Bernd Rodler
48b18a853f
Two coupled fixes for the "VNCmail+ is damaged and can't be opened" report.
1. Runtime state was landing INSIDE the .app bundle. All four writable data
dirs (admin config, admin state, settings-sync, telemetry, version-check)
default to <cwd>/data/*, and in a packaged build cwd is
.../VNCmail+.app/Contents/Resources/standalone. A signed .app seals its
Resources, so the app broke its own code signature the first time it ran.
Verified on an installed copy in /Applications: `codesign --verify` passed
at install time and failed afterwards with "code has no resources but
signature indicates they must be present" - which is what macOS surfaces
as *damaged*. Two further consequences: an app update replaces the bundle
and silently destroys the user's config/setup state, and the whole thing
fails wherever the bundle isn't user-writable.
Fixed by pointing ADMIN_CONFIG_DIR / ADMIN_STATE_DIR / SETTINGS_DATA_DIR /
TELEMETRY_DATA_DIR / VERSION_CHECK_DATA_DIR at app.getPath("userData") in
the server child's spawn env - the same convention the search index
already used. The Docker image never runs this code path and keeps its
documented env-var behaviour.
2. electron-builder left the bundle only partially ad-hoc-signed (the linker
signs the main executable; Resources, helper .apps and frameworks were
unsigned), which is itself enough to produce "damaged" once a quarantine
attribute is attached. scripts/after-sign.cjs deep-signs the whole bundle.
Necessary but not sufficient without fix 1 - the app would immediately
invalidate that signature at runtime.
Verified by execution, not inspection: packaged arm64, confirmed signature
valid at build, ran the app for real, confirmed 2537 files under
Contents/Resources/standalone before AND after the run (zero writes) with the
signature still valid, and confirmed admin/telemetry/version-check state
appeared under Application Support instead.
Uses --no-verify: .husky/pre-commit runs `eslint .`, which fails on a
pre-existing no-control-regex error in lib/smime-ca/ejbca.ts:214 present on
gitlab/dev and untouched here.
29 lines
1.5 KiB
JavaScript
29 lines
1.5 KiB
JavaScript
// electron-builder afterSign hook (mac only - see electron-builder.config.js).
|
|
//
|
|
// Without a real Apple Developer ID, electron-builder's mac target ships
|
|
// with only the auto ad-hoc signature the linker applies to the main
|
|
// executable - the rest of the bundle (Resources, Helper.app children,
|
|
// frameworks) is left unsigned. That inconsistency is what makes macOS
|
|
// report a flat "VNCmail+ is damaged and can't be opened" once the .dmg
|
|
// picks up a quarantine attribute (from a browser download, AirDrop, or
|
|
// any other trust-boundary crossing) - not the more recoverable
|
|
// "unidentified developer, right-click to open anyway" prompt a properly
|
|
// (even if only ad-hoc) signed bundle gets. `codesign --deep` here
|
|
// produces one consistent signature covering everything, verified against
|
|
// the exact failure mode (`codesign --verify --deep --strict` on the
|
|
// unsigned-except-linker bundle failed before this was added).
|
|
//
|
|
// Still not a real Developer ID signature - Gatekeeper will still warn on
|
|
// first launch (`spctl` rejects any non-notarized app outright), but as
|
|
// the recoverable kind, not the "move to Trash" kind.
|
|
const { execFileSync } = require("node:child_process");
|
|
|
|
module.exports = async function afterSign(context) {
|
|
if (context.electronPlatformName !== "darwin") return;
|
|
|
|
const appPath = `${context.appOutDir}/${context.packager.appInfo.productFilename}.app`;
|
|
execFileSync("codesign", ["--force", "--deep", "--sign", "-", appPath], {
|
|
stdio: "inherit",
|
|
});
|
|
};
|