1.1.0 (2024-03-20)

Features

• adding support for specifying per-file requirements as a string (#310) (7f7934f)

1.0.5 (2023-08-18)

Bug Fixes

• export SignOptions type (#274) (01bd4c2)
• only apply preAutoEntitlements to top-level app bundle (#292) (06b32b5)

This is a minor patch introducing support for the hardened runtime (introduced in Mojave), with a plist dependency security update.

Added:

• --hardened-runtime option to pass to codesign enabling hardened runtime (#176).

Security:

• Fix plist dependency vulnerability (#175).

Due to a release issue with v0.4.9 on npm (https://github.com/electron-userland/electron-osx-sign/issues/165), please use v0.4.10 instead though there being no activity on the repo.

This is a minor patch addressing the syntax of --timestamp option passed into codesign that results in unsuccessful attempts to code-sign.

Fixed:

• Code-sign with timestamp specified should no longer error (issue #163, #164).

This is a minor patch that adds support to adjust --strict option passed to codesign on macOS ^10.11.

Added:

• --strict-verify, --strict-verify=options, --no-strict-verify options to pass to codesign (issue https://github.com/electron-userland/electron-osx-sign/issues/161).

Fixed:

• Avoid false-positive when existing com.apple.security.application-groups in entitlements is string (https://github.com/electron-userland/electron-osx-sign/issues/161).

This is a minor patch that introduces passing ignore options as an array (#142) and few other changes.

Changes:

• electron-osx-sign version is now displayed in the debug log at the beginning of the procedure (#143).
• tempfile dependency is removed (#146).

Added:

• opts.ignore now supports an array of previously available ignore options like electron-packager (#142).

This is a minor patch fixing an issue resulted from using identity hash for codesigning (#135/#136).

This update deprecates electron-osx-flat due to packages like electron-builder having supported better package building tools. It also introduces codesigning with explicit SHA-1 hashed certs (#132, #134) that resolves a minor issue in codesign encountering segmentation fault as discussed here.

Added:

• --timestamp=timestamp option to pass timestamp authority server to codesign (#133).

Minor changes.

This release introduces minor updates with signing verification that do not affect performance in macOS El Capitan and above and enhance compatibility with earlier system versions.

Fixed:

• --strict flag only passed in macOS El Capitan and above.

Fixed:

• Validation for --provisioning-profile/opts['provisioning-profile'].
• No longer display blob header of signed entitlements file.

Updated:

• Codesign verify with strict flag in El Capitan and later.
• Deprecated debugerror and various versions of electron-osx-sign:* for logging.

Added:

• Skip Gatekeeper assess with --no-gatekeeper-assess/opts['gatekeeper-assess'].

Minor changes.

This release features a partial rewrite of electron-osx-sign where components are broken down in submodules for better code structure. The package now also supports the latest macOS update; while retaining osx as part of the package name, electron-osx-sign supports automated code signing and product building on macOS Sierra.

Added:

• Strict codesign verification similar to Gatekeeper check (https://github.com/electron-userland/electron-osx-sign/commit/eed27ddc2211ff75601954cf3a7937ecf187cb71).
• Enable/disable provisioning profile embedding with --pre-embed-provisioning-profile/--no-pre-embed-provisioning-profile (https://github.com/electron-userland/electron-osx-sign/commit/dfad463bd7acfea14b637c61735da2d2be2e51b2).
• opts.scripts option for productbuild (https://github.com/electron-userland/electron-osx-sign/commit/b1644aa3fc0c92402b89042a91d6ec28d082ed44).
• Gatekeeper acceptance of code signed platform darwin builds (https://github.com/electron-userland/electron-osx-sign/commit/6bae78e486dbb73db0f87ed88ffca7dae4b2a3b6).
• Mention blob header while displaying entitlements (https://github.com/electron-userland/electron-osx-sign/commit/9a5fcea66a39fa0ce4ee768d5a2bdcf095d94e3f).
• opts.requirements option for codesign (https://github.com/electron-userland/electron-osx-sign/commit/a01e8a448d10c493b81d5b0f578a6855cabbf46e).

Fixed:

• opts.ignore revised for code signing (https://github.com/electron-userland/electron-osx-sign/commit/1bd17ca40bc16e5241ba587be1419b2938f5ad9f).
• Dev dependency on run-series (https://github.com/electron-userland/electron-osx-sign/commit/16732d639d8d3cef423ec7722c56d9bc6666a16b).
• opts.ignore validation logic (https://github.com/electron-userland/electron-osx-sign/commit/1e8a8da13a2c39e858ae2697c37df84984a114ad).

Developer notes:

• Added: Travis CI support for Node 6 (https://github.com/electron-userland/electron-osx-sign/commit/b5753c43b922ac11ff39ba9c976423e63ebd26b9).

• Added: opts.requirements to specify the criteria to be used to evaluate code signature.

• Fixed: Better support for code linting with eslint. (#53)
• Changed: Renamed all entitlements file to format: entitlements.darwin/mas[.inherit].plist. (#55, #56)

• Fixed: Check availability of entitlements before automation. (#52)
• Changed: TypeScript updated. (#52)

Fixed: Entitlements not updated in automation. (#51)

This release is very much a complete rewrite of electron-osx-sign so bugs may come as expected. Bluebird promises are introduced for some performance boost with async methods. However, please note that none of the previously available methods are changed, APIs kept the same for best compatibility solutions.

• Added: signAsync() and flatAsync() introduced, returning Bluebird promises. (#47)
• Added: preAutoEntitlementAppGroupAsync() introduced to assist recent changes with Electron versions >= 1.1.1 for automation on Info.plist and entitlements file. (https://github.com/electron-userland/electron-packager/issues/371, #44)
• Added: opts.version flag to specify Electron version. Default to latest Electron version. (#44)
• Added: opts.pre-auto-entitlements to enable/disable automation on entitlements with preAutoEntitlementAppGroupAsync(). Default to true. (#44)
• Changed: Now use Bluebird promises for better async methods. (#47)
• Changed: Now display app entitlements after signing in debug logs. (#43)
• Fixed: Default entitlements for darwin platform. (#38)
• Fixed: Verify app bundle after code sign in debug logs. (#48)

• Added: opts.keychain to limit and to find identity for signing.
• Added: opts.ignore of electron-osx-sign to verify whether file to be signed.
• Changed: Array.indexOf instead of Array.includes for better compatibility.
• Changed: Binary files, including native node addons are now automatically signed.
• Changed: node_modules no longer skipped.
• Changed: Now uses external module debug to display logs and messages, need export DEBUG=electron-osx-sign*.
• Deprecated: opts.verbose.