Electron Fuses support

I’m flipping fuses in my afterPack script. Is there a better way to get the path to the final packaged Electron executable?

const path = require('path')
const { flipFuses, FuseVersion, FuseV1Options } = require('@electron/fuses')

module.exports = async function afterPack(context) {
  const ext = {
    darwin: '.app',
    win32: '.exe',
  }[context.electronPlatformName]

  const electronBinaryPath = path.join(context.appOutDir, context.packager.appInfo.productFilename + ext) // is there a better way?
  await flipFuses(
    electronBinaryPath,
    {
      version: FuseVersion.V1,
      [FuseV1Options.EnableNodeCliInspectArguments]: false,
    },
  )
}

[mmaietta]

Hey guys, I investigated further to see if I could integrate Fuses package directly into electron-builder. Got the logic flow but the schema validator fails due to having to use FuseConfig from @electron/fuses https://github.com/electron/fuses/blob/d69eb9cc92b13e77b08bdf3b594635fc0a2c83b8/src/config.ts#L17-L22

This theoretically would allow version overrides since electron-builder schema wouldn’t need to have a breaking change when a FuseV2Config eventually comes out. Instead, it’d just be a simple package update and the schema would automatically accept the new version.

Due to the way the package’s FuseOptions was written, the schema comes out all weird because it can’t handle enums. This is what is generated in the schema

{
          "additionalProperties": false,
          "properties": {
            "0": {
              "type": "boolean"
            },
            "1": {
              "type": "boolean"
            },
            "2": {
              "type": "boolean"
            },
            "3": {
              "type": "boolean"
            },
            "4": {
              "type": "boolean"
            },
            "5": {
              "type": "boolean"
            }
          },
          "type": "object"
        },

Which translates to:

  {
    version: FuseVersion.V1,
    [FuseV1Options.RunAsNode]: false,
    [FuseV1Options.EnableCookieEncryption]: true,
    [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
    [FuseV1Options.EnableNodeCliInspectArguments]: false,
    [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true
    [FuseV1Options.OnlyLoadAppFromAsar]: true
  }

version and EnableCookieEncryption overlap values and aren’t rendered in the schema validator.

This was the configuration property

  /**
   * *electron frameworks only* Electron fuses configuration. 
   */
  readonly electronFuses?: FuseConfig

The documentation site won’t even generate either. 😢

I don’t see a way for this to be able to be published. Thoughts are welcome. For now, I’m closing this ticket and suggesting this approach https://github.com/electron-userland/electron-builder/issues/6365#issuecomment-1191747089. Sorry folks

[mmaietta]

Adding on to ☝️ , when building for MacOS Universal distributable and want to flip fuses, you’ll need to run flipFuses only on the afterPack of the universal callback stage (added in https://github.com/electron-userland/electron-builder/releases/tag/v23.1.0) as afterPack is called for x64, arm64, and universal stages You’ll need to wrap the code above with: (note: I use electron-builder.js as a config file to achieve typesafety. More info: https://www.electron.build/api/programmatic-usage)

import * as builder from "electron-builder";
....

afterPack: async (context: builder.AfterPackContext) => {
    if (context.electronPlatformName !== 'darwin' || context.arch === builder.Arch.universal) {
        await addElectronFuses(context)
    }
},

...

// Adapted from https://github.com/electron-userland/electron-builder/issues/6365#issue-1033809141
async function addElectronFuses(context: builder.AfterPackContext) {
    const { appOutDir, packager: { appInfo }, electronPlatformName, arch } = context
    const ext = {
      darwin: '.app',
      win32: '.exe',
      linux: [''],
    }[electronPlatformName];
  
    const electronBinaryPath = path.join(appOutDir, `${appInfo.productFilename}${ext}`);
    console.log('Flipping fuses for: ', electronBinaryPath)

    await flipFuses(electronBinaryPath, {
      version: FuseVersion.V1,
      resetAdHocDarwinSignature: electronPlatformName === 'darwin' && arch === builder.Arch.arm64, // necessary for building on Apple Silicon
      [FuseV1Options.RunAsNode]: false,
      [FuseV1Options.EnableCookieEncryption]: true,
      [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
      [FuseV1Options.EnableNodeCliInspectArguments]: false,
      [FuseV1Options.OnlyLoadAppFromAsar]: true,
    });
  };