Let electron-builder find the signing identity in signed Mac builds (#5 )

CSC_IDENTITY_AUTO_DISCOVERY=false was set for every Mac build. With it, electron-builder imports CSC_LINK into its keychain but won't look the identity up, so the v0.0.3 build skipped signing and failed the signature check. It's now set only for unsigned builds. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Pin electron-builder to ^26.17 to fix macOS signing on macos-26 runners (#4 )
2026-10-18 01:02:23 +02:00 · 2026-10-07 23:01:44 +01:00 · 2026-10-07 22:42:56 +01:00
3 changed files with 44 additions and 53 deletions
@@ -140,7 +140,6 @@ jobs:
      - name: Build installers
        working-directory: apps/desktop
        env:
-          CSC_IDENTITY_AUTO_DISCOVERY: "false"
          SIGN_MAC: ${{ inputs.sign_mac }}
          SIGN_CSC_LINK: ${{ secrets.CSC_LINK }}
          SIGN_CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
@@ -160,6 +159,11 @@ jobs:
            trap 'rm -f "$key_file"' EXIT
            export CSC_LINK="$SIGN_CSC_LINK" CSC_KEY_PASSWORD="$SIGN_CSC_KEY_PASSWORD"
            export APPLE_API_KEY="$key_file" APPLE_API_KEY_ID="$SIGN_APPLE_API_KEY_ID" APPLE_API_ISSUER="$SIGN_APPLE_API_ISSUER"
+          else
+            # Unsigned (ad-hoc) build: don't let electron-builder look for a certificate.
+            # Not set for signed builds: with it, electron-builder imports CSC_LINK but then
+            # won't look the identity up, and silently skips signing.
+            export CSC_IDENTITY_AUTO_DISCOVERY=false
          fi
          unset SIGN_CSC_LINK SIGN_CSC_KEY_PASSWORD SIGN_APPLE_API_KEY SIGN_APPLE_API_KEY_ID SIGN_APPLE_API_ISSUER
          pnpm build
@@ -24,15 +24,15 @@
    "screenshots": "pnpm build && electron scripts/screenshot.cjs"
  },
  "devDependencies": {
-    "frameloader-tokens": "workspace:*",
    "@types/multicast-dns": "^7.2.4",
    "@types/node": "^24.0.0",
    "@types/ssh2": "^1.15.6",
    "@types/yauzl": "^2.10.3",
    "app-info-parser": "^1.1.6",
    "electron": "44.5.1",
-    "electron-builder": "^26.15.3",
+    "electron-builder": "^26.17.0",
    "esbuild": "^0.28.2",
+    "frameloader-tokens": "workspace:*",
    "multicast-dns": "^7.2.5",
    "ssh2": "^1.17.0",
    "typescript": "^7.0.2",
@@ -43,6 +43,5 @@
    "type": "git",
    "url": "https://github.com/travelerdev/frameloader.git",
    "directory": "apps/desktop"
-  },
-  "dependencies": {}
+  }
 }
@@ -33,8 +33,8 @@ importers:
        specifier: 44.5.1
        version: 44.5.1(supports-color@10.2.2)
      electron-builder:
-        specifier: ^26.15.3
-        version: 26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
+        specifier: ^26.17.0
+        version: 26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
      esbuild:
        specifier: ^0.28.2
        version: 0.28.2
@@ -665,10 +665,6 @@ packages:
    resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
    engines: {node: ^14.21.3 || >=16}

-  '@noble/hashes@2.4.0':
-    resolution: {integrity: sha512-X5XaVWZIBCT7HHZGm5I7ZQXDwLG+bGXuSrMQAW+7Zvl87h1kmc1ZB1VSRJcpUfoUrGQp4Fkoxm5kZ+Ms+aW+eA==}
-    engines: {node: '>= 20.19.0'}
-
  '@oxc-project/types@0.152.0':
    resolution: {integrity: sha512-oM/5rLBm2tPkg0iBgkH/FOeR3PCDpY19GTgAZjMFM8h9WI9VW7cLgzp6nwtarYKmovavIQZ+Fe/RKX/8C8O/Rw==}

@@ -992,12 +988,12 @@ packages:
    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
    engines: {node: '>=8'}

-  app-builder-lib@26.15.3:
-    resolution: {integrity: sha512-2VnyWkqsP5v5XbBhL3tD5Syx8iNPBYsoU7kY4S2fz7wg8Rj/nztWKCUzGKaFRTv0Xwf3/H058CR1Kvtd/3lRow==}
+  app-builder-lib@26.17.0:
+    resolution: {integrity: sha512-wfL7EhujuODDW3uMSD8RPcr/MLzmT0dmpVfWV0wFUWXI0rIdaukzAJ7EFUSyHXOpxuBZqaIGlQt6VeQhtHhetw==}
    engines: {node: '>=14.0.0'}
    peerDependencies:
-      dmg-builder: 26.15.3
-      electron-builder-squirrel-windows: 26.15.3
+      dmg-builder: 26.17.0
+      electron-builder-squirrel-windows: 26.17.0

  app-info-parser@1.1.6:
    resolution: {integrity: sha512-ZAFCM0bN88cbpsMoRhL/JfdX3b+nb5iBEXcu30xABvbaqtw6tXfHujDnuKSpNmA3P0uwpkIxTV/Wun5HfEch8A==}
@@ -1091,8 +1087,8 @@ packages:
    resolution: {integrity: sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==}
    engines: {node: '>=12.0.0'}

-  builder-util@26.15.3:
-    resolution: {integrity: sha512-q2hn7Mbo2nFNkVekPiHFx6Nfo3hURmES3tfBn+k5Pqxl2RkmP3QGqZUhH/q9Pch/4G05NRhPjDlVj1O8q4Txvw==}
+  builder-util@26.16.0:
+    resolution: {integrity: sha512-RLyJhB7Si3YkzKR9ubQslWuXW3Vhs3CGe1i+SeixBZ0qTd1mk3XBmssvY22TlB6CS5blyko8Gu1JzpYk8UkYAg==}
    engines: {node: '>=14.0.0'}

  bytebuffer@5.0.1:
@@ -1234,8 +1230,8 @@ packages:
  dir-compare@4.2.0:
    resolution: {integrity: sha512-2xMCmOoMrdQIPHdsTawECdNPwlVFB9zGcz3kuhmBO6U3oU+UQjsue0i8ayLKpgBcm+hcXPMVSGUN9d+pvJ6+VQ==}

-  dmg-builder@26.15.3:
-    resolution: {integrity: sha512-O3zJUFUYHJKgzPqioHxfxzBzlSC1eXCSr79gMSBKBP5AgjjpmrydMsMLotEg9fAJF36vdUncb+4ndRNxoPdlSQ==}
+  dmg-builder@26.17.0:
+    resolution: {integrity: sha512-EAw1f2iGkICmUvAVBOjm7v5mxJdB7/+OZSycHFhKBimiTkCXtvkCC6wBKzHo7ZQYi58C2MmwIleRbgRnROlK2Q==}

  dns-packet@5.6.1:
    resolution: {integrity: sha512-l4gcSouhcgIKRvyy99RNVOgxXiicE+2jZoNmaNmZ6JXiGajBOJAesk1OBlJuM5k2c+eudGdLxDqXuPCKIj6kpw==}
@@ -1261,16 +1257,16 @@ packages:
    engines: {node: '>=0.10.0'}
    hasBin: true

-  electron-builder-squirrel-windows@26.15.3:
-    resolution: {integrity: sha512-Jc19XPV9y9+2bAdZPkXuVNGNIEFBq9poHC61l8Kv6FdK7DRG3+Ic0rerC0DXOaeHNz8yW0fg/JnF8GQROOF5MA==}
+  electron-builder-squirrel-windows@26.17.0:
+    resolution: {integrity: sha512-uyh+D+B0m12qCRp9c/7dwBirHTh7JcvAzj5eTEbb4dXPPGAhYPx1nozzbu1fC6AdULfat6ZNqgWhipTFpb82lQ==}

-  electron-builder@26.15.3:
-    resolution: {integrity: sha512-a1KM5heqS3gQCZzizXEI8RjJy3QVogULPdeSknt76uLDpBIW/HDGsMg/XgP0riP6PI9COsRvFITKKGDqA8fJxA==}
+  electron-builder@26.17.0:
+    resolution: {integrity: sha512-iYHBRiagS9sDIbZx1ZD113f5rEGQvtpvTvHf70ovHKJ8mRvxwIkWX7JCwfmVQmVS4eX735p7TZmoxHnBPwF3vA==}
    engines: {node: '>=14.0.0'}
    hasBin: true

-  electron-publish@26.15.3:
-    resolution: {integrity: sha512-g/2bn8YTavY4cuS5F+jOS7zmZbXXBV8KZ8yHKfJjFPoKtzBqrpCdNPxBd3tqdBwP7BVd0lGzf7Bk2s0KesWZ4Q==}
+  electron-publish@26.16.0:
+    resolution: {integrity: sha512-Vt3KzQIiw9BImvNOYtndg9Mjki+tl4+1sQiC/+G5j8khWaENOJFWodiB+sUl6yyHwtd37avehskdtPw7f8y/+Q==}

  electron-winstaller@5.4.0:
    resolution: {integrity: sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==}
@@ -2283,7 +2279,7 @@ snapshots:

  '@electron/get@5.1.0(supports-color@10.2.2)':
    dependencies:
-      debug: 4.4.3(supports-color@7.2.0)
+      debug: 4.4.3(supports-color@10.2.2)
      env-paths: 3.0.0
      graceful-fs: 4.2.11
      progress: 2.0.3
@@ -2644,8 +2640,6 @@ snapshots:

  '@noble/hashes@1.8.0': {}

-  '@noble/hashes@2.4.0': {}
-
  '@oxc-project/types@0.152.0': {}

  '@peculiar/asn1-schema@2.10.0':
@@ -2870,7 +2864,7 @@ snapshots:
    dependencies:
      color-convert: 2.0.1

-  app-builder-lib@26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2):
+  app-builder-lib@26.17.0(dmg-builder@26.17.0)(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2):
    dependencies:
      '@electron/asar': 3.4.1
      '@electron/fuses': 1.8.0
@@ -2880,23 +2874,23 @@ snapshots:
      '@electron/rebuild': 4.2.0(supports-color@10.2.2)
      '@electron/universal': 2.0.3(supports-color@10.2.2)
      '@malept/flatpak-bundler': 0.4.0(supports-color@10.2.2)
-      '@noble/hashes': 2.4.0
+      '@noble/hashes': 1.8.0
      '@peculiar/webcrypto': 1.7.1
      '@types/fs-extra': 9.0.13
      ajv: 8.20.0
      asn1js: 3.0.10
      async-exit-hook: 2.0.1
-      builder-util: 26.15.3(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      builder-util-runtime: 9.7.0(supports-color@10.2.2)
      chromium-pickle-js: 0.2.0
      ci-info: 4.3.1
      debug: 4.4.3(supports-color@10.2.2)
-      dmg-builder: 26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
+      dmg-builder: 26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
      dotenv: 16.6.1
      dotenv-expand: 11.0.7
      ejs: 3.1.10
-      electron-builder-squirrel-windows: 26.15.3(dmg-builder@26.15.3)(supports-color@10.2.2)
-      electron-publish: 26.15.3(supports-color@10.2.2)
+      electron-builder-squirrel-windows: 26.17.0(dmg-builder@26.17.0)(supports-color@10.2.2)
+      electron-publish: 26.16.0(supports-color@10.2.2)
      fs-extra: 10.1.0
      hosted-git-info: 4.1.0
      isbinaryfile: 5.0.7
@@ -3006,7 +3000,7 @@ snapshots:
    transitivePeerDependencies:
      - supports-color

-  builder-util@26.15.3(supports-color@10.2.2):
+  builder-util@26.16.0(supports-color@10.2.2):
    dependencies:
      '@types/debug': 4.1.13
      builder-util-runtime: 9.7.0(supports-color@10.2.2)
@@ -3128,12 +3122,6 @@ snapshots:
    optionalDependencies:
      supports-color: 10.2.2

-  debug@4.4.3(supports-color@7.2.0):
-    dependencies:
-      ms: 2.1.3
-    optionalDependencies:
-      supports-color: 7.2.0
-
  decompress-response@6.0.0:
    dependencies:
      mimic-response: 3.1.0
@@ -3166,10 +3154,10 @@ snapshots:
      minimatch: 3.1.5
      p-limit: 3.1.0

-  dmg-builder@26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2):
+  dmg-builder@26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2):
    dependencies:
-      app-builder-lib: 26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
-      builder-util: 26.15.3(supports-color@10.2.2)
+      app-builder-lib: 26.17.0(dmg-builder@26.17.0)(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      fs-extra: 10.1.0
      js-yaml: 4.3.2
    transitivePeerDependencies:
@@ -3200,23 +3188,23 @@ snapshots:
    dependencies:
      jake: 10.9.4

-  electron-builder-squirrel-windows@26.15.3(dmg-builder@26.15.3)(supports-color@10.2.2):
+  electron-builder-squirrel-windows@26.17.0(dmg-builder@26.17.0)(supports-color@10.2.2):
    dependencies:
-      app-builder-lib: 26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
-      builder-util: 26.15.3(supports-color@10.2.2)
+      app-builder-lib: 26.17.0(dmg-builder@26.17.0)(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      electron-winstaller: 5.4.0(supports-color@10.2.2)
    transitivePeerDependencies:
      - dmg-builder
      - supports-color

-  electron-builder@26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2):
+  electron-builder@26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2):
    dependencies:
-      app-builder-lib: 26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
-      builder-util: 26.15.3(supports-color@10.2.2)
+      app-builder-lib: 26.17.0(dmg-builder@26.17.0)(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      builder-util-runtime: 9.7.0(supports-color@10.2.2)
      chalk: 4.1.2
      ci-info: 4.4.0
-      dmg-builder: 26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2)
+      dmg-builder: 26.17.0(electron-builder-squirrel-windows@26.17.0)(supports-color@10.2.2)
      fs-extra: 10.1.0
      lazy-val: 1.0.5
      simple-update-notifier: 2.0.0
@@ -3225,11 +3213,11 @@ snapshots:
      - electron-builder-squirrel-windows
      - supports-color

-  electron-publish@26.15.3(supports-color@10.2.2):
+  electron-publish@26.16.0(supports-color@10.2.2):
    dependencies:
      '@types/fs-extra': 9.0.13
      aws4: 1.13.2
-      builder-util: 26.15.3(supports-color@10.2.2)
+      builder-util: 26.16.0(supports-color@10.2.2)
      builder-util-runtime: 9.7.0(supports-color@10.2.2)
      chalk: 4.1.2
      form-data: 4.0.6