COMPASS-4077 - Notarize builds for macOS

[addaleax]

• COMPASS-4077 - Make package work electron-installer-codesign#6
• COMPASS-4077 - Bump electron-installer-codesign to 0.5.0 hadron-build#365
• COMPASS-4077 - Add entitlements file with sensible defaults electron-installer-codesign#7
• COMPASS-4077 - Bump electron-installer-codesign to 0.6.0 hadron-build#367
• COMPASS-4077 - Allow loading Apple notarization credentials from file hadron-build#368

🤞

Description

Checklist

• New tests and/or benchmarks are included
• Documentation is changed or added

Motivation and Context

• Bugfix
• New feature
• Dependency update
• Misc

Open Questions

Dependents

Types of changes

• Backport Needed
• Patch (non-breaking change which fixes an issue)
• Minor (non-breaking change which adds functionality)
• Major (fix or feature that would cause existing functionality to change)

[mcasimir]

23.3.1 should stop logging env

[addaleax]

I’ve updated to that – I have no strong feelings about whether we want to drop the write-to-file step then, after sleeping about it it seems more likely to me that somebody would accidentally print environment variables like we did before than accidentally publish files from /tmp/, but obviously either way works just fine for me.

[Anemy]

Nice work! Is there a case where we don't want to notarize the bundle? Not really related to this PR, but in https://github.com/mongodb-js/hadron-build/pull/367/files#diff-2265b5363474c70d8268d7c4f5e1e060L545 when the apple credentials aren't set we still continue with the build, I'm wondering if we want to have it error out when the credentials don't exist to make sure we don't release without notarizing.

[addaleax]

@Rhys To be honest, I don’t know, and I think it might just be that that was the case because we weren’t able to successfully notarize in the past. I don’t see any downsides to doing it always, though, and we also notarize every mongosh build.