Pivot Release for Core Signing Cert change (macOS)

[gschier]

Related #2451

This PR whitelists Kong's Apple Signing certificate so we can release an update with the new cert later. Electron's built-in updater (Squirrel) will reject the update if next release is signed with a different certificate.

Migration Stages

1. Release next update with configuration to whitelist new certificate
2. Wait long enough until everyone has upgraded to the newest version (probably a couple months).
3. Sign a new release with new certificate and delete whitelist logic

1. Create a "pivot" release that whitelists both certs (this PR does that)
2. Make auto-updater force all updates to go through pivot release (can't skip straight to newest)
3. Sign a new release with new certificate and delete whitelist logic (signing-requirements.txt)

Exploration

• Figure out macOS "requirements" definition to whitelist new cert
  • 9b873d4#diff-94b6d52bd034b8f5ec4465e3cf8358ac
• Release pivot and final version to beta channel
  • Test that update fails from current release to final
    • [updater] Error: Code signature at URL file:///Users/$USER/Library/Caches/com.insomnia.app.ShipIt/update.fhG0QgI/Insomnia.app/ did not pass validation: code failed to satisfy specified code requirement(s)
  • Test that update succeeds from pivot release to final
  • Test that update succeeds from current to pivot

Resources

• https://stackoverflow.com/questions/39899361/codesign-electron-app-how-to-gracefully-switch-certificates/55034237#55034237 🌟
• Error changing certificate: Code signature at URL did not pass validation Squirrel/Squirrel.Mac#160 (comment)
• https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html#//apple_ref/doc/uid/TP40005929-CH4-SW4

---

Calculating H"..." value for signing-requirements.txt

The instructions provided in the StackOverflow Answer didn't specify how to calculate the SHA1 to whitelist the new certificate, so here are the commands used, for reference.

# Extract certificates from final build installation (ie. contains the certs we want to migrate to)
codesign -d --verbose=8 -r - --extract-certificates /Applications/Insomnia.app

# Compute SHA1 of certificate for use in signing-requirements.txt
shasum codesign0

[netlify]

Deploy preview for insomnia-storybook ready!

Built with commit 905f5bc

https://deploy-preview-2453--insomnia-storybook.netlify.app

[DMarby]

Awesome 🎉