policy-builder/electron-builder.yml at main · cfengine/policy-builder · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
appId: com.northerntech.cfengine-policy-builder
productName: CFEngine Policy Builder
# One naming scheme for every installer: cfengine-policy-builder-0.1.0-mac-arm64.dmg
artifactName: ${name}-${version}-${os}-${arch}.${ext}
directories:
  buildResources: build
  output: release
# Only the built app: electron-builder adds package.json and the production node_modules itself.
files:
  - out/**
asarUnpack:
  - resources/**
# The PyInstaller sidecar lands in Contents/Resources/backend (macOS) or
# resources/backend (Windows/Linux), where src/main/backend.ts looks for it.
# Outside the asar on purpose: it is an executable spawned from disk, and
# onedir's layout — the binary next to its _internal/ directory — must survive
# packaging intact. Requires `npm run backend:build` first, which the
# build:mac/win/linux scripts take care of.
extraResources:
  - from: python/dist/cfpb-backend
    to: backend
    filter:
      - '**/*'
# Harden the packaged binary (https://www.electronjs.org/docs/latest/tutorial/security#19-check-which-fuses-you-can-change).
# Flipped after packaging, before signing. The renderer loads from app://bundle
# (src/main/index.ts), so file:// needs none of its extra privileges.
electronFuses:
  runAsNode: false # ignore ELECTRON_RUN_AS_NODE (no Node-mode escape hatch)
  enableNodeOptionsEnvironmentVariable: false
  enableNodeCliInspectArguments: false
  enableCookieEncryption: true
  onlyLoadAppFromAsar: true
  enableEmbeddedAsarIntegrityValidation: true # enforced on macOS/Windows; no-op on Linux
  grantFileProtocolExtraPrivileges: false
# @todo: wire macOS notarization + Windows EV signing in CI.
mac:
  category: public.app-category.developer-tools
  # Two plists on purpose: the inherit one carries the grants the frozen
  # sidecar needs under hardened runtime (PyInstaller's bootloader sets dyld
  # environment variables and loads unsigned dylibs from _internal/ — without
  # them the child process is killed on launch), while the main binary keeps
  # library validation enabled.
  entitlements: build/entitlements.mac.plist
  entitlementsInherit: build/entitlements.mac.inherit.plist
  target:
    - dmg
    - zip
win:
  target:
    - nsis
linux:
  target:
    - AppImage
    - deb
    - rpm
  category: Development
# @todo: publish config for update.electronjs.org auto-updates.
npmRebuild: false