chore: release v1.1.10

* chore: release v1.1.9

* fix(ci): notarize dmg in workflow

.github/workflows/build.yml

@@ -149,6 +149,7 @@ jobs:
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
         run: |
           set -euo pipefail
+          echo "SIGNING_AVAILABLE=false" >> "$GITHUB_ENV"
 
           # Check if all required secrets are present
           if [[ -z "$MAC_CERT_P12_BASE64" ]] || [[ -z "$MAC_CERT_P12_PASSWORD" ]] || \
@@ -177,10 +178,46 @@ jobs:
           echo "APPLE_API_KEY=$API_KEY_PATH" >> "$GITHUB_ENV"
           echo "APPLE_API_KEY_ID=$APPLE_API_KEY_ID" >> "$GITHUB_ENV"
           echo "APPLE_API_ISSUER=$APPLE_API_ISSUER" >> "$GITHUB_ENV"
+          echo "SIGNING_AVAILABLE=true" >> "$GITHUB_ENV"
 
       - name: Build application
         run: ${{ matrix.build_script }}
 
+      - name: Verify macOS codesign and notarization
+        if: matrix.platform == 'macos' && env.SIGNING_AVAILABLE == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          apps_found=0
+          while IFS= read -r app; do
+            apps_found=1
+            echo "Verifying codesign for $app"
+            codesign --verify --deep --strict --verbose=2 "$app"
+            spctl -a -t exec -vv "$app"
+            echo "Validating notarization ticket for $app"
+            xcrun stapler validate "$app"
+          done < <(find dist -type d -name "*.app" -prune -print)
+
+          if [[ "$apps_found" -eq 0 ]]; then
+            echo "::error::No .app bundles found in dist"
+            exit 1
+          fi
+
+          dmgs_found=0
+          while IFS= read -r dmg; do
+            dmgs_found=1
+            echo "Submitting DMG for notarization: $dmg"
+            xcrun notarytool submit "$dmg" --key "$APPLE_API_KEY" --key-id "$APPLE_API_KEY_ID" --issuer "$APPLE_API_ISSUER" --wait
+            echo "Stapling notarization ticket for $dmg"
+            xcrun stapler staple "$dmg"
+            echo "Validating notarization ticket for $dmg"
+            xcrun stapler validate "$dmg"
+          done < <(find dist -type f -name "*.dmg" -print)
+
+          if [[ "$dmgs_found" -eq 0 ]]; then
+            echo "::notice::No DMG artifacts found to validate"
+          fi
+
       - name: Upload build artifacts
         if: inputs.upload_artifacts == true
         uses: actions/upload-artifact@v4

build/after-pack.cjs

@@ -0,0 +1,58 @@
+const { execFileSync } = require('node:child_process')
+const fs = require('node:fs')
+const path = require('node:path')
+
+const BINARIES = ['yt-dlp_macos', 'ffmpeg_macos', 'deno']
+
+const findAppBundle = (appOutDir) => {
+  const entries = fs.readdirSync(appOutDir)
+  const app = entries.find((entry) => entry.endsWith('.app'))
+  return app ? path.join(appOutDir, app) : null
+}
+
+const resolveSigningIdentity = () =>
+  process.env.CSC_NAME || process.env.APPLE_SIGNING_IDENTITY || '-'
+
+const signBinary = (targetPath, entitlementsPath) => {
+  const identity = resolveSigningIdentity()
+  const args = ['--force', '--sign', identity, '--entitlements', entitlementsPath]
+
+  if (identity !== '-') {
+    args.push('--options', 'runtime', '--timestamp')
+  }
+
+  args.push(targetPath)
+  execFileSync('codesign', args, { stdio: 'inherit' })
+}
+
+exports.default = async function afterPack(context) {
+  if (context.electronPlatformName !== 'darwin') {
+    return
+  }
+
+  const appBundle = findAppBundle(context.appOutDir)
+  if (!appBundle) {
+    console.warn('afterPack: No .app bundle found, skipping tool signing.')
+    return
+  }
+
+  const resourcesPath = path.join(
+    appBundle,
+    'Contents',
+    'Resources',
+    'app.asar.unpacked',
+    'resources'
+  )
+
+  const entitlementsPath = path.resolve(__dirname, 'entitlements.mac.plist')
+
+  for (const binary of BINARIES) {
+    const targetPath = path.join(resourcesPath, binary)
+    if (!fs.existsSync(targetPath)) {
+      console.warn(`afterPack: Missing ${binary}, skipping.`)
+      continue
+    }
+    console.log(`afterPack: Signing ${binary} with entitlements.`)
+    signBinary(targetPath, entitlementsPath)
+  }
+}

build/entitlements.mac.plist

@@ -8,5 +8,7 @@
     <true/>
     <key>com.apple.security.cs.allow-dyld-environment-variables</key>
     <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
   </dict>
 </plist>

electron-builder.yml

@@ -2,6 +2,7 @@ appId: com.vidbee
 productName: VidBee
 directories:
   buildResources: build
+afterPack: build/after-pack.cjs
 protocols:
   - name: VidBee
     schemes:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "vidbee",
-  "version": "1.1.8",
+  "version": "1.1.10",
   "description": "A modern Electron application for downloading videos and audios",
   "main": "./out/main/index.js",
   "author": "VidBee",