fix: Brittle response parsing from notarytool

[connorgmeehan]

Description

Electron builder is not handling responses from notarytool on my device (MacOS Sonoma 14.4.1, XCode 15.2). The issue is it's trying to JSON.parse a string with the value:

Error: HTTP status code: 401. Invalid credentials. Username or password is incorrect. Use the app-specific password generated at appleid.apple.com. Ensure that all authentication arguments are correct.

Solution

• Fix the ordering of the status code check for the result of spawn
• For extra safety, catch errors when JSON.parse fails.

Compared log when errors

Previous logs

• electron-builder  version=24.13.3 os=23.4.0
  • loaded configuration  file=/Users/connormeehan/projects/eyejack/eyejack-creator/electron-builder.config.js
  • description is missed in the package.json  appPackageFile=/Users/connormeehan/projects/eyejack/eyejack-creator/dist_electron/bundled/package.json
  • author is missed in the package.json  appPackageFile=/Users/connormeehan/projects/eyejack/eyejack-creator/dist_electron/bundled/package.json
  • writing effective config  file=dist_electron/bundled/dist/builder-effective-config.yaml
  • rebuilding native dependencies  [email protected] platform=darwin arch=x64
  • install prebuilt binary  name=sharp version=0.32.6 platform=darwin arch=x64 napi=
                                                                                       • packaging       platform=darwin arch=x64 electron=14.2.9 appOutDir=dist_electron/bundled/dist/mac
  • signing         file=dist_electron/bundled/dist/mac/EyeJack Creator 2024.app platform=darwin type=distribution identity=34E41E43ADF5846B288472E3BA659E71DC2369DB provisioningProfile=none
  ⨯ Unexpected token 'E', "Error: HTT"... is not valid JSON  failedTask=build stackTrace=SyntaxError: Unexpected token 'E', "Error: HTT"... is not valid JSON
SyntaxError: Unexpected token 'E', "Error: HTT"... is not valid JSON
    at JSON.parse (<anonymous>)
    at /Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/node_modules/@electron/notarize/src/notarytool.ts:79:25
    at Generator.next (<anonymous>)
    at fulfilled (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/node_modules/@electron/notarize/lib/notarytool.js:28:58)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
From previous event:
    at processImmediate (node:internal/timers:478:21)
From previous event:
    at readDirectoryAndSign (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/src/macPackager.ts:478:29)
    at MacPackager.signApp (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/src/macPackager.ts:488:11)
    at MacPackager.doSignAfterPack (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/src/platformPackager.ts:336:21)
    at MacPackager.doPack (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/src/platformPackager.ts:321:7)
    at MacPackager.pack (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/src/macPackager.ts:198:9)
    at Packager.doBuild (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/src/packager.ts:445:9)
    at executeFinally (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/builder-util/src/promise.ts:12:14)
    at Packager._build (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/src/packager.ts:379:31)
    at Packager.build (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/app-builder-lib/src/packager.ts:340:12)
    at executeFinally (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/builder-util/src/promise.ts:12:14)

New logs

• electron-builder  version=24.13.3 os=23.4.0
  • loaded configuration  file=/Users/connormeehan/projects/eyejack/eyejack-creator/electron-builder.config.js
  • description is missed in the package.json  appPackageFile=/Users/connormeehan/projects/eyejack/eyejack-creator/dist_electron/bundled/package.json
  • author is missed in the package.json  appPackageFile=/Users/connormeehan/projects/eyejack/eyejack-creator/dist_electron/bundled/package.json
  • writing effective config  file=dist_electron/bundled/dist/builder-effective-config.yaml
  • rebuilding native dependencies  [email protected] platform=darwin arch=x64
  • install prebuilt binary  name=sharp version=0.32.6 platform=darwin arch=x64 napi=
                                                                                       • packaging       platform=darwin arch=x64 electron=14.2.9 appOutDir=dist_electron/bundled/dist/mac
  • signing         file=dist_electron/bundled/dist/mac/EyeJack Creator 2024.app platform=darwin type=distribution identity=34E41E43ADF5846B288472E3BA659E71DC2369DB provisioningProfile=none
  • skipped macOS notarization  reason=`notarize` options were set explicitly `false`
  ⨯ Failed to notarize via notarytool

Error: HTTP status code: 401. Invalid credentials. Username or password is incorrect. Use the app-specific password generated at appleid.apple.com. Ensure that all authentication arguments are correct.
  failedTask=build stackTrace=Error: Failed to notarize via notarytool

                     Error: HTTP status code: 401. Invalid credentials. Username or password is incorrect. Use the app-specific password generated at appleid.apple.com. Ensure that all authentication arguments are correct.

                         at /Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/@electron/notarize/src/notarytool.ts:87:13
    at Generator.next (<anonymous>)
    at fulfilled (/Users/connormeehan/projects/eyejack/eyejack-creator/node_modules/@electron/notarize/lib/notarytool.js:28:58)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)

[rotu]

Thanks for taking this on! It's a huge improvement by not truncating or swallowing the non-JSON text.

[rotu]

I'm not sure what the return code actually tells us. Does a return code of 0 mean notarization succeeded? Does it mean that the request was submitted correctly (and may have failed)?

Here are the four cases to consider:

1. exit code non-zero, non-JSON output (the problem case): Failure. Report text output as-is.
2. exit code non-zero, JSON output: (I originally thought this wouldn't happen. Now I think it could)
3. exit code zero, non-JSON output: I still think this is impossible.
4. exit code zero, JSON output. I think the output of notarytool log may contain non-error warnings so it should be printed regardless.

[connorgmeehan]

From a little testing here's what I found

• Happy path: Uploads and notarizes successfully. Returns JSON with exit-code 0
• ERR: Uploads but invalid. Return JSON with exit-code !== 0.
• ERR: Wrong arguments to notarytool (not uploaded). Returns text with exit-code !== 0 (The issue this PR addresses)

❯ xcrun notarytool submit ./EyeJack\ Creator\ 2024-3.4.2.dmg  ....AUTH_ARGS... -f json --wait
{"status":"Accepted","id":"fa15ba57-3b66-4934-b7d1-937996f94f05","message":"Processing complete"}

❯ echo $?
0

❯ xcrun notarytool submit ./EyeJack\ Creator\ 2024-3.4.2-mac.zip ...AUTH_ARGS...  -f json --wait --force
{"id":"beb99749-fd68-4d25-ba38-1a6a343ae96e","status":"Invalid","message":"Processing complete"}

❯ echo $?
130

Does a return code of 0 mean notarization succeeded?

Yep, seems to be

[rotu]

Looks awesome to me :-)

[QuentinMacheda]

I hope this fix will be released soon, I'm stuck not knowing the cause of the error I get...

[rotu]

@jonluca could you get this out the door or get another active maintainer's eyes on it please?

[continuous-auth]

🎉 This PR is included in version 2.3.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀