diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
new file mode 100644
index 00000000..72e81b04
--- /dev/null
+++ b/.github/workflows/desktop-release.yml
@@ -0,0 +1,125 @@
+name: Desktop Release
+
+on:
+ workflow_call:
+ inputs:
+ release_tag:
+ required: true
+ type: string
+ publish_testflight:
+ required: false
+ type: boolean
+ default: false
+ upload_github_release:
+ required: false
+ type: boolean
+ default: false
+
+permissions:
+ contents: read
+
+jobs:
+ testflight:
+ if: inputs.publish_testflight
+ environment: release
+ timeout-minutes: 30
+ runs-on: macos-15
+ permissions:
+ contents: read
+ env:
+ APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+ APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+ APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
+ CSC_LINK: ${{ secrets.CSC_LINK }}
+ CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+ ZEROBYTE_DESKTOP_VERSION: ${{ inputs.release_tag }}
+ ZEROBYTE_EXPORT_COMPLIANCE_CODE: ${{ secrets.ZEROBYTE_EXPORT_COMPLIANCE_CODE }}
+ ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64: ${{ secrets.ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64 }}
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+ with:
+ fetch-depth: 0
+ ref: ${{ github.ref }}
+
+ - name: Install dependencies
+ uses: "./.github/actions/install-dependencies"
+
+ - name: Install Fastlane dependencies
+ working-directory: apps/desktop
+ run: bundle install
+
+ - name: Write MAS provisioning profile
+ run: |
+ : "${ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64:?Set ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64 secret}"
+ profile_path="$RUNNER_TEMP/mac-app-store.provisionprofile"
+ echo "ZEROBYTE_MAS_PROVISIONING_PROFILE=$profile_path" >> "$GITHUB_ENV"
+ printf '%s' "$ZEROBYTE_MAS_PROVISIONING_PROFILE_BASE64" | base64 --decode > "$profile_path"
+ chmod 600 "$profile_path"
+
+ - name: Build and upload to TestFlight
+ working-directory: apps/desktop
+ env:
+ FASTLANE_HIDE_CHANGELOG: "true"
+ FASTLANE_SKIP_UPDATE_CHECK: "true"
+ run: bundle exec fastlane mac beta
+
+ - name: Clean TestFlight release secrets
+ if: always()
+ run: |
+ if [ -n "${ZEROBYTE_MAS_PROVISIONING_PROFILE:-}" ]; then
+ rm -f "$ZEROBYTE_MAS_PROVISIONING_PROFILE"
+ fi
+ rm -rf apps/desktop/dist/mas-arm64
+
+ github-release:
+ if: inputs.upload_github_release
+ environment: release
+ timeout-minutes: 30
+ runs-on: macos-15
+ permissions:
+ contents: read
+ env:
+ APP_STORE_CONNECT_API_KEY_BASE64: ${{ secrets.APP_STORE_CONNECT_API_KEY_BASE64 }}
+ APPLE_API_KEY: ${{ runner.temp }}/AuthKey.p8
+ APPLE_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
+ APPLE_API_ISSUER: ${{ secrets.APP_STORE_CONNECT_ISSUER_ID }}
+ CSC_LINK: ${{ secrets.CSC_LINK }}
+ CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+ ZEROBYTE_DESKTOP_VERSION: ${{ inputs.release_tag }}
+ ZEROBYTE_EXPORT_COMPLIANCE_CODE: ${{ secrets.ZEROBYTE_EXPORT_COMPLIANCE_CODE }}
+ ZEROBYTE_MAC_SIGN: "true"
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+ with:
+ fetch-depth: 0
+ ref: ${{ github.ref }}
+
+ - name: Install dependencies
+ uses: "./.github/actions/install-dependencies"
+
+ - name: Write App Store Connect API key
+ run: |
+ printf '%s' "$APP_STORE_CONNECT_API_KEY_BASE64" | base64 --decode > "$APPLE_API_KEY"
+ chmod 600 "$APPLE_API_KEY"
+
+ - name: Build DMG
+ working-directory: apps/desktop
+ run: bun run make
+
+ - name: Upload DMG artifact
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+ with:
+ name: desktop-github-release
+ path: |
+ apps/desktop/dist/*.dmg
+ if-no-files-found: error
+ retention-days: 1
+ compression-level: 0
+
+ - name: Clean GitHub release secrets
+ if: always()
+ run: |
+ rm -f "$APPLE_API_KEY"
+ rm -rf apps/desktop/dist
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a7bd27e..26b8c055 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -107,6 +107,16 @@ jobs:
build-args: |
APP_VERSION=${{ needs.determine-release-type.outputs.tagname }}
+ publish-desktop-testflight:
+ needs: [determine-release-type, checks, e2e-tests, integration-tests]
+ uses: ./.github/workflows/desktop-release.yml
+ permissions:
+ contents: read
+ with:
+ release_tag: ${{ needs.determine-release-type.outputs.tagname }}
+ publish_testflight: true
+ secrets: inherit
+
publish-release:
runs-on: ubuntu-latest
needs: [build-images, determine-release-type]
diff --git a/apps/desktop/.gitignore b/apps/desktop/.gitignore
index ee3e6136..07b400e6 100644
--- a/apps/desktop/.gitignore
+++ b/apps/desktop/.gitignore
@@ -2,3 +2,12 @@
.runtime
out
dist
+profiles/*.provisionprofile
+fastlane/.env
+fastlane/.env.*
+!fastlane/.env.example
+fastlane/AuthKey_*.p8
+fastlane/report.xml
+fastlane/Preview.html
+fastlane/screenshots
+fastlane/test_output
diff --git a/apps/desktop/Gemfile b/apps/desktop/Gemfile
new file mode 100644
index 00000000..b7cf8e78
--- /dev/null
+++ b/apps/desktop/Gemfile
@@ -0,0 +1,3 @@
+source "https://rubygems.org"
+
+gem "fastlane", "~> 2.236"
diff --git a/apps/desktop/Gemfile.lock b/apps/desktop/Gemfile.lock
new file mode 100644
index 00000000..d0fbd7b8
--- /dev/null
+++ b/apps/desktop/Gemfile.lock
@@ -0,0 +1,341 @@
+GEM
+ remote: https://rubygems.org/
+ specs:
+ CFPropertyList (3.0.8)
+ abbrev (0.1.2)
+ addressable (2.9.0)
+ public_suffix (>= 2.0.2, < 8.0)
+ artifactory (3.0.17)
+ atomos (0.1.3)
+ aws-eventstream (1.4.0)
+ aws-partitions (1.1261.0)
+ aws-sdk-core (3.252.0)
+ aws-eventstream (~> 1, >= 1.3.0)
+ aws-partitions (~> 1, >= 1.992.0)
+ aws-sigv4 (~> 1.9)
+ base64
+ bigdecimal
+ jmespath (~> 1, >= 1.6.1)
+ logger
+ aws-sdk-kms (1.129.0)
+ aws-sdk-core (~> 3, >= 3.248.0)
+ aws-sigv4 (~> 1.5)
+ aws-sdk-s3 (1.226.0)
+ aws-sdk-core (~> 3, >= 3.248.0)
+ aws-sdk-kms (~> 1)
+ aws-sigv4 (~> 1.5)
+ aws-sigv4 (1.12.1)
+ aws-eventstream (~> 1, >= 1.0.2)
+ babosa (1.0.4)
+ base64 (0.3.0)
+ benchmark (0.5.0)
+ bigdecimal (4.1.2)
+ claide (1.1.0)
+ colored (1.2)
+ colored2 (3.1.2)
+ commander (4.6.0)
+ highline (~> 2.0.0)
+ csv (3.3.5)
+ declarative (0.0.20)
+ digest-crc (0.7.0)
+ rake (>= 12.0.0, < 14.0.0)
+ domain_name (0.6.20240107)
+ dotenv (2.8.1)
+ emoji_regex (3.2.3)
+ excon (0.112.0)
+ faraday (1.10.5)
+ faraday-em_http (~> 1.0)
+ faraday-em_synchrony (~> 1.0)
+ faraday-excon (~> 1.1)
+ faraday-httpclient (~> 1.0)
+ faraday-multipart (~> 1.0)
+ faraday-net_http (~> 1.0)
+ faraday-net_http_persistent (~> 1.0)
+ faraday-patron (~> 1.0)
+ faraday-rack (~> 1.0)
+ faraday-retry (~> 1.0)
+ ruby2_keywords (>= 0.0.4)
+ faraday-cookie_jar (0.0.8)
+ faraday (>= 0.8.0)
+ http-cookie (>= 1.0.0)
+ faraday-em_http (1.0.0)
+ faraday-em_synchrony (1.0.1)
+ faraday-excon (1.1.0)
+ faraday-httpclient (1.0.1)
+ faraday-multipart (1.2.0)
+ multipart-post (~> 2.0)
+ faraday-net_http (1.0.2)
+ faraday-net_http_persistent (1.2.0)
+ faraday-patron (1.0.0)
+ faraday-rack (1.0.0)
+ faraday-retry (1.0.4)
+ faraday_middleware (1.2.1)
+ faraday (~> 1.0)
+ fastimage (2.4.1)
+ fastlane (2.236.1)
+ CFPropertyList (>= 2.3, < 5.0.0)
+ abbrev (~> 0.1)
+ addressable (>= 2.8, < 3.0.0)
+ artifactory (~> 3.0)
+ aws-sdk-s3 (~> 1.197)
+ babosa (>= 1.0.3, < 2.0.0)
+ base64 (~> 0.2)
+ benchmark (>= 0.1.0)
+ bundler (>= 2.4.0, < 5.0.0)
+ colored (~> 1.2)
+ commander (~> 4.6)
+ csv (~> 3.3)
+ dotenv (>= 2.1.1, < 3.0.0)
+ emoji_regex (>= 0.1, < 4.0)
+ excon (>= 0.71.0, < 1.0.0)
+ faraday (~> 1.0)
+ faraday-cookie_jar (~> 0.0.6)
+ faraday_middleware (~> 1.0)
+ fastimage (>= 2.1.0, < 3.0.0)
+ fastlane-sirp (>= 1.1.0)
+ gh_inspector (>= 1.1.2, < 2.0.0)
+ google-apis-androidpublisher_v3 (~> 0.3)
+ google-apis-playcustomapp_v1 (~> 0.1)
+ google-cloud-env (>= 1.6.0, < 2.3.0)
+ google-cloud-storage (~> 1.31)
+ highline (~> 2.0)
+ http-cookie (~> 1.0.5)
+ json (< 3.0.0)
+ jwt (>= 2.10.3, < 4)
+ logger (>= 1.6, < 2.0)
+ mini_magick (>= 4.9.4, < 5.0.0)
+ multi_json (~> 1.12)
+ multipart-post (>= 2.0.0, < 3.0.0)
+ mutex_m (~> 0.3)
+ naturally (~> 2.2)
+ nkf (~> 0.2)
+ optparse (>= 0.1.1, < 1.0.0)
+ ostruct (>= 0.1.0)
+ plist (>= 3.1.0, < 4.0.0)
+ rubyzip (>= 2.0.0, < 3.0.0)
+ security (= 0.1.5)
+ simctl (~> 1.6.3)
+ terminal-notifier (>= 2.0.0, < 3.0.0)
+ terminal-table (~> 3)
+ tty-screen (>= 0.6.3, < 1.0.0)
+ tty-spinner (>= 0.8.0, < 1.0.0)
+ word_wrap (~> 1.0.0)
+ xcodeproj (>= 1.13.0, < 2.0.0)
+ xcpretty (~> 0.4.1)
+ xcpretty-travis-formatter (>= 0.0.3, < 2.0.0)
+ fastlane-sirp (1.1.0)
+ gh_inspector (1.1.3)
+ google-apis-androidpublisher_v3 (0.102.0)
+ google-apis-core (>= 0.15.0, < 2.a)
+ google-apis-core (0.18.0)
+ addressable (~> 2.5, >= 2.5.1)
+ googleauth (~> 1.9)
+ httpclient (>= 2.8.3, < 3.a)
+ mini_mime (~> 1.0)
+ mutex_m
+ representable (~> 3.0)
+ retriable (>= 2.0, < 4.a)
+ google-apis-iamcredentials_v1 (0.27.0)
+ google-apis-core (>= 0.15.0, < 2.a)
+ google-apis-playcustomapp_v1 (0.17.0)
+ google-apis-core (>= 0.15.0, < 2.a)
+ google-apis-storage_v1 (0.63.0)
+ google-apis-core (>= 0.15.0, < 2.a)
+ google-cloud-core (1.9.0)
+ google-cloud-env (>= 1.0, < 3.a)
+ google-cloud-errors (~> 1.0)
+ google-cloud-env (2.2.2)
+ base64 (~> 0.2)
+ faraday (>= 1.0, < 3.a)
+ google-cloud-errors (1.6.0)
+ google-cloud-storage (1.61.0)
+ addressable (~> 2.8)
+ digest-crc (~> 0.4)
+ google-apis-core (>= 0.18, < 2)
+ google-apis-iamcredentials_v1 (~> 0.18)
+ google-apis-storage_v1 (>= 0.42)
+ google-cloud-core (~> 1.6)
+ googleauth (~> 1.9)
+ mini_mime (~> 1.0)
+ google-logging-utils (0.2.0)
+ googleauth (1.17.1)
+ faraday (>= 1.0, < 3.a)
+ google-cloud-env (~> 2.2)
+ google-logging-utils (~> 0.1)
+ jwt (>= 1.4, < 4.0)
+ os (>= 0.9, < 2.0)
+ pstore (~> 0.1)
+ signet (>= 0.16, < 2.a)
+ highline (2.0.3)
+ http-cookie (1.0.8)
+ domain_name (~> 0.5)
+ httpclient (2.9.0)
+ mutex_m
+ jmespath (1.6.2)
+ json (2.19.9)
+ jwt (3.2.0)
+ base64
+ logger (1.7.0)
+ mini_magick (4.13.2)
+ mini_mime (1.1.5)
+ multi_json (1.21.1)
+ multipart-post (2.4.1)
+ mutex_m (0.3.0)
+ nanaimo (0.4.0)
+ naturally (2.3.0)
+ nkf (0.3.0)
+ optparse (0.8.1)
+ os (1.1.4)
+ ostruct (0.6.3)
+ plist (3.7.2)
+ pstore (0.2.1)
+ public_suffix (7.0.5)
+ rake (13.4.2)
+ representable (3.2.0)
+ declarative (< 0.1.0)
+ trailblazer-option (>= 0.1.1, < 0.2.0)
+ uber (< 0.2.0)
+ retriable (3.8.0)
+ rexml (3.4.4)
+ rouge (3.28.0)
+ ruby2_keywords (0.0.5)
+ rubyzip (2.4.1)
+ security (0.1.5)
+ signet (0.22.0)
+ addressable (~> 2.8)
+ faraday (>= 0.17.5, < 3.a)
+ jwt (>= 1.5, < 4.0)
+ simctl (1.6.10)
+ CFPropertyList
+ naturally
+ terminal-notifier (2.0.0)
+ terminal-table (3.0.2)
+ unicode-display_width (>= 1.1.1, < 3)
+ trailblazer-option (0.1.2)
+ tty-cursor (0.7.1)
+ tty-screen (0.8.2)
+ tty-spinner (0.9.3)
+ tty-cursor (~> 0.7)
+ uber (0.1.0)
+ unicode-display_width (2.6.0)
+ word_wrap (1.0.0)
+ xcodeproj (1.27.0)
+ CFPropertyList (>= 2.3.3, < 4.0)
+ atomos (~> 0.1.3)
+ claide (>= 1.0.2, < 2.0)
+ colored2 (~> 3.1)
+ nanaimo (~> 0.4.0)
+ rexml (>= 3.3.6, < 4.0)
+ xcpretty (0.4.1)
+ rouge (~> 3.28.0)
+ xcpretty-travis-formatter (1.0.1)
+ xcpretty (~> 0.2, >= 0.0.7)
+
+PLATFORMS
+ arm64-darwin-25
+ ruby
+
+DEPENDENCIES
+ fastlane (~> 2.236)
+
+CHECKSUMS
+ CFPropertyList (3.0.8) sha256=2c99d0d980536d3d7ab252f7bd59ac8be50fbdd1ff487c98c949bb66bb114261
+ abbrev (0.1.2) sha256=ad1b4eaaaed4cb722d5684d63949e4bde1d34f2a95e20db93aecfe7cbac74242
+ addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
+ artifactory (3.0.17) sha256=3023d5c964c31674090d655a516f38ca75665c15084140c08b7f2841131af263
+ atomos (0.1.3) sha256=7d43b22f2454a36bace5532d30785b06de3711399cb1c6bf932573eda536789f
+ aws-eventstream (1.4.0) sha256=116bf85c436200d1060811e6f5d2d40c88f65448f2125bc77ffce5121e6e183b
+ aws-partitions (1.1261.0) sha256=89eda89781c1ea4e1be2a2dcdc72318c62c6171a01cdaeaa0cbecf3cea6f9fdc
+ aws-sdk-core (3.252.0) sha256=09c042cbfc2acf2239441cc9b982ebab2a999bed2ef6bdc51849e7b3d6e48a1c
+ aws-sdk-kms (1.129.0) sha256=363f548df321f4a4fcfd05523384e591060b400f8e65133ed7ef0793155a3343
+ aws-sdk-s3 (1.226.0) sha256=e599f431e006ec9b92c61ee0f14d3f658a1f6c8a1d623d2160be927ac958e2bf
+ aws-sigv4 (1.12.1) sha256=6973ff95cb0fd0dc58ba26e90e9510a2219525d07620c8babeb70ef831826c00
+ babosa (1.0.4) sha256=18dea450f595462ed7cb80595abd76b2e535db8c91b350f6c4b3d73986c5bc99
+ base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
+ benchmark (0.5.0) sha256=465df122341aedcb81a2a24b4d3bd19b6c67c1530713fd533f3ff034e419236c
+ bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
+ claide (1.1.0) sha256=6d3c5c089dde904d96aa30e73306d0d4bd444b1accb9b3125ce14a3c0183f82e
+ colored (1.2) sha256=9d82b47ac589ce7f6cab64b1f194a2009e9fd00c326a5357321f44afab2c1d2c
+ colored2 (3.1.2) sha256=b13c2bd7eeae2cf7356a62501d398e72fde78780bd26aec6a979578293c28b4a
+ commander (4.6.0) sha256=7d1ddc3fccae60cc906b4131b916107e2ef0108858f485fdda30610c0f2913d9
+ csv (3.3.5) sha256=6e5134ac3383ef728b7f02725d9872934f523cb40b961479f69cf3afa6c8e73f
+ declarative (0.0.20) sha256=8021dd6cb17ab2b61233c56903d3f5a259c5cf43c80ff332d447d395b17d9ff9
+ digest-crc (0.7.0) sha256=64adc23a26a241044cbe6732477ca1b3c281d79e2240bcff275a37a5a0d78c07
+ domain_name (0.6.20240107) sha256=5f693b2215708476517479bf2b3802e49068ad82167bcd2286f899536a17d933
+ dotenv (2.8.1) sha256=c5944793349ae03c432e1780a2ca929d60b88c7d14d52d630db0508c3a8a17d8
+ emoji_regex (3.2.3) sha256=ecd8be856b7691406c6bf3bb3a5e55d6ed683ffab98b4aa531bb90e1ddcc564b
+ excon (0.112.0) sha256=daf9ac3a4c2fc9aa48383a33da77ecb44fa395111e973084d5c52f6f214ae0f0
+ faraday (1.10.5) sha256=b144f1d2b045652fa820b5f532723e1643cc28b93dae911d784e5c5f88e8f6ed
+ faraday-cookie_jar (0.0.8) sha256=0140605823f8cc63c7028fccee486aaed8e54835c360cffc1f7c8c07c4299dbb
+ faraday-em_http (1.0.0) sha256=7a3d4c7079789121054f57e08cd4ef7e40ad1549b63101f38c7093a9d6c59689
+ faraday-em_synchrony (1.0.1) sha256=bf3ce45dcf543088d319ab051f80985ea6d294930635b7a0b966563179f81750
+ faraday-excon (1.1.0) sha256=b055c842376734d7f74350fe8611542ae2000c5387348d9ba9708109d6e40940
+ faraday-httpclient (1.0.1) sha256=4c8ff1f0973ff835be8d043ef16aaf54f47f25b7578f6d916deee8399a04d33b
+ faraday-multipart (1.2.0) sha256=7d89a949693714176f612323ca13746a2ded204031a6ba528adee788694ef757
+ faraday-net_http (1.0.2) sha256=63992efea42c925a20818cf3c0830947948541fdcf345842755510d266e4c682
+ faraday-net_http_persistent (1.2.0) sha256=0b0cbc8f03dab943c3e1cc58d8b7beb142d9df068b39c718cd83e39260348335
+ faraday-patron (1.0.0) sha256=dc2cd7b340bb3cc8e36bcb9e6e7eff43d134b6d526d5f3429c7a7680ddd38fa7
+ faraday-rack (1.0.0) sha256=ef60ec969a2bb95b8dbf24400155aee64a00fc8ba6c6a4d3968562bcc92328c0
+ faraday-retry (1.0.4) sha256=dc659233777fabf96c69c2ffe56c0a5d2c102af90321a42cc6c90157bcd716aa
+ faraday_middleware (1.2.1) sha256=d45b78c8ee864c4783fbc276f845243d4a7918a67301c052647bacabec0529e9
+ fastimage (2.4.1) sha256=c64bebd46b6fd8943ab70c1e6e85ff728f970f2e48f92ecd249b6bc3a540ad20
+ fastlane (2.236.1) sha256=fb89e618e0f38636e487743622cf710ad722723f5d33a63f19e367f84d3770bc
+ fastlane-sirp (1.1.0) sha256=10bc94f9682efd8e1badfb31452a76dd8981f1f3a33717c765fde6d75b54d847
+ gh_inspector (1.1.3) sha256=04cca7171b87164e053aa43147971d3b7f500fcb58177698886b48a9fc4a1939
+ google-apis-androidpublisher_v3 (0.102.0) sha256=562415c44bd7f81cc808abbea11845ede16cdc3696d95f95efcf50aaffb159cf
+ google-apis-core (0.18.0) sha256=96b057816feeeab448139ed5b5c78eab7fc2a9d8958f0fbc8217dedffad054ee
+ google-apis-iamcredentials_v1 (0.27.0) sha256=9289f29968610754ef11d98b9ec627f0153f3e2616fef839aef096de529f6d1e
+ google-apis-playcustomapp_v1 (0.17.0) sha256=d5bc90b705f3f862bab4998086449b0abe704ee1685a84821daa90ca7fa95a78
+ google-apis-storage_v1 (0.63.0) sha256=7063a6c19c40f5ef96d5894df33c4f9ac915e3107e632b1870ba5247e3bb633f
+ google-cloud-core (1.9.0) sha256=ab55409f51488e8deefb6edcc1ce4771dfb5da2fe7b3bc075709a030c2b682a4
+ google-cloud-env (2.2.2) sha256=94bed40e05a67e9468ce1cb38389fba9a90aa8fc62fc9e173204c1dca59e21e7
+ google-cloud-errors (1.6.0) sha256=1da8476dd706ad04b9d32e3c4b90d07d3463b37d6407cb56d41342ea7647d0a1
+ google-cloud-storage (1.61.0) sha256=a77f10f4a603289948b09e81c3e23d762a18733fd69d70a4c1399663fbd96002
+ google-logging-utils (0.2.0) sha256=675462b4ea5affa825a3442694ca2d75d0069455a1d0956127207498fca3df7b
+ googleauth (1.17.1) sha256=0f7e6fc70e204cee1b2d71f1e1de2d3b349d432404197fe68ebf7fa23d0821b9
+ highline (2.0.3) sha256=2ddd5c127d4692721486f91737307236fe005352d12a4202e26c48614f719479
+ http-cookie (1.0.8) sha256=b14fe0445cf24bf9ae098633e9b8d42e4c07c3c1f700672b09fbfe32ffd41aa6
+ httpclient (2.9.0) sha256=4b645958e494b2f86c2f8a2f304c959baa273a310e77a2931ddb986d83e498c8
+ jmespath (1.6.2) sha256=238d774a58723d6c090494c8879b5e9918c19485f7e840f2c1c7532cf84ebcb1
+ json (2.19.9) sha256=9b9025b7cdddafa38d316eca0b2358488e42d417045c1b90d216a9fefe46b79a
+ jwt (3.2.0) sha256=5419b1fe37b1da0982bd07051f573a8b8789ab724c2aa7e785e4784a3ed217d7
+ logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
+ mini_magick (4.13.2) sha256=71d6258e0e8a3d04a9a0a09784d5d857b403a198a51dd4f882510435eb95ddd9
+ mini_mime (1.1.5) sha256=8681b7e2e4215f2a159f9400b5816d85e9d8c6c6b491e96a12797e798f8bccef
+ multi_json (1.21.1) sha256=e6126a31808e3b4d19f483c775ceac34df190dffa62adfb63a165ee14ba68080
+ multipart-post (2.4.1) sha256=9872d03a8e552020ca096adadbf5e3cb1cd1cdd6acd3c161136b8a5737cdb4a8
+ mutex_m (0.3.0) sha256=cfcb04ac16b69c4813777022fdceda24e9f798e48092a2b817eb4c0a782b0751
+ nanaimo (0.4.0) sha256=faf069551bab17f15169c1f74a1c73c220657e71b6e900919897a10d991d0723
+ naturally (2.3.0) sha256=459923cf76c2e6613048301742363200c3c7e4904c324097d54a67401e179e01
+ nkf (0.3.0) sha256=357a8dbeba38b727b75930f665146546076a394a1c243faf634ff176e3588895
+ optparse (0.8.1) sha256=42bea10d53907ccff4f080a69991441d611fbf8733b60ed1ce9ee365ce03bd1a
+ os (1.1.4) sha256=57816d6a334e7bd6aed048f4b0308226c5fb027433b67d90a9ab435f35108d3f
+ ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912
+ plist (3.7.2) sha256=d37a4527cc1116064393df4b40e1dbbc94c65fa9ca2eec52edf9a13616718a42
+ pstore (0.2.1) sha256=03904d0f2c66579e96d1e6704cdabc0c88df7ea8ed8782d9f3569f6f6c702c1a
+ public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
+ rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
+ representable (3.2.0) sha256=cc29bf7eebc31653586849371a43ffe36c60b54b0a6365b5f7d95ec34d1ebace
+ retriable (3.8.0) sha256=9f2f1b0207594c7817f17f671587b8ec7587387ac6cebda6c941a802bb98a8e5
+ rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
+ rouge (3.28.0) sha256=0d6de482c7624000d92697772ab14e48dca35629f8ddf3f4b21c99183fd70e20
+ ruby2_keywords (0.0.5) sha256=ffd13740c573b7301cf7a2e61fc857b2a8e3d3aff32545d6f8300d8bae10e3ef
+ rubyzip (2.4.1) sha256=8577c88edc1fde8935eb91064c5cb1aef9ad5494b940cf19c775ee833e075615
+ security (0.1.5) sha256=3a977a0eca7706e804c96db0dd9619e0a94969fe3aac9680fcfc2bf9b8a833b7
+ signet (0.22.0) sha256=b76d495ccb07ad35dbc89f3e920665a9d8ed717141955034005d7843dcfe4780
+ simctl (1.6.10) sha256=b99077f4d13ad81eace9f86bf5ba4df1b0b893a4d1b368bd3ed59b5b27f9236b
+ terminal-notifier (2.0.0) sha256=7a0d2b2212ab9835c07f4b2e22a94cff64149dba1eed203c04835f7991078cea
+ terminal-table (3.0.2) sha256=f951b6af5f3e00203fb290a669e0a85c5dd5b051b3b023392ccfd67ba5abae91
+ trailblazer-option (0.1.2) sha256=20e4f12ea4e1f718c8007e7944ca21a329eee4eed9e0fa5dde6e8ad8ac4344a3
+ tty-cursor (0.7.1) sha256=79534185e6a777888d88628b14b6a1fdf5154a603f285f80b1753e1908e0bf48
+ tty-screen (0.8.2) sha256=c090652115beae764336c28802d633f204fb84da93c6a968aa5d8e319e819b50
+ tty-spinner (0.9.3) sha256=0e036f047b4ffb61f2aa45f5a770ec00b4d04130531558a94bfc5b192b570542
+ uber (0.1.0) sha256=5beeb407ff807b5db994f82fa9ee07cfceaa561dad8af20be880bc67eba935dc
+ unicode-display_width (2.6.0) sha256=12279874bba6d5e4d2728cef814b19197dbb10d7a7837a869bab65da943b7f5a
+ word_wrap (1.0.0) sha256=f556d4224c812e371000f12a6ee8102e0daa724a314c3f246afaad76d82accc7
+ xcodeproj (1.27.0) sha256=8cc7a73b4505c227deab044dce118ede787041c702bc47636856a2e566f854d3
+ xcpretty (0.4.1) sha256=b14c50e721f6589ee3d6f5353e2c2cfcd8541fa1ea16d6c602807dd7327f3892
+ xcpretty-travis-formatter (1.0.1) sha256=aacc332f17cb7b2cba222994e2adc74223db88724fe76341483ad3098e232f93
+
+BUNDLED WITH
+ 4.0.11
diff --git a/apps/desktop/assets/icon.icns b/apps/desktop/assets/icon.icns
index 42e8d36c..5957e4e1 100644
Binary files a/apps/desktop/assets/icon.icns and b/apps/desktop/assets/icon.icns differ
diff --git a/apps/desktop/electron-builder.config.cjs b/apps/desktop/electron-builder.config.cjs
index ae9c2955..a7302640 100644
--- a/apps/desktop/electron-builder.config.cjs
+++ b/apps/desktop/electron-builder.config.cjs
@@ -1,12 +1,59 @@
const path = require("node:path");
-const { spawn } = require("node:child_process");
+const { execFileSync, spawn } = require("node:child_process");
+const { Arch } = require("electron-builder");
const desktopDir = __dirname;
+const repoRoot = path.resolve(desktopDir, "..", "..");
const runtimeResourceDir = path.resolve(desktopDir, "..", "..", "tmp", "desktop", "zerobyte-runtime");
const shouldNotarize = Boolean(
process.env.APPLE_API_KEY && process.env.APPLE_API_KEY_ID && process.env.APPLE_API_ISSUER,
);
-const shouldSign = process.env.ZEROBYTE_MAC_SIGN === "true" || shouldNotarize;
+const isMasTarget = process.argv.some((arg) => arg === "mas" || arg === "mas-dev" || arg.includes("--mac=mas"));
+const shouldSign = process.env.ZEROBYTE_MAC_SIGN === "true" || shouldNotarize || isMasTarget;
+
+const readCurrentGitTag = () => {
+ try {
+ return execFileSync("git", ["describe", "--tags", "--exact-match"], {
+ cwd: repoRoot,
+ encoding: "utf-8",
+ stdio: ["ignore", "pipe", "ignore"],
+ }).trim();
+ } catch {
+ return undefined;
+ }
+};
+
+let releaseVersion = process.env.ZEROBYTE_DESKTOP_VERSION;
+if (!releaseVersion) releaseVersion = process.env.APP_VERSION;
+if (!releaseVersion) releaseVersion = process.env.GITHUB_REF_NAME;
+if (!releaseVersion) releaseVersion = readCurrentGitTag();
+
+const releaseTag = releaseVersion?.replace(/^refs\/tags\//, "");
+const appStoreVersion = releaseTag?.replace(/^v/, "").match(/^\d+\.\d+\.\d+/)?.[0];
+const buildNumber = process.env.ZEROBYTE_BUILD_NUMBER || process.env.GITHUB_RUN_NUMBER;
+const exportComplianceCode =
+ process.env.ZEROBYTE_EXPORT_COMPLIANCE_CODE || process.env.APP_STORE_EXPORT_COMPLIANCE_CODE;
+const masProvisioningProfile =
+ process.env.ZEROBYTE_MAS_PROVISIONING_PROFILE || path.join(desktopDir, "profiles", "mac-app-store.provisionprofile");
+const masDevProvisioningProfile =
+ process.env.ZEROBYTE_MAS_DEV_PROVISIONING_PROFILE ||
+ path.join(desktopDir, "profiles", "mac-development.provisionprofile");
+
+if (releaseTag && !process.env.APP_VERSION) {
+ process.env.APP_VERSION = releaseTag;
+}
+if (releaseTag && !process.env.VITE_APP_VERSION) {
+ process.env.VITE_APP_VERSION = releaseTag;
+}
+
+if (!releaseTag || !appStoreVersion) {
+ throw new Error("Desktop builds require a release version like v0.39.0 or v0.39.0-beta.3.");
+}
+
+const archNames = {
+ [Arch.x64]: "x64",
+ [Arch.arm64]: "arm64",
+};
const run = (command, args) =>
new Promise((resolve, reject) => {
@@ -27,17 +74,24 @@ const run = (command, args) =>
});
});
-const prepareRuntime = async ({ electronPlatformName }) => {
+const prepareRuntime = async ({ electronPlatformName, arch }) => {
+ const archName = archNames[arch];
+ const runtimePlatformName = electronPlatformName === "mas" ? "darwin" : electronPlatformName;
+ if (!archName) {
+ throw new Error(`Unsupported desktop target architecture: ${arch}`);
+ }
+
await run("bun", ["run", "build:electron"]);
- await run("bun", ["scripts/prepare-runtime.ts", "--platform", electronPlatformName, "--arch", "arm64"]);
+ await run("bun", ["scripts/prepare-runtime.ts", "--platform", runtimePlatformName, "--arch", archName]);
};
/** @type {import("electron-builder").Configuration} */
const config = {
appId: "com.nicotsx.zerobyte",
productName: "Zerobyte",
+ extraMetadata: { version: appStoreVersion },
asar: true,
- artifactName: "${productName}-${version}-${os}-${arch}.${ext}",
+ artifactName: `\${productName}-${releaseTag}-\${os}-\${arch}.\${ext}`,
directories: {
output: "dist",
buildResources: "assets",
@@ -56,22 +110,32 @@ const config = {
mac: {
category: "public.app-category.utilities",
icon: "assets/icon.icns",
+ extendInfo: {
+ ITSAppUsesNonExemptEncryption: Boolean(exportComplianceCode),
+ ...(exportComplianceCode ? { ITSEncryptionExportComplianceCode: exportComplianceCode } : {}),
+ },
target: [
{
target: "dmg",
arch: ["arm64"],
},
- {
- target: "zip",
- arch: ["arm64"],
- },
],
hardenedRuntime: true,
entitlements: "electron/entitlements.mac.plist",
entitlementsInherit: "electron/entitlements.mac.plist",
+ ...(buildNumber ? { bundleVersion: buildNumber } : {}),
...(shouldSign ? {} : { identity: null }),
...(shouldNotarize ? { notarize: true } : {}),
},
+ mas: {
+ hardenedRuntime: false,
+ entitlements: "electron/entitlements.mas.plist",
+ entitlementsInherit: "electron/entitlements.mas.inherit.plist",
+ provisioningProfile: masProvisioningProfile,
+ },
+ masDev: {
+ provisioningProfile: masDevProvisioningProfile,
+ },
dmg: {
background: "assets/dmg-background.png",
icon: "assets/icon.icns",
diff --git a/apps/desktop/electron/desktop-runtime.ts b/apps/desktop/electron/desktop-runtime.ts
index a2eefee9..def7f850 100644
--- a/apps/desktop/electron/desktop-runtime.ts
+++ b/apps/desktop/electron/desktop-runtime.ts
@@ -24,6 +24,10 @@ export type DesktopRuntime = {
const ownerOnlyDirMode = 0o700;
const ownerOnlyFileMode = 0o600;
+const desktopAppVersion = import.meta.env.VITE_APP_VERSION;
+if (app.isPackaged && !desktopAppVersion) {
+ throw new Error("Packaged desktop app is missing VITE_APP_VERSION.");
+}
const chmodIfSupported = async (targetPath: string, mode: number) => {
if (process.platform !== "win32") {
@@ -99,7 +103,7 @@ const createServerEnv = (port: number, dirs: DesktopDirs, serverUrl: string, lau
BASE_URL: serverUrl,
TRUSTED_ORIGINS: serverUrl,
APP_SECRET: dirs.appSecret,
- APP_VERSION: app.getVersion(),
+ APP_VERSION: desktopAppVersion,
ZEROBYTE_RUNTIME: "desktop",
ZEROBYTE_DESKTOP_LAUNCH_SECRET: launchSecret,
ZEROBYTE_DATABASE_URL: path.join(dirs.dataDir, "zerobyte.db"),
diff --git a/apps/desktop/electron/entitlements.mas.inherit.plist b/apps/desktop/electron/entitlements.mas.inherit.plist
new file mode 100644
index 00000000..794eada1
--- /dev/null
+++ b/apps/desktop/electron/entitlements.mas.inherit.plist
@@ -0,0 +1,10 @@
+
+
+
+
+ com.apple.security.app-sandbox
+
+ com.apple.security.inherit
+
+
+
diff --git a/apps/desktop/electron/entitlements.mas.plist b/apps/desktop/electron/entitlements.mas.plist
new file mode 100644
index 00000000..c197360d
--- /dev/null
+++ b/apps/desktop/electron/entitlements.mas.plist
@@ -0,0 +1,18 @@
+
+
+
+
+ com.apple.security.app-sandbox
+
+ com.apple.security.cs.allow-jit
+
+ com.apple.security.cs.allow-unsigned-executable-memory
+
+ com.apple.security.files.user-selected.read-write
+
+ com.apple.security.network.client
+
+ com.apple.security.network.server
+
+
+
diff --git a/apps/desktop/fastlane/.env.example b/apps/desktop/fastlane/.env.example
new file mode 100644
index 00000000..c124beff
--- /dev/null
+++ b/apps/desktop/fastlane/.env.example
@@ -0,0 +1,3 @@
+APP_STORE_CONNECT_API_KEY_ID=
+APP_STORE_CONNECT_ISSUER_ID=
+APP_STORE_CONNECT_API_KEY_PATH=fastlane/AuthKey_YOUR_KEY_ID.p8
diff --git a/apps/desktop/fastlane/Fastfile b/apps/desktop/fastlane/Fastfile
new file mode 100644
index 00000000..9b1dee1a
--- /dev/null
+++ b/apps/desktop/fastlane/Fastfile
@@ -0,0 +1,118 @@
+require "shellwords"
+require "fileutils"
+
+opt_out_usage
+default_platform(:mac)
+
+DESKTOP_DIR = File.expand_path("..", __dir__)
+APP_IDENTIFIER = "com.nicotsx.zerobyte"
+
+def env_value(*names)
+ names.each do |name|
+ value = ENV[name]
+ return value unless value.nil? || value.empty?
+ end
+
+ nil
+end
+
+def latest_mas_pkg
+ configured_pkg = env_value("ZEROBYTE_MAS_PKG")
+ return File.expand_path(configured_pkg, DESKTOP_DIR) if configured_pkg
+
+ packages = Dir[File.join(DESKTOP_DIR, "dist", "mas-arm64", "*.pkg")]
+ UI.user_error!("No MAS package found. Run `bundle exec fastlane mac build_mas` first.") if packages.empty?
+
+ packages.max_by { |path| File.mtime(path) }
+end
+
+def prepare_mas_output
+ output_dir = File.join(DESKTOP_DIR, "dist", "mas-arm64")
+ app_dir = File.join(output_dir, "Zerobyte.app")
+ return unless File.exist?(app_dir)
+ return if File.stat(app_dir).uid == Process.uid && File.writable?(app_dir)
+
+ stale_output_dir = "#{output_dir}.stale.#{Time.now.strftime("%Y%m%d%H%M%S")}"
+ FileUtils.mv(output_dir, stale_output_dir)
+ FileUtils.mkdir_p(output_dir)
+ UI.important("Moved stale MAS output to #{stale_output_dir}")
+end
+
+def app_store_api_key
+ return @app_store_api_key if @app_store_api_key
+
+ key_id = env_value("APP_STORE_CONNECT_API_KEY_ID", "ASC_KEY_ID")
+ issuer_id = env_value("APP_STORE_CONNECT_ISSUER_ID", "ASC_ISSUER_ID")
+ key_filepath = env_value("APP_STORE_CONNECT_API_KEY_PATH", "ASC_KEY_PATH")
+ key_content = env_value("APP_STORE_CONNECT_API_KEY_CONTENT", "ASC_KEY_CONTENT")
+ key_content_base64 = env_value("APP_STORE_CONNECT_API_KEY_BASE64", "ASC_KEY_BASE64")
+
+ UI.user_error!("Set APP_STORE_CONNECT_API_KEY_ID or ASC_KEY_ID.") unless key_id
+ UI.user_error!("Set APP_STORE_CONNECT_ISSUER_ID or ASC_ISSUER_ID.") unless issuer_id
+
+ options = {
+ key_id: key_id,
+ issuer_id: issuer_id,
+ }
+
+ if key_filepath
+ options[:key_filepath] = File.expand_path(key_filepath, DESKTOP_DIR)
+ elsif key_content_base64
+ options[:key_content] = key_content_base64
+ options[:is_key_content_base64] = true
+ elsif key_content
+ options[:key_content] = key_content
+ else
+ UI.user_error!(
+ "Set APP_STORE_CONNECT_API_KEY_PATH, APP_STORE_CONNECT_API_KEY_CONTENT, or APP_STORE_CONNECT_API_KEY_BASE64.",
+ )
+ end
+
+ @app_store_api_key = app_store_connect_api_key(**options)
+end
+
+def mas_build_number
+ explicit_build_number = env_value("ZEROBYTE_BUILD_NUMBER")
+ return explicit_build_number if explicit_build_number
+
+ run_number = env_value("GITHUB_RUN_NUMBER")
+ run_attempt = env_value("GITHUB_RUN_ATTEMPT")
+ return [run_number, run_attempt].compact.join(".") if run_number
+
+ UI.user_error!("Set ZEROBYTE_BUILD_NUMBER or GITHUB_RUN_NUMBER.")
+end
+
+platform :mac do
+ desc "Build the signed Mac App Store package"
+ lane :build_mas do
+ build_number = mas_build_number
+ env = "ZEROBYTE_BUILD_NUMBER=#{Shellwords.escape(build_number)} "
+
+ prepare_mas_output
+ sh("cd #{Shellwords.escape(DESKTOP_DIR)} && #{env}bun run make:mas")
+ end
+
+ desc "Upload the latest signed Mac App Store package to App Store Connect"
+ lane :upload_testflight do
+ pkg = latest_mas_pkg
+ UI.message("Uploading #{pkg}")
+
+ upload_to_app_store(
+ api_key: app_store_api_key,
+ app_identifier: APP_IDENTIFIER,
+ pkg: pkg,
+ platform: "osx",
+ skip_metadata: true,
+ skip_screenshots: true,
+ skip_app_version_update: true,
+ force: true,
+ run_precheck_before_submit: false,
+ )
+ end
+
+ desc "Build and upload the Mac App Store package to App Store Connect"
+ lane :beta do |options|
+ build_mas unless options[:skip_build] || ENV["ZEROBYTE_SKIP_MAS_BUILD"] == "true"
+ upload_testflight
+ end
+end
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 6a540006..3f740d51 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -9,6 +9,9 @@
"build:electron": "vite build --config vite.main.config.ts",
"package": "electron-builder --config electron-builder.config.cjs --mac dir --publish never",
"make": "electron-builder --config electron-builder.config.cjs --mac --publish never",
+ "make:mas": "electron-builder --config electron-builder.config.cjs --mac mas --publish never",
+ "make:mas-dev": "electron-builder --config electron-builder.config.cjs --mac mas-dev --publish never",
+ "publish": "electron-builder --config electron-builder.config.cjs --mac --publish always",
"tsc": "tsc --noEmit"
},
"dependencies": {