search

SchildiChat / schildichat-desktop

Matrix client / Element Web/Desktop fork
https://schildi.chat
Apache License 2.0
371 stars 42 forks source link

proper signing/gatekeeper for macOS #78

Closed kloenk closed 2 years ago

kloenk commented 2 years ago

Currently Schildichat is not Signed nor notarised. This creates a warning, and disables some features like NSUserActivities.

I have a apple developer account, So I would be up to sign and also give it to apple to notarise it. I just would like to hear If I may do that, don't want to harm licensing.

kloenk commented 2 years ago

For notarising IIRC we also need to enable hardened runtime on the electron wrapper.

su-ex commented 2 years ago

@michi7801

kloenk commented 2 years ago

For some interesting reasons. The electron build script does not do a deep sign. So the app is unusable if only singed by the electron builder

michi7801 commented 2 years ago

Yeah, I would love to see the MacOS build signed or even published in the AppStore. I never have done this myself, but there is a tutorial in the offical docs for it: https://www.electronjs.org/docs/tutorial/code-signing

Seems like this requires some additional steps....

I am not really sure how to help you with that, but if you need something just let me know.

kloenk commented 2 years ago

App Store needs Export stuff, because of the weapon Schildichat is xD.

I already added a info the the plist, so the App Store does not accept it without a warning. Currently I managed to get valid signatures, but it does not start. something about the libffmpeg embedded.

kloenk commented 2 years ago

@michi7801 right now there is only one thing I would known where I could use some help: testing. If you are up to it, just contact me with matrix (@kloenk:petabyte.dev)

kloenk commented 2 years ago

Keeping it here for later use. The list of technologies used by electron (we of course use OLM as well) https://www.electronjs.org/docs/tutorial/mac-app-store-submission-guide#cryptographic-algorithms-used-by-electron

kloenk commented 2 years ago

I currently see this error. Probably somehow introduced by hak.


Keytar unexpected error: Error: dlopen(/var/folders/ds/ymz2j7wn61gf7y8j5hzklvfc0000gn/T/chat.schildi.desktop/.T58RJ7QENS.chat.schildi.desktop.vBpED3, 1): no suitable image found.  Did find:
    /var/folders/ds/ymz2j7wn61gf7y8j5hzklvfc0000gn/T/chat.schildi.desktop/.T58RJ7QENS.chat.schildi.desktop.vBpED3: code signature in (/var/folders/ds/ymz2j7wn61gf7y8j5hzklvfc0000gn/T/chat.schildi.desktop/.T58RJ7QENS.chat.schildi.desktop.vBpED3) not valid for use in process using Library Validation: library load disallowed by system policy
    /var/folders/ds/ymz2j7wn61gf7y8j5hzklvfc0000gn/T/chat.schildi.desktop/.T58RJ7QENS.chat.schildi.desktop.vBpED3: stat() failed with errno=17
    at process.func [as dlopen] (electron/js2c/asar_bundle.js:5:1846)
    at Object.Module._extensions..node (internal/modules/cjs/loader.js:1138:18)
    at Object.func [as .node] (electron/js2c/asar_bundle.js:5:2073)
    at Module.load (internal/modules/cjs/loader.js:935:32)
    at Module._load (internal/modules/cjs/loader.js:776:14)
    at Function.f._load (electron/js2c/asar_bundle.js:5:12913)
    at Module.require (internal/modules/cjs/loader.js:959:19)
    at require (internal/modules/cjs/helpers.js:88:18)
    at Object.<anonymous> (/Users/kloenk/Developer/web/schildichat-desktop/element-desktop/dist/mas/SchildiChat.app/Contents/Resources/app.asar/node_modules/keytar/lib/keytar.js:1:14)
    at Module._compile (internal/modules/cjs/loader.js:1078:30)
Seshat unexpected error: Error: dlopen(/var/folders/ds/ymz2j7wn61gf7y8j5hzklvfc0000gn/T/chat.schildi.desktop/.T58RJ7QENS.chat.schildi.desktop.MxVKAx, 1): no suitable image found.  Did find:
    /var/folders/ds/ymz2j7wn61gf7y8j5hzklvfc0000gn/T/chat.schildi.desktop/.T58RJ7QENS.chat.schildi.desktop.MxVKAx: code signature in (/var/folders/ds/ymz2j7wn61gf7y8j5hzklvfc0000gn/T/chat.schildi.desktop/.T58RJ7QENS.chat.schildi.desktop.MxVKAx) not valid for use in process using Library Validation: library load disallowed by system policy
    /var/folders/ds/ymz2j7wn61gf7y8j5hzklvfc0000gn/T/chat.schildi.desktop/.T58RJ7QENS.chat.schildi.desktop.MxVKAx: stat() failed with errno=17
    at process.func [as dlopen] (electron/js2c/asar_bundle.js:5:1846)
    at Object.Module._extensions..node (internal/modules/cjs/loader.js:1138:18)
    at Object.func [as .node] (electron/js2c/asar_bundle.js:5:2073)
    at Module.load (internal/modules/cjs/loader.js:935:32)
    at Module._load (internal/modules/cjs/loader.js:776:14)
    at Function.f._load (electron/js2c/asar_bundle.js:5:12913)
    at Module.require (internal/modules/cjs/loader.js:959:19)
    at require (internal/modules/cjs/helpers.js:88:18)
    at Object.<anonymous> (/Users/kloenk/Developer/web/schildichat-desktop/element-desktop/dist/mas/SchildiChat.app/Contents/Resources/app.asar/node_modules/matrix-seshat/lib/index.js:16:22)
    at Module._compile (internal/modules/cjs/loader.js:1078:30)
Other instance detected: exiting
kloenk commented 2 years ago

@michi7801 maybe you saw in the pr that I fixed all those errors. AKA I have a notarised version of SchildiChat. My current problem is this when using the sandbox and an electron mas build.


[71245:0806/153148.394862:FATAL:gpu_data_manager_impl_private.cc(415)] GPU process isn't usable. Goodbye.
michi7801 commented 2 years ago

First of all: Very good job! I am really looking forward to see SchildiChat in the MAS.

Seems to have something to do with hardware acceleration and some wrong paths. There are a lot of people on the internet reporting this problem, but nothing really useful.

You can try to disable HW acceleration... Not permanently of course, but just to see if it helps.

kloenk commented 2 years ago

Tried many version of disabling hw accell. Only one did do anything, That just created a white window, and nothing was drawn at all