代码签名

签名数据 + 时间戳服务器签名 → 带时间戳的签名

# 在 Xcode 中登录 Apple ID
# Preferences → Accounts → Manage Certificates → 点击 "+" 添加证书

# 或使用命令行
security create-keychain -p mypassword build.keychain
security default-keychain -s build.keychain
security unlock-keychain -p mypassword build.keychain

# 导入证书（从 Apple 下载的 .p12 文件）
security import certificate.p12 -k build.keychain -P password -T /usr/bin/codesign

# 列出所有代码签名证书
security find-identity -v -p codesigning

# 输出示例
# 1) XXXXXXXX "Apple Development: Your Name (XXXXXXXXXX)"
# 2) XXXXXXXX "Developer ID Application: Your Name (XXXXXXXXXX)"

// electron-builder.json
{
  "appId": "com.yourcompany.yourapp",
  "mac": {
    "category": "public.app-category.productivity",
    "hardenedRuntime": true,
    "gatekeeperAssess": false,
    "entitlements": "build/entitlements.mac.plist",
    "entitlementsInherit": "build/entitlements.mac.plist"
  },
  "afterSign": "scripts/notarize.js"
}

{
  "mac": {
    "target": [
      {
        "target": "dmg",
        "arch": ["x64", "arm64", "universal"]
      },
      {
        "target": "zip",
        "arch": ["x64", "arm64"]
      }
    ],
    "category": "public.app-category.productivity",
    "icon": "build/icon.icns",
    "hardenedRuntime": true,
    "gatekeeperAssess": false,
    "entitlements": "build/entitlements.mac.plist",
    "entitlementsInherit": "build/entitlements.mac.plist",
    "extendInfo": {
      "NSCameraUsageDescription": "This app requires camera access for video calls.",
      "NSMicrophoneUsageDescription": "This app requires microphone access for audio recording."
    }
  },
  "dmg": {
    "sign": false,
    "background": "build/dmg-background.png",
    "iconSize": 100,
    "contents": [
      { "x": 130, "y": 220 },
      { "x": 410, "y": 220, "type": "link", "path": "/Applications" }
    ]
  }
}

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <!-- 允许 JIT 编译（V8 引擎需要） -->
  <key>com.apple.security.cs.allow-jit</key>
  <true/>
  
  <!-- 允许未签名的可执行内存（某些原生模块需要） -->
  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
  <true/>
  
  <!-- 禁用库验证（允许加载动态库） -->
  <key>com.apple.security.cs.disable-library-validation</key>
  <true/>
  
  <!-- 允许 DYLD 环境变量 -->
  <key>com.apple.security.cs.allow-dyld-environment-variables</key>
  <true/>
  
  <!-- 网络客户端权限 -->
  <key>com.apple.security.network.client</key>
  <true/>
  
  <!-- 网络服务端权限 -->
  <key>com.apple.security.network.server</key>
  <true/>
  
  <!-- 文件读写权限（用户选择的文件） -->
  <key>com.apple.security.files.user-selected.read-write</key>
  <true/>
  
  <!-- 自动化权限（Apple Events） -->
  <key>com.apple.security.automation.apple-events</key>
  <true/>
</dict>
</plist>

// scripts/notarize.js
const { notarize } = require('@electron/notarize')
const path = require('path')

exports.default = async function notarizing(context) {
  const { electronPlatformName, appOutDir } = context
  
  // 仅在 macOS 上执行公证
  if (electronPlatformName !== 'darwin') {
    return
  }
  
  // 获取应用名称
  const appName = context.packager.appInfo.productFilename
  const appPath = path.join(appOutDir, `${appName}.app`)
  
  console.log(`开始公证: ${appPath}`)
  
  try {
    await notarize({
      appBundleId: 'com.yourcompany.yourapp',
      appPath: appPath,
      appleId: process.env.APPLE_ID,
      appleIdPassword: process.env.APPLE_ID_PASSWORD,  // App-Specific Password
      teamId: process.env.APPLE_TEAM_ID
    })
    console.log('公证完成!')
  } catch (error) {
    console.error('公证失败:', error)
    throw error
  }
}

# .env 文件（添加到 .gitignore）
APPLE_ID=your-apple-id@email.com
APPLE_ID_PASSWORD=xxxx-xxxx-xxxx-xxxx
APPLE_TEAM_ID=XXXXXXXXXX

# Team ID 可在开发者账户中查看：
# https://developer.apple.com/account/#/membership

# 1. 提交公证请求
xcrun notarytool submit "MyApp.zip" \
  --apple-id "your@email.com" \
  --password "xxxx-xxxx-xxxx-xxxx" \
  --team-id "XXXXXXXXXX" \
  --wait

# 2. 检查公证状态
xcrun notarytool info <submission-id> \
  --apple-id "your@email.com" \
  --password "xxxx-xxxx-xxxx-xxxx" \
  --team-id "XXXXXXXXXX"

# 3. 公证通过后，将票据附加到应用
xcrun stapler staple "MyApp.app"

# 4. 验证票据
xcrun stapler validate "MyApp.app"

// electron-builder.json
{
  "win": {
    "target": "nsis",
    "icon": "build/icon.ico",
    "sign": "./scripts/sign.js",
    "signingHashAlgorithms": ["sha256"],
    "certificateFile": "path/to/certificate.pfx",
    "certificatePassword": "${CERT_PASSWORD}",
    "publisherName": "Your Company Name"
  }
}

// scripts/sign.js
const { execSync } = require('child_process')
const path = require('path')

exports.default = async function(configuration) {
  const certFile = process.env.WIN_CSC_LINK
  const password = process.env.WIN_CSC_KEY_PASSWORD
  
  if (!certFile || !password) {
    console.warn('未配置 Windows 签名证书，跳过签名')
    return
  }
  
  // 使用 signtool 签名
  const signToolPath = path.join(
    process.env['ProgramFiles(x86)'] || process.env.ProgramFiles,
    'Windows Kits',
    '10',
    'bin',
    '10.0.19041.0',  // 根据实际安装的 SDK 版本调整
    'x64',
    'signtool.exe'
  )
  
  const command = `"${signToolPath}" sign /fd SHA256 /f "${certFile}" /p "${password}" /tr http://timestamp.digicert.com /td SHA256 "${configuration.path}"`
  
  try {
    execSync(command, { stdio: 'inherit' })
    console.log('签名成功:', configuration.path)
  } catch (error) {
    console.error('签名失败:', error)
    throw error
  }
}

// scripts/sign-azure.js
const { execSync } = require('child_process')

exports.default = async function(configuration) {
  const command = `azuresigntool sign \
    --azure-key-vault-url "${process.env.AZURE_KEY_VAULT_URL}" \
    --azure-key-vault-client-id "${process.env.AZURE_CLIENT_ID}" \
    --azure-key-vault-tenant-id "${process.env.AZURE_TENANT_ID}" \
    --azure-key-vault-client-secret "${process.env.AZURE_CLIENT_SECRET}" \
    --azure-key-vault-certificate "${process.env.AZURE_CERTIFICATE_NAME}" \
    --timestamp-rfc3161 http://timestamp.digicert.com \
    --timestamp-digest sha256 \
    --digest-algorithm sha256 \
    "${configuration.path}"`
  
  execSync(command.replace(/\\/g, ''), { stdio: 'inherit' })
}

{
  "win": {
    "target": [
      {
        "target": "nsis",
        "arch": ["x64", "ia32"]
      }
    ]
  },
  "nsis": {
    "oneClick": false,
    "perMachine": true,
    "allowToChangeInstallationDirectory": true,
    "installerIcon": "build/installer.ico",
    "uninstallerIcon": "build/uninstaller.ico",
    "license": "LICENSE.txt"
  }
}

# 生成 SHA256 校验和
sha256sum MyApp-1.0.0.AppImage > MyApp-1.0.0.AppImage.sha256

# 验证校验和
sha256sum -c MyApp-1.0.0.AppImage.sha256

# 生成 GPG 密钥对（如果还没有）
gpg --full-generate-key

# 导出公钥
gpg --armor --export your@email.com > public-key.asc

# 签名文件
gpg --armor --detach-sign MyApp-1.0.0.AppImage

# 验证签名
gpg --verify MyApp-1.0.0.AppImage.asc MyApp-1.0.0.AppImage

{
  "linux": {
    "target": [
      {
        "target": "AppImage",
        "arch": ["x64"]
      },
      {
        "target": "deb",
        "arch": ["x64", "arm64"]
      }
    ],
    "category": "Utility",
    "maintainer": "Your Name <your@email.com>",
    "desktop": {
      "Name": "MyApp",
      "Comment": "A great application",
      "Categories": "Utility;Development"
    }
  }
}

# .github/workflows/release.yml
name: Build and Release

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [macos-latest, windows-latest, ubuntu-latest]
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      # macOS 签名和公证
      - name: Prepare macOS Signing
        if: matrix.os == 'macos-latest'
        env:
          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
        run: |
          # 将 base64 编码的证书解码并导入
          echo $CSC_LINK | base64 --decode > certificate.p12
          security create-keychain -p actions temp.keychain
          security import certificate.p12 -k temp.keychain -P $CSC_KEY_PASSWORD -T /usr/bin/codesign
          security list-keychain -d user -s temp.keychain
          rm certificate.p12
      
      - name: Build Electron App
        env:
          # macOS
          CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
          CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          # Windows
          WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
          WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
        run: npm run build
      
      - name: Upload Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.os }}-build
          path: |
            dist/*.exe
            dist/*.dmg
            dist/*.AppImage
            dist/*.deb
          retention-days: 30

  release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Download Artifacts
        uses: actions/download-artifact@v4
      
      - name: Create Release
        uses: softprops/action-gh-release@v1
        with:
          files: |
            **/*.exe
            **/*.dmg
            **/*.AppImage
            **/*.deb
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# .gitlab-ci.yml
stages:
  - build
  - release

build:mac:
  stage: build
  tags:
    - macos
  only:
    - tags
  script:
    - npm ci
    - npm run build
  artifacts:
    paths:
      - dist/*.dmg
      - dist/*.zip
    expire_in: 1 week
  variables:
    CSC_LINK: $MAC_CSC_LINK
    CSC_KEY_PASSWORD: $MAC_CSC_KEY_PASSWORD
    APPLE_ID: $APPLE_ID
    APPLE_ID_PASSWORD: $APPLE_ID_PASSWORD
    APPLE_TEAM_ID: $APPLE_TEAM_ID

build:windows:
  stage: build
  tags:
    - windows
  only:
    - tags
  script:
    - npm ci
    - npm run build
  artifacts:
    paths:
      - dist/*.exe
    expire_in: 1 week
  variables:
    WIN_CSC_LINK: $WIN_CSC_LINK
    WIN_CSC_KEY_PASSWORD: $WIN_CSC_KEY_PASSWORD

# 验证代码签名
codesign --verify --verbose /path/to/App.app

# 验证签名详情
codesign -dvvv /path/to/App.app

# 验证 Gatekeeper 状态
spctl --assess --verbose /path/to/App.app

# 验证公证状态
spctl -a -t execute -vv /path/to/App.app

# 查看公证票据
stapler validate /path/to/App.app

# 输出应该显示：
# MyApp.app: Accepted

# PowerShell 查看签名信息
Get-AuthenticodeSignature "path\to\App.exe"

# 使用 signtool 验证
signtool verify /pa /all "path\to\App.exe"

# 检查签名详情
signtool verify /v /pa "path\to\App.exe"

# 1. 检查签名
codesign -dvvv /path/to/App.app

# 2. 检查公证
spctl -a -t execute -vv /path/to/App.app

# 3. 检查 Hardened Runtime
codesign -d --entitlements :- /path/to/App.app

# 4. 重新签名
codesign --force --deep --sign "Developer ID Application: Your Name" /path/to/App.app

The signature of the binary is invalid

# 查找未签名的二进制文件
find MyApp.app -name '*.dylib' -o -name '*.so' | while read f; do
  codesign -v "$f" 2>&1 || echo "Unsigned: $f"
done

# 签名所有二进制文件
find MyApp.app -name '*.dylib' -exec codesign --force --sign "Developer ID Application: Your Name" {} \;

The binary uses an SDK version earlier than 10.9

{
  "win": {
    "signingHashAlgorithms": ["sha256"],
    "rfc3161TimeStampServer": "http://timestamp.digicert.com"
  }
}

// 在签名前关闭文件句柄
const fs = require('fs')

async function beforeSign(filePath) {
  // 等待文件完全写入
  await new Promise(resolve => setTimeout(resolve, 1000))
  
  // 确保文件可写
  fs.accessSync(filePath, fs.constants.W_OK)
}

# 添加调试信息
- name: Debug Signing
  run: |
    echo "Checking certificate..."
    security find-identity -v -p codesigning || echo "No identities found"
    echo "Checking environment variables..."
    env | grep -E '(CSC|APPLE)' | sed 's/=.*/=***/'

// 推荐的签名配置
{
  // macOS
  mac: {
    hardenedRuntime: true,          // 启用强化运行时
    gatekeeperAssess: false,        // 禁用 Gatekeeper 评估
    entitlements: '...',            // 明确声明权限
  },
  
  // Windows
  win: {
    signingHashAlgorithms: ['sha256'],  // 使用 SHA-256
    rfc3161TimeStampServer: '...',      // 添加时间戳
  }
}