feat: add option to skip signature on macos

[Mikescops]

There are scenarios where one would want to sign manually or later the binaries.

I'm adding a simple option that will skip the final codesign on macos.

[Mikescops]

@baparham whenever you have time to take a look here 🙌

[baparham]

Can you come up with a test for this? There seems to be one other signature test but I'm not entirely sure how you could replicate it to test this feature and only run on mac, but I welcome your thoughts, otherwise this is untested code (even though it is simple enough to 'test' in your brain)

https://github.com/vercel/pkg/blob/main/test/test-50-signature/main.js

[Mikescops]

@baparham I come up with a solution that works well on my mac, but it seems like there are no CI for macos-latest currently

[baparham]

Ah, of course. We should fix that, are you comfortable adding to the workflow matrix in this pr?

[Mikescops]

We can have a look at how bad it is, let me push it

[baparham]

let's see! Thanks

[Mikescops]

Macos is damn too smart...

[Mikescops]

@baparham ok I made some extra fixes and I could run all tests on my computer

[Mikescops]

Sounds good ✅

[Mikescops]

I'd recommend dropping node12 support to lighten a bit the CI

[baparham]

I'd recommend dropping node12 support to lighten a bit the CI

I 100% agree with this. I see no reason to support an EOL node js publicly with pkg.

I'm not sure what SLA we claim in pkg though, so this probably needs some more discussion from @robertsLando and maybe @leerob

[Mikescops]

I have opened a separate issue as we can move forward on this specific PR first #1886

Is it ok for you to merge?

[baparham]

lgtm

[Mikescops]

why this merge commit?

[baparham]

why this merge commit?

It seems the repo is set up to require the branch be up to date before I can merge it. I don't really know why, but now it says it can be merged in, which I'll do in a squash commit. Perhaps the requirement is that the checks pass on the final merged result or something against main 🤷

[Mikescops]

Weird, I made a rebase on main before pushing 🤔

Thanks for the help here!

[Mikescops]

@baparham @robertsLando can we tag a release? i'd need to use the new option soon 👍

[robertsLando]

@Mikescops Unfortunately this doesn't depends by us as we both don't have the permissions to make new releases. @baparham already sent a private message to @leerob for this, I think it will be ready for the end of this week.

BTW in the meanwhile you could simply npm install vercel/pkg#main

[Mikescops]

Ok thanks, I'll wait then. I can't really do this in a production software unfortunately 😂

[robertsLando]

@Mikescops Giving that you just need to use it to package the application (it's a dev dependency) that will give the same result as after the release so not really a big difference

[Mikescops]

Not really, because it will be used in a brew Formula to package the app, and it is versioned, and I can't guarantee what will be added to the main branch here 'till i can update the brew Formula.