harden

.circleci/config.yml

@@ -309,6 +309,7 @@ jobs:
             cd apps/remixdesktop
             xcrun notarytool store-credentials "notarytool-password" \
                --apple-id ${APPLE_ID} \
+               --team-id ${APPLE_TEAM_ID} \
                --password ${APPLE_ID_PASSWORD}
             # Assuming your app is packaged as a dmg or zip for notarization
             xcrun notarytool submit 'release/Remix IDE-0.0.11-Alpha.dmg' \

apps/remixdesktop/entitlements.mac.plist

@@ -0,0 +1,13 @@
+
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+  </dict>
+</plist>

apps/remixdesktop/package.json

@@ -30,6 +30,7 @@
     "postinstall": "electron-builder install-app-deps"
   },
   "devDependencies": {
+    "@electron/notarize": "^2.3.0",
     "@electron/rebuild": "^3.2.13",
     "@types/byline": "^4.2.35",
     "@types/express": "^4.17.21",
@@ -69,13 +70,15 @@
     "files": [
       "build/**/*"
     ],
-    "publish": [{
+    "publish": [
-      "provider": "github",
+      {
-      "owner": "bunsenstraat",
+        "provider": "github",
-      "repo": "remix-desktop",
+        "owner": "bunsenstraat",
-      "releaseType": "draft",
+        "repo": "remix-desktop",
-      "publishAutoUpdate": true
+        "releaseType": "draft",
-    }],
+        "publishAutoUpdate": true
+      }
+    ],
     "mac": {
       "category": "public.app-category.productivity",
       "target": [
@@ -88,10 +91,15 @@
         }
       ],
       "icon": "assets/icon.png",
-      "darkModeSupport": true
+      "darkModeSupport": true,
+      "hardenedRuntime" : true,
+      "gatekeeperAssess": false,
+      "entitlements": "entitlements.mac.plist",
+      "entitlementsInherit": "entitlements.mac.plist"
     },
     "dmg": {
-      "writeUpdateInfo": false
+      "writeUpdateInfo": false,
+      "sign": false
     },
     "nsis": {
       "createDesktopShortcut": "always",

apps/remixdesktop/src/entitlements.mac.plist

@@ -1,19 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-    <key>com.apple.security.cs.allow-jit</key>
-    <true/>
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-    <true/>
-    <key>com.apple.security.cs.disable-executable-page-protection</key>
-    <true/>
-    <key>com.apple.security.cs.disable-library-validation</key>
-    <true/>
-    <key>com.apple.security.network.client</key>
-    <true/>
-    <key>com.apple.security.network.server</key>
-    <true/>
-    <!-- Add other entitlements as needed -->
-</dict>
-</plist>

apps/remixdesktop/yarn.lock

@@ -37,6 +37,15 @@
   optionalDependencies:
     global-agent "^3.0.0"
 
+"@electron/notarize@^2.3.0":
+  version "2.3.0"
+  resolved "https://registry.yarnpkg.com/@electron/notarize/-/notarize-2.3.0.tgz#9659cf6c92563dd69411afce229f52f9f7196227"
+  integrity sha512-EiTBU0BwE7HZZjAG1fFWQaiQpCuPrVGn7jPss1kUjD6eTTdXXd29RiZqEqkgN7xqt/Pgn4g3I7Saqovanrfj3w==
+  dependencies:
+    debug "^4.1.1"
+    fs-extra "^9.0.1"
+    promise-retry "^2.0.1"
+
 "@electron/rebuild@^3.2.13":
   version "3.2.13"
   resolved "https://registry.npmjs.org/@electron/rebuild/-/rebuild-3.2.13.tgz"