feat: add default osx sign (#17)

ycjcl868 · web-flow · commit 9db3f70a4253 · 2025-01-24T13:04:35.000+08:00
* chore: add default osx sign

* chore(ci): test case

* feat: support osx app sign

* chore: e

* chore: hardenedRuntime

* chore: hardenedRuntime

* chore: hardened-runtime

* chore: replace with computer-use pkgs

* chore: macos

* chore: remove @electron/notarize

* chore: version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -11,8 +11,12 @@ env:
   HUSKY: 0
 
 jobs:
-  publish_on_mac_arm64:
-    runs-on: macos-latest
+  publish_on_mac:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, macos-13]
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
       - name: Show operating system info
@@ -29,36 +33,54 @@ jobs:
         run: brew install python-setuptools
       - name: Install appdmg
         run: npm install -g appdmg
+      - name: Install the Apple certificate and provisioning profile
+        env:
+          BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
+          P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
+          BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
+          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+        run: |
+          # create variables
+          CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
+          PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+
+          # import certificate and provisioning profile from secrets
+          echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
+          echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH
+
+          # create temporary keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+
+          # import certificate to keychain
+          security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+
+          # apply provisioning profile
+          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
+          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles
       - name: install dependencies
         run: pnpm install
-      - name: publish
+      - name: publish arm64
+        if: matrix.os == 'macos-latest'
         env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          KEYCHAIN_PATH: ${{ runner.temp }}/app-signing.keychain-db
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           pnpm run publish:mac-arm64
-
-  publish_on_mac_x64:
-    runs-on: macos-13
-    steps:
-      - uses: actions/checkout@v4
-      - name: Show operating system info
-        run: |
-          echo "Operating System:"
-          uname -a
-      - name: Install pnpm
-        run: npm install -g pnpm@9
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: 'pnpm'
-      - name: Install Python setuptools
-        run: brew install python-setuptools
-      - name: Install appdmg
-        run: npm install -g appdmg
-      - name: install dependencies
-        run: pnpm install
-      - name: publish
+      - name: publish x64
+        if: matrix.os == 'macos-13'
         env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          KEYCHAIN_PATH: ${{ runner.temp }}/app-signing.keychain-db
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           pnpm run publish:mac-x64
diff --git a/README.md b/README.md
@@ -19,10 +19,10 @@ UI-TARS Desktop is a GUI Agent application based on [UI-TARS (Vision-Language Mo
 
 ### ⚠️ Important Announcement: GGUF Model Performance
 
-The **GGUF model** has undergone quantization, but unfortunately, its performance cannot be guaranteed. As a result, we have decided to **downgrade** it. 
+The **GGUF model** has undergone quantization, but unfortunately, its performance cannot be guaranteed. As a result, we have decided to **downgrade** it.
 
-💡 **Alternative Solution**:  
-You can use **[Cloud Deployment](#cloud-deployment)** or **[Local Deployment [vLLM]](#local-deployment-vllm)**(If you have enough GPU resources) instead. 
+💡 **Alternative Solution**:
+You can use **[Cloud Deployment](#cloud-deployment)** or **[Local Deployment [vLLM]](#local-deployment-vllm)**(If you have enough GPU resources) instead.
 
 We appreciate your understanding and patience as we work to ensure the best possible experience.
 
@@ -54,10 +54,6 @@ You can download the [latest release](https://github.com/bytedance/UI-TARS-deskt
 1. Drag **UI TARS** application into the **Applications** folder
   <img src="./images/mac_install.png" width="500px" />
 
-> **Note**: If app broken, you can use `sudo xattr -dr com.apple.quarantine /Applications/UI\ TARS.app`  in Terminal to fix it.
->
-> <img src="./images/mac_broken.png" width="400px" />
-
 2. Enable the permission of **UI TARS** in MacOS:
   - System Settings -> Privacy & Security -> **Accessibility**
   - System Settings -> Privacy & Security -> **Screen Recording**
diff --git a/build/entitlements.mac.plist b/build/entitlements.mac.plist
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+  </dict>
+</plist>
diff --git a/forge.config.ts b/forge.config.ts
@@ -87,7 +87,7 @@ const config: ForgeConfig = {
       unpack: [
         '**/node_modules/sharp/**/*',
         '**/node_modules/@img/**/*',
-        '**/node_modules/mac-screen-capture-permissions/**/*',
+        '**/node_modules/@computer-use/mac-screen-capture-permissions/**/*',
       ],
     },
     afterCopy: [
@@ -99,6 +99,23 @@ const config: ForgeConfig = {
     prune: true,
     executableName: 'UI-TARS',
     extraResource: ['./resources/app-update.yml', './resources/report.html'],
+    ...(process.env.APPLE_ID &&
+    process.env.APPLE_PASSWORD &&
+    process.env.APPLE_TEAM_ID
+      ? {
+          osxSign: {
+            keychain: process.env.KEYCHAIN_PATH,
+            optionsForFile: () => ({
+              entitlements: 'build/entitlements.mac.plist',
+            }),
+          },
+          osxNotarize: {
+            appleId: process.env.APPLE_ID,
+            appleIdPassword: process.env.APPLE_PASSWORD,
+            teamId: process.env.APPLE_TEAM_ID,
+          },
+        }
+      : {}),
   },
   rebuildConfig: {},
   publishers: [
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ui-tars-desktop",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "private": true,
   "packageManager": "pnpm@9.10.0",
   "description": "Control your computer with Agent",
@@ -38,11 +38,11 @@
     "prepare": "husky"
   },
   "dependencies": {
+    "@computer-use/mac-screen-capture-permissions": "^1.0.2",
     "@computer-use/node-mac-permissions": "2.2.2",
     "@computer-use/nut-js": "^4.2.0",
     "@electron-toolkit/preload": "^3.0.1",
     "@electron-toolkit/utils": "^3.0.0",
-    "@electron/notarize": "^2.3.2",
     "@ui-tars/action-parser": "workspace:*",
     "@ui-tars/shared": "workspace:*",
     "async-retry": "^1.3.3",
@@ -56,7 +56,6 @@
     "electron-updater": "^6.1.4",
     "js-yaml": "^4.1.0",
     "lodash-es": "4.17.21",
-    "mac-screen-capture-permissions": "2.1.0",
     "ms": "^2.1.3",
     "openai": "4.73.0",
     "react-use": "^17.6.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/main/agent/execute.ts b/src/main/agent/execute.ts
@@ -28,6 +28,29 @@ const moveStraightTo = async (startX: number | null, startY: number | null) => {
   await mouse.move(straightTo(new Point(startX, startY)));
 };
 
+const parseBoxToScreenCoordsWithScaleFactor = ({
+  boxStr,
+  screenWidth,
+  screenHeight,
+  scaleFactor,
+}: {
+  boxStr: string;
+  screenWidth: number;
+  screenHeight: number;
+  scaleFactor: number;
+}) => {
+  const { x: _x, y: _y } = boxStr
+    ? parseBoxToScreenCoords(boxStr, screenWidth, screenHeight)
+    : { x: null, y: null };
+
+  const x = _x ? _x * scaleFactor : null;
+  const y = _y ? _y * scaleFactor : null;
+  return {
+    x,
+    y,
+  };
+};
+
 export interface ExecuteParams {
   scaleFactor?: number;
   prediction: PredictionParsed;
@@ -61,14 +84,14 @@ export const execute = async (executeParams: ExecuteParams) => {
 
   logger.info('[execute] action_type', action_type, 'startBoxStr', startBoxStr);
 
-  const { x, y } = startBoxStr
-    ? parseBoxToScreenCoords(startBoxStr, screenWidth, screenHeight)
-    : { x: null, y: null };
-
-  const startX = x ? x * scaleFactor : null;
-  const startY = y ? y * scaleFactor : null;
+  const { x: startX, y: startY } = parseBoxToScreenCoordsWithScaleFactor({
+    boxStr: startBoxStr,
+    screenWidth,
+    screenHeight,
+    scaleFactor,
+  });
 
-  logger.info(`[execute] [Position] (${x}, ${y}) => (${startX}, ${startY})`);
+  logger.info(`[execute] [Position] (${startX}, ${startY})`);
 
   // execute configs
   mouse.config.mouseSpeed = 1500;
@@ -129,11 +152,12 @@ export const execute = async (executeParams: ExecuteParams) => {
       logger.info('[device] drag', action_inputs);
       // end_box
       if (action_inputs?.end_box) {
-        const { x: endX, y: endY } = parseBoxToScreenCoords(
-          action_inputs.end_box,
+        const { x: endX, y: endY } = parseBoxToScreenCoordsWithScaleFactor({
+          boxStr: action_inputs.end_box,
           screenWidth,
           screenHeight,
-        );
+          scaleFactor,
+        });
 
         if (startX && startY && endX && endY) {
           // calculate x and y direction difference
diff --git a/src/main/utils/systemPermissions.ts b/src/main/utils/systemPermissions.ts
@@ -2,12 +2,12 @@
  * Copyright (c) 2025 Bytedance, Inc. and its affiliates.
  * SPDX-License-Identifier: Apache-2.0
  */
-import permissions from '@computer-use/node-mac-permissions';
 import {
   hasPromptedForPermission,
   hasScreenCapturePermission,
   openSystemPreferences,
-} from 'mac-screen-capture-permissions';
+} from '@computer-use/mac-screen-capture-permissions';
+import permissions from '@computer-use/node-mac-permissions';
 
 import * as env from '@main/env';
 import { logger } from '@main/logger';
