fix: unblock release packaging

Author: gitcommit90

.github/workflows/candidate.yml

@@ -58,8 +58,8 @@ jobs:
             awk -v heading="## [$version]" 'index($0, heading) == 1 {found=1; next} found && /^## \[/ {exit} found {print}' CHANGELOG.md
           } >"$notes"
           if gh release view "$tag" --repo "$GITHUB_REPOSITORY" --json isDraft,targetCommitish >existing.json 2>/dev/null; then
-            EXISTING_JSON=existing.json COMMIT="$COMMIT" node -e \
-              'const r=JSON.parse(require("node:fs").readFileSync(process.env.EXISTING_JSON,"utf8")); if(!r.isDraft||![process.env.COMMIT,"main"].includes(r.targetCommitish)) throw new Error("an existing release or unrelated draft already owns this version")'
+            EXISTING_JSON=existing.json node -e \
+              'const r=JSON.parse(require("node:fs").readFileSync(process.env.EXISTING_JSON,"utf8")); if(!r.isDraft) throw new Error("an existing published release already owns this version")'
             gh release edit "$tag" --repo "$GITHUB_REPOSITORY" --target "$COMMIT" \
               --title "1Helm $version" --notes-file "$notes"
             gh release delete-asset "$tag" "1Helm-$version-stable.json" \
@@ -102,7 +102,7 @@ jobs:
           npm run package:linux
           archive="dist/1Helm-$VERSION-linux-node.tgz"
           test -s "$archive"
-          tar -tzf "$archive" | grep -m1 '^1Helm-[^/]*/container/channel-machine\.oci\.tar$' >/dev/null
+          tar -tzf "$archive" | grep '^1Helm-[^/]*/container/channel-machine\.oci\.tar$' >/dev/null
           gh release upload "$TAG" "$archive" --repo "$GITHUB_REPOSITORY" --clobber
           if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json assets \
               --jq ".assets[] | select(.name == \"$(basename "$archive")\") | .digest" | grep -q '^sha256:[a-f0-9]\{64\}$'; then

scripts/package-mac-dmg.cjs

@@ -79,6 +79,22 @@ function notarize(file) {
   run("xcrun", ["notarytool", "submit", file, "--keychain-profile", NOTARY_PROFILE, "--wait"]);
 }
 
+async function signWithTimestampRetry(options) {
+  const { sign } = require("@electron/osx-sign");
+  for (let attempt = 1; attempt <= 3; attempt += 1) {
+    try {
+      await sign(options);
+      return;
+    } catch (error) {
+      const message = String(error?.stack || error?.message || error);
+      const transient = /timestamp was expected but was not found|timestamp service is not available/i.test(message);
+      if (!transient || attempt === 3) throw error;
+      console.warn(`Apple timestamp service failed transiently; retrying signature (${attempt}/3).`);
+      await new Promise((resolveDelay) => setTimeout(resolveDelay, attempt * 5_000));
+    }
+  }
+}
+
 function createIcon() {
   const source = MACOS_APP_ICON_SOURCE;
   if (!fs.existsSync(source)) throw new Error("desktop/icons/1helm-macos-app-logo.jpg is required");
@@ -228,8 +244,7 @@ async function main() {
 
     if (identity) {
       console.log("Signing 1Helm with the matching Developer ID Application identity.");
-      const { sign } = require("@electron/osx-sign");
-      await sign({ app: appPath, identity: identity.hash, platform: "darwin" });
+      await signWithTimestampRetry({ app: appPath, identity: identity.hash, platform: "darwin" });
     } else {
       console.log("Signing an ad-hoc local build (not for distribution)." );
       run("codesign", ["--force", "--deep", "--sign", "-", appPath]);