feat(release): sign and publish Windows Velopack packages from the signing Mac

[h4yfans]

Summary

Windows moves to Velopack packages that are Authenticode-signed with the Certum SimplySign key. That key lives in a hardware-backed cloud keystore reachable only from Kaan's Mac, so GitHub Actions can no longer produce a complete release. CI becomes build-only and pnpm release drives everything from the Mac.

publish-release.yml builds macOS (signed and notarized), Linux and Windows exactly as before, validates the asset set, and stops at two workflow artifacts: memry-release-<version> with the assets and release-metadata-<version> with the draft tag, release id, resolved version and commit SHA. Nothing in CI touches the release any more. The dry_run input is gone, since one path was left and it has no side effects. The Homebrew cask bump moves to publish-homebrew-cask.yml, which pnpm release dispatches after it publishes.

New pnpm release -- --humanize --yes sequence

1. Check the signing prerequisites (vpk, jsign, osslsigncode, keytool, the SimplySign PKCS#11 library, the PKCS#11 config, the Certum chain, the Keychain PIN) and fail with the exact install command for whichever is missing.
2. Check the SimplySign session by listing the PKCS#11 keystore for alias 57D2B94F4B6C4356BD26F757F3855C1F. When it is absent, open SimplySign Desktop, print one instruction and wait for Enter.
3. Humanize the draft release notes, show the plan, dispatch publish-release.yml and watch the run.
4. Download the staged assets and the release metadata CI resolved.
5. Unzip the Windows payload, fetch the previous release's MemryNote-<previous>-full.nupkg so vpk can emit a delta, re-check the SimplySign session, then run vpk '[win]' pack with --signTemplate scripts/sign-windows-binary.sh.
6. Verify with osslsigncode that MemryNote-win-Setup.exe and the Memrynote.exe inside the full nupkg both report Signature verification: ok against the two committed Certum CA certificates. Abort before upload when either fails.
7. Upload every asset to the draft with gh release upload --clobber, rename the draft to the publish-day tag, verify the asset set, publish.
8. Dispatch the Homebrew cask bump, optionally dispatch the Velopack smoke test with --smoke, print the Reddit follow-up.

Every step is idempotent. Progress lives in .release-state/<draft-tag>/state.json (gitignored) as an ordered step list plus the workflow run id, so a re-run after a failure attaches to a run that already succeeded instead of rebuilding for two hours. --restart discards it.

The one manual step

Logging in to SimplySign Desktop with the OTP from the phone app. --yes does not skip it, because it is a precondition rather than a confirmation. A session lasts about two hours and a CI build can outlive one, so the script re-checks right before it signs and may ask a second time.

Transition

Windows keeps shipping both installer families. The NSIS MemryNote-<version>-setup.exe, latest.yml, blockmaps and MemryNote-<version>-win.zip keep existing installs updating through electron-updater; the Velopack set (MemryNote-win-Setup.exe, MemryNote-<version>-full.nupkg, a -delta.nupkg when the previous full package was available, releases.win.json, RELEASES) is what new installs and the Velopack updater use. The NSIS assets stop shipping once telemetry shows no NSIS installs remain.

scripts/release.mjs carries the one-line switch for the app-side updater:

const skipVeloAppCheck = true

Flip it to false in the release that ships VelopackApp.build().run().

Deviations from the brief

The Velopack input is the existing MemryNote-<version>-win.zip, not a second win-unpacked artifact. The zip is the same content and is already built, staged and published, so a second 1.4 GB upload and download per release buys nothing. resolveUnpackedDir locates Memrynote.exe inside the extracted archive and fails loudly when the layout is neither the archive root nor a single nested directory.

velopack-smoke.yml gains an optional update_tag input. The installer and the newer package normally live on two different releases, so without it the smoke could only reapply one version to itself. pnpm release --smoke dispatches the previous release's Setup.exe against this release's package, and skips when the previous release predates Velopack.

Release note

none

Test plan

Run on this Mac against real artifacts. No CI run was dispatched and no release was created, uploaded to or published.

• node --test scripts/*.test.mjs — 183 pass, 0 fail. 64 of those cover the new pure logic: resume decisions, the vpk argument vector, asset assembly, metadata and tag parsing, and the session gate.
• Real vpk run of the generated argument vector against /tmp/velopack-proto/win-unpacked (1.4 GB, the shipped 2026.910.1 build) with --signTemplate omitted. Exit 0 in 71 s, emitting MemryNote-win-Setup.exe, MemryNote-2026.910.1-full.nupkg, releases.win.json and RELEASES, with 47 file(s) will not be signed plus the setup bundle, which is the set the sign template would cover.
• osslsigncode verify -CAfile <the two committed Certum CAs> -TSA-CAfile <same> against the prototype's signed MemryNote-win-Setup.exe printed Signature verification: ok and Number of verified signatures: 1. This is the exact argument vector buildOsslsigncodeVerifyArgs produces.
• The signing gate against the real keystore: keytool -list -keystore NONE -storetype PKCS11 with the PIN on stdin returned alias 57D2B94F4B6C4356BD26F757F3855C1F, and decideSigningSession reported ready. Read-only. Nothing was signed.
• pnpm lint — 0 errors (one pre-existing warning in vault-switcher.tsx, untouched here). ESLint ignores scripts/, so the new scripts are covered by Prettier and the unit tests instead.
• pnpm docs:impact --base origin/main --strict, pnpm docs:build, git diff --check — all pass.
• All three workflows parse as YAML. Everything below steps: in velopack-smoke.yml is unchanged from the proven velopack-windows-smoke branch apart from splitting the asset download across release_tag and update_tag.

Not verifiable here, for whoever reviews this:

• No signed vpk pack was produced. The signing session belongs to Kaan.
• No end-to-end pnpm release. The CI changes have not run on a runner.
• No real *-win.zip was inspected, so the archive layout is handled rather than confirmed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!