refactor: electron-builder config

Signed-off-by: Kristóf Marussy <kristof@marussy.com>

3 files changed, 152 insertions, 85 deletions

diff --git a/.electron-builder.config.cjs b/.electron-builder.config.cjs
index 3eef91c..4402088 100644
--- a/.electron-builder.config.cjs
+++ b/.electron-builder.config.cjs
@@ -1,90 +1,9 @@
-const { readFile, rename, writeFile  } = require('node:fs/promises');
-const path = require('node:path');
 
 const { Arch } = require('electron-builder');
-const { flipFuses, FuseV1Options, FuseVersion } = require('@electron/fuses');
+const { FuseV1Options, FuseVersion } = require('@electron/fuses');
 
-/**
- * Hardens the shipped electron binary by burning some electron fuses.
- *
- * Enabled chromium cookie encryption and disables options that could be
- * used to execute arbitrary code in the main process to circumvent cookie encryption:
- * - Running the application as a plain node process is disabled.
- * - Setting options through the `NODE_OPTIONS` environment variable is disabled.
- * - Attaching a debugger through the `--inspect` family of options is disabled.
- * - Will onload load the application from the ASAR archive.
- *
- * @param {import('electron-builder').AfterPackContext} context The `electron-builder` context.
- * @return {Promise<void>} The promise to flip the fuses.
- * @see https://github.com/electron/fuses
- */
-async function burnFuses(context) {
-  /** @type {string} */
-  const ext =
-    {
-      darwin: '.app',
-      win32: '.exe',
-    }[context.electronPlatformName] || '';
-  const electronBinaryPath = path.join(
-    context.appOutDir,
-    `${context.packager.appInfo.productFilename}${ext}`,
-  );
-  /** @type {import('@electron/fuses').FuseConfig<boolean>} */
-  const fuseConfig = {
-    version: FuseVersion.V1,
-    resetAdHocDarwinSignature:
-      context.electronPlatformName === 'darwin' && context.arch === Arch.arm64,
-    [FuseV1Options.RunAsNode]: false,
-    [FuseV1Options.EnableCookieEncryption]: true,
-    [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
-    [FuseV1Options.EnableNodeCliInspectArguments]: false,
-    // TODO: Revisit this: IF set to 'true' the packaged app doesn't start up on macos (x86)
-    [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: false,
-    [FuseV1Options.OnlyLoadAppFromAsar]: true,
-  };
-  return flipFuses(electronBinaryPath, fuseConfig);
-}
-
-/**
- * Adds a wrapper scripts that detects in wayland is in use and enabled it in chromium.
- *
- * The script in `build-heleprs/detect_wayland.sh` uses the `WAYLAND_DISPLAY` environmental
- * variable to detect whether wayland is in use.
- *
- * If wayland is in use, the script enables the wayland ozone backed for chromium
- * and pipewire screen sharing. Otherwise, the x11 ozone backend will be used.
- *
- * @param {import('electron-builder').AfterPackContext} context The `electron-builder` context.
- * @return {Promise<void>} The promise to add the wrapper script.
- * @see https://stackoverflow.com/a/45537237
- */
-async function enableWaylandAutoDetection(context) {
-  const { appOutDir, packager: { appInfo: { productName, productFilename } } } = context;
-  const electronBinaryPath = path.join(appOutDir, productFilename);
-  const newFilename = `${productFilename}-bin`;
-  const newElectronBinaryPath = path.join(appOutDir, newFilename);
-  await rename(electronBinaryPath, newElectronBinaryPath);
-  const wrapperScriptPath = path.join(__dirname, 'build-helpers/detect_wayland.sh');
-  const wrapperScriptTempate = await readFile(wrapperScriptPath, 'utf8');
-  const replacements = new Map([
-    ['PRODUCT_NAME', productName],
-    ['REAL_BINARY_NAME', newFilename],
-  ]);
-  const wrapperScript = wrapperScriptTempate.replaceAll(
-    /\{\{([^}]+)\}\}/g,
-    (_match, /** @type {string} */ variable) => {
-      const replacement = replacements.get(variable);
-      if (replacement === undefined) {
-        throw new Error(`Unknown variable: ${variable}`);
-      }
-      return replacement;
-    },
-  );
-  await writeFile(electronBinaryPath, wrapperScript, {
-    encoding: 'utf8',
-    mode: 0o755,
-  });
-}
+const burnFuses = require('./config/burnFuses.cjs');
+const enableWaylandAutoDetection = require('./config/enableWaylandAutoDetection.cjs');
 
 /**
  * @type {import('electron-builder').Configuration}
@@ -105,7 +24,22 @@ const config = {
     '!**/*.map',
   ],
   afterPack(context) {
-    return burnFuses(context);
+    /*
+    * Enables chromium cookie encryption and disables options that could be
+    * used to execute arbitrary code in the main process to circumvent cookie encryption:
+    */
+    return burnFuses(context, {
+      version: FuseVersion.V1,
+      resetAdHocDarwinSignature:
+        context.electronPlatformName === 'darwin' && context.arch === Arch.arm64,
+      [FuseV1Options.RunAsNode]: false,
+      [FuseV1Options.EnableCookieEncryption]: true,
+      [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+      [FuseV1Options.EnableNodeCliInspectArguments]: false,
+      // TODO: Revisit this: IF set to `true` the packaged app doesn't start up on macos (x86)
+      [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: false,
+      [FuseV1Options.OnlyLoadAppFromAsar]: true,
+    });
   },
   async afterSign(context) {
     if (context.electronPlatformName === 'linux') {
diff --git a/config/burnFuses.cjs b/config/burnFuses.cjs
new file mode 100644
index 0000000..a6ea197
--- /dev/null
+++ b/config/burnFuses.cjs
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C)  2022 Kristóf Marussy <kristof@marussy.com>
+ *
+ * This file is part of Sophie.
+ *
+ * Sophie is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+const path = require('node:path');
+
+const { flipFuses } = require('@electron/fuses');
+
+/**
+ * Hardens the shipped electron binary by burning some electron fuses.
+ *
+ *
+ * @param {import('electron-builder').AfterPackContext} context The `electron-builder` context.
+ * @param {import('@electron/fuses').FuseConfig<boolean>} config The fuses to burn.
+ * @return {Promise<void>} The promise to flip the fuses.
+ * @see https://github.com/electron/fuses
+ */
+module.exports = async function burnFuses(context, config) {
+  /** @type {string} */
+  const ext =
+    {
+      darwin: '.app',
+      win32: '.exe',
+    }[context.electronPlatformName] || '';
+  const electronBinaryPath = path.join(
+    context.appOutDir,
+    `${context.packager.appInfo.productFilename}${ext}`,
+  );
+  /** @type {import('@electron/fuses').FuseConfig<boolean>} */
+  return flipFuses(electronBinaryPath, config);
+};
diff --git a/config/enableWaylandAutoDetection.cjs b/config/enableWaylandAutoDetection.cjs
new file mode 100644
index 0000000..393ec91
--- /dev/null
+++ b/config/enableWaylandAutoDetection.cjs
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C)  2022 Kristóf Marussy <kristof@marussy.com>
+ *
+ * This file is part of Sophie.
+ *
+ * Sophie is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+const { readFile, rename, writeFile } = require('node:fs/promises');
+const path = require('node:path');
+
+const templatePath = path.join(__dirname, '../build-helpers/detect_wayland.sh');
+
+/**
+ * Replaces the `{{handlebars}}` in the template with the replacements.
+ *
+ * Each `{{VARIABLE}}` will be repalced by `value` in the replacement `['VARIABLE', value]`.
+ *
+ * @param {string} template The template.
+ * @param {[string, string][]} replacements The replacements to apply.
+ * @returns
+ */
+function executeTemplate(template, ...replacements) {
+  const replacementsMap = new Map(replacements);
+  return template.replaceAll(
+    /{{([^}]+)}}/g,
+    (_match, /** @type {string} */ variable) => {
+      const replacement = replacementsMap.get(variable);
+      if (replacement === undefined) {
+        throw new Error(`Unknown variable: ${variable}`);
+      }
+      return replacement;
+    },
+  );
+}
+
+/**
+ * Adds a wrapper scripts that detects in wayland is in use and enabled it in chromium.
+ *
+ * The script in `build-heleprs/detect_wayland.sh` uses the `WAYLAND_DISPLAY` environmental
+ * variable to detect whether wayland is in use.
+ *
+ * If wayland is in use, the script enables the wayland ozone backed for chromium
+ * and pipewire screen sharing. Otherwise, the x11 ozone backend will be used.
+ *
+ * @param {import('electron-builder').AfterPackContext} context The `electron-builder` context.
+ * @return {Promise<void>} The promise to add the wrapper script.
+ * @see https://stackoverflow.com/a/45537237
+ */
+module.exports = async function enableWaylandAutoDetection(context) {
+  const {
+    appOutDir,
+    packager: {
+      appInfo: { productName, productFilename },
+    },
+  } = context;
+
+  const electronBinaryPath = path.join(appOutDir, productFilename);
+  const newFilename = `${productFilename}-bin`;
+  const newElectronBinaryPath = path.join(appOutDir, newFilename);
+
+  await rename(electronBinaryPath, newElectronBinaryPath);
+
+  const wrapperScriptTempate = await readFile(templatePath, 'utf8');
+  const wrapperScript = executeTemplate(
+    wrapperScriptTempate,
+    ['PRODUCT_NAME', productName],
+    ['REAL_BINARY_NAME', newFilename],
+  );
+  await writeFile(electronBinaryPath, wrapperScript, {
+    encoding: 'utf8',
+    mode: 0o755,
+  });
+};