@electron/notarize 2.5.0: notarize

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/%40electron/notarize@2.5.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40electron/notarize@2.5.0
Demonstrate these symbols/APIs:
  - notarize

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:4d95897137e43e5e7d4304d6d6b4438eb8e89a5a554139cad7abb46b8008bf7a","contract":["validateAuthorizationArgs validates complete password credentials and rejects missing properties","validateAuthorizationArgs validates complete App Store Connect API key credentials and rejects missing properties","validateAuthorizationArgs validates keychain credentials with profile and optional keychain path","validateAuthorizationArgs rejects conflicting multi-strategy credentials and empty options","notarize rejects deprecated legacy altool invocation with decommissioning error"],"goal":"verify pkg:npm/%40electron/notarize@2.5.0","kind":"HOW","packages":["pkg:npm/%40electron/notarize@2.5.0"],"schemaVersion":1,"symbols":["notarize"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40electron/notarize@2.5.0"],"schemaVersion":1,"subject":"pkg:npm/%40electron/notarize@2.5.0","symbols":["notarize"],"verifierAdapter":"node-typescript@1"}

import { notarize, validateAuthorizationArgs } from '@electron/notarize';

export function checkCredentials(options) {
  return validateAuthorizationArgs(options);
}

export async function notarizeApplication(options) {
  return await notarize(options);
}

export { notarize, validateAuthorizationArgs };

{
  "name": "sample-electron-notarize",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-electron-notarize",
      "version": "1.0.0",
      "dependencies": {
        "@electron/notarize": "2.5.0"
      }
    },
    "node_modules/@electron/notarize": {
      "version": "2.5.0",
      "resolved": "https://registry.npmjs.org/@electron/notarize/-/notarize-2.5.0.tgz",
      "integrity": "sha512-jNT8nwH1f9X5GEITXaQ8IF/KdskvIkOFfB2CvwumsveVidzpSc+mvhhTMdAGSYF3O+Nq49lJ7y+ssODRXu06+A==",
      "license": "MIT",
      "dependencies": {
        "debug": "^4.1.1",
        "fs-extra": "^9.0.1",
        "promise-retry": "^2.0.1"
      },
      "engines": {
        "node": ">= 10.0.0"
      }
    },
    "node_modules/at-least-node": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
      "license": "ISC",
      "engines": {
        "node": ">= 4.0.0"
      }
    },
    "node_modules/debug": {
      "version": "4.4.3",
      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
      "license": "MIT",
      "dependencies": {
        "ms": "^2.1.3"
      },
      "engines": {
        "node": ">=6.0"
      },
      "peerDependenciesMeta": {
        "supports-color": {
          "optional": true
        }
      }
    },
    "node_modules/err-code": {
      "version": "2.0.3",
      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
      "license": "MIT"
    },
    "node_modules/fs-extra": {
      "version": "9.1.0",
      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
      "license": "MIT",
      "dependencies": {
        "at-least-node": "^1.0.0",
        "graceful-fs": "^4.2.0",
        "jsonfile": "^6.0.1",
        "universalify": "^2.0.0"
      },
      "engines": {
        "node": ">=10"
      }
    },
    "node_modules/graceful-fs": {
      "version": "4.2.11",
      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
      "license": "ISC"
    },
    "node_modules/jsonfile": {
      "version": "6.2.1",
      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
      "license": "MIT",
      "dependencies": {
        "universalify": "^2.0.0"
      },
      "optionalDependencies": {
        "graceful-fs": "^4.1.6"
      }
    },
    "node_modules/ms": {
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
      "license": "MIT"
    },
    "node_modules/promise-retry": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
      "license": "MIT",
      "dependencies": {
        "err-code": "^2.0.2",
        "retry": "^0.12.0"
      },
      "engines": {
        "node": ">=10"
      }
    },
    "node_modules/retry": {
      "version": "0.12.0",
      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
      "license": "MIT",
      "engines": {
        "node": ">= 4"
      }
    },
    "node_modules/universalify": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
      "license": "MIT",
      "engines": {
        "node": ">= 10.0.0"
      }
    }
  }
}

{
  "name": "sample-electron-notarize",
  "version": "1.0.0",
  "type": "module",
  "private": true,
  "dependencies": {
    "@electron/notarize": "2.5.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/%40electron/notarize@2.5.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40electron/notarize@2.5.0"
  ],
  "symbols": [
    "notarize"
  ]
}

import assert from 'node:assert/strict';
import {
  notarize,
  validateAuthorizationArgs,
  checkCredentials,
  notarizeApplication,
} from '../index.js';

// 1. validateAuthorizationArgs validates complete password credentials and rejects missing properties
{
  const validPassword = {
    appleId: 'developer@example.com',
    appleIdPassword: 'app-specific-password',
    teamId: 'TEAM123456',
  };
  const verified = checkCredentials(validPassword);
  assert.deepEqual(verified, validPassword);

  assert.throws(
    () => checkCredentials({ appleIdPassword: 'app-specific-password', teamId: 'TEAM123456' }),
    { message: 'The appleId property is required when using notarization with password credentials' }
  );

  assert.throws(
    () => checkCredentials({ appleId: 'developer@example.com', teamId: 'TEAM123456' }),
    { message: 'The appleIdPassword property is required when using notarization with password credentials' }
  );

  assert.throws(
    () => checkCredentials({ appleId: 'developer@example.com', appleIdPassword: 'app-specific-password' }),
    { message: 'The teamId property is required when using notarization with password credentials' }
  );
}

// 2. validateAuthorizationArgs validates complete App Store Connect API key credentials and rejects missing properties
{
  const validApiKey = {
    appleApiKey: 'AuthKey_EXAMPLE.p8',
    appleApiKeyId: 'KEY1234567',
    appleApiIssuer: '00000000-0000-0000-0000-000000000000',
  };
  const verified = checkCredentials(validApiKey);
  assert.deepEqual(verified, validApiKey);

  assert.throws(
    () => checkCredentials({ appleApiKeyId: 'KEY1234567', appleApiIssuer: '00000000-0000-0000-0000-000000000000' }),
    { message: 'The appleApiKey property is required when using notarization with ASC credentials' }
  );

  assert.throws(
    () => checkCredentials({ appleApiKey: 'AuthKey_EXAMPLE.p8', appleApiKeyId: 'KEY1234567' }),
    { message: 'The appleApiIssuer property is required when using notarization with ASC credentials' }
  );

  assert.throws(
    () => checkCredentials({ appleApiKey: 'AuthKey_EXAMPLE.p8', appleApiIssuer: '00000000-0000-0000-0000-000000000000' }),
    { message: 'The appleApiKeyId property is required when using notarization with ASC credentials' }
  );
}

// 3. validateAuthorizationArgs validates keychain credentials with profile and optional keychain path
{
  const validWithKeychain = {
    keychainProfile: 'NOTARIZE_PROFILE',
    keychain: 'custom.keychain-db',
  };
  assert.deepEqual(checkCredentials(validWithKeychain), validWithKeychain);

  const validProfileOnly = {
    keychainProfile: 'NOTARIZE_PROFILE',
  };
  assert.deepEqual(checkCredentials(validProfileOnly), validProfileOnly);

  assert.throws(
    () => checkCredentials({ keychain: 'custom.keychain-db' }),
    { message: 'The keychainProfile property is required when using notarization with keychain credentials' }
  );
}

// 4. validateAuthorizationArgs rejects conflicting multi-strategy credentials and empty options
{
  assert.throws(
    () =>
      checkCredentials({
        appleId: 'developer@example.com',
        keychainProfile: 'NOTARIZE_PROFILE',
      }),
    { message: 'Cannot use password credentials, API key credentials and keychain credentials at once' }
  );

  assert.throws(
    () =>
      checkCredentials({
        appleApiKey: 'AuthKey_EXAMPLE.p8',
        keychainProfile: 'NOTARIZE_PROFILE',
      }),
    { message: 'Cannot use password credentials, API key credentials and keychain credentials at once' }
  );

  assert.throws(
    () =>
      checkCredentials({
        appleId: 'developer@example.com',
        appleApiKey: 'AuthKey_EXAMPLE.p8',
      }),
    { message: 'Cannot use password credentials, API key credentials and keychain credentials at once' }
  );

  assert.throws(
    () => checkCredentials({}),
    { message: 'No authentication properties provided (e.g. appleId, appleApiKey, keychain)' }
  );
}

// 5. notarize rejects deprecated legacy altool invocation with decommissioning error
{
  await assert.rejects(
    () =>
      notarizeApplication({
        tool: 'legacy',
        appPath: 'sample.dmg',
        appBundleId: 'com.example.sample',
        appleId: 'developer@example.com',
        appleIdPassword: 'password',
      }),
    {
      name: 'Error',
      message: 'Notarization with the legacy altool system was decommisioned as of November 2023',
    }
  );
}

console.log('Contract tests passed successfully.');