Repository navigation
🐛 Fix(build): patch electron-builder keychain unlock for macOS 26.6 - #1448
Merged
Merged
Conversation
GitHub's macos-latest image moved to macOS 26.6, which validates the `-k` password of `security set-key-partition-list`. electron-builder 26.1.0 passes the .p12 password there instead of the temporary keychain password, so CSC_LINK signing on the arm64 runner fails with "SecKeychainUnlock: The user name or passphrase you entered is not correct". Backport the upstream fix (electron-userland/electron-builder#10172) as a pnpm patch on app-builder-lib@26.1.0 instead of upgrading: electron-builder 26.16.x/26.17.0 drop most production deps (including picgo itself) from app.asar when the app package name equals a dependency name. Pin pnpm to 10.29.2 via packageManager and let pnpm/action-setup read it, since pnpm >= 10.29.3 makes electron-builder 26.1.0 omit nested deps such as array-timsort (see #1400).
Several releases built and signed fine but crashed on launch because electron-builder silently dropped runtime deps from app.asar: pnpm >= 10.29.3 with electron-builder 26.1.0 drops nested deps such as array-timsort (#1400), and electron-builder 26.13.1 ~ 26.17.0 drops picgo itself and most production deps because the root package shares its name with the picgo dependency. These were only noticed after release. Add scripts/verify-packaged-deps.js, which collects the modules the packaged main/preload bundles still require at runtime, walks their dependency closure inside app.asar with Node's node_modules lookup and reports every missing package with its chain, then requires each external through the packaged Electron binary with ELECTRON_RUN_AS_NODE=1. Add a Packaged Deps job to CI Check that builds an unpacked Linux app and runs the script, so these regressions fail at PR time.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
v3.0.3 发版时 macOS arm64 构建在签名阶段失败，x64 正常：
arm64 用的是
macos-latest，镜像已从 macOS 26.5.2（20260728）滚动到 26.6.2（20260907）；x64 用的是macos-15-intel，所以没受影响。electron-builder 26.1.0 给set-key-partition-list -k传的是 .p12 的密码，而不是临时 keychain 的密码。macOS 26.6 开始校验这个密码，于是签名失败。上游已在 electron-userland/electron-builder#10172 修复（26.16.1）。为什么不直接升级 electron-builder
实测 26.16.1 和 26.17.0 的 pnpm 依赖收集器有 bug：应用自身的包名（
picgo）和某个生产依赖同名时，会把那个依赖的 package.json 当成根项目来读。打出来的app.asar只剩 picgo-core 的依赖，picgo本身以及 element-plus、systeminformation、semver 等都没打进去，包一启动就会崩。这个 bug 会单独给上游提 issue。改动
pnpm patch把上游那一行修复移植到app-builder-lib@26.1.0（patches/app-builder-lib@26.1.0.patch）package.json新增"packageManager": "pnpm@10.29.2"，所有 workflow 里的pnpm/action-setup不再写version，统一从packageManager读取。原因同 fix: pin pnpm to 10.29.2 for release builds #1400：pnpm ≥ 10.29.3（包括 11.x）配 electron-builder 26.1.0 会漏打array-timsort这类嵌套依赖。本地 cd 进项目后 pnpm 也会自动切到 10.29.2验证
esprima、array-timsort都在workflow_dispatch（build_os = macOS）在 arm64 上签名和公证通过