feat: Fuse the electron binary

Disables some node flags in production and enables cookie encryption.

1 files changed, 32 insertions, 0 deletions

diff --git a/.electron-builder.config.js b/.electron-builder.config.js
index e0f59e7..4ff94d7 100644
--- a/.electron-builder.config.js
+++ b/.electron-builder.config.js
@@ -1,5 +1,9 @@
 // @ts-check
 
+const { Arch } = require('electron-builder');
+const { flipFuses, FuseV1Options, FuseVersion } = require('@electron/fuses');
+const { join } = require('path');
+
 if (process.env.VITE_APP_VERSION === undefined) {
   const now = new Date;
   process.env.VITE_APP_VERSION = `${now.getUTCFullYear() - 2000}.${now.getUTCMonth() + 1}.${now.getUTCDate()}-${now.getUTCHours() * 60 + now.getUTCMinutes()}`;
@@ -20,6 +24,34 @@ const config = {
   extraMetadata: {
     version: process.env.VITE_APP_VERSION,
   },
+  /**
+   * @param {import('electron-builder').AfterPackContext} context The `electron-builder` context.
+   * @return {Promise<void>} The promise to flip the fuses.
+   * @see https://github.com/electron-userland/electron-builder/issues/6365
+   */
+  afterPack(context) {
+    /** @type {string} */
+    const ext = {
+      darwin: '.app',
+      win32: '.exe',
+    }[context.electronPlatformName] || '';
+    const electronBinaryPath = join(
+      context.appOutDir,
+      `${context.packager.appInfo.productFilename}${ext}`
+    );
+    /** @type {import('@electron/fuses').FuseConfig<boolean>} */
+    const fuseConfig = {
+      version: FuseVersion.V1,
+      resetAdHocDarwinSignature: context.electronPlatformName === 'darwin' && context.arch === Arch.arm64,
+      [FuseV1Options.RunAsNode]: false,
+      [FuseV1Options.EnableCookieEncryption]: true,
+      [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+      [FuseV1Options.EnableNodeCliInspectArguments]: false,
+      [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
+      [FuseV1Options.OnlyLoadAppFromAsar]: true,
+    };
+    return flipFuses(electronBinaryPath, fuseConfig);
+  },
 };
 
 module.exports = config;