Skip to content

fix(desktop): materialize gateway resources before signing #304

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
orangeboyChen merged 2 commits into from
Oct 29, 2026
Merged

fix(desktop): materialize gateway resources before signing #304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e6b27fb
fix(desktop): materialize gateway resources before signing
orangeboyChen Oct 29, 2026
7f1a0d5
ci(desktop): verify macOS bundles on pull requests
orangeboyChen Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/ci-desktop.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ on:
push:
branches:
- main
pull_request:
# A push only ever builds Linux, so the macOS and Windows targets would
# otherwise first run at release time. Dispatch this by hand to build another
# one of them, from any branch: the installer comes back as an artifact of the
Expand Down Expand Up @@ -138,6 +139,20 @@ jobs:
- name: Build the macOS app
run: bun scripts/build-desktop.ts --dev-icon --mac --arm64 --dir

- name: Check gateway bundle resources
run: |
set -euo pipefail
app="$(find build/desktop -name '*.app' -maxdepth 2 -print -quit)"
if [[ -z "$app" ]]; then
echo '::error::electron-builder left no .app behind'
exit 1
fi
link="$(find "$app/Contents/Resources/gateway" -type l -print -quit)"
if [[ -n "$link" ]]; then
echo "::error::gateway contains a symlink that can invalidate macOS signing: $link"
exit 1
fi

# Zipped with ditto rather than handed over as a directory: an app is a
# bundle, and a bundle carries resource forks, symlinks and an executable
# bit that an archive has to keep or the app will not open.
Expand Down
15 changes: 15 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -325,6 +325,21 @@ jobs:
else
bun scripts/build-desktop.ts ${{ matrix.targets }}
fi
- name: Check gateway bundle resources
if: ${{ matrix.macos }}
shell: bash
run: |
set -euo pipefail
app="$(find build/desktop -name '*.app' -maxdepth 2 -print -quit)"
if [[ -z "$app" ]]; then
echo '::error::electron-builder left no .app behind'
exit 1
fi
link="$(find "$app/Contents/Resources/gateway" -type l -print -quit)"
if [[ -n "$link" ]]; then
echo "::error::gateway contains a symlink that can invalidate macOS signing: $link"
exit 1
fi
- name: Check that the app is signed
if: ${{ env.MATCH_GIT_URL != '' }}
shell: bash
Expand Down
6 changes: 5 additions & 1 deletion scripts/build-desktop.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,11 @@ const requirePath = (target: string, hint: string) => {
};

const copyInto = (source: string, destination: string) => {
fs.cpSync(source, destination, { recursive: true });
// macOS code signing rejects resource symlinks whose destination is not
// represented as a bundle resource. The standalone Next.js output uses
// symlinks for a few traced packages, so materialize those packages while
// assembling the gateway instead of copying the links into the app bundle.
fs.cpSync(source, destination, { dereference: true, recursive: true });
};

/**
Expand Down
Loading