Publish triggers afterAllArtifactBuild hook too late

[martani]

• Version:
  20.41.0

• Target:
  Mac

I'm writing an afterAllArtifactBuild hook where the produced dmg on Mac is notarized using electron-notarize. This works fine when building (i.e. electron-builder build --mac): the hook triggers after all targets are built and the dmg is notarized.

When building and publishing to github by running electron-builder build --mac -p always however, electron-builder starts uploading the dmg to github even before the afterAllArtifactBuild hook is triggered.

When simply publishing without building, the afterAllArtifactBuild is not triggered at all!

Ideally the publish command should wait for the afterAllArtifactBuild hook to finish running, or not rebuild the targets at all. If publish did not rebuild the targets, one could notarize/generate checksums using the afterAllArtifactBuild hook then have the publish command only pickup the generated binaries; Now it overrides anything generated before!

[Kilian]

I think you want this to be done not for the dmg, but for the app, in the afterSign hook. Unfortunately, it seems the afterSign hook is called before an app is signed, as when doing this and calling electron-notarize on the created .app, notarization fails because the app isn't signed.

In addition, if you have a console.log in your afterSign function, then you see it appear before the signing console output. This has also been mentioned in #3504.

[raymondjacobson]

I believe that the right call is to notarize and staple the dmg, see https://forums.developer.apple.com/thread/115670

[martani]

@raymondjacobson That does not work unfortunately and you get scary warnings like these when opening the dmg: #3870 (comment).

What ended up working is to sign+notarize the app and package it into a non-signed/non-notarized dmg. See #3870 (comment)

[raymondjacobson]

Ah, looks like I missed the point about not signing the dmg in b3acc81

Thanks! Will give this a go :)

[wagslane]

Yup, definitely still an issue :(

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[danni]

This is actually still an issue if you build a .pkg file, because you need to notarize the pkg file itself (for all the scripts it contains etc). You can notarize the pkg in afterAllArtifactBuild, but publish will have already attempted to upload this file before notarization is finished. You have to upload it again yourself afterwards.

[danni]

Updated to add, you can work around this by setting publish: null on your pkg target, and then returning the path of the pkg in the afterAllArtifactBuild hook.

pkg:
  publish: null # This will be published by the afterAllArtifactBuild hook

/**
 * Notarize .pkg
 */
const fs = require('fs');

const notarize = require('electron-notarize');

module.exports = async function (context) {
  if (process.platform !== 'darwin') {
    console.log(`afterAllArtifactBuild: nothing to do on ${process.platform}`);
    return [];
  }

  const appBundleId = context.configuration.appId;
  const paths = await Promise.all(context.artifactPaths.map(async appPath => {
    if (!appPath.endsWith('.pkg')) return null;

    if (process.env.APPLE_ID === undefined) {
      console.warn("APPLE_ID not set, skipping notarization");
      return appPath;
    }

    console.log(`afterAllArtifactBuild: Notarizing ${appBundleId} at ${appPath}`);

    // Test we can access the file
    await fs.promises.access(appPath)
    await notarize.notarize({
      appBundleId,
      appPath,
      appleId: process.env.APPLE_ID,
      appleIdPassword: '@keychain:AC_PASSWORD',
    });

    return appPath;
  }));

  return paths.filter(appPath => appPath !== null);
}

[dankegel]

Electron newbie here. Dani's tip helped here for notarizing a .pkg. When using it, I didn't seem to need to set the afterSign hook (which seems to be for notarizing e.g. a .zip file, not the .pkg).

[vcombey]

"Ideally the publish command should wait for the afterAllArtifactBuild hook to finish running !"
I also think this should be the case. Is it the case ?
I try to sign the exe on windows in afterAllArtifactBuild but the exe is upload before my script runs..