update electron to v43

electron/node_modules/app-builder-lib/out/platformPackager.js

@@ -1,14 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isSafeToUnpackElectronOnRemoteBuildServer = exports.chooseNotNull = exports.resolveFunction = exports.normalizeExt = exports.computeSafeArtifactNameIfNeeded = exports.isSafeGithubName = exports.PlatformPackager = void 0;
-const bluebird_lst_1 = require("bluebird-lst");
+exports.PlatformPackager = void 0;
+exports.isSafeGithubName = isSafeGithubName;
+exports.computeSafeArtifactNameIfNeeded = computeSafeArtifactNameIfNeeded;
+exports.normalizeExt = normalizeExt;
+exports.chooseNotNull = chooseNotNull;
+const dynamicImport_1 = require("./util/dynamicImport");
 const builder_util_1 = require("builder-util");
-const arch_1 = require("builder-util/out/arch");
-const fs_1 = require("builder-util/out/fs");
-const promise_1 = require("builder-util/out/promise");
+const builder_util_runtime_1 = require("builder-util-runtime");
 const promises_1 = require("fs/promises");
 const lazy_val_1 = require("lazy-val");
 const path = require("path");
+const fs = require("fs/promises");
+const os = require("os");
 const appInfo_1 = require("./appInfo");
 const asarFileChecker_1 = require("./asar/asarFileChecker");
 const asarUtil_1 = require("./asar/asarUtil");
@@ -17,17 +21,11 @@ const fileMatcher_1 = require("./fileMatcher");
 const fileTransformer_1 = require("./fileTransformer");
 const Framework_1 = require("./Framework");
 const index_1 = require("./index");
-const appBuilder_1 = require("./util/appBuilder");
 const appFileCopier_1 = require("./util/appFileCopier");
+const iconConverter_1 = require("./util/iconConverter");
 const macroExpander_1 = require("./util/macroExpander");
+const macosIconComposer_1 = require("./util/macosIconComposer");
 class PlatformPackager {
-    constructor(info, platform) {
-        this.info = info;
-        this.platform = platform;
-        this._resourceList = new lazy_val_1.Lazy(() => promise_1.orIfFileNotExist(promises_1.readdir(this.info.buildResourcesDir), []));
-        this.platformSpecificBuildOptions = PlatformPackager.normalizePlatformSpecificBuildOptions(this.config[platform.buildConfigurationKey]);
-        this.appInfo = this.prepareAppInfo(info.appInfo);
-    }
     get packagerOptions() {
         return this.info.options;
     }
@@ -43,6 +41,15 @@ class PlatformPackager {
     get resourceList() {
         return this._resourceList.value;
     }
+    constructor(info, platform) {
+        this.info = info;
+        this.platform = platform;
+        this._resourceList = new lazy_val_1.Lazy(() => (0, builder_util_1.orIfFileNotExist)((0, promises_1.readdir)(this.info.buildResourcesDir), []));
+        this.assetCatalogResults = new Map();
+        this.cachedIcnsFromIconFile = new Map();
+        this.platformSpecificBuildOptions = PlatformPackager.normalizePlatformSpecificBuildOptions(this.config[platform.buildConfigurationKey]);
+        this.appInfo = this.prepareAppInfo(info.appInfo);
+    }
     get compression() {
         const compression = this.platformSpecificBuildOptions.compression;
         // explicitly set to null - request to use default value instead of parent (in the config)
@@ -63,7 +70,7 @@ class PlatformPackager {
     }
     getCscPassword() {
         const password = this.doGetCscPassword();
-        if (builder_util_1.isEmptyOrSpaces(password)) {
+        if ((0, builder_util_1.isEmptyOrSpaces)(password)) {
             builder_util_1.log.info({ reason: "CSC_KEY_PASSWORD is not defined" }, "empty password will be used for code signing");
             return "";
         }
@@ -81,21 +88,20 @@ class PlatformPackager {
         return chooseNotNull(chooseNotNull(this.info.config.cscKeyPassword, this.platformSpecificBuildOptions.cscKeyPassword), process.env.CSC_KEY_PASSWORD);
     }
     computeAppOutDir(outDir, arch) {
-        return (this.packagerOptions.prepackaged ||
-            path.join(outDir, `${this.platform.buildConfigurationKey}${builder_util_1.getArchSuffix(arch, this.platformSpecificBuildOptions.defaultArch)}${this.platform === index_1.Platform.MAC ? "" : "-unpacked"}`));
-    }
-    dispatchArtifactCreated(file, target, arch, safeArtifactName) {
-        return this.info.callArtifactBuildCompleted({
-            file,
-            safeArtifactName,
-            target,
-            arch,
-            packager: this,
-        });
+        // codeql[js/shell-command-constructed-from-input] - prepackaged and outDir are validated via sanitizeDirPath in the Packager constructor
+        return path.resolve(this.packagerOptions.prepackaged ||
+            path.join(outDir, `${this.platform.buildConfigurationKey}${(0, builder_util_1.getArchSuffix)(arch, this.platformSpecificBuildOptions.defaultArch)}${this.platform === index_1.Platform.MAC ? "" : "-unpacked"}`));
     }
     async pack(outDir, arch, targets, taskManager) {
         const appOutDir = this.computeAppOutDir(outDir, arch);
-        await this.doPack(outDir, appOutDir, this.platform.nodeName, arch, this.platformSpecificBuildOptions, targets);
+        await this.doPack({
+            outDir,
+            appOutDir,
+            platformName: this.platform.nodeName,
+            arch,
+            platformSpecificBuildOptions: this.platformSpecificBuildOptions,
+            targets,
+        });
         this.packageInDistributableFormat(appOutDir, arch, targets, taskManager);
     }
     packageInDistributableFormat(appOutDir, arch, targets, taskManager) {
@@ -109,7 +115,7 @@ class PlatformPackager {
             PlatformPackager.buildAsyncTargets(targets, subTaskManager, appOutDir, arch);
             await subTaskManager.awaitTasks();
             for (const target of targets) {
-                if (!target.isAsyncSupported) {
+                if (!target.isAsyncSupported && !this.info.cancellationToken.cancelled) {
                     await target.build(appOutDir, arch);
                 }
             }
@@ -123,12 +129,9 @@ class PlatformPackager {
         }
     }
     getExtraFileMatchers(isResources, appOutDir, options) {
-        const base = isResources
-            ? this.getResourcesDir(appOutDir)
-            : this.platform === index_1.Platform.MAC
-                ? path.join(appOutDir, `${this.appInfo.productFilename}.app`, "Contents")
-                : appOutDir;
-        return fileMatcher_1.getFileMatchers(this.config, isResources ? "extraResources" : "extraFiles", base, options);
+        const outDir = this.platform === index_1.Platform.MAC ? path.join(appOutDir, `${this.appInfo.productFilename}.app`, "Contents") : appOutDir;
+        const base = isResources ? this.getResourcesDir(appOutDir) : outDir;
+        return (0, fileMatcher_1.getFileMatchers)(this.config, isResources ? "extraResources" : "extraFiles", base, options);
     }
     createGetFileMatchersOptions(outDir, arch, customBuildOptions) {
         return {
@@ -138,24 +141,25 @@ class PlatformPackager {
             defaultSrc: this.projectDir,
         };
     }
-    async doPack(outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets, sign = true, disableAsarIntegrity = false) {
+    async doPack(packOptions) {
+        var _a;
         if (this.packagerOptions.prepackaged != null) {
             return;
         }
         if (this.info.cancellationToken.cancelled) {
             return;
         }
-        const beforePack = resolveFunction(this.config.beforePack, "beforePack");
-        if (beforePack != null) {
-            await beforePack({
-                appOutDir,
-                outDir,
-                arch,
-                targets,
-                packager: this,
-                electronPlatformName: platformName,
-            });
-        }
+        // Due to node-gyp rewriting GYP_MSVS_VERSION when reused across the same session, we must reset the env var: https://github.com/electron-userland/electron-builder/issues/7256
+        delete process.env.GYP_MSVS_VERSION;
+        const { outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets, options } = packOptions;
+        await this.info.emitBeforePack({
+            appOutDir,
+            outDir,
+            arch,
+            targets,
+            packager: this,
+            electronPlatformName: platformName,
+        });
         await this.info.installAppDependencies(this.platform, arch);
         if (this.info.cancellationToken.cancelled) {
             return;
@@ -174,6 +178,14 @@ class PlatformPackager {
             arch: builder_util_1.Arch[arch],
             version: framework.version,
         });
+        await this.info.emitAfterExtract({
+            appOutDir,
+            outDir,
+            arch,
+            targets,
+            packager: this,
+            electronPlatformName: platformName,
+        });
         const excludePatterns = [];
         const computeParsedPatterns = (patterns) => {
             if (patterns != null) {
@@ -199,7 +211,7 @@ class PlatformPackager {
         const asarOptions = await this.computeAsarOptions(platformSpecificBuildOptions);
         const resourcesPath = this.platform === index_1.Platform.MAC
             ? path.join(appOutDir, framework.distMacOsAppName, "Contents", "Resources")
-            : Framework_1.isElectronBased(framework)
+            : (0, Framework_1.isElectronBased)(framework)
                 ? path.join(appOutDir, "resources")
                 : appOutDir;
         const taskManager = new builder_util_1.AsyncTaskManager(this.info.cancellationToken);
@@ -209,11 +221,15 @@ class PlatformPackager {
             return;
         }
         if (framework.beforeCopyExtraFiles != null) {
-            const resourcesRelativePath = this.platform === index_1.Platform.MAC ? "Resources" : Framework_1.isElectronBased(framework) ? "resources" : "";
+            const resourcesRelativePath = this.platform === index_1.Platform.MAC ? "Resources" : (0, Framework_1.isElectronBased)(framework) ? "resources" : "";
+            let asarIntegrity = null;
+            if (!(asarOptions == null || (options === null || options === void 0 ? void 0 : options.disableAsarIntegrity) || this.config.disableAsarIntegrity)) {
+                asarIntegrity = await (0, integrity_1.computeData)({ resourcesPath, resourcesRelativePath, resourcesDestinationPath: this.getResourcesDir(appOutDir), extraResourceMatchers });
+            }
             await framework.beforeCopyExtraFiles({
                 packager: this,
                 appOutDir,
-                asarIntegrity: asarOptions == null || disableAsarIntegrity ? null : await integrity_1.computeData({ resourcesPath, resourcesRelativePath }),
+                asarIntegrity,
                 platformName,
             });
         }
@@ -221,21 +237,89 @@ class PlatformPackager {
             return;
         }
         const transformerForExtraFiles = this.createTransformerForExtraFiles(packContext);
-        await fileMatcher_1.copyFiles(extraResourceMatchers, transformerForExtraFiles);
-        await fileMatcher_1.copyFiles(extraFileMatchers, transformerForExtraFiles);
+        await (0, fileMatcher_1.copyFiles)(extraResourceMatchers, transformerForExtraFiles);
+        await (0, fileMatcher_1.copyFiles)(extraFileMatchers, transformerForExtraFiles);
         if (this.info.cancellationToken.cancelled) {
             return;
         }
-        await this.info.afterPack(packContext);
+        await this.info.emitAfterPack(packContext);
         if (framework.afterPack != null) {
             await framework.afterPack(packContext);
         }
         const isAsar = asarOptions != null;
-        await this.sanityCheckPackage(appOutDir, isAsar, framework);
-        if (sign) {
+        await this.sanityCheckPackage(appOutDir, isAsar, framework, !!this.config.disableSanityCheckAsar);
+        if (!(options === null || options === void 0 ? void 0 : options.disableFuses)) {
+            await this.doAddElectronFuses(packContext);
+        }
+        if ((_a = options === null || options === void 0 ? void 0 : options.sign) !== null && _a !== void 0 ? _a : true) {
             await this.doSignAfterPack(outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets);
         }
     }
+    // the fuses MUST be flipped right before signing
+    async doAddElectronFuses(packContext) {
+        if (this.config.electronFuses == null) {
+            return;
+        }
+        const fuseConfig = await this.generateFuseConfig(this.config.electronFuses);
+        await this.addElectronFuses(packContext, fuseConfig);
+    }
+    async generateFuseConfig(fuses) {
+        const { FuseVersion, FuseV1Options } = await (0, dynamicImport_1.dynamicImport)("@electron/fuses");
+        const config = {
+            version: FuseVersion.V1,
+            resetAdHocDarwinSignature: fuses.resetAdHocDarwinSignature,
+        };
+        // this is annoying, but we must filter out undefined entries because some older electron versions will receive `the fuse wire in this version of Electron is not long enough` even if entry is set undefined
+        if (fuses.runAsNode != null) {
+            config[FuseV1Options.RunAsNode] = fuses.runAsNode;
+        }
+        if (fuses.enableCookieEncryption != null) {
+            config[FuseV1Options.EnableCookieEncryption] = fuses.enableCookieEncryption;
+        }
+        if (fuses.enableNodeOptionsEnvironmentVariable != null) {
+            config[FuseV1Options.EnableNodeOptionsEnvironmentVariable] = fuses.enableNodeOptionsEnvironmentVariable;
+        }
+        if (fuses.enableNodeCliInspectArguments != null) {
+            config[FuseV1Options.EnableNodeCliInspectArguments] = fuses.enableNodeCliInspectArguments;
+        }
+        if (fuses.enableEmbeddedAsarIntegrityValidation != null) {
+            config[FuseV1Options.EnableEmbeddedAsarIntegrityValidation] = fuses.enableEmbeddedAsarIntegrityValidation;
+        }
+        if (fuses.onlyLoadAppFromAsar != null) {
+            config[FuseV1Options.OnlyLoadAppFromAsar] = fuses.onlyLoadAppFromAsar;
+        }
+        if (fuses.loadBrowserProcessSpecificV8Snapshot != null) {
+            config[FuseV1Options.LoadBrowserProcessSpecificV8Snapshot] = fuses.loadBrowserProcessSpecificV8Snapshot;
+        }
+        if (fuses.grantFileProtocolExtraPrivileges != null) {
+            config[FuseV1Options.GrantFileProtocolExtraPrivileges] = fuses.grantFileProtocolExtraPrivileges;
+        }
+        return config;
+    }
+    /**
+     * Use `AfterPackContext` here to keep available for public API
+     * @param {AfterPackContext} context
+     * @param {FuseConfig} fuses
+     *
+     * Can be used in `afterPack` hook for custom fuse logic like below. It's an alternative approach if one wants to override electron-builder's @electron/fuses version
+     * ```
+     * await context.packager.addElectronFuses(context, { ... })
+     * ```
+     */
+    async addElectronFuses(context, fuses) {
+        const { appOutDir, electronPlatformName } = context;
+        const ext = {
+            darwin: ".app",
+            mas: ".app",
+            win32: ".exe",
+            linux: "",
+        }[electronPlatformName];
+        const executableName = this instanceof index_1.LinuxPackager ? this.executableName : this.appInfo.productFilename;
+        const electronBinaryPath = path.join(appOutDir, `${executableName}${ext}`);
+        builder_util_1.log.info({ electronPath: builder_util_1.log.filePath(electronBinaryPath) }, "executing @electron/fuses");
+        const { flipFuses } = await (0, dynamicImport_1.dynamicImport)("@electron/fuses");
+        return flipFuses(electronBinaryPath, fuses);
+    }
     async doSignAfterPack(outDir, appOutDir, platformName, arch, platformSpecificBuildOptions, targets) {
         const asarOptions = await this.computeAsarOptions(platformSpecificBuildOptions);
         const isAsar = asarOptions != null;
@@ -247,10 +331,12 @@ class PlatformPackager {
             packager: this,
             electronPlatformName: platformName,
         };
-        await this.signApp(packContext, isAsar);
-        const afterSign = resolveFunction(this.config.afterSign, "afterSign");
-        if (afterSign != null) {
-            await Promise.resolve(afterSign(packContext));
+        const didSign = await this.signApp(packContext, isAsar);
+        if (didSign) {
+            await this.info.emitAfterSign(packContext);
+        }
+        else if (this.info.filterPackagerEventListeners("afterSign", "user").length) {
+            builder_util_1.log.warn(null, `skipping "afterSign" hook as no signing occurred, perhaps you intended "afterPack"?`);
         }
     }
     // eslint-disable-next-line
@@ -260,15 +346,15 @@ class PlatformPackager {
     copyAppFiles(taskManager, asarOptions, resourcePath, defaultDestination, packContext, platformSpecificBuildOptions, excludePatterns, macroExpander) {
         const appDir = this.info.appDir;
         const config = this.config;
-        const isElectronCompile = asarOptions != null && fileTransformer_1.isElectronCompileUsed(this.info);
-        const mainMatchers = fileMatcher_1.getMainFileMatchers(appDir, defaultDestination, macroExpander, platformSpecificBuildOptions, this, packContext.outDir, isElectronCompile);
+        const isElectronCompile = asarOptions != null && (0, fileTransformer_1.isElectronCompileUsed)(this.info);
+        const mainMatchers = (0, fileMatcher_1.getMainFileMatchers)(appDir, defaultDestination, macroExpander, platformSpecificBuildOptions, this, packContext.outDir, isElectronCompile);
         if (excludePatterns.length > 0) {
             for (const matcher of mainMatchers) {
                 matcher.excludePatterns = excludePatterns;
             }
         }
         const framework = this.info.framework;
-        const transformer = fileTransformer_1.createTransformer(appDir, config, isElectronCompile
+        const transformer = (0, fileTransformer_1.createTransformer)(appDir, config, isElectronCompile
             ? {
                 originalMain: this.info.metadata.main,
                 main: appFileCopier_1.ELECTRON_COMPILE_SHIM_FILENAME,
@@ -276,16 +362,20 @@ class PlatformPackager {
             }
             : config.extraMetadata, framework.createTransformer == null ? null : framework.createTransformer());
         const _computeFileSets = (matchers) => {
-            return appFileCopier_1.computeFileSets(matchers, this.info.isPrepackedAppAsar ? null : transformer, this, isElectronCompile).then(async (result) => {
+            return (0, appFileCopier_1.computeFileSets)(matchers, this.info.isPrepackedAppAsar ? null : transformer, this, isElectronCompile).then(async (result) => {
                 if (!this.info.isPrepackedAppAsar && !this.info.areNodeModulesHandledExternally) {
-                    const moduleFileMatcher = fileMatcher_1.getNodeModuleFileMatcher(appDir, defaultDestination, macroExpander, platformSpecificBuildOptions, this.info);
-                    result = result.concat(await appFileCopier_1.computeNodeModuleFileSets(this, moduleFileMatcher));
+                    const moduleFileMatcher = (0, fileMatcher_1.getNodeModuleFileMatcher)(appDir, defaultDestination, macroExpander, platformSpecificBuildOptions, this.info);
+                    result = result.concat(await (0, appFileCopier_1.computeNodeModuleFileSets)(this, moduleFileMatcher));
                 }
                 return result.filter(it => it.files.length > 0);
             });
         };
         if (this.info.isPrepackedAppAsar) {
-            taskManager.addTask(bluebird_lst_1.default.each(_computeFileSets([new fileMatcher_1.FileMatcher(appDir, resourcePath, macroExpander)]), it => appFileCopier_1.copyAppFiles(it, this.info, transformer)));
+            taskManager.add(async () => {
+                const fileSets = await _computeFileSets([new fileMatcher_1.FileMatcher(appDir, resourcePath, macroExpander)]);
+                fileSets.forEach(it => taskManager.addTask((0, appFileCopier_1.copyAppFiles)(it, this.info, transformer)));
+                await taskManager.awaitTasks();
+            });
         }
         else if (asarOptions == null) {
             // for ASAR all asar unpacked files will be extra transformed (e.g. sign of EXE and DLL) later,
@@ -301,10 +391,14 @@ class PlatformPackager {
                 }
                 return transformer(file);
             };
-            taskManager.addTask(bluebird_lst_1.default.each(_computeFileSets(mainMatchers), it => appFileCopier_1.copyAppFiles(it, this.info, combinedTransformer)));
+            taskManager.add(async () => {
+                const fileSets = await _computeFileSets(mainMatchers);
+                fileSets.forEach(it => taskManager.addTask((0, appFileCopier_1.copyAppFiles)(it, this.info, combinedTransformer)));
+                await taskManager.awaitTasks();
+            });
         }
         else {
-            const unpackPattern = fileMatcher_1.getFileMatchers(config, "asarUnpack", defaultDestination, {
+            const unpackPattern = (0, fileMatcher_1.getFileMatchers)(config, "asarUnpack", defaultDestination, {
                 macroExpander,
                 customBuildOptions: platformSpecificBuildOptions,
                 globalOutDir: packContext.outDir,
@@ -313,21 +407,26 @@ class PlatformPackager {
             const fileMatcher = unpackPattern == null ? null : unpackPattern[0];
             taskManager.addTask(_computeFileSets(mainMatchers).then(async (fileSets) => {
                 for (const fileSet of fileSets) {
-                    await appFileCopier_1.transformFiles(transformer, fileSet);
+                    await (0, appFileCopier_1.transformFiles)(transformer, fileSet);
                 }
-                await new asarUtil_1.AsarPackager(appDir, resourcePath, asarOptions, fileMatcher == null ? null : fileMatcher.createFilter()).pack(fileSets, this);
+                await new asarUtil_1.AsarPackager(this, {
+                    defaultDestination,
+                    resourcePath,
+                    options: asarOptions,
+                    unpackPattern: fileMatcher === null || fileMatcher === void 0 ? void 0 : fileMatcher.createFilter(),
+                }).pack(fileSets);
             }));
         }
     }
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     signApp(packContext, isAsar) {
-        return Promise.resolve();
+        return Promise.resolve(false);
     }
     getIconPath() {
         return Promise.resolve(null);
     }
     async computeAsarOptions(customBuildOptions) {
-        if (!Framework_1.isElectronBased(this.info.framework)) {
+        if (!(0, Framework_1.isElectronBased)(this.info.framework)) {
             return null;
         }
         function errorMessage(name) {
@@ -343,7 +442,7 @@ class PlatformPackager {
         const platformSpecific = customBuildOptions.asar;
         const result = platformSpecific == null ? this.config.asar : platformSpecific;
         if (result === false) {
-            const appAsarStat = await fs_1.statOrNull(path.join(this.info.appDir, "app.asar"));
+            const appAsarStat = await (0, builder_util_1.statOrNull)(path.join(this.info.appDir, "app.asar"));
             //noinspection ES6MissingAwait
             if (appAsarStat == null || !appAsarStat.isFile()) {
                 builder_util_1.log.warn({
@@ -360,7 +459,7 @@ class PlatformPackager {
                 throw new Error(errorMessage(`asar.${name}`));
             }
         }
-        return builder_util_1.deepAssign({}, result);
+        return (0, builder_util_runtime_1.deepAssign)({}, result);
     }
     getElectronSrcDir(dist) {
         return path.resolve(this.projectDir, dist);
@@ -372,20 +471,25 @@ class PlatformPackager {
         if (this.platform === index_1.Platform.MAC) {
             return this.getMacOsResourcesDir(appOutDir);
         }
-        else if (Framework_1.isElectronBased(this.info.framework)) {
+        if ((0, Framework_1.isElectronBased)(this.info.framework)) {
             return path.join(appOutDir, "resources");
         }
-        else {
-            return appOutDir;
-        }
+        return appOutDir;
+    }
+    getMacOsElectronFrameworkResourcesDir(appOutDir) {
+        const electronFrameworkName = path.basename(this.info.framework.distMacOsAppName, ".app") + " " + "Framework.framework";
+        return path.join(appOutDir, `${this.appInfo.productFilename}.app`, "Contents", "Frameworks", electronFrameworkName, "Versions", "A", "Resources");
     }
     getMacOsResourcesDir(appOutDir) {
         return path.join(appOutDir, `${this.appInfo.productFilename}.app`, "Contents", "Resources");
     }
-    async checkFileInPackage(resourcesDir, file, messagePrefix, isAsar) {
+    async checkFileInPackage(resourcesDir, file, messagePrefix, isAsar, disableSanityCheckAsar) {
+        if (isAsar && disableSanityCheckAsar) {
+            return;
+        }
         const relativeFile = path.relative(this.info.appDir, path.resolve(this.info.appDir, file));
         if (isAsar) {
-            await asarFileChecker_1.checkFileInArchive(path.join(resourcesDir, "app.asar"), relativeFile, messagePrefix);
+            await (0, asarFileChecker_1.checkFileInArchive)(path.join(resourcesDir, "app.asar"), relativeFile, messagePrefix);
             return;
         }
         const pathParsed = path.parse(file);
@@ -404,11 +508,11 @@ class PlatformPackager {
             const asarPath = path.join(...pathSplit.slice(0, partWithAsarIndex + 1));
             let mainPath = pathSplit.length > partWithAsarIndex + 1 ? path.join.apply(pathSplit.slice(partWithAsarIndex + 1)) : "";
             mainPath += path.join(mainPath, pathParsed.base);
-            await asarFileChecker_1.checkFileInArchive(path.join(resourcesDir, "app", asarPath), mainPath, messagePrefix);
+            await (0, asarFileChecker_1.checkFileInArchive)(path.join(resourcesDir, "app", asarPath), mainPath, messagePrefix);
         }
         else {
             const fullPath = path.join(resourcesDir, "app", relativeFile);
-            const outStat = await fs_1.statOrNull(fullPath);
+            const outStat = await (0, builder_util_1.statOrNull)(fullPath);
             if (outStat == null) {
                 throw new Error(`${messagePrefix} "${fullPath}" does not exist. Seems like a wrong configuration.`);
             }
@@ -420,8 +524,8 @@ class PlatformPackager {
             }
         }
     }
-    async sanityCheckPackage(appOutDir, isAsar, framework) {
-        const outStat = await fs_1.statOrNull(appOutDir);
+    async sanityCheckPackage(appOutDir, isAsar, framework, disableSanityCheckAsar) {
+        const outStat = await (0, builder_util_1.statOrNull)(appOutDir);
         if (outStat == null) {
             throw new Error(`Output directory "${appOutDir}" does not exist. Seems like a wrong configuration.`);
         }
@@ -433,16 +537,16 @@ class PlatformPackager {
         }
         const resourcesDir = this.getResourcesDir(appOutDir);
         const mainFile = (framework.getMainFile == null ? null : framework.getMainFile(this.platform)) || this.info.metadata.main || "index.js";
-        await this.checkFileInPackage(resourcesDir, mainFile, "Application entry file", isAsar);
-        await this.checkFileInPackage(resourcesDir, "package.json", "Application", isAsar);
+        await this.checkFileInPackage(resourcesDir, mainFile, "Application entry file", isAsar, disableSanityCheckAsar);
+        await this.checkFileInPackage(resourcesDir, "package.json", "Application", isAsar, disableSanityCheckAsar);
     }
     // tslint:disable-next-line:no-invalid-template-strings
     computeSafeArtifactName(suggestedName, ext, arch, skipDefaultArch = true, defaultArch, safePattern = "${name}-${version}-${arch}.${ext}") {
-        return computeSafeArtifactNameIfNeeded(suggestedName, () => this.computeArtifactName(safePattern, ext, skipDefaultArch && arch === arch_1.defaultArchFromString(defaultArch) ? null : arch));
+        return computeSafeArtifactNameIfNeeded(suggestedName, () => this.computeArtifactName(safePattern, ext, skipDefaultArch && arch === (0, builder_util_1.defaultArchFromString)(defaultArch) ? null : arch));
     }
     expandArtifactNamePattern(targetSpecificOptions, ext, arch, defaultPattern, skipDefaultArch = true, defaultArch) {
         const { pattern, isUserForced } = this.artifactPatternConfig(targetSpecificOptions, defaultPattern);
-        return this.computeArtifactName(pattern, ext, !isUserForced && skipDefaultArch && arch === arch_1.defaultArchFromString(defaultArch) ? null : arch);
+        return this.computeArtifactName(pattern, ext, !isUserForced && skipDefaultArch && arch === (0, builder_util_1.defaultArchFromString)(defaultArch) ? null : arch);
     }
     artifactPatternConfig(targetSpecificOptions, defaultPattern) {
         const userSpecifiedPattern = (targetSpecificOptions === null || targetSpecificOptions === void 0 ? void 0 : targetSpecificOptions.artifactName) || this.platformSpecificBuildOptions.artifactName || this.config.artifactName;
@@ -456,13 +560,13 @@ class PlatformPackager {
         return this.expandArtifactNamePattern(targetSpecificOptions, ext, arch, "${productName} ${version} ${arch}.${ext}", true);
     }
     computeArtifactName(pattern, ext, arch) {
-        const archName = arch == null ? null : arch_1.getArtifactArchName(arch, ext);
+        const archName = arch == null ? null : (0, builder_util_1.getArtifactArchName)(arch, ext);
         return this.expandMacro(pattern, archName, {
             ext,
         });
     }
     expandMacro(pattern, arch, extra = {}, isProductNameSanitized = true) {
-        return macroExpander_1.expandMacro(pattern, arch, this.appInfo, { os: this.platform.buildConfigurationKey, ...extra }, isProductNameSanitized);
+        return (0, macroExpander_1.expandMacro)(pattern, arch, this.appInfo, { os: this.platform.buildConfigurationKey, ...extra }, isProductNameSanitized);
     }
     generateName2(ext, classifier, deployment) {
         const dotExt = ext == null ? "" : `.${ext}`;
@@ -473,7 +577,7 @@ class PlatformPackager {
         return this.info.tempDirManager.getTempFile({ suffix });
     }
     get fileAssociations() {
-        return builder_util_1.asArray(this.config.fileAssociations).concat(builder_util_1.asArray(this.platformSpecificBuildOptions.fileAssociations));
+        return (0, builder_util_1.asArray)(this.config.fileAssociations).concat((0, builder_util_1.asArray)(this.platformSpecificBuildOptions.fileAssociations));
     }
     async getResource(custom, ...names) {
         const resourcesDir = this.info.buildResourcesDir;
@@ -481,19 +585,21 @@ class PlatformPackager {
             const resourceList = await this.resourceList;
             for (const name of names) {
                 if (resourceList.includes(name)) {
-                    return path.join(resourcesDir, name);
+                    // sanitizeDirPath with resourcesDir base enforces containment — CodeQL recognises the startsWith check inside as a path-traversal sanitizer
+                    return (0, builder_util_1.sanitizeDirPath)(path.join(resourcesDir, path.basename(name)), resourcesDir);
                 }
             }
         }
-        else if (custom != null && !builder_util_1.isEmptyOrSpaces(custom)) {
+        else if (custom != null && !(0, builder_util_1.isEmptyOrSpaces)(custom)) {
             const resourceList = await this.resourceList;
             if (resourceList.includes(custom)) {
-                return path.join(resourcesDir, custom);
+                return (0, builder_util_1.sanitizeDirPath)(path.join(resourcesDir, path.basename(custom)), resourcesDir);
             }
+            // codeql[js/shell-command-constructed-from-input] - intentional: custom may be an absolute path outside the build resources dir; existence is verified below via statOrNull
             let p = path.resolve(resourcesDir, custom);
-            if ((await fs_1.statOrNull(p)) == null) {
+            if ((await (0, builder_util_1.statOrNull)(p)) == null) {
                 p = path.resolve(this.projectDir, custom);
-                if ((await fs_1.statOrNull(p)) == null) {
+                if ((await (0, builder_util_1.statOrNull)(p)) == null) {
                     throw new builder_util_1.InvalidConfigurationError(`cannot find specified resource "${custom}", nor relative to "${resourcesDir}", neither relative to project dir ("${this.projectDir}")`);
                 }
             }
@@ -505,8 +611,45 @@ class PlatformPackager {
         const forceCodeSigningPlatform = this.platformSpecificBuildOptions.forceCodeSigning;
         return (forceCodeSigningPlatform == null ? this.config.forceCodeSigning : forceCodeSigningPlatform) || false;
     }
+    generateAssetCatalogData(iconPath) {
+        // Cache results
+        const cachedPromise = this.assetCatalogResults.get(iconPath);
+        if (cachedPromise) {
+            return cachedPromise;
+        }
+        const promise = (0, macosIconComposer_1.generateAssetCatalogForIcon)(iconPath);
+        this.assetCatalogResults.set(iconPath, promise);
+        return promise;
+    }
+    async generateIcnsFromIcon(iconPath) {
+        const cachedPromise = this.cachedIcnsFromIconFile.get(iconPath);
+        if (cachedPromise) {
+            return cachedPromise;
+        }
+        const runner = async () => {
+            const { icnsFile } = await this.generateAssetCatalogData(iconPath);
+            // Generate icns file
+            const tempDir = await fs.mkdtemp(path.resolve(os.tmpdir(), "icon-compile-"));
+            const tempIcnsPath = path.resolve(tempDir, "Icon.icns");
+            await fs.writeFile(tempIcnsPath, icnsFile);
+            return tempIcnsPath;
+        };
+        const promise = runner();
+        this.cachedIcnsFromIconFile.set(iconPath, promise);
+        return promise;
+    }
     async getOrConvertIcon(format) {
-        const result = await this.resolveIcon(builder_util_1.asArray(this.platformSpecificBuildOptions.icon || this.config.icon), [], format);
+        if (format === "icns") {
+            const configuredIcon = this.platformSpecificBuildOptions.icon;
+            // If it is a .icon file, generate the icns file and return the path to the icns file
+            if (configuredIcon === null || configuredIcon === void 0 ? void 0 : configuredIcon.endsWith(".icon")) {
+                const iconPath = await this.getResource(configuredIcon);
+                if (iconPath) {
+                    return this.generateIcnsFromIcon(iconPath);
+                }
+            }
+        }
+        const result = await this.resolveIcon((0, builder_util_1.asArray)(this.platformSpecificBuildOptions.icon || this.config.icon), [], format);
         if (result.length === 0) {
             const framework = this.info.framework;
             if (framework.getDefaultIcon != null) {
@@ -525,39 +668,25 @@ class PlatformPackager {
     }
     // convert if need, validate size (it is a reason why tool is called even if file has target extension (already specified as foo.icns for example))
     async resolveIcon(sources, fallbackSources, outputFormat) {
-        const args = [
-            "icon",
-            "--format",
-            outputFormat,
-            "--root",
-            this.buildResourcesDir,
-            "--root",
-            this.projectDir,
-            "--out",
-            path.resolve(this.projectDir, this.config.directories.output, `.icon-${outputFormat}`),
-        ];
-        for (const source of sources) {
-            args.push("--input", source);
-        }
-        for (const source of fallbackSources) {
-            args.push("--fallback-input", source);
-        }
-        const result = await appBuilder_1.executeAppBuilderAsJson(args);
-        const errorMessage = result.error;
-        if (errorMessage != null) {
-            throw new builder_util_1.InvalidConfigurationError(errorMessage, result.errorCode);
+        const output = this.expandMacro(this.config.directories.output);
+        const outDir = (0, builder_util_1.sanitizeDirPath)(path.resolve(this.projectDir, output, `.icon-${outputFormat}`));
+        const roots = [this.buildResourcesDir, this.projectDir];
+        const filteredSources = sources.filter(s => !s.endsWith(".icon"));
+        const filteredFallbacks = fallbackSources.filter(s => !s.endsWith(".icon"));
+        const result = await (0, iconConverter_1.convertIcon)({ sources: filteredSources, fallbackSources: filteredFallbacks, roots, format: outputFormat, outDir });
+        if (result.error != null) {
+            throw new builder_util_1.InvalidConfigurationError(result.error, result.errorCode);
         }
         if (result.isFallback) {
             builder_util_1.log.warn({ reason: "application icon is not set" }, `default ${capitalizeFirstLetter(this.info.framework.name)} icon is used`);
         }
-        return result.icons || [];
+        return result.icons;
     }
 }
 exports.PlatformPackager = PlatformPackager;
 function isSafeGithubName(name) {
     return /^[0-9A-Za-z._-]+$/.test(name);
 }
-exports.isSafeGithubName = isSafeGithubName;
 function computeSafeArtifactNameIfNeeded(suggestedName, safeNameProducer) {
     // GitHub only allows the listed characters in file names.
     if (suggestedName != null) {
@@ -572,53 +701,14 @@ function computeSafeArtifactNameIfNeeded(suggestedName, safeNameProducer) {
     }
     return safeNameProducer();
 }
-exports.computeSafeArtifactNameIfNeeded = computeSafeArtifactNameIfNeeded;
 // remove leading dot
 function normalizeExt(ext) {
     return ext.startsWith(".") ? ext.substring(1) : ext;
 }
-exports.normalizeExt = normalizeExt;
-function resolveFunction(executor, name) {
-    if (executor == null || typeof executor !== "string") {
-        return executor;
-    }
-    let p = executor;
-    if (p.startsWith(".")) {
-        p = path.resolve(p);
-    }
-    try {
-        p = require.resolve(p);
-    }
-    catch (e) {
-        builder_util_1.debug(e);
-        p = path.resolve(p);
-    }
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const m = require(p);
-    const namedExport = m[name];
-    if (namedExport == null) {
-        return m.default || m;
-    }
-    else {
-        return namedExport;
-    }
-}
-exports.resolveFunction = resolveFunction;
 function chooseNotNull(v1, v2) {
     return v1 == null ? v2 : v1;
 }
-exports.chooseNotNull = chooseNotNull;
 function capitalizeFirstLetter(text) {
     return text.charAt(0).toUpperCase() + text.slice(1);
 }
-function isSafeToUnpackElectronOnRemoteBuildServer(packager) {
-    if (packager.platform !== index_1.Platform.LINUX || packager.config.remoteBuild === false) {
-        return false;
-    }
-    if (process.platform === "win32" || builder_util_1.isEnvTrue(process.env._REMOTE_BUILD)) {
-        return packager.config.electronDist == null && packager.config.electronDownload == null;
-    }
-    return false;
-}
-exports.isSafeToUnpackElectronOnRemoteBuildServer = isSafeToUnpackElectronOnRemoteBuildServer;
 //# sourceMappingURL=platformPackager.js.map