Initial copy of files from the riot-web repo

None of this will work as it will need tweaking (at the very least
I've not copied the origin migrator because that's had long enough)
but these are files which already existed in their current state and
so don't need re-reviewing.

scripts/electron_afterSign.js

@@ -0,0 +1,24 @@
+const { notarize } = require('electron-notarize');
+
+exports.default = async function(context) {
+    const { electronPlatformName, appOutDir } = context;
+
+    if (electronPlatformName === 'darwin') {
+        const appName = context.packager.appInfo.productFilename;
+        // We get the password from keychain. The keychain stores
+        // user IDs too, but apparently altool can't get the user ID
+        // from the keychain, so we need to get it from the environment.
+        const userId = process.env.NOTARIZE_APPLE_ID;
+        if (userId === undefined) {
+            throw new Error("User ID not found. Set NOTARIZE_APPLE_ID.");
+        }
+
+        console.log("Notarising macOS app. This may be some time.");
+        return await notarize({
+            appBundleId: 'im.riot.app',
+            appPath: `${appOutDir}/${appName}.app`,
+            appleId: userId,
+            appleIdPassword: '@keychain:NOTARIZE_CREDS',
+        });
+    }
+};

scripts/electron_winSign.js

@@ -0,0 +1,69 @@
+const { exec, execFile } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const shellescape = require('shell-escape');
+
+exports.default = async function(options) {
+    const inPath = options.path;
+    const appOutDir = path.dirname(inPath);
+
+    // get the token passphrase from the keychain
+    const tokenPassphrase = await new Promise((resolve, reject) => {
+        execFile(
+            'security',
+            ['find-generic-password', '-s', 'riot_signing_token', '-w'],
+            {},
+            (err, stdout) => {
+                if (err) {
+                    console.error("Couldn't find signing token in keychain", err);
+                    // electron-builder seems to print '[object Object]' on the
+                    // console whether you reject with an Error or a string...
+                    reject(err);
+                } else {
+                    resolve(stdout.trim());
+                }
+            },
+        );
+    });
+
+    return new Promise((resolve, reject) => {
+        let cmdLine = 'osslsigncode sign ';
+        if (process.env.OSSLSIGNCODE_SIGNARGS) {
+            cmdLine += process.env.OSSLSIGNCODE_SIGNARGS + ' ';
+        }
+        const tmpFile = path.join(
+            appOutDir,
+            'tmp_' + Math.random().toString(36).substring(2, 15) + '.exe',
+        );
+        const args = [
+            '-h', options.hash,
+            '-pass', tokenPassphrase,
+            '-in', inPath,
+            '-out', tmpFile,
+        ];
+        if (options.isNest) args.push('-nest');
+        cmdLine += shellescape(args);
+
+        let signStdout;
+        const signproc = exec(cmdLine, {}, (error, stdout) => {
+            signStdout = stdout;
+        });
+        signproc.on('exit', (code) => {
+            if (code !== 0) {
+                console.log("Running", cmdLine);
+                console.log(signStdout);
+                console.error("osslsigncode failed with code " + code);
+                reject("osslsigncode failed with code " + code);
+                return;
+            }
+            fs.rename(tmpFile, inPath, (err) => {
+                if (err) {
+                    console.error("Error renaming file", err);
+                    reject(err);
+                } else {
+                    resolve();
+                }
+            });
+        });
+    });
+};