mac: Enable autoupdate by sign and notarize via github action (#581)

mac: Enable autoupdate by sign and notarize via github action

Signed and notarized binaries are the precondition for autoupdates on
mac. Additionally Gatekeeper on 10.15+ is happy and allows to open the
app instead of blocking it.

The notarize step is added unconditionally, as it only emits a warning if
the notarization API key is not set, but it does not break the build.

This is an upstreaming of https://github.com/csett86/jitsi-meet-electron
where it worked since March 2020.

On CI, only sign if not triggered by pull request, as these will fail (as secrets
are not available to pull request builds).

The required github secrets (signing key, cert and notarize API login, password and team id) are:

Signing

Open the Keychain Access app. Export all certificates (Developer ID Certificate) related to your app into a single file (e.g. certs.p12) and set a strong password.

Base64-encode your certificates using the following command: base64 -i certs.p12 -o encoded.txt

In the GitHub repository, go to Settings → Secrets and add the following two variables:

    mac_certs: Your base64 encoded certificates, i.e. the content of the encoded.txt file you created before
    mac_certs_password: The password you set when exporting the certificates

Notarization

Create an app-specific password for your apple id: https://support.apple.com/de-de/HT204397

In the GitHub repository, go to Settings → Secrets and add the following three variables:

    apple_id: your apple id
    apple_id_password: the just created app-specific password for your apple id
    team_id: your team short name: https://github.com/electron/electron-notarize#notes-on-your-team-short-name

Co-authored-by: Saúl Ibarra Corretgé <s@saghul.net>

4 files changed, 293 insertions, 294 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 025cf0f..6b8a5e0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,6 +37,14 @@ jobs:
     - uses: actions/setup-node@v1
       with:
         node-version: '16.x'
+    - name: Prepare for app signing and notarization
+      if: ${{ github.event_name != 'pull_request' }}
+      run: |
+        echo "CSC_LINK=${{ secrets.mac_cert }}" >> $GITHUB_ENV
+        echo "CSC_KEY_PASSWORD=${{ secrets.mac_cert_password }}" >> $GITHUB_ENV
+        echo "APPLE_ID=${{ secrets.apple_id }}" >> $GITHUB_ENV
+        echo "APPLE_ID_PASSWORD=${{ secrets.apple_id_password }}" >> $GITHUB_ENV
+        echo "TEAM_ID=${{ secrets.team_id }}" >> $GITHUB_ENV
     - name: Build it
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/notarize.js b/notarize.js
new file mode 100644
index 0000000..15c3db9
--- /dev/null
+++ b/notarize.js
@@ -0,0 +1,28 @@
+const { notarize } = require('electron-notarize');
+const process = require('process');
+const pkgJson = require('./package.json');
+
+exports.default = async function notarizing(context) {
+    const { electronPlatformName, appOutDir } = context;
+
+    if (electronPlatformName !== 'darwin') {
+        return;
+    }
+
+    if (!(process.env.APPLE_ID && process.env.APPLE_ID_PASSWORD && process.env.TEAM_ID)) {
+        console.log('Skipping notarization');
+
+        return;
+    }
+
+    const appName = context.packager.appInfo.productFilename;
+
+    return await notarize({
+        tool: 'notarytool',
+        appBundleId: pkgJson.build.appId,
+        appPath: `${appOutDir}/${appName}.app`,
+        appleId: process.env.APPLE_ID,
+        appleIdPassword: process.env.APPLE_ID_PASSWORD,
+        teamId: process.env.TEAM_ID
+    });
+};
diff --git a/package-lock.json b/package-lock.json
index c7f5dbd..3f2ddc4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -45,6 +45,7 @@
         "electron-context-menu": "^2.5.0",
         "electron-is-dev": "^1.2.0",
         "electron-log": "^4.3.2",
+        "electron-notarize": "1.1.1",
         "electron-react-devtools": "0.5.3",
         "electron-store": "^5.2.0",
         "electron-updater": "^4.4.3",
@@ -9758,6 +9759,55 @@
       "integrity": "sha512-PJPWE8JDzQ137UlxX9K917nI8GTcwgiJpE2PMPXZo+I6C4AaZU+JWQ3lW5NjQ1Lg8Qk8qbze+Ly0yAiqhbmpeA==",
       "dev": true
     },
+    "node_modules/electron-notarize": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/electron-notarize/-/electron-notarize-1.1.1.tgz",
+      "integrity": "sha512-kufsnqh86CTX89AYNG3NCPoboqnku/+32RxeJ2+7A4Rbm4bbOx0Nc7XTy3/gAlBfpj9xPAxHfhZLOHgfi6cJVw==",
+      "dev": true,
+      "dependencies": {
+        "debug": "^4.1.1",
+        "fs-extra": "^9.0.1"
+      },
+      "engines": {
+        "node": ">= 10.0.0"
+      }
+    },
+    "node_modules/electron-notarize/node_modules/fs-extra": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
+      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
+      "dev": true,
+      "dependencies": {
+        "at-least-node": "^1.0.0",
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/electron-notarize/node_modules/jsonfile": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
+      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "dev": true,
+      "dependencies": {
+        "universalify": "^2.0.0"
+      },
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
+    "node_modules/electron-notarize/node_modules/universalify": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz",
+      "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 10.0.0"
+      }
+    },
     "node_modules/electron-osx-sign": {
       "version": "0.5.0",
       "resolved": "https://registry.npmjs.org/electron-osx-sign/-/electron-osx-sign-0.5.0.tgz",
@@ -12952,9 +13002,9 @@
       "dev": true
     },
     "node_modules/js-yaml": {
-      "version": "3.13.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.13.1.tgz",
-      "integrity": "sha512-YfbcO7jXDdyj0DGxYVSlSeQNHbD7XPWvrVWeVUujrQEoZzWJIRrCPoyk6kL6IAjAG2IolMK4T0hNUe0HOUs5Jw==",
+      "version": "3.14.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
+      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
       "dev": true,
       "dependencies": {
         "argparse": "^1.0.7",
@@ -18308,34 +18358,30 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/abbrev": {
       "version": "1.1.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/ansi-regex": {
       "version": "2.1.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/aproba": {
       "version": "1.2.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/are-we-there-yet": {
       "version": "1.1.5",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "delegates": "^1.0.0",
         "readable-stream": "^2.0.6"
@@ -18343,17 +18389,15 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/balanced-match": {
       "version": "1.0.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/brace-expansion": {
       "version": "1.1.11",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "balanced-match": "^1.0.0",
         "concat-map": "0.0.1"
@@ -18361,75 +18405,66 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/chownr": {
       "version": "1.1.4",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/code-point-at": {
       "version": "1.1.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/concat-map": {
       "version": "0.0.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/console-control-strings": {
       "version": "1.1.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/core-util-is": {
       "version": "1.0.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/debug": {
       "version": "3.2.6",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "ms": "^2.1.1"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/deep-extend": {
       "version": "0.6.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=4.0.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/delegates": {
       "version": "1.0.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/detect-libc": {
       "version": "1.0.3",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "Apache-2.0",
-      "optional": true,
       "bin": {
         "detect-libc": "bin/detect-libc.js"
       },
@@ -18439,27 +18474,24 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/fs-minipass": {
       "version": "1.2.7",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "minipass": "^2.6.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/fs.realpath": {
       "version": "1.0.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/gauge": {
       "version": "2.7.4",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "aproba": "^1.0.3",
         "console-control-strings": "^1.0.0",
@@ -18473,10 +18505,9 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/glob": {
       "version": "7.1.6",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "fs.realpath": "^1.0.0",
         "inflight": "^1.0.4",
@@ -18494,17 +18525,15 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/has-unicode": {
       "version": "2.0.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/iconv-lite": {
       "version": "0.4.24",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3"
       },
@@ -18514,20 +18543,18 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/ignore-walk": {
       "version": "3.0.3",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "minimatch": "^3.0.4"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/inflight": {
       "version": "1.0.6",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "once": "^1.3.0",
         "wrappy": "1"
@@ -18535,27 +18562,24 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/inherits": {
       "version": "2.0.4",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/ini": {
       "version": "1.3.5",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "engines": {
         "node": "*"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/is-fullwidth-code-point": {
       "version": "1.0.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "number-is-nan": "^1.0.0"
       },
@@ -18565,17 +18589,15 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/isarray": {
       "version": "1.0.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/minimatch": {
       "version": "3.0.4",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },
@@ -18585,17 +18607,15 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/minimist": {
       "version": "1.2.5",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/minipass": {
       "version": "2.9.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "safe-buffer": "^5.1.2",
         "yallist": "^3.0.0"
@@ -18603,10 +18623,9 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/minizlib": {
       "version": "1.3.3",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "minipass": "^2.9.0"
       }
@@ -18614,10 +18633,9 @@
     "node_modules/watchpack/node_modules/fsevents/node_modules/mkdirp": {
       "version": "0.5.3",
       "deprecated": "Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "minimist": "^1.2.5"
       },
@@ -18627,17 +18645,15 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/ms": {
       "version": "2.1.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/needle": {
       "version": "2.3.3",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "debug": "^3.2.6",
         "iconv-lite": "^0.4.4",
@@ -18652,10 +18668,9 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/node-pre-gyp": {
       "version": "0.14.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "BSD-3-Clause",
-      "optional": true,
       "dependencies": {
         "detect-libc": "^1.0.2",
         "mkdirp": "^0.5.1",
@@ -18674,10 +18689,9 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/nopt": {
       "version": "4.0.3",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "abbrev": "1",
         "osenv": "^0.1.4"
@@ -18688,27 +18702,24 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/npm-bundled": {
       "version": "1.1.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "npm-normalize-package-bin": "^1.0.1"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/npm-normalize-package-bin": {
       "version": "1.0.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/npm-packlist": {
       "version": "1.4.8",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "ignore-walk": "^3.0.1",
         "npm-bundled": "^1.0.1",
@@ -18717,10 +18728,9 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/npmlog": {
       "version": "4.1.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "are-we-there-yet": "~1.1.2",
         "console-control-strings": "~1.1.0",
@@ -18730,60 +18740,54 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/number-is-nan": {
       "version": "1.0.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/object-assign": {
       "version": "4.1.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/once": {
       "version": "1.4.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "wrappy": "1"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/os-homedir": {
       "version": "1.0.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/os-tmpdir": {
       "version": "1.0.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/osenv": {
       "version": "0.1.5",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "os-homedir": "^1.0.0",
         "os-tmpdir": "^1.0.0"
@@ -18791,27 +18795,24 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/path-is-absolute": {
       "version": "1.0.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/process-nextick-args": {
       "version": "2.0.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/rc": {
       "version": "1.2.8",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
-      "optional": true,
       "dependencies": {
         "deep-extend": "^0.6.0",
         "ini": "~1.3.0",
@@ -18824,10 +18825,9 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/readable-stream": {
       "version": "2.3.7",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "core-util-is": "~1.0.0",
         "inherits": "~2.0.3",
@@ -18840,10 +18840,9 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/rimraf": {
       "version": "2.7.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "glob": "^7.1.3"
       },
@@ -18853,65 +18852,57 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/safe-buffer": {
       "version": "5.1.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/safer-buffer": {
       "version": "2.1.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/sax": {
       "version": "1.2.4",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/semver": {
       "version": "5.7.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "bin": {
         "semver": "bin/semver"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/set-blocking": {
       "version": "2.0.0",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/signal-exit": {
       "version": "3.0.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/string_decoder": {
       "version": "1.1.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "safe-buffer": "~5.1.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/string-width": {
       "version": "1.0.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "code-point-at": "^1.0.0",
         "is-fullwidth-code-point": "^1.0.0",
@@ -18923,10 +18914,9 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/strip-ansi": {
       "version": "3.0.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "ansi-regex": "^2.0.0"
       },
@@ -18936,20 +18926,18 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/strip-json-comments": {
       "version": "2.0.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/tar": {
       "version": "4.4.13",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "chownr": "^1.1.1",
         "fs-minipass": "^1.2.5",
@@ -18965,34 +18953,30 @@
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/util-deprecate": {
       "version": "1.0.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/wide-align": {
       "version": "1.1.3",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "string-width": "^1.0.2 || 2"
       }
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/wrappy": {
       "version": "1.0.2",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/fsevents/node_modules/yallist": {
       "version": "3.1.1",
-      "dev": true,
+      "extraneous": true,
       "inBundle": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/watchpack/node_modules/glob-parent": {
       "version": "3.1.0",
@@ -27888,6 +27872,46 @@
       "integrity": "sha512-PJPWE8JDzQ137UlxX9K917nI8GTcwgiJpE2PMPXZo+I6C4AaZU+JWQ3lW5NjQ1Lg8Qk8qbze+Ly0yAiqhbmpeA==",
       "dev": true
     },
+    "electron-notarize": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/electron-notarize/-/electron-notarize-1.1.1.tgz",
+      "integrity": "sha512-kufsnqh86CTX89AYNG3NCPoboqnku/+32RxeJ2+7A4Rbm4bbOx0Nc7XTy3/gAlBfpj9xPAxHfhZLOHgfi6cJVw==",
+      "dev": true,
+      "requires": {
+        "debug": "^4.1.1",
+        "fs-extra": "^9.0.1"
+      },
+      "dependencies": {
+        "fs-extra": {
+          "version": "9.1.0",
+          "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
+          "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
+          "dev": true,
+          "requires": {
+            "at-least-node": "^1.0.0",
+            "graceful-fs": "^4.2.0",
+            "jsonfile": "^6.0.1",
+            "universalify": "^2.0.0"
+          }
+        },
+        "jsonfile": {
+          "version": "6.1.0",
+          "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
+          "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+          "dev": true,
+          "requires": {
+            "graceful-fs": "^4.1.6",
+            "universalify": "^2.0.0"
+          }
+        },
+        "universalify": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz",
+          "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==",
+          "dev": true
+        }
+      }
+    },
     "electron-osx-sign": {
       "version": "0.5.0",
       "resolved": "https://registry.npmjs.org/electron-osx-sign/-/electron-osx-sign-0.5.0.tgz",
@@ -28458,6 +28482,7 @@
     },
     "eslint-config-jitsi": {
       "version": "git+ssh://git@github.com/jitsi/eslint-config-jitsi.git#f9ec185a0f3d7ad39226c59ab01251c87e000c5b",
+      "integrity": "sha512-3dZxKaSugOZ9sjIMZoaBdamixY4s2LMX1/MQThfW/ApsqFrc8hVdTYcOGUKv5NOHMjN8o1J32nzi+ocQqnVhBQ==",
       "dev": true,
       "from": "eslint-config-jitsi@github:jitsi/eslint-config-jitsi#1.0.2"
     },
@@ -30439,6 +30464,7 @@
     },
     "jitsi-meet-electron-utils": {
       "version": "git+ssh://git@github.com/jitsi/jitsi-meet-electron-utils.git#64477b82008c25b203903568ec11bdac1a284b06",
+      "integrity": "sha512-ye+W8DAwNaDvjnqKxAa4YhOGUTg8gDCMisF/7Im+f26sKYAAOcNwCItpmtsYG57XDf8MxzqCgnrvlJSfp+voZg==",
       "from": "jitsi-meet-electron-utils@github:jitsi/jitsi-meet-electron-utils#64477b82008c25b203903568ec11bdac1a284b06",
       "requires": {
         "jitsi-meet-logger": "github:jitsi/jitsi-meet-logger#v1.0.0",
@@ -30450,6 +30476,7 @@
     },
     "jitsi-meet-logger": {
       "version": "git+ssh://git@github.com/jitsi/jitsi-meet-logger.git#4add5bac2e4cea73a05f42b7596ee03c7f7a2567",
+      "integrity": "sha512-1WC//tMrc8lAxfldhEYFxk8EZuHwBcJgy+QDzd9E7ZJCCm5r+aUYshnx69PLwcbf7iLfKPhcuCKz8FOJRpBdXg==",
       "from": "jitsi-meet-logger@github:jitsi/jitsi-meet-logger#v1.0.0"
     },
     "js-md5": {
@@ -30465,9 +30492,9 @@
       "dev": true
     },
     "js-yaml": {
-      "version": "3.13.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.13.1.tgz",
-      "integrity": "sha512-YfbcO7jXDdyj0DGxYVSlSeQNHbD7XPWvrVWeVUujrQEoZzWJIRrCPoyk6kL6IAjAG2IolMK4T0hNUe0HOUs5Jw==",
+      "version": "3.14.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
+      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
       "dev": true,
       "requires": {
         "argparse": "^1.0.7",
@@ -34858,26 +34885,22 @@
             "abbrev": {
               "version": "1.1.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "ansi-regex": {
               "version": "2.1.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "aproba": {
               "version": "1.2.0",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "are-we-there-yet": {
               "version": "1.1.5",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "delegates": "^1.0.0",
                 "readable-stream": "^2.0.6"
@@ -34886,14 +34909,12 @@
             "balanced-match": {
               "version": "1.0.0",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "brace-expansion": {
               "version": "1.1.11",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "balanced-match": "^1.0.0",
                 "concat-map": "0.0.1"
@@ -34902,38 +34923,32 @@
             "chownr": {
               "version": "1.1.4",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "code-point-at": {
               "version": "1.1.0",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "concat-map": {
               "version": "0.0.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "console-control-strings": {
               "version": "1.1.0",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "core-util-is": {
               "version": "1.0.2",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "debug": {
               "version": "3.2.6",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "ms": "^2.1.1"
               }
@@ -34941,26 +34956,22 @@
             "deep-extend": {
               "version": "0.6.0",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "delegates": {
               "version": "1.0.0",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "detect-libc": {
               "version": "1.0.3",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "fs-minipass": {
               "version": "1.2.7",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "minipass": "^2.6.0"
               }
@@ -34968,14 +34979,12 @@
             "fs.realpath": {
               "version": "1.0.0",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "gauge": {
               "version": "2.7.4",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "aproba": "^1.0.3",
                 "console-control-strings": "^1.0.0",
@@ -34990,8 +34999,7 @@
             "glob": {
               "version": "7.1.6",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "fs.realpath": "^1.0.0",
                 "inflight": "^1.0.4",
@@ -35004,14 +35012,12 @@
             "has-unicode": {
               "version": "2.0.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "iconv-lite": {
               "version": "0.4.24",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "safer-buffer": ">= 2.1.2 < 3"
               }
@@ -35019,8 +35025,7 @@
             "ignore-walk": {
               "version": "3.0.3",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "minimatch": "^3.0.4"
               }
@@ -35028,8 +35033,7 @@
             "inflight": {
               "version": "1.0.6",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "once": "^1.3.0",
                 "wrappy": "1"
@@ -35038,20 +35042,17 @@
             "inherits": {
               "version": "2.0.4",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "ini": {
               "version": "1.3.5",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "is-fullwidth-code-point": {
               "version": "1.0.0",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "number-is-nan": "^1.0.0"
               }
@@ -35059,14 +35060,12 @@
             "isarray": {
               "version": "1.0.0",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "minimatch": {
               "version": "3.0.4",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "brace-expansion": "^1.1.7"
               }
@@ -35074,14 +35073,12 @@
             "minimist": {
               "version": "1.2.5",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "minipass": {
               "version": "2.9.0",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "safe-buffer": "^5.1.2",
                 "yallist": "^3.0.0"
@@ -35090,8 +35087,7 @@
             "minizlib": {
               "version": "1.3.3",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "minipass": "^2.9.0"
               }
@@ -35099,8 +35095,7 @@
             "mkdirp": {
               "version": "0.5.3",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "minimist": "^1.2.5"
               }
@@ -35108,14 +35103,12 @@
             "ms": {
               "version": "2.1.2",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "needle": {
               "version": "2.3.3",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "debug": "^3.2.6",
                 "iconv-lite": "^0.4.4",
@@ -35125,8 +35118,7 @@
             "node-pre-gyp": {
               "version": "0.14.0",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "detect-libc": "^1.0.2",
                 "mkdirp": "^0.5.1",
@@ -35143,8 +35135,7 @@
             "nopt": {
               "version": "4.0.3",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "abbrev": "1",
                 "osenv": "^0.1.4"
@@ -35153,8 +35144,7 @@
             "npm-bundled": {
               "version": "1.1.1",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "npm-normalize-package-bin": "^1.0.1"
               }
@@ -35162,14 +35152,12 @@
             "npm-normalize-package-bin": {
               "version": "1.0.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "npm-packlist": {
               "version": "1.4.8",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "ignore-walk": "^3.0.1",
                 "npm-bundled": "^1.0.1",
@@ -35179,8 +35167,7 @@
             "npmlog": {
               "version": "4.1.2",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "are-we-there-yet": "~1.1.2",
                 "console-control-strings": "~1.1.0",
@@ -35191,20 +35178,17 @@
             "number-is-nan": {
               "version": "1.0.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "object-assign": {
               "version": "4.1.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "once": {
               "version": "1.4.0",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "wrappy": "1"
               }
@@ -35212,20 +35196,17 @@
             "os-homedir": {
               "version": "1.0.2",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "os-tmpdir": {
               "version": "1.0.2",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "osenv": {
               "version": "0.1.5",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "os-homedir": "^1.0.0",
                 "os-tmpdir": "^1.0.0"
@@ -35234,20 +35215,17 @@
             "path-is-absolute": {
               "version": "1.0.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "process-nextick-args": {
               "version": "2.0.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "rc": {
               "version": "1.2.8",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "deep-extend": "^0.6.0",
                 "ini": "~1.3.0",
@@ -35258,8 +35236,7 @@
             "readable-stream": {
               "version": "2.3.7",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "core-util-is": "~1.0.0",
                 "inherits": "~2.0.3",
@@ -35273,8 +35250,7 @@
             "rimraf": {
               "version": "2.7.1",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "glob": "^7.1.3"
               }
@@ -35282,44 +35258,37 @@
             "safe-buffer": {
               "version": "5.1.2",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "safer-buffer": {
               "version": "2.1.2",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "sax": {
               "version": "1.2.4",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "semver": {
               "version": "5.7.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "set-blocking": {
               "version": "2.0.0",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "signal-exit": {
               "version": "3.0.2",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "string_decoder": {
               "version": "1.1.1",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "safe-buffer": "~5.1.0"
               }
@@ -35327,8 +35296,7 @@
             "string-width": {
               "version": "1.0.2",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "code-point-at": "^1.0.0",
                 "is-fullwidth-code-point": "^1.0.0",
@@ -35338,8 +35306,7 @@
             "strip-ansi": {
               "version": "3.0.1",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "ansi-regex": "^2.0.0"
               }
@@ -35347,14 +35314,12 @@
             "strip-json-comments": {
               "version": "2.0.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "tar": {
               "version": "4.4.13",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "chownr": "^1.1.1",
                 "fs-minipass": "^1.2.5",
@@ -35368,14 +35333,12 @@
             "util-deprecate": {
               "version": "1.0.2",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "wide-align": {
               "version": "1.1.3",
               "bundled": true,
-              "dev": true,
-              "optional": true,
+              "extraneous": true,
               "requires": {
                 "string-width": "^1.0.2 || 2"
               }
@@ -35383,14 +35346,12 @@
             "wrappy": {
               "version": "1.0.2",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             },
             "yallist": {
               "version": "3.1.1",
               "bundled": true,
-              "dev": true,
-              "optional": true
+              "extraneous": true
             }
           }
         },
diff --git a/package.json b/package.json
index fcd3896..e6e8ac2 100644
--- a/package.json
+++ b/package.json
@@ -21,6 +21,7 @@
     "productName": "Jitsi Meet",
     "generateUpdatesFilesForAllChannels": true,
     "afterPack": "./linux-sandbox-fix.js",
+    "afterSign": "./notarize.js",
     "files": [
       "build",
       "resources",
@@ -163,6 +164,7 @@
     "electron-context-menu": "^2.5.0",
     "electron-is-dev": "^1.2.0",
     "electron-log": "^4.3.2",
+    "electron-notarize": "1.1.1",
     "electron-react-devtools": "0.5.3",
     "electron-store": "^5.2.0",
     "electron-updater": "^4.4.3",