[HOLD for payment 2023-11-09] [$500] [Due November 1, 2023] MacOS Desktop switch to the notarytool system

[AndrewGable]

Problem

We are receiving this warning on all MacOS Desktop builds:

Notarizing using the legacy altool system. The altool system will be disabled on November 1 2023. Please switch to the notarytool system before then.
You can do this by setting "tool: notarytool" in your "@electron/notarize" options. Please note that the credentials options may be slightly different between tools.

Solution

Use notarytool system tool in @electron/notarize

cc @Expensify/mobile-deployers

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~01aaa4dddd4145fd7d
• Upwork Job ID: 1717388083552153600
• Last Price Increase: 2023-10-26
• Automatic offers:
• tienifr | Contributor | 27465891

Issue Owner

Current Issue Owner: @AndrewGable

[melvin-bot]

Triggered auto assignment to @kadiealexander (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~01aaa4dddd4145fd7d

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @burczu (External)

[tienifr]

Proposal

Please re-state the problem that we are trying to solve in this issue.

We are receiving this warning on all MacOS Desktop builds.

What is the root cause of that problem?

We're passing tool: 'notarytool', when notarizing, but we're still passing legacy options like appBundleId, leading to it forcing to use legacy tool.
See the list of options for each tool in here.

What changes do you think we should make in order to solve the problem?

Remove the legacy options from the notarize function call, for example the appBundleId.

We might need to additionally set some environment variables to make it work with the notarytool.

What alternative solutions did you explore? (Optional)

After this change is released, it will have proper type system so it will not be possible to use the wrong options for the tool. But it's optional and not required to fix this issue, we'll get that later once we update the package.

[AndrewGable]

We might need to additionally set some environment variables to make it work with the notarytool.

Which ones and where?

[AndrewGable]

To be honest this will be pretty complex to set up with external as it will require a lot of internal work, but if we find a good proposal we can try it!

[burczu]

@AndrewGable Is there a way I can test it locally? I've tried to build for desktop but it fails on signing step.

[AndrewGable]

Not unless you set up your own Apple developer account, but we can test this using AdHoc builds.

[tienifr]

but we can test this using AdHoc builds.

@AndrewGable Can you try an adhoc build on this branch so see if it's working fine, in there I just removed the appBundleId which is a legacy field.

Which ones and where?

If the above build does not work, we might need to add environment variables following this recommendation. But let's try the above first (or if we could some how have a doc on how to set up the notarizing on our own environment, that would be great)

[kadiealexander]

@AndrewGable is this supposed to be internal or external?

[AndrewGable]

@kadiealexander - Currently set to external, but might need to switch to internal to hit deadline.

[AndrewGable]

@tienifr - Still seeing same warning

https://github.com/Expensify/App/actions/runs/6696472036/job/18194338484

#30599

[AndrewGable]

Made some additional changes that @tienifr suggested and now seeing a successful build using the correct tool. I'll submit the PR, we can pay @tienifr half.

[burczu]

Just to inform, I'll be ooo for the next few days and we'll be back on Monday, November 6th.

[melvin-bot]

📣 @tienifr 🎉 An offer has been automatically sent to your Upwork account for the Contributor role 🎉 Thanks for contributing to the Expensify app!

Offer link
Upwork job
Please accept the offer and leave a comment on the Github issue letting us know when we can expect a PR to be ready for review 🧑‍💻
Keep in mind: Code of Conduct | Contributing 📖

[melvin-bot]

Reviewing label has been removed, please complete the "BugZero Checklist".

[melvin-bot]

The solution for this issue has been 🚀 deployed to production 🚀 in version 1.3.94-2 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

• Migrate MacOS desktop to use notarytool to notarize #30599

If no regressions arise, payment will be issued on 2023-11-09. 🎊

After the hold period is over and BZ checklist items are completed, please complete any of the applicable payments for this issue, and check them off once done.

• External issue reporter
• Contributor that fixed the issue
• Contributor+ that helped on the issue and/or PR

For reference, here are some details about the assignees on this issue:

• @tienifr requires payment offer (Contributor)

[melvin-bot]

BugZero Checklist: The PR fixing this issue has been merged! The following checklist (instructions) will need to be completed before the issue can be closed:

• [@AndrewGable] The PR that introduced the bug has been identified. Link to the PR:
• [@AndrewGable] The offending PR has been commented on, pointing out the bug it caused and why, so the author and reviewers can learn from the mistake. Link to comment:
• [@AndrewGable] A discussion in #expensify-bugs has been started about whether any other steps should be taken (e.g. updating the PR review checklist) in order to catch this type of bug sooner. Link to discussion:
• [@tienifr] Determine if we should create a regression test for this bug.
• [@tienifr] If we decide to create a regression test for the bug, please propose the regression test steps to ensure the same bug will not reach production again.
• [@kadiealexander] Link the GH issue for creating/updating the regression test once above steps have been agreed upon:

[kadiealexander]

@AndrewGable any thoughts on the checklist?

[AndrewGable]

This was not a bug in the traditional sense, just something that needed to be updated to keep up with maintenance from Apple.

[kadiealexander]

Easy! @tienifr has been paid, closing this one out.