Burn Node-related Electron fuses as a proactive hardening measure

.github/workflows/build_and_test.yaml

@@ -107,6 +107,8 @@ jobs:
                       os: macos
                       artifact: macos
                       executable: "/Users/runner/Applications/Element.app/Contents/MacOS/Element"
+                      # We need to mount the DMG and copy the app to the Applications folder as a mounted DMG is
+                      # read-only and thus would not allow us to override the fuses as is required for Playwright.
                       prepare_cmd: |
                           hdiutil attach ./dist/*.dmg -mountpoint /Volumes/Element &&
                           rsync -a /Volumes/Element/Element.app ~/Applications/ &&
@@ -150,7 +152,7 @@ jobs:
               run: ${{ matrix.prepare_cmd }}
               if: matrix.prepare_cmd
 
-            # This is required for Playwright testing
+            # Playwright requires this fuse to be enabled to test Electron apps
             - name: Set EnableNodeCliInspectArguments fuse enabled
               run: $RUN_AS npx @electron/fuses write --app ${{ matrix.executable }} EnableNodeCliInspectArguments=on
               shell: bash

.github/workflows/build_macos.yaml

@@ -92,10 +92,10 @@ jobs:
             - name: Check app was signed & notarised successfully
               if: inputs.sign != ''
               run: |
-                  hdiutil attach dist/*.dmg
-                  codesign -dv --verbose=4 /Volumes/Element*/*.app
-                  spctl -a -vvv -t install /Volumes/Element*/*.app
-                  hdiutil detach /Volumes/Element*
+                  hdiutil attach dist/*.dmg -mountpoint /Volumes/Element
+                  codesign -dv --verbose=4 /Volumes/Element/*.app
+                  spctl -a -vvv -t install /Volumes/Element/*.app
+                  hdiutil detach /Volumes/Element
 
             - name: "[Unsigned] Build App"
               if: inputs.sign == ''

electron-builder.js

@@ -28,27 +28,21 @@ const NIGHTLY_DEB_NAME = "element-nightly";
 
 const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
 
-let buildMacOsUniversal = false;
-
 /**
  * @type {import('electron-builder').Configuration}
  * @see https://www.electron.build/configuration/configuration
  */
 const config = {
     appId: "im.riot.app",
     asarUnpack: "**/*.node",
-    beforePack: async (context) => {
-        if (context.electronPlatformName === "darwin" && context.arch === Arch.universal) {
-            buildMacOsUniversal = true;
-        }
-    },
     afterPack: async (context) => {
-        if (context.electronPlatformName !== "darwin" || context.arch === Arch.universal || !buildMacOsUniversal) {
-            // Burn in electron fuses, for macOS if we are building a universal package we only need to burn fuses there
+        if (context.electronPlatformName !== "darwin" || context.arch === Arch.universal) {
+            // Burn in electron fuses for proactive security hardening.
+            // On macOS, we only do this for the universal package, as the constituent arm64 and amd64 packages are embedded within.
             const ext = {
                 darwin: ".app",
                 win32: ".exe",
-                linux: [""],
+                linux: "",
             }[context.electronPlatformName];
 
             let executableName = context.packager.appInfo.productFilename;
@@ -58,7 +52,7 @@ const config = {
             }
 
             const electronBinaryPath = path.join(context.appOutDir, `${executableName}${ext}`);
-            console.log("Flipping fuses for: ", electronBinaryPath);
+            console.log(`Flipping fuses for: ${electronBinaryPath}`);
 
             await flipFuses(electronBinaryPath, {
                 version: FuseVersion.V1,
@@ -71,7 +65,7 @@ const config = {
                 [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
                 [FuseV1Options.EnableNodeCliInspectArguments]: false,
 
-                // Mac app crashes when enabled for us on arm, might be fine for you
+                // Mac app crashes on arm for us when `LoadBrowserProcessSpecificV8Snapshot` is enabled
                 [FuseV1Options.LoadBrowserProcessSpecificV8Snapshot]: false,
                 // https://github.com/electron/fuses/issues/7
                 [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: false,