update electron to v43

electron/node_modules/app-builder-lib/out/codeSign/macCodeSign.js

@@ -1,10 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.findIdentity = exports.findIdentityRawResult = exports.sign = exports.createKeychain = exports.removeKeychain = exports.reportError = exports.isSignAllowed = exports.appleCertificatePrefixes = void 0;
-const bluebird_lst_1 = require("bluebird-lst");
-const util_1 = require("builder-util/out/util");
-const fs_1 = require("builder-util/out/fs");
-const log_1 = require("builder-util/out/log");
+exports.findIdentityRawResult = exports.appleCertificatePrefixes = void 0;
+exports.isSignAllowed = isSignAllowed;
+exports.reportError = reportError;
+exports.removeKeychain = removeKeychain;
+exports.createKeychain = createKeychain;
+exports.sign = sign;
+exports.findIdentity = findIdentity;
+const builder_util_1 = require("builder-util");
+const dynamicImport_1 = require("../util/dynamicImport");
 const crypto_1 = require("crypto");
 const promises_1 = require("fs/promises");
 const lazy_val_1 = require("lazy-val");
@@ -17,38 +21,37 @@ exports.appleCertificatePrefixes = ["Developer ID Application:", "Developer ID I
 function isSignAllowed(isPrintWarn = true) {
     if (process.platform !== "darwin") {
         if (isPrintWarn) {
-            util_1.log.warn({ reason: "supported only on macOS" }, "skipped macOS application code signing");
+            builder_util_1.log.warn({ reason: "supported only on macOS" }, "skipped macOS application code signing");
         }
         return false;
     }
-    const buildForPrWarning = "There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)" +
-        "\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.";
-    if (util_1.isPullRequest()) {
-        if (util_1.isEnvTrue(process.env.CSC_FOR_PULL_REQUEST)) {
+    if ((0, builder_util_1.isPullRequest)()) {
+        const buildForPrWarning = "There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)" +
+            "\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.";
+        if ((0, builder_util_1.isEnvTrue)(process.env.CSC_FOR_PULL_REQUEST)) {
             if (isPrintWarn) {
-                util_1.log.warn(buildForPrWarning);
+                builder_util_1.log.warn(buildForPrWarning);
             }
         }
         else {
             if (isPrintWarn) {
                 // https://github.com/electron-userland/electron-builder/issues/1524
-                util_1.log.warn("Current build is a part of pull request, code signing will be skipped." + "\nSet env CSC_FOR_PULL_REQUEST to true to force code signing." + `\n${buildForPrWarning}`);
+                builder_util_1.log.warn("Current build is a part of pull request, code signing will be skipped." + "\nSet env CSC_FOR_PULL_REQUEST to true to force code signing." + `\n${buildForPrWarning}`);
             }
             return false;
         }
     }
     return true;
 }
-exports.isSignAllowed = isSignAllowed;
 async function reportError(isMas, certificateTypes, qualifier, keychainFile, isForceCodeSigning) {
     const logFields = {};
     if (qualifier == null) {
         logFields.reason = "";
-        if (flags_1.isAutoDiscoveryCodeSignIdentity()) {
+        if ((0, flags_1.isAutoDiscoveryCodeSignIdentity)()) {
             logFields.reason += `cannot find valid "${certificateTypes.join(", ")}" identity${isMas ? "" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`}`;
         }
         logFields.reason += ", see https://electron.build/code-signing";
-        if (!flags_1.isAutoDiscoveryCodeSignIdentity()) {
+        if (!(0, flags_1.isAutoDiscoveryCodeSignIdentity)()) {
             logFields.CSC_IDENTITY_AUTO_DISCOVERY = false;
         }
     }
@@ -60,21 +63,21 @@ async function reportError(isMas, certificateTypes, qualifier, keychainFile, isF
     if (keychainFile != null) {
         args.push(keychainFile);
     }
-    if (qualifier != null || flags_1.isAutoDiscoveryCodeSignIdentity()) {
-        logFields.allIdentities = (await util_1.exec("security", args))
+    if (qualifier != null || (0, flags_1.isAutoDiscoveryCodeSignIdentity)()) {
+        logFields.allIdentities = (await (0, builder_util_1.exec)("/usr/bin/security", args))
             .trim()
             .split("\n")
             .filter(it => !(it.includes("Policy: X.509 Basic") || it.includes("Matching identities")))
             .join("\n");
     }
+    const skipMessage = "skipped macOS application code signing";
     if (isMas || isForceCodeSigning) {
-        throw new Error(log_1.Logger.createMessage("skipped macOS application code signing", logFields, "error", it => it));
+        throw new Error(builder_util_1.Logger.createMessage(skipMessage, logFields, "error", it => it));
     }
     else {
-        util_1.log.warn(logFields, "skipped macOS application code signing");
+        builder_util_1.log.warn(logFields, skipMessage);
     }
 }
-exports.reportError = reportError;
 // "Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list."
 // but "security list-keychains" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list
 // "overly complicated and introduces a race condition."
@@ -82,23 +85,23 @@ exports.reportError = reportError;
 const bundledCertKeychainAdded = new lazy_val_1.Lazy(async () => {
     // copy to temp and then atomic rename to final path
     const cacheDir = getCacheDirectory();
-    const tmpKeychainPath = path.join(cacheDir, temp_file_1.getTempName("electron-builder-root-certs"));
+    const tmpKeychainPath = path.join(cacheDir, (0, temp_file_1.getTempName)("electron-builder-root-certs"));
     const keychainPath = path.join(cacheDir, "electron-builder-root-certs.keychain");
     const results = await Promise.all([
         listUserKeychains(),
-        fs_1.copyFile(path.join(__dirname, "..", "..", "certs", "root_certs.keychain"), tmpKeychainPath).then(() => promises_1.rename(tmpKeychainPath, keychainPath)),
+        (0, builder_util_1.copyFile)(path.join(__dirname, "..", "..", "certs", "root_certs.keychain"), tmpKeychainPath).then(() => (0, promises_1.rename)(tmpKeychainPath, keychainPath)),
     ]);
     const list = results[0];
     if (!list.includes(keychainPath)) {
-        await util_1.exec("security", ["list-keychains", "-d", "user", "-s", keychainPath].concat(list));
+        await (0, builder_util_1.exec)("/usr/bin/security", ["list-keychains", "-d", "user", "-s", keychainPath].concat(list));
     }
 });
 function getCacheDirectory() {
     const env = process.env.ELECTRON_BUILDER_CACHE;
-    return util_1.isEmptyOrSpaces(env) ? path.join(os_1.homedir(), "Library", "Caches", "electron-builder") : path.resolve(env);
+    return (0, builder_util_1.isEmptyOrSpaces)(env) ? path.join((0, os_1.homedir)(), "Library", "Caches", "electron-builder") : path.resolve(env);
 }
 function listUserKeychains() {
-    return util_1.exec("security", ["list-keychains", "-d", "user"]).then(it => it
+    return (0, builder_util_1.exec)("/usr/bin/security", ["list-keychains", "-d", "user"]).then(it => it
         .split("\n")
         .map(it => {
         const r = it.trim();
@@ -107,14 +110,13 @@ function listUserKeychains() {
         .filter(it => it.length > 0));
 }
 function removeKeychain(keychainFile, printWarn = true) {
-    return util_1.exec("security", ["delete-keychain", keychainFile]).catch(e => {
+    return (0, builder_util_1.exec)("/usr/bin/security", ["delete-keychain", keychainFile]).catch((e) => {
         if (printWarn) {
-            util_1.log.warn({ file: keychainFile, error: e.stack || e }, "cannot delete keychain");
+            builder_util_1.log.warn({ file: keychainFile, error: e.stack || e }, "cannot delete keychain");
         }
-        return fs_1.unlinkIfExists(keychainFile);
+        return (0, builder_util_1.unlinkIfExists)(keychainFile);
     });
 }
-exports.removeKeychain = removeKeychain;
 async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }) {
     // travis has correct AppleWWDRCA cert
     if (process.env.TRAVIS !== "true") {
@@ -122,9 +124,8 @@ async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIK
     }
     // https://github.com/electron-userland/electron-builder/issues/3685
     // use constant file
-    const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || os_1.tmpdir(), `${crypto_1.createHash("sha256").update(currentDir).update("app-builder").digest("hex")}.keychain`);
+    const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || (0, os_1.tmpdir)(), `${(0, crypto_1.createHash)("sha256").update(currentDir).update("app-builder").digest("hex")}.keychain`);
     // noinspection JSUnusedLocalSymbols
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     await removeKeychain(keychainFile, false).catch(_ => {
         /* ignore*/
     });
@@ -133,7 +134,7 @@ async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIK
         certLinks.push(cscILink);
     }
     const certPaths = new Array(certLinks.length);
-    const keychainPassword = crypto_1.randomBytes(32).toString("base64");
+    const keychainPassword = (0, crypto_1.randomBytes)(32).toString("base64");
     const securityCommands = [
         ["create-keychain", "-p", keychainPassword, keychainFile],
         ["unlock-keychain", "-p", keychainPassword, keychainFile],
@@ -147,33 +148,37 @@ async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIK
     }
     await Promise.all([
         // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.
-        bluebird_lst_1.default.map(certLinks, (link, i) => codesign_1.importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))),
-        bluebird_lst_1.default.mapSeries(securityCommands, it => util_1.exec("security", it)),
+        ...certLinks.map((link, i) => (0, codesign_1.importCertificate)(link, tmpDir, currentDir).then(it => (certPaths[i] = it))),
+        // queue each security command
+        securityCommands.reduce((promise, cmd) => promise.then(() => (0, builder_util_1.exec)("/usr/bin/security", cmd)), new Promise(resolve => resolve(null))),
     ]);
-    return await importCerts(keychainFile, certPaths, [cscKeyPassword, cscIKeyPassword].filter(it => it != null));
+    const cscPasswords = [cscKeyPassword];
+    if (cscIKeyPassword != null) {
+        cscPasswords.push(cscIKeyPassword);
+    }
+    return await importCerts(keychainFile, certPaths, cscPasswords);
 }
-exports.createKeychain = createKeychain;
 async function importCerts(keychainFile, paths, keyPasswords) {
+    var _a;
     for (let i = 0; i < paths.length; i++) {
-        const password = keyPasswords[i];
-        await util_1.exec("security", ["import", paths[i], "-k", keychainFile, "-T", "/usr/bin/codesign", "-T", "/usr/bin/productbuild", "-P", password]);
+        const password = (_a = keyPasswords[i]) !== null && _a !== void 0 ? _a : "";
+        await (0, builder_util_1.exec)("/usr/bin/security", ["import", paths[i], "-k", keychainFile, "-T", "/usr/bin/codesign", "-T", "/usr/bin/productbuild", "-P", password]);
         // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p
         // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996
-        await util_1.exec("security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]);
+        await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]);
     }
     return {
         keychainFile,
     };
 }
-/** @private */
-function sign(path, name, keychain) {
-    const args = ["--deep", "--force", "--sign", name, path];
-    if (keychain != null) {
-        args.push("--keychain", keychain);
-    }
-    return util_1.exec("codesign", args);
+async function sign(opts) {
+    const { signAsync } = await (0, dynamicImport_1.dynamicImport)("@electron/osx-sign");
+    return (0, builder_util_1.retry)(() => signAsync(opts), {
+        retries: 3,
+        interval: 5000,
+        backoff: 5000,
+    });
 }
-exports.sign = sign;
 exports.findIdentityRawResult = null;
 async function getValidIdentities(keychain) {
     function addKeychain(args) {
@@ -187,7 +192,7 @@ async function getValidIdentities(keychain) {
         // https://github.com/electron-userland/electron-builder/issues/481
         // https://github.com/electron-userland/electron-builder/issues/535
         result = Promise.all([
-            util_1.exec("security", addKeychain(["find-identity", "-v"])).then(it => it
+            (0, builder_util_1.exec)("/usr/bin/security", addKeychain(["find-identity", "-v"])).then(it => it
                 .trim()
                 .split("\n")
                 .filter(it => {
@@ -198,7 +203,7 @@ async function getValidIdentities(keychain) {
                 }
                 return false;
             })),
-            util_1.exec("security", addKeychain(["find-identity", "-v", "-p", "codesigning"])).then(it => it.trim().split("\n")),
+            (0, builder_util_1.exec)("/usr/bin/security", addKeychain(["find-identity", "-v", "-p", "codesigning"])).then(it => it.trim().split("\n")),
         ]).then(it => {
             const array = it[0]
                 .concat(it[1])
@@ -223,7 +228,7 @@ async function _findIdentity(type, qualifier, keychain) {
             continue;
         }
         if (line.includes(namePrefix)) {
-            return parseIdentity(line);
+            return await parseIdentity(line);
         }
     }
     if (type === "Developer ID Application") {
@@ -241,22 +246,22 @@ async function _findIdentity(type, qualifier, keychain) {
                     continue l;
                 }
             }
-            return parseIdentity(line);
+            return await parseIdentity(line);
         }
     }
     return null;
 }
-const _Identity = require("electron-osx-sign/util-identities").Identity;
-function parseIdentity(line) {
+async function parseIdentity(line) {
     const firstQuoteIndex = line.indexOf('"');
     const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('"'));
     const hash = line.substring(0, firstQuoteIndex - 1);
-    return new _Identity(name, hash);
+    const { Identity: IdentityClass } = await (0, dynamicImport_1.dynamicImport)("@electron/osx-sign/dist/cjs/util-identities");
+    return new IdentityClass(name, hash);
 }
 function findIdentity(certType, qualifier, keychain) {
     let identity = qualifier || process.env.CSC_NAME;
-    if (util_1.isEmptyOrSpaces(identity)) {
-        if (flags_1.isAutoDiscoveryCodeSignIdentity()) {
+    if ((0, builder_util_1.isEmptyOrSpaces)(identity)) {
+        if ((0, flags_1.isAutoDiscoveryCodeSignIdentity)()) {
             return _findIdentity(certType, null, keychain);
         }
         else {
@@ -271,10 +276,9 @@ function findIdentity(certType, qualifier, keychain) {
         return _findIdentity(certType, identity, keychain);
     }
 }
-exports.findIdentity = findIdentity;
 function checkPrefix(name, prefix) {
     if (name.startsWith(prefix)) {
-        throw new util_1.InvalidConfigurationError(`Please remove prefix "${prefix}" from the specified name — appropriate certificate will be chosen automatically`);
+        throw new builder_util_1.InvalidConfigurationError(`Please remove prefix "${prefix}" from the specified name — appropriate certificate will be chosen automatically`);
     }
 }
 //# sourceMappingURL=macCodeSign.js.map