Merge pull request #4095 from zen-browser/macos-credentials-fix

.github/workflows/build.yml

@@ -63,7 +63,6 @@ jobs:
         with:
           submodules: recursive
           token: ${{ secrets.DEPLOY_KEY }}
-          fetch-depth: 0
 
       - name: Check if correct branch
         run: |

.github/workflows/macos-release-build.yml

@@ -126,6 +126,11 @@ jobs:
           p12-file-base64: ${{ secrets.macOS_CERTIFICATES_P12_For_App_BASE64 }}
           p12-password: ${{ secrets.macOS_CERTIFICATES_P12_PASSWORD }}
 
+      - name: Import provisioning profile for .app
+        run: |
+          echo "${{ secrets.macOS_PROVISIONING_PROFILE }}" | base64 --decode > ./engine/Zen_Browser.provisionprofile
+          ls -la
+
       - name: Package
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
@@ -139,6 +144,10 @@ jobs:
         run: |
           mv ./dist/output.mar macos-${{ matrix.arch }}.mar
 
+      - name: Remove sensitive information
+        run: |
+          rm -f ./engine/Zen_Browser.provisionprofile
+
       - name: Sign .dmg
         run: |
           set -ex

build/codesign/browser.developer.entitlements.xml

@@ -28,5 +28,15 @@
          for native messaging webextension helper applications launched by
          Firefox which rely on Apple Events to signal other processes. -->
     <key>com.apple.security.automation.apple-events</key><true/>
+
+    <!-- For SmartCardServices(7) -->
+    <key>com.apple.security.smartcard</key><true/>
+
+    <!-- Required for com.apple.developer.web-browser.public-key-credential -->
+    <key>com.apple.application-identifier</key>
+    <string>H36NPCN86W.app.zen-browser.zen</string>
+
+    <!-- For platform passkey (webauthn) support -->
+    <key>com.apple.developer.web-browser.public-key-credential</key><true/>
   </dict>
 </plist>

build/codesign/codesign.bash

@@ -111,6 +111,9 @@ echo "-------------------------------------------------------------------------"
 
 set -x
 
+# move Zen_Browser.provisionprofile to the Contents directory
+cp Zen_Browser.provisionprofile "${BUNDLE}"/Contents/embedded.provisionprofile
+
 # Clear extended attributes which cause codesign to fail
 xattr -cr "${BUNDLE}"
 
@@ -166,4 +169,4 @@ if [ ! -z "${OUTPUT_DMG_FILE}" ]; then
   rm ${TEMP_FILE}
   rm ${TEMP_DMG}
   rm -rf "${DISK_IMAGE_DIR}"
-fi
+fi