根因:afterPack 中使用 codesign --force --deep -s - 签名,但 --deep 标志 不可靠,无法保证正确的签名顺序,导致 Electron 内嵌的 helper apps、 frameworks、.node 原生模块未被正确签名,ShipIt 在 kSecCSStrictValidate 严格校验时失败。 修复方案: - scripts/after-pack.js: 移除 Step 4 的 --deep 签名 - scripts/after-sign.js (新增): afterSign 钩子中从内到外逐个签名: 1. 所有 .node/.dylib/.so 原生二进制 2. 所有 .framework 目录 3. 所有 Electron Helper .app 4. 主 .app bundle 签名完成后执行 codesign --verify --strict 验证 - electron-builder.yml: 添加 afterSign 钩子引用 使用 afterSign 而非 afterPack 的原因:afterSign 在 electron-builder 自身 签名步骤之后执行(CSC_IDENTITY_AUTO_DISCOVERY=false 时为 no-op),确保 ad-hoc 签名是创建 DMG/ZIP 产物前的最后一步,不会被后续处理覆盖或失效。 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
127 lines
4.9 KiB
JavaScript
127 lines
4.9 KiB
JavaScript
/* eslint-disable @typescript-eslint/no-require-imports */
|
|
/**
|
|
* electron-builder afterPack hook.
|
|
*
|
|
* The standard @electron/rebuild step only rebuilds native modules found
|
|
* in the `files` config. Since better-sqlite3 enters the app through
|
|
* extraResources (via .next/standalone/), it gets skipped.
|
|
*
|
|
* This hook:
|
|
* 1. Explicitly rebuilds better-sqlite3 for the target Electron ABI
|
|
* 2. Copies the rebuilt .node into all locations within standalone resources
|
|
*/
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const { execSync } = require('child_process');
|
|
|
|
module.exports = async function afterPack(context) {
|
|
const appOutDir = context.appOutDir;
|
|
const arch = context.arch;
|
|
// electron-builder arch enum: 1=x64, 3=arm64, etc.
|
|
const archName = arch === 3 ? 'arm64' : arch === 1 ? 'x64' : arch === 0 ? 'ia32' : String(arch);
|
|
const platform = context.packager.platform.name; // 'mac', 'windows', 'linux'
|
|
|
|
// Get Electron version from packager config or from installed package
|
|
const electronVersion =
|
|
context.electronVersion ||
|
|
context.packager?.config?.electronVersion ||
|
|
require(path.join(process.cwd(), 'node_modules', 'electron', 'package.json')).version;
|
|
|
|
console.log(`[afterPack] Electron ${electronVersion}, arch=${archName}, platform=${platform}`);
|
|
|
|
// Step 1: Explicitly rebuild better-sqlite3 for the target Electron version
|
|
const projectDir = process.cwd();
|
|
console.log('[afterPack] Rebuilding better-sqlite3 for Electron ABI...');
|
|
|
|
try {
|
|
// Use @electron/rebuild via npx (it's a dependency of electron-builder)
|
|
const rebuildCmd = `npx electron-rebuild -f -o better-sqlite3 -v ${electronVersion} -a ${archName}`;
|
|
console.log(`[afterPack] Running: ${rebuildCmd}`);
|
|
execSync(rebuildCmd, {
|
|
cwd: projectDir,
|
|
stdio: 'inherit',
|
|
timeout: 120000,
|
|
});
|
|
console.log('[afterPack] Rebuild completed successfully');
|
|
} catch (err) {
|
|
console.error('[afterPack] Failed to rebuild better-sqlite3:', err.message);
|
|
// Try alternative: use @electron/rebuild programmatically
|
|
try {
|
|
const { rebuild } = require('@electron/rebuild');
|
|
await rebuild({
|
|
buildPath: projectDir,
|
|
electronVersion: electronVersion,
|
|
arch: archName,
|
|
onlyModules: ['better-sqlite3'],
|
|
force: true,
|
|
});
|
|
console.log('[afterPack] Rebuild via @electron/rebuild API succeeded');
|
|
} catch (err2) {
|
|
console.error('[afterPack] @electron/rebuild API also failed:', err2.message);
|
|
throw new Error('Cannot rebuild better-sqlite3 for Electron ABI');
|
|
}
|
|
}
|
|
|
|
// Step 2: Verify the rebuilt .node file
|
|
const rebuiltSource = path.join(
|
|
projectDir, 'node_modules', 'better-sqlite3', 'build', 'Release', 'better_sqlite3.node'
|
|
);
|
|
|
|
if (!fs.existsSync(rebuiltSource)) {
|
|
throw new Error(`[afterPack] Rebuilt better_sqlite3.node not found at ${rebuiltSource}`);
|
|
}
|
|
|
|
const sourceStats = fs.statSync(rebuiltSource);
|
|
console.log(`[afterPack] Rebuilt .node file: ${rebuiltSource} (${sourceStats.size} bytes, mtime: ${sourceStats.mtime.toISOString()})`);
|
|
|
|
// Step 3: Find and replace all better_sqlite3.node in standalone resources
|
|
// macOS: <appOutDir>/CodePilot.app/Contents/Resources/standalone/...
|
|
// Windows/Linux: <appOutDir>/resources/standalone/...
|
|
const searchRoots = [
|
|
path.join(appOutDir, 'CodePilot.app', 'Contents', 'Resources', 'standalone'),
|
|
path.join(appOutDir, 'Contents', 'Resources', 'standalone'),
|
|
path.join(appOutDir, 'resources', 'standalone'),
|
|
];
|
|
|
|
let replaced = 0;
|
|
|
|
function walkAndReplace(dir) {
|
|
if (!fs.existsSync(dir)) return;
|
|
const entries = fs.readdirSync(dir, { withFileTypes: true });
|
|
for (const entry of entries) {
|
|
const fullPath = path.join(dir, entry.name);
|
|
if (entry.isDirectory()) {
|
|
walkAndReplace(fullPath);
|
|
} else if (entry.name === 'better_sqlite3.node') {
|
|
const beforeSize = fs.statSync(fullPath).size;
|
|
fs.copyFileSync(rebuiltSource, fullPath);
|
|
const afterSize = fs.statSync(fullPath).size;
|
|
console.log(`[afterPack] Replaced ${fullPath} (${beforeSize} -> ${afterSize} bytes)`);
|
|
replaced++;
|
|
}
|
|
}
|
|
}
|
|
|
|
for (const root of searchRoots) {
|
|
walkAndReplace(root);
|
|
}
|
|
|
|
if (replaced > 0) {
|
|
console.log(`[afterPack] Successfully replaced ${replaced} better_sqlite3.node file(s) with Electron ABI build`);
|
|
} else {
|
|
console.warn('[afterPack] WARNING: No better_sqlite3.node files found in standalone resources!');
|
|
for (const root of searchRoots) {
|
|
if (fs.existsSync(root)) {
|
|
console.log(`[afterPack] Contents of ${root}:`, fs.readdirSync(root).slice(0, 20));
|
|
} else {
|
|
console.log(`[afterPack] Path does not exist: ${root}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Note: Ad-hoc code signing moved to scripts/after-sign.js (afterSign hook).
|
|
// afterSign runs after electron-builder's own signing step (which is a no-op
|
|
// with CSC_IDENTITY_AUTO_DISCOVERY=false), ensuring the signature is the last
|
|
// modification before DMG/ZIP creation.
|
|
};
|