2015-10-16 09:15:23 +00:00
|
|
|
|
# Mac App Store Submission Guide
|
|
|
|
|
|
2015-10-21 20:03:12 +00:00
|
|
|
|
Since v0.34.0, Electron allows submitting packaged apps to the Mac App Store
|
|
|
|
|
(MAS). This guide provides information on: how to submit your app and the
|
2015-10-16 23:25:30 +00:00
|
|
|
|
limitations of the MAS build.
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2016-03-31 05:17:50 +00:00
|
|
|
|
**Note:** Submitting an app to Mac App Store requires enrolling [Apple Developer
|
2015-11-30 07:21:39 +00:00
|
|
|
|
Program][developer-program], which costs money.
|
|
|
|
|
|
2015-10-16 22:50:41 +00:00
|
|
|
|
## How to Submit Your App
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2015-10-21 20:03:12 +00:00
|
|
|
|
The following steps introduce a simple way to submit your app to Mac App Store.
|
2015-11-19 01:04:16 +00:00
|
|
|
|
However, these steps do not ensure your app will be approved by Apple; you
|
2015-10-21 20:03:12 +00:00
|
|
|
|
still need to read Apple's [Submitting Your App][submitting-your-app] guide on
|
2015-10-16 23:25:30 +00:00
|
|
|
|
how to meet the Mac App Store requirements.
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2015-10-16 22:50:41 +00:00
|
|
|
|
### Get Certificate
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2015-10-21 20:03:12 +00:00
|
|
|
|
To submit your app to the Mac App Store, you first must get a certificate from
|
2015-10-16 23:25:30 +00:00
|
|
|
|
Apple. You can follow these [existing guides][nwjs-guide] on web.
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2016-05-19 02:13:09 +00:00
|
|
|
|
### Get Team ID
|
|
|
|
|
|
|
|
|
|
Before signing your app, you need to know the Team ID of your account. To locate
|
2016-05-19 09:36:26 +00:00
|
|
|
|
your Team ID, Sign in to [Apple Developer Center](https://developer.apple.com/account/),
|
|
|
|
|
and click Membership in the sidebar. Your Team ID appears in the Membership
|
|
|
|
|
Information section under the team name.
|
2016-05-19 02:13:09 +00:00
|
|
|
|
|
2015-10-16 22:50:41 +00:00
|
|
|
|
### Sign Your App
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2016-05-19 02:13:09 +00:00
|
|
|
|
After finishing the preparation work, you can package your app by following
|
2015-10-21 20:03:12 +00:00
|
|
|
|
[Application Distribution](application-distribution.md), and then proceed to
|
2016-05-19 02:13:09 +00:00
|
|
|
|
signing your app.
|
|
|
|
|
|
|
|
|
|
First, you have to add a `ElectronTeamID` key to your app's `Info.plist`, which
|
2016-10-11 16:58:53 +00:00
|
|
|
|
has your Team ID as value:
|
2016-05-19 02:13:09 +00:00
|
|
|
|
|
|
|
|
|
```xml
|
|
|
|
|
<plist version="1.0">
|
|
|
|
|
<dict>
|
|
|
|
|
...
|
|
|
|
|
<key>ElectronTeamID</key>
|
|
|
|
|
<string>TEAM_ID</string>
|
|
|
|
|
</dict>
|
|
|
|
|
</plist>
|
|
|
|
|
```
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2016-05-19 02:13:09 +00:00
|
|
|
|
Then, you need to prepare two entitlements files.
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
|
|
|
|
`child.plist`:
|
|
|
|
|
|
|
|
|
|
```xml
|
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
|
|
|
<plist version="1.0">
|
|
|
|
|
<dict>
|
|
|
|
|
<key>com.apple.security.app-sandbox</key>
|
|
|
|
|
<true/>
|
|
|
|
|
<key>com.apple.security.inherit</key>
|
|
|
|
|
<true/>
|
|
|
|
|
</dict>
|
|
|
|
|
</plist>
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
`parent.plist`:
|
|
|
|
|
|
|
|
|
|
```xml
|
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
|
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
|
|
|
<plist version="1.0">
|
|
|
|
|
<dict>
|
|
|
|
|
<key>com.apple.security.app-sandbox</key>
|
|
|
|
|
<true/>
|
2016-05-18 07:48:22 +00:00
|
|
|
|
<key>com.apple.security.application-groups</key>
|
2016-05-19 02:13:09 +00:00
|
|
|
|
<string>TEAM_ID.your.bundle.id</string>
|
2015-10-16 09:15:23 +00:00
|
|
|
|
</dict>
|
|
|
|
|
</plist>
|
|
|
|
|
```
|
|
|
|
|
|
2016-05-19 02:13:09 +00:00
|
|
|
|
You have to replace `TEAM_ID` with your Team ID, and replace `your.bundle.id`
|
|
|
|
|
with the Bundle ID of your app.
|
2016-05-18 07:48:22 +00:00
|
|
|
|
|
2015-10-16 23:25:30 +00:00
|
|
|
|
And then sign your app with the following script:
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
|
|
|
|
```bash
|
|
|
|
|
#!/bin/bash
|
|
|
|
|
|
|
|
|
|
# Name of your app.
|
|
|
|
|
APP="YourApp"
|
2016-04-29 20:28:41 +00:00
|
|
|
|
# The path of your app to sign.
|
|
|
|
|
APP_PATH="/path/to/YourApp.app"
|
2015-10-16 09:15:23 +00:00
|
|
|
|
# The path to the location you want to put the signed package.
|
|
|
|
|
RESULT_PATH="~/Desktop/$APP.pkg"
|
|
|
|
|
# The name of certificates you requested.
|
|
|
|
|
APP_KEY="3rd Party Mac Developer Application: Company Name (APPIDENTITY)"
|
|
|
|
|
INSTALLER_KEY="3rd Party Mac Developer Installer: Company Name (APPIDENTITY)"
|
2016-05-31 23:48:03 +00:00
|
|
|
|
# The path of your plist files.
|
|
|
|
|
CHILD_PLIST="/path/to/child.plist"
|
|
|
|
|
PARENT_PLIST="/path/to/parent.plist"
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
|
|
|
|
FRAMEWORKS_PATH="$APP_PATH/Contents/Frameworks"
|
|
|
|
|
|
2016-05-31 23:48:03 +00:00
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Electron Framework"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework/Versions/A/Libraries/libnode.dylib"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/Electron Framework.framework"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/Contents/MacOS/$APP Helper"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper.app/"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper EH.app/Contents/MacOS/$APP Helper EH"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper EH.app/"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper NP.app/Contents/MacOS/$APP Helper NP"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$FRAMEWORKS_PATH/$APP Helper NP.app/"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$CHILD_PLIST" "$APP_PATH/Contents/MacOS/$APP"
|
|
|
|
|
codesign -s "$APP_KEY" -f --entitlements "$PARENT_PLIST" "$APP_PATH"
|
2016-01-29 04:38:50 +00:00
|
|
|
|
|
2015-11-09 03:42:37 +00:00
|
|
|
|
productbuild --component "$APP_PATH" /Applications --sign "$INSTALLER_KEY" "$RESULT_PATH"
|
2015-10-16 09:15:23 +00:00
|
|
|
|
```
|
2015-10-21 20:03:12 +00:00
|
|
|
|
|
2016-06-18 13:26:26 +00:00
|
|
|
|
If you are new to app sandboxing under macOS, you should also read through
|
2015-10-21 20:03:12 +00:00
|
|
|
|
Apple's [Enabling App Sandbox][enable-app-sandbox] to have a basic idea, then
|
2015-10-16 23:25:30 +00:00
|
|
|
|
add keys for the permissions needed by your app to the entitlements files.
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2016-06-07 01:26:53 +00:00
|
|
|
|
Apart from manually signing your app, you can also choose to use the
|
|
|
|
|
[electron-osx-sign][electron-osx-sign] module to do the job.
|
|
|
|
|
|
|
|
|
|
#### Sign Native Modules
|
|
|
|
|
|
|
|
|
|
Native modules used in your app also need to be signed. If using
|
|
|
|
|
electron-osx-sign, be sure to include the path to the built binaries in the
|
|
|
|
|
argument list:
|
|
|
|
|
|
|
|
|
|
```bash
|
|
|
|
|
electron-osx-sign YourApp.app YourApp.app/Contents/Resources/app/node_modules/nativemodule/build/release/nativemodule
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Also note that native modules may have intermediate files produced which should
|
|
|
|
|
not be included (as they would also need to be signed). If you use
|
2016-10-10 17:08:36 +00:00
|
|
|
|
[electron-packager][electron-packager] before version 8.1.0, add
|
|
|
|
|
`--ignore=.+\.o$` to your build step to ignore these files. Versions 8.1.0 and
|
|
|
|
|
later ignores those files by default.
|
2016-06-07 01:26:53 +00:00
|
|
|
|
|
2016-04-19 07:08:37 +00:00
|
|
|
|
### Upload Your App
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2015-10-16 22:50:41 +00:00
|
|
|
|
After signing your app, you can use Application Loader to upload it to iTunes
|
|
|
|
|
Connect for processing, making sure you have [created a record][create-record]
|
2016-04-19 07:08:37 +00:00
|
|
|
|
before uploading.
|
|
|
|
|
|
|
|
|
|
### Submit Your App for Review
|
|
|
|
|
|
|
|
|
|
After these steps, you can [submit your app for review][submit-for-review].
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2015-10-16 22:50:41 +00:00
|
|
|
|
## Limitations of MAS Build
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2015-10-21 20:03:12 +00:00
|
|
|
|
In order to satisfy all requirements for app sandboxing, the following modules
|
2015-10-16 23:25:30 +00:00
|
|
|
|
have been disabled in the MAS build:
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2016-01-29 04:38:50 +00:00
|
|
|
|
* `crashReporter`
|
|
|
|
|
* `autoUpdater`
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2015-10-16 22:50:41 +00:00
|
|
|
|
and the following behaviors have been changed:
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
|
|
|
|
* Video capture may not work for some machines.
|
|
|
|
|
* Certain accessibility features may not work.
|
|
|
|
|
* Apps will not be aware of DNS changes.
|
2016-09-26 18:00:13 +00:00
|
|
|
|
* APIs for launching apps at login are disabled. See
|
|
|
|
|
https://github.com/electron/electron/issues/7312#issuecomment-249479237
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2015-10-16 23:25:30 +00:00
|
|
|
|
Also, due to the usage of app sandboxing, the resources which can be accessed by
|
2016-01-29 04:38:50 +00:00
|
|
|
|
the app are strictly limited; you can read [App Sandboxing][app-sandboxing] for
|
|
|
|
|
more information.
|
|
|
|
|
|
2016-06-14 22:20:29 +00:00
|
|
|
|
### Additional Entitlements
|
|
|
|
|
|
|
|
|
|
Depending on which Electron APIs your app uses, you may need to add additional
|
2016-06-14 22:22:12 +00:00
|
|
|
|
entitlements to your `parent.plist` file to be able to use these APIs from your
|
|
|
|
|
app's Mac App Store build.
|
2016-06-14 22:20:29 +00:00
|
|
|
|
|
2016-09-09 20:55:32 +00:00
|
|
|
|
#### Network Access
|
|
|
|
|
|
|
|
|
|
Enable outgoing network connections to allow your app to connect to a server:
|
|
|
|
|
|
|
|
|
|
```xml
|
|
|
|
|
<key>com.apple.security.network.client</key>
|
|
|
|
|
<true/>
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Enable incoming network connections to allow your app to open a network
|
|
|
|
|
listening socket:
|
|
|
|
|
|
|
|
|
|
```xml
|
|
|
|
|
<key>com.apple.security.network.server</key>
|
|
|
|
|
<true/>
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
See the [Enabling Network Access documentation][network-access] for more
|
|
|
|
|
details.
|
|
|
|
|
|
2016-06-14 22:20:29 +00:00
|
|
|
|
#### dialog.showOpenDialog
|
|
|
|
|
|
|
|
|
|
```xml
|
|
|
|
|
<key>com.apple.security.files.user-selected.read-only</key>
|
|
|
|
|
<true/>
|
|
|
|
|
```
|
|
|
|
|
|
2016-06-14 22:24:05 +00:00
|
|
|
|
See the [Enabling User-Selected File Access documentation][user-selected] for
|
|
|
|
|
more details.
|
2016-06-14 22:20:29 +00:00
|
|
|
|
|
|
|
|
|
#### dialog.showSaveDialog
|
|
|
|
|
|
|
|
|
|
```xml
|
|
|
|
|
<key>com.apple.security.files.user-selected.read-write</key>
|
|
|
|
|
<true/>
|
|
|
|
|
```
|
|
|
|
|
|
2016-06-14 22:24:05 +00:00
|
|
|
|
See the [Enabling User-Selected File Access documentation][user-selected] for
|
|
|
|
|
more details.
|
2016-06-14 22:20:29 +00:00
|
|
|
|
|
2017-07-06 09:28:41 +00:00
|
|
|
|
## Known issues
|
|
|
|
|
|
|
|
|
|
#### `shell.openItem(filePath)` #9005
|
|
|
|
|
|
|
|
|
|
This will fail when the app is signed for distribution in the Mac App Store.
|
|
|
|
|
|
|
|
|
|
##### Workaround
|
|
|
|
|
`shell.openExternal('file://' + filePath)` will open the file in the default application (as long as the extension is associated with an app).
|
|
|
|
|
|
2016-01-29 04:38:50 +00:00
|
|
|
|
## Cryptographic Algorithms Used by Electron
|
|
|
|
|
|
|
|
|
|
Depending on the country and region you are located, Mac App Store may require
|
|
|
|
|
documenting the cryptographic algorithms used in your app, and even ask you to
|
|
|
|
|
submit a copy of U.S. Encryption Registration (ERN) approval.
|
|
|
|
|
|
|
|
|
|
Electron uses following cryptographic algorithms:
|
|
|
|
|
|
|
|
|
|
* AES - [NIST SP 800-38A](http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf), [NIST SP 800-38D](http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf), [RFC 3394](http://www.ietf.org/rfc/rfc3394.txt)
|
|
|
|
|
* HMAC - [FIPS 198-1](http://csrc.nist.gov/publications/fips/fips198-1/FIPS-198-1_final.pdf)
|
|
|
|
|
* ECDSA - ANS X9.62–2005
|
|
|
|
|
* ECDH - ANS X9.63–2001
|
|
|
|
|
* HKDF - [NIST SP 800-56C](http://csrc.nist.gov/publications/nistpubs/800-56C/SP-800-56C.pdf)
|
|
|
|
|
* PBKDF2 - [RFC 2898](https://tools.ietf.org/html/rfc2898)
|
|
|
|
|
* RSA - [RFC 3447](http://www.ietf.org/rfc/rfc3447)
|
|
|
|
|
* SHA - [FIPS 180-4](http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf)
|
|
|
|
|
* Blowfish - https://www.schneier.com/cryptography/blowfish/
|
|
|
|
|
* CAST - [RFC 2144](https://tools.ietf.org/html/rfc2144), [RFC 2612](https://tools.ietf.org/html/rfc2612)
|
|
|
|
|
* DES - [FIPS 46-3](http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdf)
|
|
|
|
|
* DH - [RFC 2631](https://tools.ietf.org/html/rfc2631)
|
|
|
|
|
* DSA - [ANSI X9.30](http://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.30-1%3A1997)
|
|
|
|
|
* EC - [SEC 1](http://www.secg.org/sec1-v2.pdf)
|
|
|
|
|
* IDEA - "On the Design and Security of Block Ciphers" book by X. Lai
|
|
|
|
|
* MD2 - [RFC 1319](http://tools.ietf.org/html/rfc1319)
|
|
|
|
|
* MD4 - [RFC 6150](https://tools.ietf.org/html/rfc6150)
|
|
|
|
|
* MD5 - [RFC 1321](https://tools.ietf.org/html/rfc1321)
|
|
|
|
|
* MDC2 - [ISO/IEC 10118-2](https://www.openssl.org/docs/manmaster/crypto/mdc2.html)
|
|
|
|
|
* RC2 - [RFC 2268](https://tools.ietf.org/html/rfc2268)
|
|
|
|
|
* RC4 - [RFC 4345](https://tools.ietf.org/html/rfc4345)
|
|
|
|
|
* RC5 - http://people.csail.mit.edu/rivest/Rivest-rc5rev.pdf
|
|
|
|
|
* RIPEMD - [ISO/IEC 10118-3](http://webstore.ansi.org/RecordDetail.aspx?sku=ISO%2FIEC%2010118-3:2004)
|
|
|
|
|
|
|
|
|
|
On how to get the ERN approval, you can reference the article: [How to legally
|
|
|
|
|
submit an app to Apple’s App Store when it uses encryption (or how to obtain an
|
|
|
|
|
ERN)][ern-tutorial].
|
2015-10-16 09:15:23 +00:00
|
|
|
|
|
2015-11-30 07:21:39 +00:00
|
|
|
|
[developer-program]: https://developer.apple.com/support/compare-memberships/
|
2015-10-16 09:15:23 +00:00
|
|
|
|
[submitting-your-app]: https://developer.apple.com/library/mac/documentation/IDEs/Conceptual/AppDistributionGuide/SubmittingYourApp/SubmittingYourApp.html
|
|
|
|
|
[nwjs-guide]: https://github.com/nwjs/nw.js/wiki/Mac-App-Store-%28MAS%29-Submission-Guideline#first-steps
|
|
|
|
|
[enable-app-sandbox]: https://developer.apple.com/library/ios/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html
|
|
|
|
|
[create-record]: https://developer.apple.com/library/ios/documentation/LanguagesUtilities/Conceptual/iTunesConnect_Guide/Chapters/CreatingiTunesConnectRecord.html
|
2016-06-07 01:26:53 +00:00
|
|
|
|
[electron-osx-sign]: https://github.com/electron-userland/electron-osx-sign
|
|
|
|
|
[electron-packager]: https://github.com/electron-userland/electron-packager
|
2015-10-16 09:15:23 +00:00
|
|
|
|
[submit-for-review]: https://developer.apple.com/library/ios/documentation/LanguagesUtilities/Conceptual/iTunesConnect_Guide/Chapters/SubmittingTheApp.html
|
|
|
|
|
[app-sandboxing]: https://developer.apple.com/app-sandboxing/
|
2016-01-29 04:38:50 +00:00
|
|
|
|
[ern-tutorial]: https://carouselapps.com/2015/12/15/legally-submit-app-apples-app-store-uses-encryption-obtain-ern/
|
2016-04-19 07:08:37 +00:00
|
|
|
|
[temporary-exception]: https://developer.apple.com/library/mac/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/AppSandboxTemporaryExceptionEntitlements.html
|
2016-06-14 22:24:05 +00:00
|
|
|
|
[user-selected]: https://developer.apple.com/library/mac/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html#//apple_ref/doc/uid/TP40011195-CH4-SW6
|
2016-09-09 20:55:32 +00:00
|
|
|
|
[network-access]: https://developer.apple.com/library/ios/documentation/Miscellaneous/Reference/EntitlementKeyReference/Chapters/EnablingAppSandbox.html#//apple_ref/doc/uid/TP40011195-CH4-SW9
|