electron-builder: Autoupdater fails on MacOS X

@aguynamedben Thanks for donation, electron-builder 20.38.3 is released. https://github.com/electron-userland/electron-builder/commit/930dc8d

Please never use "NSAllowsArbitraryLoads": true. electron-builder 20.33.0 adds localhost to NSExceptionDomains by default now, so, you don’t need it at all. But if you want to be really sure, you can set "NSAllowsLocalNetworking": true (but please, please test without it, to ensure that electron-builder default configuration is valid).

According to Apple documentation (https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW35) NSAllowsLocalNetworking is not available for macOS 10.12 and older.

The workaround for Supporting Older Operating Systems: Version-specific ATS behavior: In a current operating system, the presence of a fine-grained transport security key (NSAllowsArbitraryLoadsForMedia, NSAllowsArbitraryLoadsInWebContent, or NSAllowsLocalNetworking) overrides the value of the NSAllowsArbitraryLoads key to NO. This allows you to set NSAllowsArbitraryLoads to YES if needed for your app in older operating systems, without disabling ATS generally in current operating systems.

Please never use "NSAllowsArbitraryLoads": true. electron-builder 20.33.0 adds localhost to NSExceptionDomains by default now, so, you don’t need it at all. But if you want to be really sure, you can set "NSAllowsLocalNetworking": true (but please, please test without it, to ensure that electron-builder default configuration is valid).

Any official word on the cause anywhere yet?

@makeitcount If your app has been built with electron-builder and you use built-in autoUpdater (the one bundled in electron, not electron-updater) then soon you will get that NSAppTransportSecurity is not properly configured for allowing connections to external Http update endpoints (for electron prebuilts with macOS SDK 10.12+) due to the fact that NSAllowsArbitraryLoads and NSAllowsLocalNetworking are set to YES simultaneously, and that’s, according to App Transport Security Reference resets NSAllowsArbitraryLoads to default value (NO).

You must explicitly define domains which are allowed to be requested via non-secure HTTP protocol.

"extendInfo": {
    "NSAppTransportSecurity" : {
      "NSExceptionDomains": {
        "your.domain": {
          "NSIncludesSubdomains": true,
          "NSExceptionAllowsInsecureHTTPLoads": true
        }
      }
    }
}

By the way, thank you, @develar , for your efforts on maintaining this project.

@framerate To clarify — I fixed one bug, then discovered another one, then added another improvement, then I decided to require Electron 3 (to simplify testing and to use new Electron features). That’s why so many electron-updater versions recently 😃

electron-builder 20.36.2 and electron-updater 4.0.4 are latest versions that were tested and proven to be working. If not, please provide steps to reproduce.

Please try next pre-release versions:

• electron-updater 3.2.1
• electron-builder 20.33.1

@dafivius I was having this problem and I solved using the following versions:

electron: 3.0.5 electron-builder: 20.20.4 electron-updater: 2.23.3

package.json:

"mac": {
    "type": "distribution",
    "extendInfo": {
        "NSAppTransportSecurity": {
            "NSAllowsArbitraryLoads": true
        }
    },
    "target": [
        "zip"
    ]
}

Adding this to package.json helps with the nsapp error

"extendInfo": {
       "NSAppTransportSecurity": {
          "NSAllowsArbitraryLoads": true
        },
        "NSExceptionDomains": {
          "localhost": {
            "NSTemporaryExceptionAllowsInsecureHTTPSLoads": false,
            "NSIncludesSubdomains": false,
            "NSTemporaryExceptionAllowsInsecureHTTPLoads": true,
            "NSTemporaryExceptionMinimumTLSVersion": "1.0",
            "NSTemporaryExceptionRequiresForwardSecrecy": false
          }
        }
      }