Ferdi: Signing and notarisation on Mac

[vantezzen]

Currently, when first opening a Ferdi build on MacOS, you'll get this error:

This is because Ferdi is not signed using an Apple Developer ID. The only way to open Ferdi is to use ctrl-click > "Open".

From MacOS Catalina onwards, you'll also get this error because Ferdi isn't notarised either:

These two warnings will probably scare off new users switching from Franz, as they might think Ferdi is a virus.

The problem is, that we would need an Apple Developer ID to sign and notarise Ferdi, costing 100$ per year.

Are there any suggestions on how one could solve this problem? Any Developer IDs we could use?

[kytwb]

I don't have an Apple Developer ID at the moment, but I could sort that out.

[shenwalter]

Hi, to circumvent that issue you want to right click on Ferdi, and then in the menu click "open".

After that, the same message should pop up but it'll give you the option to actually open Ferdi. Hopefully this works!

[vantezzen]

@shenwalter Thank you for your comment. I also mentioned this "trick" in my original comment, but I don't think this will work as a permanent solution:

This will work for all experienced users, but unexperienced users will not know this "trick" - especially because Franz is signed, meaning they don't need to use the trick there - and also probably won't search for this trick as they will think Ferdi (not having a button to open by default) might be a virus or could harm their computer.

[kytwb]

I have the Apple Developer Program membership sorted; will take a look at the next steps soon.

[kytwb]

~Maybe related:~

Will not use, seems deprecated/unused: https://github.com/kytwb/ferdi/blob/f5b266719d90639b673c0e0344144f8c443f7378/gulpfile.babel.js#L181

[kytwb]

~Maybe related: https://www.jviotti.com/2016/03/16/how-to-code-sign-os-x-electron-apps-in-travis-ci.html~

[kytwb]

Will follow https://github.com/electron/electron-osx-sign/wiki/1.-Getting-Started#create-your-certificates to generate certificates; then refer to https://www.electron.build/code-signing as we use electron-builder for the build command.

Still waiting on the membership to activate to be able to generate the certificates:

Your purchase may take up to 48 hours to process.

[vantezzen]

Also related: https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/

[kytwb]

  • electron-builder version=20.43.0
  • loaded configuration file=/Users/kytwb/Downloads/Side Projects/ferdi/electron-builder.yml
  • electron-rebuild not required if you use electron-builder, please consider to remove excess dependency from devDependencies

To ensure your native dependencies are always matched electron version, simply add script `"postinstall": "electron-builder install-app-deps" to your `package.json`
  • writing effective config file=out/builder-effective-config.yaml
  • installing production dependencies platform=darwin arch=x64 appDir=/Users/kytwb/Downloads/Side Projects/ferdi/build
  • packaging       platform=darwin arch=x64 electron=4.2.4 appOutDir=out/mac
  • signing         file=out/mac/Ferdi.app identityName=Developer ID Application: Amine Mouafik (B6J9X9DWFL) identityHash=0DB37648852C073A6B47DE14AD8B9F686D840B4D provisioningProfile=none
  • building        target=macOS zip arch=x64 file=out/Ferdi-5.3.3-mac.zip
  • building        target=DMG arch=x64 file=out/Ferdi-5.3.3.dmg
(node:45614) Warning: a promise was created in a handler at /Users/kytwb/Downloads/Side Projects/ferdi/node_modules/app-builder-lib/src/macPackager.ts:91:26 but was not returned from it, see http://goo.gl/rRqMUw
    at /Users/kytwb/Downloads/Side Projects/ferdi/node_modules/bluebird/js/release/generators.js:197:21
  • building block map blockMapFile=out/Ferdi-5.3.3.dmg.blockmap
  • building embedded block map file=out/Ferdi-5.3.3-mac.zip

Looking at making signing work in Travis next.

[kytwb]

Added to https://travis-ci.org/kytwb/ferdi/settings

As per https://www.electron.build/code-signing#travis-appveyor-and-other-ci-servers.

[kytwb]

Also added the env variables used in build-helpers/notarize.js (see https://github.com/kytwb/ferdi/pull/52/commits/96bf053ac6cb90a8bfb87fd89ffe866e9cbf015f):

Edit: At first, I experienced a "This Apple ID has been locked for security reasons." error when trying to notorize the app using the APPLEID and app-specific APPLEID_PASSWORD I generated; I had to use the Application Loader developer tool from Xcode to login with these credentials and check the "keep me signed in" box. Worked afterwise.

[kytwb]

Email received after https://travis-ci.org/kytwb/ferdi/jobs/586865267 succeeded:

[kytwb]

@all-contributors add @vantezzen for example

[allcontributors[bot]]

@kytwb

I've put up a pull request to add @vantezzen! :tada:

[vantezzen]

@kytwb Could you also remove meetfranz.com as the project URL from GitHub?

I think it is not fitting to link the fork origin project as the project URL, I would just keep it blank.

[kytwb]

@vantezzen done 👍

[kytwb]

[vantezzen]

Still waiting on the membership to activate to be able to generate the certificates:

Your purchase may take up to 48 hours to process.

@kytwb Can you add this expense to opencollective?

[kytwb]

@vantezzen Done 👍