use provisionprofiles from Fastlane Match

electron-builder.yaml

@@ -15,7 +15,7 @@ mac:
   gatekeeperAssess: true
   hardenedRuntime: true
   icon: buildResources/ScratchDesktop.icns
-  provisioningProfile: embedded.provisionprofile
+  provisioningProfile: build/AppStore_edu.mit.scratch.scratch-desktop.provisionprofile
   artifactName: "Scratch ${version}.${ext}"
   target:
     - dmg
@@ -30,7 +30,7 @@ mas:
   icon: buildResources/ScratchDesktop.icns
 masDev:
   type: development
-  provisioningProfile: mas-dev.provisionprofile
+  provisioningProfile: build/Development_edu.mit.scratch.scratch-desktop.provisionprofile
 win:
   icon: buildResources/ScratchDesktop.ico
   target:

fastlane/Fastfile

@@ -18,12 +18,12 @@ default_platform(:mac)
 platform :mac do
   desc "Use Fastlane Match to install development certificates"
   lane :match_dev do
-    match(type: "development", platform: "macos", readonly: is_ci)
+    match(type: "development", platform: "macos", output_path: "build", readonly: is_ci)
   end
 
   desc "Use Fastlane Match to install distribution certificates"
   lane :match_dist do
-    match(type: "appstore", platform: "macos", readonly: is_ci)
+    match(type: "appstore", platform: "macos", output_path: "build", readonly: is_ci)
-    match(type: "developer_id", platform: "macos", readonly: is_ci, additional_cert_types: "developer_id_installer")
+    match(type: "developer_id", platform: "macos", output_path: "build", readonly: is_ci, additional_cert_types: "developer_id_installer")
   end
 end

scripts/electron-builder-wrapper.js

@@ -9,6 +9,8 @@
 const {spawnSync} = require('child_process');
 const fs = require('fs');
 
+const masDevProfile = 'build/Development_edu.mit.scratch.scratch-desktop.provisionprofile';
+
 /**
  * Strip any code signing configuration (CSC) from a set of environment variables.
  * @param {object} environment - a collection of environment variables which might include code signing configuration.
@@ -58,7 +60,7 @@ const runBuilder = function (wrapperConfig, target) {
     if (target.platform === 'darwin') {
         allArgs.push(`--c.mac.type=${wrapperConfig.mode === 'dist' ? 'distribution' : 'development'}`);
         if (target.name === 'mas-dev') {
-            allArgs.push('--c.mac.provisioningProfile=mas-dev.provisionprofile');
+            allArgs.push(`--c.mac.provisioningProfile=${masDevProfile}`);
         }
         if (wrapperConfig.doSign) {
             // really this is "notarize only if we also sign"
@@ -95,7 +97,6 @@ const runBuilder = function (wrapperConfig, target) {
  * same time but doing so limits has unwanted side effects on both macOS and Windows (see function body).
  */
 const calculateTargets = function (wrapperConfig) {
-    const masDevProfile = 'mas-dev.provisionprofile';
     const availableTargets = {
         macAppStore: {
             name: 'mas',