mirror of
https://github.com/zhayujie/chatgpt-on-wechat.git
synced 2026-07-17 11:07:11 +08:00
93 lines
2.7 KiB
JavaScript
93 lines
2.7 KiB
JavaScript
/**
|
|
* electron-builder afterPack hook.
|
|
*
|
|
* The Python backend is a PyInstaller onedir bundle shipped via extraResources
|
|
* into Contents/Resources/backend/. electron-builder's deep signing does NOT
|
|
* cover extraResources, so its executable + hundreds of .so/.dylib files stay
|
|
* unsigned — which makes notarization reject the whole app.
|
|
*
|
|
* This hook runs before electron-builder signs the .app: it code-signs every
|
|
* Mach-O file under the backend dir with hardened runtime + entitlements, so
|
|
* the outer app signature and notarization succeed.
|
|
*/
|
|
const { execFileSync, execSync } = require('child_process')
|
|
const fs = require('fs')
|
|
const path = require('path')
|
|
|
|
exports.default = async function signBackend(context) {
|
|
const { electronPlatformName, appOutDir, packager } = context
|
|
if (electronPlatformName !== 'darwin') return
|
|
|
|
// Signing identity comes from CSC_NAME (set in CI and, for local builds,
|
|
// your shell). No identity => unsigned build (e.g. dry runs), so skip the
|
|
// backend signing rather than fail.
|
|
const identity = process.env.CSC_NAME
|
|
if (!identity) {
|
|
console.log('[sign-backend] CSC_NAME not set — unsigned build, skipping backend signing')
|
|
return
|
|
}
|
|
|
|
const appName = packager.appInfo.productFilename
|
|
const backendDir = path.join(
|
|
appOutDir,
|
|
`${appName}.app`,
|
|
'Contents',
|
|
'Resources',
|
|
'backend'
|
|
)
|
|
|
|
if (!fs.existsSync(backendDir)) {
|
|
console.log(`[sign-backend] no backend dir at ${backendDir}, skipping`)
|
|
return
|
|
}
|
|
|
|
const entitlements = path.join(__dirname, 'entitlements.mac.plist')
|
|
|
|
// Collect every Mach-O file (executables + dylibs/so) under backend/.
|
|
// `file` output contains "Mach-O" for native binaries.
|
|
const files = []
|
|
const walk = (dir) => {
|
|
for (const name of fs.readdirSync(dir)) {
|
|
const full = path.join(dir, name)
|
|
const stat = fs.lstatSync(full)
|
|
if (stat.isSymbolicLink()) continue
|
|
if (stat.isDirectory()) {
|
|
walk(full)
|
|
continue
|
|
}
|
|
try {
|
|
const out = execSync(`file -b "${full}"`, { encoding: 'utf8' })
|
|
if (out.includes('Mach-O')) files.push(full)
|
|
} catch {
|
|
// ignore unreadable entries
|
|
}
|
|
}
|
|
}
|
|
walk(backendDir)
|
|
|
|
console.log(`[sign-backend] signing ${files.length} Mach-O files under backend/`)
|
|
|
|
// Sign inner libraries first, then the main executable last (inside-out).
|
|
files.sort((a, b) => b.length - a.length)
|
|
|
|
for (const f of files) {
|
|
execFileSync(
|
|
'codesign',
|
|
[
|
|
'--force',
|
|
'--timestamp',
|
|
'--options',
|
|
'runtime',
|
|
'--entitlements',
|
|
entitlements,
|
|
'--sign',
|
|
identity,
|
|
f,
|
|
],
|
|
{ stdio: 'inherit' }
|
|
)
|
|
}
|
|
|
|
console.log('[sign-backend] backend signing complete')
|
|
}
|