feat(mac): Support for a custom 'sign' function in mac config

.changeset/fresh-poems-greet.md

@@ -0,0 +1,6 @@
+---
+"app-builder-lib": minor
+"electron-builder": minor
+---
+
+mac: Support for a custom 'sign' action

docs/configuration/mac.md

@@ -92,6 +92,9 @@ The top-level [mac](configuration.md#Configuration-mac) key contains set of opti
 <p><code id="MacConfiguration-signIgnore">signIgnore</code> Array&lt;String&gt; | String | “undefined” - Regex or an array of regex’s that signal skipping signing a file.</p>
 </li>
 <li>
+<p><code id="MacConfiguration-sign">sign</code> module:app-builder-lib/out/macPackager.__type | String | “undefined” - The custom function (or path to file or module id) to sign an app bundle.</p>
+</li>
+<li>
 <p><code id="MacConfiguration-timestamp">timestamp</code> String | “undefined” - Specify the URL of the timestamp authority server</p>
 </li>
 <li>

packages/app-builder-lib/scheme.json

@@ -2787,6 +2787,20 @@
             "string"
           ]
         },
+        "sign": {
+          "anyOf": [
+            {
+              "typeof": "function"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "The custom function (or path to file or module id) to sign an app bundle."
+        },
         "signIgnore": {
           "anyOf": [
             {
@@ -3420,6 +3434,20 @@
             "string"
           ]
         },
+        "sign": {
+          "anyOf": [
+            {
+              "typeof": "function"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "The custom function (or path to file or module id) to sign an app bundle."
+        },
         "signIgnore": {
           "anyOf": [
             {

packages/app-builder-lib/src/index.ts

@@ -39,6 +39,7 @@ export { SnapOptions, PlugDescriptor, SlotDescriptor } from "./options/SnapOptio
 export { Metadata, AuthorMetadata, RepositoryInfo } from "./options/metadata"
 export { AppInfo } from "./appInfo"
 export { SquirrelWindowsOptions } from "./options/SquirrelWindowsOptions"
+export { CustomMacSign, CustomMacSignOptions } from "./macPackager"
 export {
   WindowsSignOptions,
   CustomWindowsSignTaskConfiguration,

packages/app-builder-lib/src/macPackager.ts

@@ -13,7 +13,7 @@ import { DIR_TARGET, Platform, Target } from "./core"
 import { AfterPackContext, ElectronPlatformName } from "./index"
 import { MacConfiguration, MasConfiguration, NotarizeLegacyOptions, NotarizeNotaryOptions } from "./options/macOptions"
 import { Packager } from "./packager"
-import { chooseNotNull, PlatformPackager } from "./platformPackager"
+import { chooseNotNull, resolveFunction, PlatformPackager } from "./platformPackager"
 import { ArchiveTarget } from "./targets/ArchiveTarget"
 import { PkgTarget, prepareProductBuildArgs } from "./targets/pkg"
 import { createCommonTarget, NoOpTarget } from "./targets/targetFactory"
@@ -23,6 +23,9 @@ import * as fs from "fs/promises"
 import { notarize, NotarizeOptions } from "@electron/notarize"
 import { LegacyNotarizePasswordCredentials, LegacyNotarizeStartOptions, NotaryToolStartOptions, NotaryToolCredentials } from "@electron/notarize/lib/types"
 
+export type CustomMacSign = (configuration: SignOptions, packager?: MacPackager) => Promise<any>
+export type CustomMacSignOptions = SignOptions
+
 export default class MacPackager extends PlatformPackager<MacConfiguration> {
   readonly codeSigningInfo = new Lazy<CodeSigningInfo>(() => {
     const cscLink = this.getCscLink()
@@ -231,7 +234,7 @@ export default class MacPackager extends PlatformPackager<MacConfiguration> {
         }
       }
 
-      if (identity == null) {
+      if (!options.sign && identity == null) {
         await reportError(isMas, certificateTypes, qualifier, keychainFile, this.forceCodeSigning)
         return false
       }
@@ -309,13 +312,13 @@ export default class MacPackager extends PlatformPackager<MacConfiguration> {
     log.info(
       {
         file: log.filePath(appPath),
-        identityName: identity.name,
-        identityHash: identity.hash,
+        identityName: identity?.name,
+        identityHash: identity?.hash,
         provisioningProfile: signOptions.provisioningProfile || "none",
       },
       "signing"
     )
-    await this.doSign(signOptions)
+    await this.doSign(signOptions, masOptions)
 
     // https://github.com/electron-userland/electron-builder/issues/1196#issuecomment-312310209
     if (masOptions != null && !isDevelopment) {
@@ -393,7 +396,14 @@ export default class MacPackager extends PlatformPackager<MacConfiguration> {
   }
 
   //noinspection JSMethodCanBeStatic
-  protected doSign(opts: SignOptions): Promise<any> {
+  protected async doSign(opts: SignOptions, masOptions: MasConfiguration | null): Promise<any> {
+    const options = masOptions == null ? this.platformSpecificBuildOptions : masOptions
+
+    const customSign = await resolveFunction(this.appInfo.type, options.sign, "sign")
+    if (customSign) {
+      return customSign(opts, this)
+    }
+
     return signAsync(opts)
   }
 

packages/app-builder-lib/src/options/macOptions.ts

@@ -1,4 +1,5 @@
 import { PlatformSpecificBuildOptions, TargetConfiguration, TargetSpecificOptions } from "../index"
+import { CustomMacSign } from "../macPackager"
 
 export type MacOsTargetName = "default" | "dmg" | "mas" | "mas-dev" | "pkg" | "7z" | "zip" | "tar.xz" | "tar.lz" | "tar.gz" | "tar.bz2" | "dir"
 
@@ -175,6 +176,11 @@ export interface MacConfiguration extends PlatformSpecificBuildOptions {
    */
   readonly signIgnore?: Array<string> | string | null
 
+  /**
+   * The custom function (or path to file or module id) to sign an app bundle.
+   */
+  readonly sign?: CustomMacSign | string | null
+
   /**
    * Specify the URL of the timestamp authority server
    */