feat: Fuse the electron binary

Disables some node flags in production and enables cookie encryption.

3 files changed, 47 insertions, 0 deletions

diff --git a/.electron-builder.config.js b/.electron-builder.config.js
index e0f59e7..4ff94d7 100644
--- a/.electron-builder.config.js
+++ b/.electron-builder.config.js
@@ -1,5 +1,9 @@
 // @ts-check
 
+const { Arch } = require('electron-builder');
+const { flipFuses, FuseV1Options, FuseVersion } = require('@electron/fuses');
+const { join } = require('path');
+
 if (process.env.VITE_APP_VERSION === undefined) {
   const now = new Date;
   process.env.VITE_APP_VERSION = `${now.getUTCFullYear() - 2000}.${now.getUTCMonth() + 1}.${now.getUTCDate()}-${now.getUTCHours() * 60 + now.getUTCMinutes()}`;
@@ -20,6 +24,34 @@ const config = {
   extraMetadata: {
     version: process.env.VITE_APP_VERSION,
   },
+  /**
+   * @param {import('electron-builder').AfterPackContext} context The `electron-builder` context.
+   * @return {Promise<void>} The promise to flip the fuses.
+   * @see https://github.com/electron-userland/electron-builder/issues/6365
+   */
+  afterPack(context) {
+    /** @type {string} */
+    const ext = {
+      darwin: '.app',
+      win32: '.exe',
+    }[context.electronPlatformName] || '';
+    const electronBinaryPath = join(
+      context.appOutDir,
+      `${context.packager.appInfo.productFilename}${ext}`
+    );
+    /** @type {import('@electron/fuses').FuseConfig<boolean>} */
+    const fuseConfig = {
+      version: FuseVersion.V1,
+      resetAdHocDarwinSignature: context.electronPlatformName === 'darwin' && context.arch === Arch.arm64,
+      [FuseV1Options.RunAsNode]: false,
+      [FuseV1Options.EnableCookieEncryption]: true,
+      [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+      [FuseV1Options.EnableNodeCliInspectArguments]: false,
+      [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
+      [FuseV1Options.OnlyLoadAppFromAsar]: true,
+    };
+    return flipFuses(electronBinaryPath, fuseConfig);
+  },
 };
 
 module.exports = config;
diff --git a/package.json b/package.json
index 488c717..8335b57 100644
--- a/package.json
+++ b/package.json
@@ -40,6 +40,7 @@
     "packages/shared"
   ],
   "devDependencies": {
+    "@electron/fuses": "^1.5.0",
     "@typescript-eslint/eslint-plugin": "^5.8.0",
     "@typescript-eslint/parser": "^5.8.0",
     "cross-env": "^7.0.3",
diff --git a/yarn.lock b/yarn.lock
index ff5e499..717f18a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -335,6 +335,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@electron/fuses@npm:^1.5.0":
+  version: 1.5.0
+  resolution: "@electron/fuses@npm:1.5.0"
+  dependencies:
+    chalk: ^4.1.1
+    fs-extra: ^9.0.1
+    minimist: ^1.2.5
+  bin:
+    electron-fuses: dist/bin.js
+  checksum: 2e3106bf18e8e1f5ce7eae18220252fbf85e883f4a3c0457dc81e0e5b00db290a2eecf8a1e9d79518c26471a06d16bb4c754f4945c45c4eb7ea93d73ef1acf59
+  languageName: node
+  linkType: hard
+
 "@electron/get@npm:^1.13.0":
   version: 1.13.1
   resolution: "@electron/get@npm:1.13.1"
@@ -4957,6 +4970,7 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "sophie@workspace:."
   dependencies:
+    "@electron/fuses": ^1.5.0
     "@typescript-eslint/eslint-plugin": ^5.8.0
     "@typescript-eslint/parser": ^5.8.0
     cross-env: ^7.0.3