Skip to content

Commit b0ca6ae

Browse files
CryptIT-DevCryptIT-Dev
committed
Merge branch 'fb-tiny-keys' into feat/time-based-challenge
2 parents e7cc8b5 + f3f0d27 commit b0ca6ae

File tree

8 files changed

+1535
-357
lines changed

8 files changed

+1535
-357
lines changed

‎.github/workflows/release.yml

+13
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,13 @@ jobs:
5353

5454
- name: Install dependencies
5555
run: pnpm install
56+
57+
- name: Import mac certificate to keychain
58+
uses: apple-actions/import-codesign-certs@v3
59+
with:
60+
p12-file-base64: ${{ secrets.MAC_CERTIFICATE_P12_BASE64 }}
61+
p12-password: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
62+
if: matrix.os == 'macos-latest'
5663

5764
# Use the version generated from dry-run in the build process
5865
- name: Set desktop app package version
@@ -63,6 +70,12 @@ jobs:
6370

6471
- name: Build monorepo
6572
run: npx nx run-many --target=build --all
73+
env:
74+
CSC_LINK: ${{ secrets.MAC_CERTIFICATE_P12_BASE64 }}
75+
CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
76+
APPLE_ID: ${{ secrets.APPLE_ID }}
77+
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
78+
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
6679

6780
- name: Upload sentry-client-desktop artifacts
6881
uses: actions/upload-artifact@v4

‎.github/workflows/test-release.yml

+27
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,21 @@ on:
55
branches:
66
- '**'
77

8+
on:
9+
pull_request:
10+
types: [review_requested]
11+
branches:
12+
- "*"
13+
14+
pull_request_review:
15+
types: [submitted]
16+
branches:
17+
- '*'
18+
819
jobs:
920
# Matrix build jobs that depend on the dryrun job
1021
build:
22+
if: github.event_name == 'pull_request' || github.event.review.state == 'approved'
1123
strategy:
1224
matrix:
1325
os: [ubuntu-latest, macos-latest, windows-latest]
@@ -34,6 +46,13 @@ jobs:
3446
- name: Install dependencies
3547
run: pnpm install
3648

49+
- name: Import mac certificate to keychain
50+
uses: apple-actions/import-codesign-certs@v3
51+
with:
52+
p12-file-base64: ${{ secrets.MAC_CERTIFICATE_P12_BASE64 }}
53+
p12-password: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
54+
if: matrix.os == 'macos-latest'
55+
3756
# Use the version generated from dry-run in the build process
3857
- name: Set desktop app package version
3958
run: pnpm pkg set version=${{ env.VERSION }} --prefix apps/sentry-client-desktop
@@ -43,6 +62,12 @@ jobs:
4362

4463
- name: Build monorepo
4564
run: npx nx run-many --target=build --all
65+
env:
66+
CSC_LINK: ${{ secrets.MAC_CERTIFICATE_P12_BASE64 }}
67+
CSC_KEY_PASSWORD: ${{ secrets.MAC_CERTIFICATE_PASSWORD }}
68+
APPLE_ID: ${{ secrets.APPLE_ID }}
69+
APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
70+
APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
4671

4772
- name: Upload sentry-client-desktop artifacts
4873
uses: actions/upload-artifact@v4
@@ -65,6 +90,7 @@ jobs:
6590
path: apps/cli/release
6691

6792
sign:
93+
if: github.event_name == 'pull_request' || github.event.review.state == 'approved'
6894
needs: build
6995
runs-on: ubuntu-latest
7096

@@ -97,6 +123,7 @@ jobs:
97123
path: release-desktop-windows-latest
98124

99125
checksum-and-release:
126+
if: github.event_name == 'pull_request' || github.event.review.state == 'approved'
100127
needs: sign
101128
runs-on: macos-latest
102129

‎apps/sentry-client-desktop/README.md

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
# Xai Sentry Desktop Client
2+
3+
An electron & vite cross platform desktop client for the Sentry Node Operator building on top of the `@sentry/core` operator services.
4+
5+
## Local development
6+
7+
Running and building is done from the root of the monorepo.
8+
The monorepo will handle all npm dependencies
9+
10+
From the root run
11+
12+
- `pnpm desktop` to run a local dev instance with hot reload
13+
- `pnpm -filter @sentry/sentry-client-desktop build` to create a release build for the current working os
14+
15+
Building the monorepo with `pnpm run build` from the root of the repo will also create a release build of the desktop client.
16+
17+
## Release build and signing
18+
19+
The desktop client is build using [`electron-builder`](https://www.electron.build/code-signing.html). The configuration for the release build is defined in `apps\sentry-client-desktop\electron-builder.json5`. The release build will create the release for the OS running the build, so for multi platform release the build has to be run on all required platforms.
20+
21+
### Windows
22+
23+
Windows signing is done with SSL.com in the release workflow using the [EV Code signing certificate](https://www.electron.build/code-signing.html#windows)
24+
25+
Required build environment variables for signing:
26+
27+
28+
- `SSL_USERNAME` SSL.com login username
29+
- `SSL_PASSWORD` SSL.com login password
30+
- `SSL_TOTP_SECRET` Certificate secret to pull the actual EV certificate from the SSL.com identity
31+
32+
33+
### MacOS
34+
35+
Signing the mac build can be done by the `electron-builder`. Currently the configuration is setup to sign and notarize the app.
36+
For signing a macOS release a Apple Developer Application ID Certificate is required, detailed steps in the section below.
37+
38+
For integrating the electron-builder signing the certificate has to be added to the mac key-chain, for this specific environment variables need to be set during the release build process:
39+
40+
- `MAC_CERTIFICATE_P12_BASE64` the base64 encoded certificate and private key
41+
- `MAC_CERTIFICATE_PASSWORD` the certificate encryption password
42+
43+
Electron builder signing and notarizing env:
44+
45+
- `CSC_LINK` same as `MAC_CERTIFICATE_P12_BASE64`, important for electron-builder finding the identity
46+
- `CSC_KEY_PASSWORD` same as `MAC_CERTIFICATE_PASSWORD`, important for electron-builder finding the identity from the cert above
47+
- `APPLE_ID` The apple ID used for the Developer certificate for notarizing the app
48+
- `APPLE_APP_SPECIFIC_PASSWORD` [App specific password](https://support.apple.com/en-us/102654) for notarizing the app
49+
- `APPLE_TEAM_ID` The apple team id used for the account that created the certificate used for notarizing the app
50+
51+
#### Verify Mac Signing:
52+
53+
- Verify the app’s signature
54+
- `codesign --verify --deep --verbose --strict /path/to/sentry-client-macos.app`
55+
56+
- Check if Gatekeeper accepts the app after notarizing
57+
- `spctl --assess --type exec --verbose /path/to/sentry-client-macos.app`
58+
59+
- Check notarization status
60+
- `xcrun notarytool history --apple-id APPLE_ID --password APPLE_APP_SPECIFIC_PASSWORD --team-id APPLE_TEAM_ID`
61+
62+
63+
#### Create an Apple Developer Application ID Certificate
64+
65+
### Step 1: Create a Certificate Signing Request (CSR)
66+
67+
1. Open **Keychain Access** (`Applications > Utilities > Keychain Access`).
68+
2. From the menu, select **Keychain Access > Certificate Assistant > Request a Certificate From a Certificate Authority**.
69+
3. Fill out the following fields:
70+
- **User Email Address**: Your Apple Developer account email.
71+
- **Common Name**: Your name or your company’s name.
72+
- **CA Email Address**: Leave this blank.
73+
- **Request is**: Select **Saved to disk**.
74+
4. Check the box for **Let me specify key pair information**.
75+
5. **Key Pair Information**:
76+
- Algorithm: Select **RSA**.
77+
- Key Size: Choose **2048-bit**.
78+
6. Click **Continue** and save the CSR file to your desktop (or any location).
79+
80+
---
81+
82+
### Step 2: Submit the CSR to Apple Developer
83+
84+
1. Log in to your [Apple Developer Account](https://developer.apple.com/account/).
85+
2. Go to **Certificates, Identifiers & Profiles**.
86+
3. Under **Certificates**, click the **+** button to create a new certificate.
87+
4. Choose the appropriate certificate type based on your need (e.g., **Developer ID Installer** or **Mac App Distribution**).
88+
5. Upload the CSR file you generated earlier.
89+
6. Download the new certificate (`.cer` file) provided by Apple.
90+
91+
---
92+
93+
### Step 3: Install the Certificate in Keychain Access
94+
95+
1. Double-click the downloaded `.cer` file to install it in **Keychain Access**.
96+
2. Open **Keychain Access** and navigate to **login > My Certificates**.
97+
3. Find the certificate you just installed.
98+
- It should appear under **My Certificates** and when expanded, should show the private key associated with it.
99+
4. If the certificate is not under **My Certificates** or you don’t see the private key, see the troubleshooting steps below.
100+
101+
---
102+
103+
### Step 4: Export the Certificate and Private Key as a `.p12` File
104+
105+
1. In **Keychain Access**, go to **My Certificates**.
106+
2. Right-click the certificate (which should now include the private key) and select **Export**.
107+
3. Choose the **.p12** format from the list of options.
108+
4. Set a name for the `.p12` file and choose a location to save it.
109+
5. You will be prompted to set a password to protect the `.p12` file.
110+
6. After setting the password, your `.p12` file will be exported and saved.
111+
112+
---
113+
114+
### Step 5: Use the `.p12` in Your Build Pipeline
115+
116+
Once you have your `.p12` file, you can use it in your build process for signing packages or apps, such as in GitHub Actions:
117+
118+
1. **Encode the `.p12` file to base64**:
119+
```bash
120+
base64 -i certificate.p12 -o certificate.p12.base64
121+
122+
---
123+
124+
### Troubleshooting Tips
125+
126+
- **Missing Private Key**: If your certificate is in the **Certificates** section but not in **My Certificates**, it means the private key is not associated. This can happen if the private key wasn’t created or stored correctly during the CSR process.
127+
- In **Keychain Access**, go to **login > Keys** and look for a private key matching the common name of the certificate.
128+
- If you find the private key, you can try manually associating it with the certificate by dragging the certificate onto the key.
129+
- If the private key is not present, you'll need to regenerate the CSR and repeat the steps to create the certificate.
130+
131+
---
132+
133+
### Notes
134+
135+
- **Key Size**: Make sure to select **RSA 2048-bit** or higher, as 1024-bit is no longer considered secure.
136+
- **Password**: You will need the password set during the `.p12` export when using the file for signing operations in your build pipeline.
137+
138+
---
139+
140+
141+

‎apps/sentry-client-desktop/build-config/entitlements.mac.plist

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.app-sandbox</key>
6+
<false/>
7+
<key>com.apple.security.cs.allow-jit</key>
8+
<true/>
9+
<key>com.apple.security.cs.disable-library-validation</key>
10+
<true/>
11+
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
12+
<true/>
13+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
14+
<true/>
15+
</dict>
16+
</plist>

‎apps/sentry-client-desktop/electron-builder-config.js

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
/**
2+
* @see https://www.electron.build/configuration
3+
*/
4+
module.exports = {
5+
appId: "com.github.xaifoundation.sentry",
6+
includeSubNodeModules: true,
7+
asar: true,
8+
productName: "Xai Sentry Node",
9+
directories: {
10+
output: "release"
11+
},
12+
files: [
13+
"dist",
14+
"dist-electron"
15+
],
16+
dmg: {
17+
sign: false
18+
},
19+
mac: {
20+
target: [
21+
"dmg",
22+
"zip"
23+
],
24+
artifactName: "sentry-client-macos.${ext}",
25+
icon: "public/xai.png",
26+
hardenedRuntime: true,
27+
entitlements: "build-config/entitlements.mac.plist",
28+
entitlementsInherit: "build-config/entitlements.mac.plist",
29+
gatekeeperAssess: false,
30+
notarize: {
31+
teamId: process.env["APPLE_TEAM_ID"] || ""
32+
}
33+
},
34+
win: {
35+
target: [
36+
"nsis"
37+
],
38+
publisherName: "Xai Foundation",
39+
verifyUpdateCodeSignature: false,
40+
artifactName: "sentry-client-windows.${ext}",
41+
icon: "public/xai.ico"
42+
},
43+
nsis: {
44+
oneClick: false,
45+
perMachine: false,
46+
allowToChangeInstallationDirectory: true,
47+
deleteAppDataOnUninstall: false
48+
},
49+
linux: {
50+
target: [
51+
"AppImage"
52+
],
53+
artifactName: "sentry-client-linux.${ext}"
54+
},
55+
protocols: [
56+
{
57+
name: "Xai Sentry",
58+
schemes: ["xai-sentry"]
59+
}
60+
]
61+
};
62+

‎apps/sentry-client-desktop/electron-builder.json5 renamed to ‎apps/sentry-client-desktop/electron-builder.json5.bak

+11-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* @see https://www.electron.build/configuration/configuration
2+
* @see https://www.electron.build/configuration
33
*/
44
{
55
"$schema": "https://raw.githubusercontent.com/electron-userland/electron-builder/master/packages/app-builder-lib/scheme.json",
@@ -8,19 +8,27 @@
88
"asar": true,
99
"productName": "Xai Sentry Node",
1010
"directories": {
11-
"output": "release",
11+
"output": "release"
1212
},
1313
"files": [
1414
"dist",
1515
"dist-electron"
1616
],
17+
"dmg": {
18+
"sign": false
19+
},
1720
"mac": {
1821
"target": [
1922
"dmg",
2023
"zip"
2124
],
2225
"artifactName": "sentry-client-macos.${ext}",
23-
"icon": "public/xai.png"
26+
"icon": "public/xai.png",
27+
"hardenedRuntime": true,
28+
"entitlements": "build-config/entitlements.mac.plist",
29+
"entitlementsInherit": "build-config/entitlements.mac.plist",
30+
"gatekeeperAssess": false,
31+
"notarize": true
2432
},
2533
"win": {
2634
"target": [

‎apps/sentry-client-desktop/package.json

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
{
22
"name": "@sentry/sentry-client-desktop",
33
"author": "Xai Foundation",
4+
"description": "Cross platform desktop client for the Xai Sentry Node",
45
"version": "1.0.0",
56
"private": true,
67
"main": "dist-electron/main.js",
78
"repository": "https://github.com/xai-foundation/sentry",
89
"scripts": {
9-
"build": "tsc --build && vite build && electron-builder -p never",
10+
"build": "tsc --build && vite build && electron-builder -p never -c electron-builder-config.js",
1011
"clean": "rimraf dist && rimraf dist-electron && rimraf release && rimraf public/web && rimraf tsconfig.tsbuildinfo && rimraf vite.config.js && rimraf vite.config.d.ts",
1112
"dev": "vite",
1213
"lint": "eslint src --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
@@ -47,7 +48,7 @@
4748
"@vitejs/plugin-react": "^4.0.4",
4849
"autoprefixer": "^10.4.15",
4950
"electron": "^27.1.3",
50-
"electron-builder": "^24.9.1",
51+
"electron-builder": "^24.13.3",
5152
"eslint": "^8.48.0",
5253
"eslint-plugin-only-warn": "^1.1.0",
5354
"eslint-plugin-react-hooks": "^4.6.0",

0 commit comments

Comments
 (0)