@electron/notarize 2.5.0: notarize

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify @electron/notarize.notarize in pkg:npm/%40electron/notarize@2.5.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40electron/notarize@2.5.0
Demonstrate these symbols/APIs:
  - @electron/notarize.notarize

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:231333903e6845a47a6602cff7c99faa7f3cff17c9bdf7e0d1c6922d5e4865e2","contract":["notarize rejects deprecated legacy altool invocation with decommissioning error","notarize checks notarytool availability via xcrun and reports error if missing","notarize validates credentials and rejects missing authentication properties","notarize rejects conflicting multi-strategy authentication credentials","notarize completes end-to-end notarization submission and app stapling for dmg bundle","notarize surfaces diagnostic logs when notarytool submission status is invalid"],"goal":"verify @electron/notarize.notarize in pkg:npm/%40electron/notarize@2.5.0","kind":"HOW","packages":["pkg:npm/%40electron/notarize@2.5.0"],"schemaVersion":1,"symbols":["@electron/notarize.notarize"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40electron/notarize@2.5.0"],"schemaVersion":1,"subject":"pkg:npm/%40electron/notarize@2.5.0","symbols":["@electron/notarize.notarize"],"verifierAdapter":"node-typescript@1"}

import { notarize } from '@electron/notarize';

export async function notarizeApplication(options) {
  return await notarize(options);
}

export { notarize };

{
  "name": "sample-electron-notarize",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-electron-notarize",
      "version": "1.0.0",
      "dependencies": {
        "@electron/notarize": "2.5.0"
      }
    },
    "node_modules/@electron/notarize": {
      "version": "2.5.0",
      "resolved": "https://registry.npmjs.org/@electron/notarize/-/notarize-2.5.0.tgz",
      "integrity": "sha512-jNT8nwH1f9X5GEITXaQ8IF/KdskvIkOFfB2CvwumsveVidzpSc+mvhhTMdAGSYF3O+Nq49lJ7y+ssODRXu06+A==",
      "license": "MIT",
      "dependencies": {
        "debug": "^4.1.1",
        "fs-extra": "^9.0.1",
        "promise-retry": "^2.0.1"
      },
      "engines": {
        "node": ">= 10.0.0"
      }
    },
    "node_modules/at-least-node": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
      "license": "ISC",
      "engines": {
        "node": ">= 4.0.0"
      }
    },
    "node_modules/debug": {
      "version": "4.4.3",
      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
      "license": "MIT",
      "dependencies": {
        "ms": "^2.1.3"
      },
      "engines": {
        "node": ">=6.0"
      },
      "peerDependenciesMeta": {
        "supports-color": {
          "optional": true
        }
      }
    },
    "node_modules/err-code": {
      "version": "2.0.3",
      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
      "license": "MIT"
    },
    "node_modules/fs-extra": {
      "version": "9.1.0",
      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
      "license": "MIT",
      "dependencies": {
        "at-least-node": "^1.0.0",
        "graceful-fs": "^4.2.0",
        "jsonfile": "^6.0.1",
        "universalify": "^2.0.0"
      },
      "engines": {
        "node": ">=10"
      }
    },
    "node_modules/graceful-fs": {
      "version": "4.2.11",
      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
      "license": "ISC"
    },
    "node_modules/jsonfile": {
      "version": "6.2.1",
      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
      "license": "MIT",
      "dependencies": {
        "universalify": "^2.0.0"
      },
      "optionalDependencies": {
        "graceful-fs": "^4.1.6"
      }
    },
    "node_modules/ms": {
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
      "license": "MIT"
    },
    "node_modules/promise-retry": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
      "license": "MIT",
      "dependencies": {
        "err-code": "^2.0.2",
        "retry": "^0.12.0"
      },
      "engines": {
        "node": ">=10"
      }
    },
    "node_modules/retry": {
      "version": "0.12.0",
      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
      "license": "MIT",
      "engines": {
        "node": ">= 4"
      }
    },
    "node_modules/universalify": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
      "license": "MIT",
      "engines": {
        "node": ">= 10.0.0"
      }
    }
  }
}

{
  "name": "sample-electron-notarize",
  "version": "1.0.0",
  "type": "module",
  "private": true,
  "dependencies": {
    "@electron/notarize": "2.5.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify @electron/notarize.notarize in pkg:npm/%40electron/notarize@2.5.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40electron/notarize@2.5.0"
  ],
  "symbols": [
    "@electron/notarize.notarize"
  ]
}

import assert from 'node:assert/strict';
import fs from 'node:fs';
import path from 'node:path';
import os from 'node:os';
import { notarize, notarizeApplication } from '../index.js';

async function withMockXcrun(handler, xcrunBehavior) {
  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mock-xcrun-'));
  const xcrunScript = path.join(tmpDir, 'xcrun');
  fs.writeFileSync(xcrunScript, xcrunBehavior, { mode: 0o755 });

  const origPath = process.env.PATH;
  process.env.PATH = `${tmpDir}:${origPath}`;
  try {
    return await handler(tmpDir);
  } finally {
    process.env.PATH = origPath;
    fs.rmSync(tmpDir, { recursive: true, force: true });
  }
}

// 1. notarize rejects deprecated legacy altool invocation with decommissioning error
{
  await assert.rejects(
    () =>
      notarizeApplication({
        tool: 'legacy',
        appPath: 'sample.dmg',
        appBundleId: 'com.example.sample',
        appleId: 'developer@example.com',
        appleIdPassword: 'password',
      }),
    {
      name: 'Error',
      message: 'Notarization with the legacy altool system was decommisioned as of November 2023',
    }
  );
}

// 2. notarize checks notarytool availability via xcrun and reports error if missing
{
  const missingXcrunScript = `#!/bin/sh
exit 1
`;
  await withMockXcrun(async () => {
    await assert.rejects(
      () =>
        notarizeApplication({
          appPath: 'sample.dmg',
          appleApiKey: 'AuthKey_EXAMPLE.p8',
          appleApiKeyId: 'KEY1234567',
          appleApiIssuer: '00000000-0000-0000-0000-000000000000',
        }),
      {
        name: 'Error',
        message: 'notarytool is not available, you must be on at least Xcode 13 or provide notarytoolPath',
      }
    );
  }, missingXcrunScript);
}

// 3. notarize validates credentials and rejects missing authentication properties
{
  const availableXcrunScript = `#!/bin/sh
if [ "$1" = "--find" ] && [ "$2" = "notarytool" ]; then
  echo "/usr/bin/notarytool"
  exit 0
fi
exit 0
`;
  await withMockXcrun(async () => {
    await assert.rejects(
      () =>
        notarizeApplication({
          appPath: 'sample.dmg',
        }),
      {
        name: 'Error',
        message: 'No authentication properties provided (e.g. appleId, appleApiKey, keychain)',
      }
    );
  }, availableXcrunScript);
}

// 4. notarize rejects conflicting multi-strategy authentication credentials
{
  const availableXcrunScript = `#!/bin/sh
if [ "$1" = "--find" ] && [ "$2" = "notarytool" ]; then
  echo "/usr/bin/notarytool"
  exit 0
fi
exit 0
`;
  await withMockXcrun(async () => {
    await assert.rejects(
      () =>
        notarizeApplication({
          appPath: 'sample.dmg',
          appleId: 'developer@example.com',
          appleIdPassword: 'password',
          teamId: 'TEAM123456',
          keychainProfile: 'NOTARIZE_PROFILE',
        }),
      {
        name: 'Error',
        message: 'Cannot use password credentials, API key credentials and keychain credentials at once',
      }
    );
  }, availableXcrunScript);
}

// 5. notarize completes end-to-end notarization submission and app stapling for dmg bundle
{
  const successfulXcrunScript = `#!/bin/sh
if [ "$1" = "--find" ] && [ "$2" = "notarytool" ]; then
  echo "/usr/bin/notarytool"
  exit 0
fi
if [ "$1" = "notarytool" ] && [ "$2" = "submit" ]; then
  echo '{"status":"Accepted","id":"test-submission-id"}'
  exit 0
fi
if [ "$1" = "notarytool" ] && [ "$2" = "log" ]; then
  echo "Log: submission accepted"
  exit 0
fi
if [ "$1" = "stapler" ] && [ "$2" = "staple" ]; then
  echo "The staple and validate action worked!"
  exit 0
fi
exit 1
`;
  await withMockXcrun(async (tmpDir) => {
    const dummyDmg = path.join(tmpDir, 'sample.dmg');
    fs.writeFileSync(dummyDmg, 'dummy dmg content');

    const result = await notarizeApplication({
      appPath: dummyDmg,
      appleApiKey: 'AuthKey_EXAMPLE.p8',
      appleApiKeyId: 'KEY1234567',
      appleApiIssuer: '00000000-0000-0000-0000-000000000000',
    });

    assert.equal(result, undefined);
  }, successfulXcrunScript);
}

// 6. notarize surfaces diagnostic logs when notarytool submission status is invalid
{
  const invalidXcrunScript = `#!/bin/sh
if [ "$1" = "--find" ] && [ "$2" = "notarytool" ]; then
  echo "/usr/bin/notarytool"
  exit 0
fi
if [ "$1" = "notarytool" ] && [ "$2" = "submit" ]; then
  echo '{"status":"Invalid","id":"test-invalid-id"}'
  exit 0
fi
if [ "$1" = "notarytool" ] && [ "$2" = "log" ]; then
  echo "Package contains unsigned code binaries"
  exit 0
fi
exit 1
`;
  await withMockXcrun(async (tmpDir) => {
    const dummyDmg = path.join(tmpDir, 'sample.dmg');
    fs.writeFileSync(dummyDmg, 'dummy dmg content');

    await assert.rejects(
      () =>
        notarizeApplication({
          appPath: dummyDmg,
          appleApiKey: 'AuthKey_EXAMPLE.p8',
          appleApiKeyId: 'KEY1234567',
          appleApiIssuer: '00000000-0000-0000-0000-000000000000',
        }),
      (err) => {
        assert(err instanceof Error);
        assert(err.message.includes('Failed to notarize via notarytool'));
        assert(err.message.includes('Diagnostics from notarytool log: Package contains unsigned code binaries'));
        return true;
      }
    );
  }, invalidXcrunScript);
}

console.log('Contract tests passed successfully.');