Update Electron app dependencies with known vulnerabilities

CHANGELOG.md

@@ -34,6 +34,10 @@ Line wrap the file at 100 chars.                                              Th
 - Flush states on tunnel state changes. Previously, pre-existing connections could leak when
   internet sharing was enabled on a device.
 
+#### Windows
+- Update electron-builder to 24.13.3 to fix CVE-2024-27303, which enabled privilege escelation when
+  running the installer.
+
 
 ## [2024.2-beta1] - 2024-04-15
 ### Added

build.sh

@@ -354,6 +354,18 @@ if [[ "$SIGN" == "true" && "$(uname -s)" == "MINGW"* ]]; then
     done
 fi
 
+# notarize installer on macOS
+if [[ "$NOTARIZE" == "true" && "$(uname -s)" == "Darwin" ]]; then
+    log_info "Notarizing pkg"
+    xcrun notarytool submit dist/*"$PRODUCT_VERSION"*.pkg \
+        --keychain "$NOTARIZE_KEYCHAIN" \
+        --keychain-profile "$NOTARIZE_KEYCHAIN_PROFILE" \
+        --wait
+
+    log_info "Stapling pkg"
+    xcrun stapler staple dist/*"$PRODUCT_VERSION"*.pkg
+fi
+
 log_success "**********************************"
 log_success ""
 log_success " The build finished successfully! "

dist-assets/pkg-scripts/postinstall

@@ -2,15 +2,23 @@
 
 set -eu
 
+INSTALL_DIR=$2
+
+# Workaround for issue in electron-builder where the pkg-scripts are run twice, once with the
+# correct install dir and once with an incorrect one. This guard prevents running the script when
+# called the second time. This can be reverted when the following issue has been fixed:
+# https://github.com/electron-userland/electron-builder/issues/8166
+if [[ $INSTALL_DIR == *"Mullvad VPN.app" ]]; then
+    exit 0
+fi
+
 LOG_DIR=/var/log/mullvad-vpn
 
 mkdir -p $LOG_DIR
 exec > $LOG_DIR/postinstall.log 2>&1
 
 echo "Running postinstall at $(date)"
 
-INSTALL_DIR=$2
-
 # Run CLI to force macOS to check the certificate, and shut down the already running daemon, if one
 # exists.
 # This is a temporary workaround. After 2023.3, we switched from signing with Amagicom AB to

dist-assets/pkg-scripts/preinstall

@@ -2,9 +2,18 @@
 
 set -eux
 
-LOG_DIR=/var/log/mullvad-vpn
 INSTALL_DIR=$2
 
+# Workaround for issue in electron-builder where the pkg-scripts are run twice, once with the
+# correct install dir and once with an incorrect one. This guard prevents running the script when
+# called the second time. This can be reverted when the following issue has been fixed:
+# https://github.com/electron-userland/electron-builder/issues/8166
+if [[ $INSTALL_DIR == *"Mullvad VPN.app" ]]; then
+    exit 0
+fi
+
+LOG_DIR=/var/log/mullvad-vpn
+
 mkdir -p $LOG_DIR
 chmod 755 $LOG_DIR
 exec > $LOG_DIR/preinstall.log 2>&1