From e0ed957bfaa60a692b92c95d4adaab5bed890de4 Mon Sep 17 00:00:00 2001 From: Afonso Jorge Ramos Date: Sun, 6 Sep 2026 22:11:59 +0000 Subject: [PATCH] fix(ci): patch app-builder-lib keychain password for macOS signing electron-builder 26.15.3 passes the .p12 import password to `security set-key-partition-list -k`, which expects the temporary keychain's own unlock password. Older macOS builds tolerated the mismatch because the keychain had just been unlocked; the macOS 26.6 runner image (macos-latest since 2026-09) validates it and fails with "SecKeychainUnlock: The user name or passphrase you entered is not correct", which broke the v7.8.0 macOS publish job. Apply the upstream fix (electron-userland/electron-builder#10101) as a pnpm patch until it ships in a 26.x release. Windows and Linux packaging do not touch this code path. --- patches/app-builder-lib@26.15.3.patch | 24 ++++++++++++++++++++++++ pnpm-lock.yaml | 11 +++++++---- pnpm-workspace.yaml | 4 ++++ 3 files changed, 35 insertions(+), 4 deletions(-) create mode 100644 patches/app-builder-lib@26.15.3.patch diff --git a/patches/app-builder-lib@26.15.3.patch b/patches/app-builder-lib@26.15.3.patch new file mode 100644 index 000000000..d065268c2 --- /dev/null +++ b/patches/app-builder-lib@26.15.3.patch @@ -0,0 +1,24 @@ +diff --git a/out/codeSign/macCodeSign.js b/out/codeSign/macCodeSign.js +index 9a69042fd48f4759a1c697bf23fa5b44f2da2366..637cc19f525c6ee3479b377cac4c6c78345aa8ba 100644 +--- a/out/codeSign/macCodeSign.js ++++ b/out/codeSign/macCodeSign.js +@@ -156,16 +156,16 @@ async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIK + if (cscIKeyPassword != null) { + cscPasswords.push(cscIKeyPassword); + } +- return await importCerts(keychainFile, certPaths, cscPasswords); ++ return await importCerts(keychainFile, certPaths, cscPasswords, keychainPassword); + } +-async function importCerts(keychainFile, paths, keyPasswords) { ++async function importCerts(keychainFile, paths, keyPasswords, keychainPassword) { + var _a; + for (let i = 0; i < paths.length; i++) { + const password = (_a = keyPasswords[i]) !== null && _a !== void 0 ? _a : ""; + await (0, builder_util_1.exec)("/usr/bin/security", ["import", paths[i], "-k", keychainFile, "-T", "/usr/bin/codesign", "-T", "/usr/bin/productbuild", "-P", password]); + // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p + // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996 +- await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]); ++ await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", keychainPassword, keychainFile]); + } + return { + keychainFile, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a59f16043..ff8aba18f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -10,6 +10,9 @@ overrides: got: 11.8.6 electron: 44.1.1 +patchedDependencies: + app-builder-lib@26.15.3: 4688f96749e3d76cf27bc535d874470bf264610a331db13644df7715d699acf1 + importers: .: @@ -6377,7 +6380,7 @@ snapshots: ansi-styles@6.2.3: {} - app-builder-lib@26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2): + app-builder-lib@26.15.3(patch_hash=4688f96749e3d76cf27bc535d874470bf264610a331db13644df7715d699acf1)(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2): dependencies: '@electron/asar': 3.4.1 '@electron/fuses': 1.8.0 @@ -6803,7 +6806,7 @@ snapshots: dmg-builder@26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2): dependencies: - app-builder-lib: 26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2) + app-builder-lib: 26.15.3(patch_hash=4688f96749e3d76cf27bc535d874470bf264610a331db13644df7715d699acf1)(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2) builder-util: 26.15.3(supports-color@10.2.2) fs-extra: 10.1.0 js-yaml: 4.3.2 @@ -6843,7 +6846,7 @@ snapshots: electron-builder-squirrel-windows@26.15.3(dmg-builder@26.15.3)(supports-color@10.2.2): dependencies: - app-builder-lib: 26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2) + app-builder-lib: 26.15.3(patch_hash=4688f96749e3d76cf27bc535d874470bf264610a331db13644df7715d699acf1)(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2) builder-util: 26.15.3(supports-color@10.2.2) electron-winstaller: 5.4.0(supports-color@10.2.2) transitivePeerDependencies: @@ -6852,7 +6855,7 @@ snapshots: electron-builder@26.15.3(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2): dependencies: - app-builder-lib: 26.15.3(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2) + app-builder-lib: 26.15.3(patch_hash=4688f96749e3d76cf27bc535d874470bf264610a331db13644df7715d699acf1)(dmg-builder@26.15.3)(electron-builder-squirrel-windows@26.15.3)(supports-color@10.2.2) builder-util: 26.15.3(supports-color@10.2.2) builder-util-runtime: 9.7.0(supports-color@10.2.2) chalk: 4.1.2 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ee45811fc..e83c547b4 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -19,4 +19,8 @@ overrides: cross-spawn: '7.0.6' got: '11.8.6' electron: 'catalog:' +# Temporary: electron-builder passes the .p12 import password to `security set-key-partition-list -k`, +# which macOS 26.6+ rejects. Drop once electron-userland/electron-builder#10101 ships in a 26.x release. +patchedDependencies: + app-builder-lib@26.15.3: patches/app-builder-lib@26.15.3.patch savePrefix: ''