From 0c2fdb2d4049fee03d4d3a1ac587c1f36f75defc Mon Sep 17 00:00:00 2001 From: rokdock-sync Date: Tue, 21 Jul 2026 07:24:17 +0000 Subject: [PATCH] Sync main --- .github/workflows/release.yml | 13 +++++++++---- electron-builder.json | 1 + 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9eedd7f..a4d5a34 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -103,10 +103,15 @@ jobs: run: npx electron-builder --${{ matrix.platform }} --publish always env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - CSC_LINK: ${{ secrets.CSC_LINK }} - CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }} - APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} - APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }} + # Signing/notarization is macOS-only. These MUST be gated to the mac runner: + # CSC_LINK is electron-builder's generic code-signing variable, so leaving it set + # on the Windows runner makes electron-builder Authenticode-sign the .exe with the + # Apple Developer ID cert, which Windows cannot validate and which breaks + # electron-updater. Windows and Linux ship unsigned by design. + CSC_LINK: ${{ matrix.platform == 'mac' && secrets.CSC_LINK || '' }} + CSC_KEY_PASSWORD: ${{ matrix.platform == 'mac' && secrets.CSC_KEY_PASSWORD || '' }} + APPLE_API_KEY_ID: ${{ matrix.platform == 'mac' && secrets.APPLE_API_KEY_ID || '' }} + APPLE_API_ISSUER: ${{ matrix.platform == 'mac' && secrets.APPLE_API_ISSUER || '' }} - name: Checkpoint installers as a workflow artifact # electron-builder builds and uploads to the release in one step. If the diff --git a/electron-builder.json b/electron-builder.json index 2aa769f..9e78e66 100644 --- a/electron-builder.json +++ b/electron-builder.json @@ -54,6 +54,7 @@ ], "win": { "icon": "resources/icons/icon.ico", + "verifyUpdateCodeSignature": false, "target": [ { "target": "nsis",