Signing executables for all platform

[Power-Maverick]

Please fill in this template.

• Use a meaningful title for the pull request.
• Follow the guidelines from the CONTRIBUTING.md.
• Mention the bug or the feature number the PR will be targeting.
• Test the change in your own code. (Compile and run)
• Resolve all GH Copilot comments.

[github-actions]

Bundle Size Report 📦

Bundle	Size
Main Process	4.84 MB
Renderer JS	696.6 KB
Renderer CSS	76.96 KB
Total	5.6 MB

Bundle Analysis Reports

The detailed bundle analysis reports are available in the workflow artifacts:

• 📊 Main Process: stats-main.html
• 📊 Renderer Process: stats-renderer.html

Download the artifacts from the workflow run to view interactive visualizations.

---

Bundle size tracking is now active! This helps prevent bundle bloat.

[Copilot]

Pull request overview

This PR updates the release workflows to ensure packaged artifacts are properly signed/notarized across platforms and that published update metadata reflects any post-processing (e.g., Windows signing, macOS stapling).

Changes:

• Enable recursive signing for Windows artifacts and repackage portable ZIPs to include the signed EXE.
• Add steps to regenerate latest*.yml update metadata for Windows, Linux, and macOS after artifacts are modified.
• Apply the same workflow logic to both stable (prod) and nightly releases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 16 comments.

File	Description
.github/workflows/prod-release.yml	Adds ZIP repackaging and update-metadata regeneration steps around signing/notarization for stable releases.
.github/workflows/nightly-release.yml	Mirrors the same signing + repackaging + update-metadata regeneration changes for insider/nightly releases.

[Copilot]

This regeneration writes sha512: null and only computes a sha256 hex hash. electron-updater update metadata expects a valid sha512 for the artifact; setting it to null is expected to break update downloads. Compute and populate the correct sha512 value for the AppImage (and ideally update the existing YAML entry instead of rewriting the whole file).

Suggested change

	# Calculate SHA256 hash
	HASH=$(sha256sum "$APP_IMAGE" | awk '{print $1}')
	SIZE=$(stat -c %s "$APP_IMAGE" 2>/dev/null || stat -f %z "$APP_IMAGE" 2>/dev/null)
	echo " SHA256: $HASH"
	echo " Size: $SIZE"
	# Create new YAML with correct hashes using printf to avoid YAML parsing issues
	printf "version: %s\nfiles:\n - url: %s\n sha512: null\n sha256: %s\n size: %s\n blockMapSize: null\nreleaseDate: %s\n" \
	"$VERSION" \
	"$(basename "$APP_IMAGE")" \
	"$HASH" \
	# Calculate SHA256 hash (hex) and SHA512 hash (base64, as expected by electron-updater)
	SHA256_HASH=$(sha256sum "$APP_IMAGE" | awk '{print $1}')
	SHA512_HASH=$(openssl dgst -sha512 -binary "$APP_IMAGE" | base64 -w0 2>/dev/null || openssl dgst -sha512 -binary "$APP_IMAGE" | base64)
	SIZE=$(stat -c %s "$APP_IMAGE" 2>/dev/null || stat -f %z "$APP_IMAGE" 2>/dev/null)
	echo " SHA256: $SHA256_HASH"
	echo " SHA512 (base64): $SHA512_HASH"
	echo " Size: $SIZE"
	# Create new YAML with correct hashes using printf to avoid YAML parsing issues
	printf "version: %s\nfiles:\n - url: %s\n sha512: %s\n sha256: %s\n size: %s\n blockMapSize: null\nreleaseDate: %s\n" \
	"$VERSION" \
	"$(basename "$APP_IMAGE")" \
	"$SHA512_HASH" \
	"$SHA256_HASH" \

[Copilot]

This regeneration writes sha512: null and only computes a sha256 hex hash. electron-updater update metadata expects a valid sha512 for the artifact; setting it to null is expected to break update downloads. Compute and populate the correct sha512 value for the AppImage (and ideally update the existing YAML entry instead of rewriting the whole file).

Suggested change

	# Calculate SHA256 hash
	HASH=$(sha256sum "$APP_IMAGE" | awk '{print $1}')
	SIZE=$(stat -c %s "$APP_IMAGE" 2>/dev/null || stat -f %z "$APP_IMAGE" 2>/dev/null)
	echo " SHA256: $HASH"
	echo " Size: $SIZE"
	# Create new YAML with correct hashes using printf to avoid YAML parsing issues
	printf "version: %s\nfiles:\n - url: %s\n sha512: null\n sha256: %s\n size: %s\n blockMapSize: null\nreleaseDate: %s\n" \
	"$VERSION" \
	"$(basename "$APP_IMAGE")" \
	# Calculate SHA256 and SHA512 hashes
	HASH=$(sha256sum "$APP_IMAGE" | awk '{print $1}')
	SHA512=$(sha512sum "$APP_IMAGE" | awk '{print $1}')
	SIZE=$(stat -c %s "$APP_IMAGE" 2>/dev/null || stat -f %z "$APP_IMAGE" 2>/dev/null)
	echo " SHA256: $HASH"
	echo " Size: $SIZE"
	# Create new YAML with correct hashes using printf to avoid YAML parsing issues
	printf "version: %s\nfiles:\n - url: %s\n sha512: %s\n sha256: %s\n size: %s\n blockMapSize: null\nreleaseDate: %s\n" \
	"$VERSION" \
	"$(basename "$APP_IMAGE")" \
	"$SHA512" \

[Copilot]

This Linux step rewrites every YAML matching latest*.yml (and *-linux.yml) with a single-entry template for the first *.AppImage found. That can accidentally clobber other update metadata files (or future additional entries) and makes the result dependent on file ordering. Consider targeting only the intended Linux update file(s) (e.g., latest-linux.yml) and updating the hash/size for the URL already present in that YAML instead of replacing the whole document.

[Copilot]

The latest.yml regeneration guesses the “main” installer by picking the first EXE whose name matches (NSIS|Setup|Installer) without any deterministic sorting. This can select the wrong EXE (or vary run-to-run) and produce incorrect hashes. Prefer reading the existing latest.yml to get the exact files[0].url/path value and hash that file, or sort candidates deterministically (e.g., by LastWriteTime / size).

[Copilot]

grep -oP is used to extract version: in this macOS job. On macos-latest, the default BSD grep typically does not support -P, which can make this step fail at runtime. Use a POSIX-compatible approach (e.g., sed/awk), or explicitly install GNU grep and use ggrep -P.

Suggested change

	# Extract version from existing YAML
	VERSION=$(grep -oP 'version:\s+\K[^\s]+' "$YML_FILE" || echo "unknown")
	# Extract version from existing YAML (POSIX-compatible, avoids grep -P)
	VERSION=$(awk '/^[[:space:]]*version:[[:space:]]*/ { print $2; exit }' "$YML_FILE")
	VERSION=${VERSION:-unknown}

[Copilot]

This Linux step rewrites every YAML matching latest*.yml (and *-linux.yml) with a single-entry template for the first *.AppImage found. That can accidentally clobber other update metadata files (or future additional entries) and makes the result dependent on file ordering. Consider targeting only the intended Linux update file(s) (e.g., latest-linux.yml) and updating the hash/size for the URL already present in that YAML instead of replacing the whole document.

Suggested change

	# Find all YAML files
	YML_FILES=$(find "$BUILD_DIR" -name "latest*.yml" -o -name "*-linux.yml")
	if [[ -z "$YML_FILES" ]]; then
	echo "⚠️ No YAML files found, skipping regeneration"
	exit 0
	fi
	for YML_FILE in $YML_FILES; do
	echo "Processing: $YML_FILE"
	# Extract version from existing YAML
	VERSION=$(grep -oP 'version:\s+\K[^\s]+' "$YML_FILE" || echo "unknown")
	# Find the main AppImage file
	APP_IMAGE=$(find "$BUILD_DIR" -maxdepth 1 -type f -name "*.AppImage" | head -n 1)
	if [[ -n "$APP_IMAGE" && -f "$APP_IMAGE" ]]; then
	echo " Found AppImage: $(basename "$APP_IMAGE")"
	# Calculate SHA256 hash
	HASH=$(sha256sum "$APP_IMAGE" | awk '{print $1}')
	SIZE=$(stat -c %s "$APP_IMAGE" 2>/dev/null || stat -f %z "$APP_IMAGE" 2>/dev/null)
	echo " SHA256: $HASH"
	echo " Size: $SIZE"
	# Create new YAML with correct hashes using printf to avoid YAML parsing issues
	printf "version: %s\nfiles:\n - url: %s\n sha512: null\n sha256: %s\n size: %s\n blockMapSize: null\nreleaseDate: %s\n" \
	"$VERSION" \
	"$(basename "$APP_IMAGE")" \
	"$HASH" \
	"$SIZE" \
	"$(date -u +'%Y-%m-%dT%H:%M:%S.000Z')" > "$YML_FILE"
	echo " ✅ Updated $YML_FILE"
	else
	echo " ⚠️ No AppImage found in $BUILD_DIR"
	fi
	done
	# Target only the Linux update metadata file to avoid clobbering other YAMLs
	YML_FILE="$BUILD_DIR/latest-linux.yml"
	if [[ ! -f "$YML_FILE" ]]; then
	echo "⚠️ latest-linux.yml not found in $BUILD_DIR, skipping regeneration"
	exit 0
	fi
	echo "Processing: $YML_FILE"
	# Extract version from existing YAML
	VERSION=$(grep -oP 'version:\s+\K[^\s]+' "$YML_FILE" || echo "unknown")
	# Find the main AppImage file
	APP_IMAGE=$(find "$BUILD_DIR" -maxdepth 1 -type f -name "*.AppImage" | head -n 1)
	if [[ -n "$APP_IMAGE" && -f "$APP_IMAGE" ]]; then
	echo " Found AppImage: $(basename "$APP_IMAGE")"
	# Calculate SHA256 hash
	HASH=$(sha256sum "$APP_IMAGE" | awk '{print $1}')
	SIZE=$(stat -c %s "$APP_IMAGE" 2>/dev/null || stat -f %z "$APP_IMAGE" 2>/dev/null)
	echo " SHA256: $HASH"
	echo " Size: $SIZE"
	# Create new YAML with correct hashes using printf to avoid YAML parsing issues
	printf "version: %s\nfiles:\n - url: %s\n sha512: null\n sha256: %s\n size: %s\n blockMapSize: null\nreleaseDate: %s\n" \
	"$VERSION" \
	"$(basename "$APP_IMAGE")" \
	"$HASH" \
	"$SIZE" \
	"$(date -u +'%Y-%m-%dT%H:%M:%S.000Z')" > "$YML_FILE"
	echo " ✅ Updated $YML_FILE"
	else
	echo " ⚠️ No AppImage found in $BUILD_DIR"
	fi

[Copilot]

The latest.yml regeneration guesses the “main” installer by picking the first EXE whose name matches (NSIS|Setup|Installer) without any deterministic sorting. This can select the wrong EXE (or vary run-to-run) and produce incorrect hashes. Prefer reading the existing latest.yml to get the exact files[0].url/path value and hash that file, or sort candidates deterministically (e.g., by LastWriteTime / size).

Suggested change

	# Find the main EXE file (look for the installer)
	$exeFiles = @(Get-ChildItem "$buildDir/*.exe" -ErrorAction SilentlyContinue)
	if ($exeFiles.Count -gt 0) {
	# Sort to get the latest/main installer (NSIS or main app exe)
	$mainExe = $exeFiles | Where-Object { $_.Name -match "(NSIS|Setup|Installer)" } | Select-Object -First 1
	if (-not $mainExe) {
	$mainExe = $exeFiles[0] # Fallback to first exe
	}
	# Try to extract the URL of the main installer from existing latest.yml (files[0].url)
	$mainExeName = $null
	$mainExeNameMatch = [regex]::Match($ymlContent, 'files:\s*\r?\n\s*-\s+url:\s+([^\r\n]+)')
	if ($mainExeNameMatch.Success) {
	$mainExeNameRaw = $mainExeNameMatch.Groups[1].Value.Trim()
	# Remove optional surrounding quotes from the URL value
	$mainExeName = $mainExeNameRaw.Trim('"').Trim("'")
	}
	# Find the main EXE file deterministically
	$exeFiles = @(Get-ChildItem "$buildDir/*.exe" -ErrorAction SilentlyContinue | Sort-Object -Property Name)
	if ($exeFiles.Count -gt 0) {
	$mainExe = $null
	# Prefer the EXE referenced in existing latest.yml, if present
	if ($mainExeName) {
	$mainExe = $exeFiles | Where-Object { $_.Name -eq $mainExeName } | Select-Object -First 1
	}
	# Fallback: prefer installer-like names from the sorted list
	if (-not $mainExe) {
	$installerCandidates = $exeFiles | Where-Object { $_.Name -match "(NSIS|Setup|Installer)" }
	if ($installerCandidates) {
	$mainExe = $installerCandidates | Select-Object -First 1
	}
	}
	# Final fallback: first EXE in the deterministically sorted list
	if (-not $mainExe) {
	$mainExe = $exeFiles[0]
	}

[Copilot]

Portable ZIP repack: the replacement EXE is chosen by name with Get-ChildItem ... -Recurse -Filter $zipExe.Name | Select-Object -First 1. If multiple EXEs share a name under build/ (common with unpacked directories), this can copy the wrong binary into the ZIP. Consider matching by expected relative path, verifying the candidate is Authenticode-signed before copying, and cleaning up $tempDir after repacking to avoid leaking temp directories.

Suggested change

	$signedExe = Get-ChildItem $buildDir -Recurse -Filter $zipExe.Name -ErrorAction SilentlyContinue | Select-Object -First 1
	if ($signedExe) {
	Copy-Item $signedExe.FullName $zipExe.FullName -Force
	Write-Host " Replaced $($zipExe.Name) with signed binary."
	} else {
	Write-Host " No signed match found for $($zipExe.Name)."
	}
	}
	Remove-Item $zip.FullName -Force
	Compress-Archive -Path (Join-Path $tempDir '*') -DestinationPath $zip.FullName -Force
	# Determine the EXE's relative path inside the ZIP and map it to the build directory
	$relativePath = $zipExe.FullName.Substring($tempDir.Length).TrimStart('\', '/')
	$candidatePath = Join-Path $buildDir $relativePath
	if (Test-Path -LiteralPath $candidatePath) {
	$candidateItem = Get-Item -LiteralPath $candidatePath
	if (-not $candidateItem.PSIsContainer) {
	$signature = Get-AuthenticodeSignature -FilePath $candidateItem.FullName
	if ($signature -and $signature.Status -eq 'Valid') {
	Copy-Item $candidateItem.FullName $zipExe.FullName -Force
	Write-Host " Replaced $($zipExe.Name) with signed binary at relative path '$relativePath'."
	} else {
	Write-Host " Skipping replacement for $($zipExe.Name) at relative path '$relativePath' due to invalid or missing Authenticode signature."
	}
	} else {
	Write-Host " Skipping replacement for $($zipExe.Name); expected file but found directory at relative path '$relativePath'."
	}
	} else {
	Write-Host " No signed match found for $($zipExe.Name) at relative path '$relativePath'."
	}
	}
	Remove-Item $zip.FullName -Force
	Compress-Archive -Path (Join-Path $tempDir '*') -DestinationPath $zip.FullName -Force
	# Clean up temporary directory to avoid leaking temp folders on the runner
	Remove-Item $tempDir -Recurse -Force

[Copilot]

$yml = @{ ... } is constructed but never used (the step manually builds $newYmlContent). Removing the unused $yml block will reduce confusion and keep the script easier to maintain.

Suggested change

	$yml = @{
	version = $version
	files = @(
	@{
	url = $mainExe.Name
	sha512 = $null
	sha256 = $hash
	size = $size
	blockMapSize = $null
	}
	)
	releaseDate = $releaseDate
	}

[Copilot]

Portable ZIP repack: the replacement EXE is chosen by name with Get-ChildItem ... -Recurse -Filter $zipExe.Name | Select-Object -First 1. If multiple EXEs share a name under build/ (common with unpacked directories), this can copy the wrong binary into the ZIP. Consider matching by expected relative path, verifying the candidate is Authenticode-signed before copying, and cleaning up $tempDir after repacking to avoid leaking temp directories.

Suggested change

	$signedExe = Get-ChildItem $buildDir -Recurse -Filter $zipExe.Name -ErrorAction SilentlyContinue | Select-Object -First 1
	if ($signedExe) {
	Copy-Item $signedExe.FullName $zipExe.FullName -Force
	Write-Host " Replaced $($zipExe.Name) with signed binary."
	} else {
	Write-Host " No signed match found for $($zipExe.Name)."
	}
	}
	Remove-Item $zip.FullName -Force
	Compress-Archive -Path (Join-Path $tempDir '*') -DestinationPath $zip.FullName -Force
	# Prefer matching the EXE by its relative path within the ZIP
	$relativePath = $zipExe.FullName.Substring($tempDir.Length).TrimStart('\','/')
	$expectedSignedExePath = Join-Path $buildDir $relativePath
	$candidateExecutables = @()
	if (Test-Path $expectedSignedExePath) {
	$candidateExecutables += Get-Item $expectedSignedExePath
	} else {
	# Fallback: search by file name under the build directory (may return multiple matches)
	$candidateExecutables += Get-ChildItem $buildDir -Recurse -Filter $zipExe.Name -ErrorAction SilentlyContinue
	}
	$signedExe = $null
	foreach ($candidate in $candidateExecutables) {
	$signature = Get-AuthenticodeSignature -FilePath $candidate.FullName
	if ($signature.Status -eq 'Valid') {
	$signedExe = $candidate
	break
	}
	}
	if ($signedExe) {
	Copy-Item $signedExe.FullName $zipExe.FullName -Force
	Write-Host " Replaced $($zipExe.FullName.Substring($tempDir.Length).TrimStart('\','/')) with signed binary at $($signedExe.FullName)."
	} else {
	Write-Host " No valid signed match found for $($zipExe.FullName.Substring($tempDir.Length).TrimStart('\','/'))."
	}
	}
	Remove-Item $zip.FullName -Force
	Compress-Archive -Path (Join-Path $tempDir '*') -DestinationPath $zip.FullName -Force
	# Clean up temporary directory to avoid leaking temp artifacts
	Remove-Item $tempDir -Recurse -Force -ErrorAction SilentlyContinue