fix(macos-sign): missing stdout/stderr in Node.js context (#10654)

.changes/fix-missing-codesign-error-macos.md

@@ -0,0 +1,5 @@
+---
+"tauri-macos-sign": patch:bug
+---
+
+Fixes output not visible when running on Node.js via NAPI.

tooling/bundler/src/bundle/common.rs

@@ -168,6 +168,7 @@ pub trait CommandExt {
 
 impl CommandExt for Command {
   fn piped(&mut self) -> std::io::Result<ExitStatus> {
+    self.stdin(os_pipe::dup_stdin()?);
     self.stdout(os_pipe::dup_stdout()?);
     self.stderr(os_pipe::dup_stderr()?);
     let program = self.get_program().to_string_lossy().into_owned();

tooling/cli/Cargo.lock

@@ -5479,6 +5479,7 @@ version = "0.1.0-beta.0"
 dependencies = [
  "anyhow",
  "dirs-next",
+ "log",
  "once-cell-regex",
  "os_pipe",
  "plist",

tooling/cli/src/lib.rs

@@ -301,6 +301,7 @@ pub trait CommandExt {
 
 impl CommandExt for Command {
   fn piped(&mut self) -> std::io::Result<ExitStatus> {
+    self.stdin(os_pipe::dup_stdin()?);
     self.stdout(os_pipe::dup_stdout()?);
     self.stderr(os_pipe::dup_stderr()?);
     let program = self.get_program().to_string_lossy().into_owned();

tooling/macos-sign/Cargo.toml

@@ -22,3 +22,4 @@ os_pipe = "1"
 plist = "1"
 rand = "0.8"
 dirs-next = "2"
+log = "0.4"

tooling/macos-sign/src/keychain.rs

@@ -8,7 +8,7 @@ use std::{
   process::Command,
 };
 
-use crate::assert_command;
+use crate::{assert_command, CommandExt};
 use anyhow::Result;
 use rand::distributions::{Alphanumeric, DistString};
 
@@ -33,7 +33,7 @@ impl Drop for Keychain {
       let _ = Command::new("security")
         .arg("delete-keychain")
         .arg(path)
-        .status();
+        .piped();
     }
   }
 }
@@ -77,7 +77,7 @@ impl Keychain {
       Command::new("security")
         .args(["create-keychain", "-p", &keychain_password])
         .arg(&keychain_path)
-        .status(),
+        .piped(),
       "failed to create keychain",
     )?;
 
@@ -85,7 +85,7 @@ impl Keychain {
       Command::new("security")
         .args(["unlock-keychain", "-p", &keychain_password])
         .arg(&keychain_path)
-        .status(),
+        .piped(),
       "failed to set unlock keychain",
     )?;
 
@@ -105,7 +105,7 @@ impl Keychain {
         ])
         .arg("-k")
         .arg(&keychain_path)
-        .status(),
+        .piped(),
       "failed to import keychain certificate",
     )?;
 
@@ -113,7 +113,7 @@ impl Keychain {
       Command::new("security")
         .args(["set-keychain-settings", "-t", "3600", "-u"])
         .arg(&keychain_path)
-        .status(),
+        .piped(),
       "failed to set keychain settings",
     )?;
 
@@ -128,7 +128,7 @@ impl Keychain {
           &keychain_password,
         ])
         .arg(&keychain_path)
-        .status(),
+        .piped(),
       "failed to set keychain settings",
     )?;
 
@@ -147,7 +147,7 @@ impl Keychain {
         .args(["list-keychain", "-d", "user", "-s"])
         .args(current_keychains)
         .arg(&keychain_path)
-        .status(),
+        .piped(),
       "failed to list keychain",
     )?;
 
@@ -209,7 +209,7 @@ impl Keychain {
 
     codesign.arg(path);
 
-    assert_command(codesign.status(), "failed to sign app")?;
+    assert_command(codesign.piped(), "failed to sign app")?;
 
     Ok(())
   }

tooling/macos-sign/src/keychain/identity.rs

@@ -16,6 +16,7 @@ fn get_pem_list(keychain_path: &Path, name_substr: &str) -> std::io::Result<std:
     .arg("-c")
     .arg(name_substr)
     .arg(keychain_path)
+    .stdin(os_pipe::dup_stdin().unwrap())
     .stderr(os_pipe::dup_stderr().unwrap())
     .output()
 }

tooling/macos-sign/src/lib.rs

@@ -5,7 +5,7 @@
 use std::{
   ffi::{OsStr, OsString},
   path::{Path, PathBuf},
-  process::Command,
+  process::{Command, ExitStatus},
 };
 
 use anyhow::{Context, Result};
@@ -17,6 +17,24 @@ mod provisioning_profile;
 pub use keychain::{Keychain, Team};
 pub use provisioning_profile::ProvisioningProfile;
 
+trait CommandExt {
+  // The `pipe` function sets the stdout and stderr to properly
+  // show the command output in the Node.js wrapper.
+  fn piped(&mut self) -> std::io::Result<ExitStatus>;
+}
+
+impl CommandExt for Command {
+  fn piped(&mut self) -> std::io::Result<ExitStatus> {
+    self.stdin(os_pipe::dup_stdin()?);
+    self.stdout(os_pipe::dup_stdout()?);
+    self.stderr(os_pipe::dup_stderr()?);
+    let program = self.get_program().to_string_lossy().into_owned();
+    log::debug!(action = "Running"; "Command `{} {}`", program, self.get_args().map(|arg| arg.to_string_lossy()).fold(String::new(), |acc, arg| format!("{acc} {arg}")));
+
+    self.status().map_err(Into::into)
+  }
+}
+
 pub enum ApiKey {
   Path(PathBuf),
   Raw(Vec<u8>),
@@ -71,7 +89,7 @@ pub fn notarize(
   // use ditto to create a PKZip almost identical to Finder
   // this remove almost 99% of false alarm in notarization
   assert_command(
-    Command::new("ditto").args(zip_args).status(),
+    Command::new("ditto").args(zip_args).piped(),
     "failed to zip app with ditto",
   )?;
 
@@ -230,7 +248,7 @@ fn decode_base64(base64: &OsStr, out_path: &Path) -> Result<()> {
       .arg(&src_path)
       .arg("-o")
       .arg(out_path)
-      .status(),
+      .piped(),
     "failed to decode certificate",
   )?;