_PASSWORD
`
Example Usage
javascript
import { notarize } from 'electron-notarize';async function packageTask () {
// Package your app here, and code sign with hardened runtime
await notarize({
appBundleId,
appPath,
appleId,
appleIdPassword,
ascProvider, // This parameter is optional
});
}
``