feat: add spctl and codesign verificatin prior to stapling

src/check-signature.ts

@@ -0,0 +1,48 @@
+import * as path from 'path';
+
+import { spawn } from './spawn';
+import type { NotarizeStapleOptions } from './types';
+import debug from 'debug';
+const d = debug('electron-notarize');
+
+const spctl = async (opts: NotarizeStapleOptions) => {
+  d('attempting to spctl asses app:', opts.appPath);
+  const result = await spawn('spctl', ['-vvv', '--assess', path.basename(opts.appPath)], {
+    cwd: path.dirname(opts.appPath),
+  });
+
+  return result;
+};
+
+const codesign = async (opts: NotarizeStapleOptions) => {
+  d('attempting to check codesign of app:', opts.appPath);
+  const result = await spawn(
+    'codesign',
+    ['-vvv', '--deep', '--strict', path.basename(opts.appPath)],
+    {
+      cwd: path.dirname(opts.appPath),
+    },
+  );
+
+  return result;
+};
+export async function checkSignatures(opts: NotarizeStapleOptions): Promise<void> {
+  const codesignResult = await codesign(opts);
+  const spctlResult = await spctl(opts);
+
+  let error = '';
+
+  if (spctlResult.code !== 0) {
+    d('spctl asses failed');
+    error = `Failed to spctl asses your application with code: ${spctlResult.code}\n\n${spctlResult.output}\n`;
+  }
+  if (codesignResult.code !== 0) {
+    d('codesign check failed');
+    error += `Failed to codesign your application with code: ${spctlResult.code}\n\n${spctlResult.output}`;
+  }
+
+  if (error) {
+    throw new Error(error);
+  }
+  d('codesign and spctl asses succeeded');
+}

src/index.ts

@@ -6,6 +6,7 @@ import { startLegacyNotarize, waitForLegacyNotarize } from './legacy';
 import { isNotaryToolAvailable, notarizeAndWaitForNotaryTool } from './notarytool';
 import { stapleApp } from './staple';
 import { NotarizeOptions, NotaryToolStartOptions } from './types';
+import { checkSignatures } from './check-signature';
 
 const d = debug('electron-notarize');
 
@@ -50,6 +51,8 @@ export async function notarize({ appPath, ...otherOptions }: NotarizeOptions) {
     } as NotaryToolStartOptions);
   }
 
+  await checkSignatures({ appPath });
+
   await retry(() => stapleApp({ appPath }), {
     retries: 3,
   });