Update entitlements.mac.plist

Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>

.github/workflows/build_and_deploy.yaml

@@ -112,8 +112,6 @@ jobs:
 
             - name: Prepare artifacts for deployment
               run: |
-                  set -x
-
                   # Windows
                   for arch in x64 ia32 arm64
                   do
@@ -147,8 +145,6 @@ jobs:
             - name: "[Nightly] Strip version from installer file"
               if: needs.prepare.outputs.nightly-version != ''
               run: |
-                  set -x
-
                   # Windows
                   for arch in x64 ia32 arm64
                   do
@@ -165,8 +161,6 @@ jobs:
             - name: "[Release] Prepare release latest symlink"
               if: needs.prepare.outputs.nightly-version == ''
               run: |
-                  set -x
-
                   # Windows
                   for arch in x64 ia32 arm64
                   do
@@ -214,7 +208,6 @@ jobs:
             - name: Deploy artifacts
               if: needs.prepare.outputs.deploy == 'true'
               run: |
-                  set -x
                   aws s3 cp --recursive packages.element.io/ s3://$R2_BUCKET/$DEPLOYMENT_DIR --endpoint-url $R2_URL --region auto
               env:
                   AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
@@ -234,8 +227,6 @@ jobs:
               id: deb
               if: needs.linux.result == 'success'
               run: |
-                  set -x
-
                   for arch in amd64 arm64
                   do
                       echo "$arch=$(ls linux-$arch-sqlcipher-static/*.deb | tail -n1)" >> $GITHUB_OUTPUT
@@ -295,8 +286,6 @@ jobs:
 
             - name: Copy files to S3
               run: |
-                  set -x
-
                   PREFIX="${VERSION%.*}"
                   for file in win-*/*.msi; do
                       filename=$(basename "$file")

.github/workflows/build_and_test.yaml

@@ -43,6 +43,9 @@ jobs:
         needs: fetch
         name: macOS
         uses: ./.github/workflows/build_macos.yaml
+        secrets: inherit
+        with:
+            sign: true
 
     test:
         needs:
@@ -97,7 +100,7 @@ jobs:
 
             - uses: actions/setup-node@v4
               with:
-                  node-version-file: .node-version
+                  node-version-file: package.json
                   cache: "yarn"
 
             - name: Install Deps

.github/workflows/build_linux.yaml

@@ -76,7 +76,7 @@ jobs:
 
             - uses: actions/setup-node@v4
               with:
-                  node-version-file: .node-version
+                  node-version-file: package.json
                   cache: "yarn"
               env:
                   # Workaround for https://github.com/actions/setup-node/issues/317
@@ -98,7 +98,7 @@ jobs:
               uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6
               if: steps.changed_files.outputs.any_modified == 'true'
               with:
-                  file: dockerbuild/Dockerfile
+                  context: dockerbuild
                   load: true
                   platforms: linux/${{ inputs.arch }}
                   tags: ${{ env.HAK_DOCKER_IMAGE }}

.github/workflows/build_macos.yaml

@@ -62,7 +62,7 @@ jobs:
 
             - uses: actions/setup-node@v4
               with:
-                  node-version-file: .node-version
+                  node-version-file: package.json
                   cache: "yarn"
 
             - name: Install Deps
@@ -86,8 +86,8 @@ jobs:
                   APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
                   CSC_KEY_PASSWORD: ${{ secrets.APPLE_CSC_KEY_PASSWORD }}
                   CSC_LINK: ${{ secrets.APPLE_CSC_LINK }}
-                  # Only set for Nightly builds
-                  ED_NIGHTLY: ${{ inputs.version }}
+                  # TODO REMOVE
+                  CSC_FOR_PULL_REQUEST: true
 
             - name: Check app was signed & notarised successfully
               if: inputs.sign != ''
@@ -103,6 +103,8 @@ jobs:
                   yarn build:universal --publish never
               env:
                   CSC_IDENTITY_AUTO_DISCOVERY: false
+                  # Only set for Nightly builds
+                  ED_NIGHTLY: ${{ inputs.version }}
 
             - name: Generate releases.json
               if: inputs.base-url

.github/workflows/build_prepare.yaml

@@ -56,7 +56,7 @@ jobs:
 
             - uses: actions/setup-node@v4
               with:
-                  node-version-file: .node-version
+                  node-version-file: package.json
                   cache: "yarn"
 
             - name: Install Deps

.github/workflows/build_windows.yaml

@@ -99,9 +99,7 @@ jobs:
 
             - uses: actions/setup-node@v4
               with:
-                  # node-version-file: package.json
-                  # For https://github.com/element-hq/element-desktop/issues/2161
-                  node-version: 23.9.0
+                  node-version-file: package.json
                   cache: "yarn"
 
             - name: Install Deps

.github/workflows/dockerbuild.yaml

@@ -32,7 +32,7 @@ jobs:
             - name: Build test image
               uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6
               with:
-                  file: dockerbuild/Dockerfile
+                  context: dockerbuild
                   push: false
                   load: true
                   tags: element-desktop-dockerbuild
@@ -63,7 +63,7 @@ jobs:
               if: github.event_name != 'pull_request'
               uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6
               with:
-                  file: dockerbuild/Dockerfile
+                  context: dockerbuild
                   push: true
                   tags: ${{ steps.meta.outputs.tags }}
                   labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release.yml

@@ -19,7 +19,6 @@ jobs:
             contents: write
             issues: write
             pull-requests: read
-            id-token: write
         secrets:
             ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}
             GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}

.github/workflows/triage-stale.yml

@@ -14,9 +14,7 @@ jobs:
         steps:
             - uses: actions/stale@v9
               with:
-                  operations-per-run: 250
-                  days-before-issue-stale: -1
-                  days-before-issue-close: -1
+                  operations-per-run: 100
                   days-before-pr-stale: 180
                   days-before-pr-close: 0
                   close-pr-message: "This PR has been automatically closed because it has been stale for 180 days. If you wish to continue working on this PR, please ping a maintainer to reopen it."

.node-version

@@ -1 +0,0 @@
-v22.13.1

CHANGELOG.md

@@ -1,44 +1,3 @@
-Changes in [1.11.94](https://github.com/element-hq/element-desktop/releases/tag/v1.11.94) (2025-02-27)
-======================================================================================================
-* No changes
-
-## 🐛 Bug Fixes
-
-* [Backport staging] fix: /tmp/element-web-config may already exist preventing the container from booting up ([#29377](https://github.com/element-hq/element-web/pull/29377)). Contributed by @RiotRobot.
-
-
-
-Changes in [1.11.93](https://github.com/element-hq/element-desktop/releases/tag/v1.11.93) (2025-02-25)
-======================================================================================================
-## ✨ Features
-
-* [backport] Dynamically load Element Web modules in Docker entrypoint ([#29358](https://github.com/element-hq/element-web/pull/29358)). Contributed by @t3chguy.
-* ChangeRecoveryKey: error handling ([#29262](https://github.com/element-hq/element-web/pull/29262)). Contributed by @richvdh.
-* Dehydration: enable dehydrated device on "Set up recovery" ([#29265](https://github.com/element-hq/element-web/pull/29265)). Contributed by @richvdh.
-* Render reason for invite rejection. ([#29257](https://github.com/element-hq/element-web/pull/29257)). Contributed by @Half-Shot.
-* New room list: add search section ([#29251](https://github.com/element-hq/element-web/pull/29251)). Contributed by @florianduros.
-* New room list: hide favourites and people meta spaces ([#29241](https://github.com/element-hq/element-web/pull/29241)). Contributed by @florianduros.
-* New Room List: Create new labs flag ([#29239](https://github.com/element-hq/element-web/pull/29239)). Contributed by @MidhunSureshR.
-* Stop URl preview from covering message box ([#29215](https://github.com/element-hq/element-web/pull/29215)). Contributed by @edent.
-* Rename "security key" into "recovery key" ([#29217](https://github.com/element-hq/element-web/pull/29217)). Contributed by @florianduros.
-* Add new verification section to user profile ([#29200](https://github.com/element-hq/element-web/pull/29200)). Contributed by @MidhunSureshR.
-* Initial support for runtime modules ([#29104](https://github.com/element-hq/element-web/pull/29104)). Contributed by @t3chguy.
-* Add `Forgot recovery key?` button to encryption tab ([#29202](https://github.com/element-hq/element-web/pull/29202)). Contributed by @florianduros.
-* Add KeyIcon to key storage out of sync toast ([#29201](https://github.com/element-hq/element-web/pull/29201)). Contributed by @florianduros.
-* Improve rendering of empty topics in the timeline  ([#29152](https://github.com/element-hq/element-web/pull/29152)). Contributed by @Half-Shot.
-
-## 🐛 Bug Fixes
-
-* Fix font scaling in member list ([#29285](https://github.com/element-hq/element-web/pull/29285)). Contributed by @florianduros.
-* Grow member list search field when resizing the right panel ([#29267](https://github.com/element-hq/element-web/pull/29267)). Contributed by @langleyd.
-* Don't reload roomview on offline connectivity check ([#29243](https://github.com/element-hq/element-web/pull/29243)). Contributed by @dbkr.
-* Respect user's 12/24 hour preference consistently ([#29237](https://github.com/element-hq/element-web/pull/29237)). Contributed by @t3chguy.
-* Restore the accessibility role on call views ([#29225](https://github.com/element-hq/element-web/pull/29225)). Contributed by @robintown.
-* Revert `GoToHome` keyboard shortcut to `Ctrl`–`Shift`–`H` on macOS ([#28577](https://github.com/element-hq/element-web/pull/28577)). Contributed by @gy-mate.
-* Encryption tab: display correct encryption panel when user cancels the reset identity flow ([#29216](https://github.com/element-hq/element-web/pull/29216)). Contributed by @florianduros.
-
-
-
 Changes in [1.11.92](https://github.com/element-hq/element-desktop/releases/tag/v1.11.92) (2025-02-11)
 ======================================================================================================
 ## ✨ Features

build/entitlements-sandbox.mac.plist

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- https://github.com/electron/electron-notarize#prerequisites -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+
+    <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+
+    <!-- Enable the app sandbox -->
+    <key>com.apple.security.app-sandbox</key>
+    <true/>
+    <key>com.apple.security.inherit</key>
+    <true/>
+
+    <!-- Allow opening outgoing network connections -->
+    <key>com.apple.security.network.client</key>
+    <true/>
+
+    <!-- Allow opening & saving files for upload & download -->
+    <key>com.apple.security.files.user-selected.read-write</key>
+    <true/>
+
+    <!-- Access to camera & microphone for calls -->
+    <key>com.apple.security.device.camera</key>
+    <true/>
+    <key>com.apple.security.device.audio-input</key>
+    <true/>
+</dict>
+</plist>

build/entitlements.mac.plist

@@ -2,14 +2,6 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-    <!-- Entitlements from electron-builder's defaults
-         (https://github.com/electron-userland/electron-builder/blob/master/packages/app-builder-lib/templates/entitlements.mac.plist)
-         nb. This does *not* include the app sandbox: at the time of adding this file,
-         we were using electron-builder 21.2.0 which does not have the sandbox entitlement.
-         Latest electron-builder does, but it appears to be causing issues:
-         (https://github.com/electron-userland/electron-builder/issues/4390)
-    -->
-
     <!-- https://github.com/electron/electron-notarize#prerequisites -->
     <key>com.apple.security.cs.allow-jit</key>
     <true/>
@@ -18,8 +10,15 @@
     <key>com.apple.security.cs.disable-library-validation</key>
     <true/>
 
-    <!-- Our own additional entitlements (we need to access the camera and
-        mic for VoIP calls -->
+    <!-- Allow opening outgoing network connections -->
+    <key>com.apple.security.network.client</key>
+    <true/>
+
+    <!-- Allow opening & saving files for upload & download -->
+    <key>com.apple.security.files.user-selected.read-write</key>
+    <true/>
+
+    <!-- Access to camera & microphone for calls -->
     <key>com.apple.security.device.camera</key>
     <true/>
     <key>com.apple.security.device.audio-input</key>

dockerbuild/Dockerfile

@@ -21,7 +21,8 @@ ENV FORCE_COLOR true
 
 WORKDIR /project
 
+ENV NODE_VERSION 20.18.2
 ARG TARGETOS
 ARG TARGETARCH
-COPY .node-version dockerbuild/setup.sh /
+COPY setup.sh /setup.sh
 RUN /setup.sh

dockerbuild/setup.sh

@@ -3,6 +3,5 @@
 set -x
 declare -A archMap=(["amd64"]="x64" ["arm64"]="arm64")
 ARCH="${archMap["$TARGETARCH"]}"
-NODE_VERSION=$(cat /.node-version)
-curl --proto "=https" -L "https://nodejs.org/dist/$NODE_VERSION/node-$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
+curl --proto "=https" -L "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-$TARGETOS-$ARCH.tar.gz" | tar xz -C /usr/local --strip-components=1 && \
   unlink /usr/local/CHANGELOG.md && unlink /usr/local/LICENSE && unlink /usr/local/README.md

electron-builder.ts

@@ -18,6 +18,9 @@ import { readFile, writeFile } from "node:fs/promises";
  *  Replaces spaces in the product name with dashes as spaces in paths can cause issues
  *  Removes libsqlcipher0 recommended dependency if env SQLCIPHER_BUNDLED is asserted.
  *  Passes $ED_DEBIAN_CHANGELOG to build.deb.fpm if specified
+ *
+ * On macOS:
+ *  Passes $APPLE_TEAM_ID to build.mac.extendInfo["ElectronTeamID"] if specified.
  */
 
 const NIGHTLY_APP_ID = "im.riot.nightly";
@@ -186,6 +189,18 @@ if (process.env.ED_SIGNTOOL_SUBJECT_NAME && process.env.ED_SIGNTOOL_THUMBPRINT)
     config.win.signtoolOptions!.certificateSha1 = process.env.ED_SIGNTOOL_THUMBPRINT;
 }
 
+/**
+ * Allow specifying ElectronTeamID via env vars
+ * @param {string} process.env.APPLE_TEAM_ID
+ * Workaround for https://github.com/electron-userland/electron-builder/issues/7995
+ */
+if (process.env.APPLE_TEAM_ID) {
+    config.mac.extendInfo = {
+        ElectronTeamID: process.env.APPLE_TEAM_ID,
+    };
+    config.mac.entitlements = "./build/entitlements-sandbox.mac.plist";
+}
+
 /**
  * Allow specifying nightly version via env var
  * @param {string} process.env.ED_NIGHTLY

package.json

@@ -3,7 +3,7 @@
     "productName": "Element",
     "main": "lib/electron-main.js",
     "exports": "./lib/electron-main.js",
-    "version": "1.11.94",
+    "version": "1.11.91",
     "description": "Element: the future of secure communication",
     "author": "Element",
     "homepage": "https://element.io",
@@ -15,7 +15,7 @@
     "type": "module",
     "files": [],
     "engines": {
-        "node": ">=18.0.0 <=22.13.1 || >22"
+        "node": ">=18.0.0"
     },
     "scripts": {
         "i18n": "matrix-gen-i18n && yarn i18n:sort && yarn i18n:lint",
@@ -44,7 +44,7 @@
         "build": "yarn run build:ts && yarn run build:res && electron-builder",
         "build:ts": "tsc",
         "build:res": "tsx scripts/copy-res.ts",
-        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild -f dockerbuild/Dockerfile .",
+        "docker:setup": "docker build --platform linux/amd64 -t element-desktop-dockerbuild dockerbuild",
         "docker:build:native": "scripts/in-docker.sh yarn run hak",
         "docker:build": "scripts/in-docker.sh yarn run build",
         "docker:install": "scripts/in-docker.sh yarn install",
@@ -82,12 +82,12 @@
         "@types/pacote": "^11.1.1",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
         "@typescript-eslint/parser": "^8.0.0",
-        "app-builder-lib": "26.0.8",
+        "app-builder-lib": "26.0.7",
         "chokidar": "^4.0.0",
         "detect-libc": "^2.0.0",
         "electron": "34.2.0",
-        "electron-builder": "26.0.8",
-        "electron-builder-squirrel-windows": "26.0.8",
+        "electron-builder": "26.0.7",
+        "electron-builder-squirrel-windows": "26.0.7",
         "electron-devtools-installer": "^4.0.0",
         "eslint": "^8.26.0",
         "eslint-config-google": "^0.14.0",

yarn.lock

@@ -2522,10 +2522,10 @@ app-builder-bin@5.0.0-alpha.12:
   resolved "https://registry.yarnpkg.com/app-builder-bin/-/app-builder-bin-5.0.0-alpha.12.tgz#2daf82f8badc698e0adcc95ba36af4ff0650dc80"
   integrity sha512-j87o0j6LqPL3QRr8yid6c+Tt5gC7xNfYo6uQIQkorAC6MpeayVMZrEDzKmJJ/Hlv7EnOQpaRm53k6ktDYZyB6w==
 
-app-builder-lib@26.0.8:
-  version "26.0.8"
-  resolved "https://registry.yarnpkg.com/app-builder-lib/-/app-builder-lib-26.0.8.tgz#a809f60fb6d371743214893e0feab89c598bed99"
-  integrity sha512-inISmbUzsWJcKUHEzANHvh4Z3Tqld3lcGa6TfDzEBzhAcku2JhOX4GXz7w/Yb+mjQIFcfUGD8NDAfu/hjv3AiA==
+app-builder-lib@26.0.7:
+  version "26.0.7"
+  resolved "https://registry.yarnpkg.com/app-builder-lib/-/app-builder-lib-26.0.7.tgz#c930a624c8184b39c1974b27505f84eaf89d17b7"
+  integrity sha512-Sa6qGtt2l9of+KEA2fxdRBNLcWld74xgaP+U3Zr3A0R529Z2jPfUTmLi0dDY3jwRF6uOrsQAEkN+JWWvw5WpPw==
   dependencies:
     "@develar/schema-utils" "~2.6.5"
     "@electron/asar" "3.2.18"
@@ -3348,12 +3348,12 @@ dir-compare@^4.2.0:
     minimatch "^3.0.5"
     p-limit "^3.1.0 "
 
-dmg-builder@26.0.8:
-  version "26.0.8"
-  resolved "https://registry.yarnpkg.com/dmg-builder/-/dmg-builder-26.0.8.tgz#53e5455b41b0c53dcac30eee58bb9d839699cad1"
-  integrity sha512-m2exxy1w/I5XuJ3+AKsInW+odHhXMuyPVFQ4feUnBX/dsyfKcA8f5TesmSWPD4+SoyB3Hgefz9FGLn7CI3+/NQ==
+dmg-builder@26.0.7:
+  version "26.0.7"
+  resolved "https://registry.yarnpkg.com/dmg-builder/-/dmg-builder-26.0.7.tgz#f1a2d7dcfd7cfdc143cabdaf78e9f94df9ce98a3"
+  integrity sha512-fsMjG/TmwcC7HzjSNi+3mlEUgo0RrWwq44VB9XKcGtTPPfqfSi3JvhWCCsAWzElZ0OtSO/DnK/TNgSqyaG/Ajw==
   dependencies:
-    app-builder-lib "26.0.8"
+    app-builder-lib "26.0.7"
     builder-util "26.0.7"
     builder-util-runtime "9.3.1"
     fs-extra "^10.1.0"
@@ -3439,25 +3439,25 @@ ejs@^3.1.8:
   dependencies:
     jake "^10.8.5"
 
-electron-builder-squirrel-windows@26.0.8:
-  version "26.0.8"
-  resolved "https://registry.yarnpkg.com/electron-builder-squirrel-windows/-/electron-builder-squirrel-windows-26.0.8.tgz#0ed66c409dbaba864b1ab6feccbc3aa107d90382"
-  integrity sha512-rkhrZFeGr5XrILkhIlnfB4wepaY0o8Q26qLabB4+jqFqZxAdDT9lwclo6A5nZBze7Bbi8ZAk9Q50RgSfhBzrIA==
+electron-builder-squirrel-windows@26.0.7:
+  version "26.0.7"
+  resolved "https://registry.yarnpkg.com/electron-builder-squirrel-windows/-/electron-builder-squirrel-windows-26.0.7.tgz#66cb4a0bedea951b61378bd3bad0c60e7c1731ec"
+  integrity sha512-xNavcnsM55zkfk6gdyhED+eCOMDFK76B+cqYMANMmeoGH4Lcp6jM3nob6CPXrEsXc0yNMVa7enR3wkRsE5IpaA==
   dependencies:
-    app-builder-lib "26.0.8"
+    app-builder-lib "26.0.7"
     builder-util "26.0.7"
     electron-winstaller "5.4.0"
 
-electron-builder@26.0.8:
-  version "26.0.8"
-  resolved "https://registry.yarnpkg.com/electron-builder/-/electron-builder-26.0.8.tgz#bce826a878b194b5cfd17fcebda1e5e539d4ff3d"
-  integrity sha512-7Heomwy2C9OUJQOYN+zdPSVhIEmaw59v6cPYZWx/FvGX4UbcH5HT2AdjxAzLkcMTAbwVwt1TqmJr9LPs6SYvEA==
+electron-builder@26.0.7:
+  version "26.0.7"
+  resolved "https://registry.yarnpkg.com/electron-builder/-/electron-builder-26.0.7.tgz#4f6724f41735b919514cd1b7462be7eb2d37078a"
+  integrity sha512-nVSaWw3dMLGGLrI/7WSifYzNGNseIpvmFwBRwi2E8tOUkcqN+em+3qYeRq8k/AYHRDcrmj6UCJJT6rBo+bikfw==
   dependencies:
-    app-builder-lib "26.0.8"
+    app-builder-lib "26.0.7"
     builder-util "26.0.7"
     builder-util-runtime "9.3.1"
     chalk "^4.1.2"
-    dmg-builder "26.0.8"
+    dmg-builder "26.0.7"
     fs-extra "^10.1.0"
     is-ci "^3.0.0"
     lazy-val "^1.0.5"