@rightkit/release 0.2.105 → 0.2.106

package/rightkit-versions.json

@@ -1,140 +1,141 @@
-{
-  "schema": 2,
-  "packageManager": "pnpm@11.24.0",
-  "npm": {
-    "@rightkit/git": "0.2.0",
-    "@rightkit/legal": "0.2.0",
-    "@rightkit/license": "0.1.5",
-    "@rightkit/logs": "0.1.3",
-    "@rightkit/platform-ui": "0.1.0",
-    "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.47",
-    "@rightkit/tauri": "0.1.0",
-    "@rightkit/updates": "0.2.3"
-  },
-  "stagedNpm": {
-    "@rightkit/ax": "0.2.4",
-    "@rightkit/git": "0.2.25",
-    "@rightkit/hooks": "0.1.1",
-    "@rightkit/legal": "0.3.1",
-    "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.7",
-    "@rightkit/logs": "0.1.4",
-    "@rightkit/platform-ui": "0.1.1",
-    "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.105",
-    "@rightkit/tauri": "0.1.1",
-    "@rightkit/updates": "0.2.4"
-  },
-  "legacyNpm": {
-    "@rightkit/ax": [
-      "0.2.0",
-      "0.2.1",
-      "0.2.2",
-      "0.2.3"
-    ],
-    "@rightkit/git": [
-      "0.2.1",
-      "0.2.2",
-      "0.2.3",
-      "0.2.4",
-      "0.2.5",
-      "0.2.6",
-      "0.2.7",
-      "0.2.8",
-      "0.2.9",
-      "0.2.10",
-      "0.2.11",
-      "0.2.12",
-      "0.2.13",
-      "0.2.14",
-      "0.2.15",
-      "0.2.16",
-      "0.2.18",
-      "0.2.19",
-      "0.2.20",
-      "0.2.21",
-      "0.2.22",
-      "0.2.23",
-      "0.2.24"
-    ],
-    "@rightkit/legal-ui": [
-      "0.1.0"
-    ],
-    "@rightkit/hooks": [
-      "0.1.0"
-    ],
-    "@rightkit/legal": [
-      "0.3.0"
-    ],
-    "@rightkit/license": [
-      "0.1.6"
-    ],
-    "@rightkit/release": [
-      "0.2.22",
-      "0.2.29",
-      "0.2.30",
-      "0.2.31",
-      "0.2.41",
-      "0.2.42",
-      "0.2.43",
-      "0.2.44",
-      "0.2.45",
-      "0.2.46",
-      "0.2.49",
-      "0.2.50",
-      "0.2.51",
-      "0.2.53",
-      "0.2.54",
-      "0.2.55",
-      "0.2.56",
-      "0.2.61",
-      "0.2.62",
-      "0.2.63",
-      "0.2.64",
-      "0.2.65",
-      "0.2.66",
-      "0.2.67",
-      "0.2.68",
-      "0.2.69",
-      "0.2.70",
-      "0.2.71",
-      "0.2.72",
-      "0.2.73",
-      "0.2.74",
-      "0.2.75",
-      "0.2.76",
-      "0.2.82",
-      "0.2.83",
-      "0.2.91",
-      "0.2.92",
-      "0.2.94",
-      "0.2.95",
-      "0.2.96",
-      "0.2.97",
-      "0.2.98",
-      "0.2.99",
-      "0.2.104"
-    ],
-    "@rightkit/qa": [
-      "0.1.0",
-      "0.2.0"
-    ]
-  },
-  "cargo": {
-    "rightkit-license": "0.1.2",
-    "rightkit-logs": "0.1.0",
-    "rightkit-process": "0.1.0",
-    "rightkit-tauri": "0.1.0"
-  },
-  "stagedCargo": {
-    "rightkit-license": "0.1.3",
-    "rightkit-tauri": "0.1.1"
-  },
-  "swift": {
-    "rightkit-swift": {
-      "url": "https://github.com/bogusyogi/rightkit-swift.git",
-      "version": "0.1.0"
-    }
-  }
-}
+{
+  "schema": 2,
+  "packageManager": "pnpm@11.24.0",
+  "npm": {
+    "@rightkit/git": "0.2.0",
+    "@rightkit/legal": "0.2.0",
+    "@rightkit/license": "0.1.5",
+    "@rightkit/logs": "0.1.3",
+    "@rightkit/platform-ui": "0.1.0",
+    "@rightkit/qa": "0.1.0",
+    "@rightkit/release": "0.2.47",
+    "@rightkit/tauri": "0.1.0",
+    "@rightkit/updates": "0.2.3"
+  },
+  "stagedNpm": {
+    "@rightkit/ax": "0.2.4",
+    "@rightkit/git": "0.2.25",
+    "@rightkit/hooks": "0.1.1",
+    "@rightkit/legal": "0.3.1",
+    "@rightkit/legal-ui": "0.1.1",
+    "@rightkit/license": "0.1.7",
+    "@rightkit/logs": "0.1.4",
+    "@rightkit/platform-ui": "0.1.1",
+    "@rightkit/qa": "0.2.1",
+    "@rightkit/release": "0.2.106",
+    "@rightkit/tauri": "0.1.1",
+    "@rightkit/updates": "0.2.4"
+  },
+  "legacyNpm": {
+    "@rightkit/ax": [
+      "0.2.0",
+      "0.2.1",
+      "0.2.2",
+      "0.2.3"
+    ],
+    "@rightkit/git": [
+      "0.2.1",
+      "0.2.2",
+      "0.2.3",
+      "0.2.4",
+      "0.2.5",
+      "0.2.6",
+      "0.2.7",
+      "0.2.8",
+      "0.2.9",
+      "0.2.10",
+      "0.2.11",
+      "0.2.12",
+      "0.2.13",
+      "0.2.14",
+      "0.2.15",
+      "0.2.16",
+      "0.2.18",
+      "0.2.19",
+      "0.2.20",
+      "0.2.21",
+      "0.2.22",
+      "0.2.23",
+      "0.2.24"
+    ],
+    "@rightkit/legal-ui": [
+      "0.1.0"
+    ],
+    "@rightkit/hooks": [
+      "0.1.0"
+    ],
+    "@rightkit/legal": [
+      "0.3.0"
+    ],
+    "@rightkit/license": [
+      "0.1.6"
+    ],
+    "@rightkit/release": [
+      "0.2.22",
+      "0.2.29",
+      "0.2.30",
+      "0.2.31",
+      "0.2.41",
+      "0.2.42",
+      "0.2.43",
+      "0.2.44",
+      "0.2.45",
+      "0.2.46",
+      "0.2.49",
+      "0.2.50",
+      "0.2.51",
+      "0.2.53",
+      "0.2.54",
+      "0.2.55",
+      "0.2.56",
+      "0.2.61",
+      "0.2.62",
+      "0.2.63",
+      "0.2.64",
+      "0.2.65",
+      "0.2.66",
+      "0.2.67",
+      "0.2.68",
+      "0.2.69",
+      "0.2.70",
+      "0.2.71",
+      "0.2.72",
+      "0.2.73",
+      "0.2.74",
+      "0.2.75",
+      "0.2.76",
+      "0.2.82",
+      "0.2.83",
+      "0.2.91",
+      "0.2.92",
+      "0.2.94",
+      "0.2.95",
+      "0.2.96",
+      "0.2.97",
+      "0.2.98",
+      "0.2.99",
+      "0.2.104",
+      "0.2.105"
+    ],
+    "@rightkit/qa": [
+      "0.1.0",
+      "0.2.0"
+    ]
+  },
+  "cargo": {
+    "rightkit-license": "0.1.2",
+    "rightkit-logs": "0.1.0",
+    "rightkit-process": "0.1.0",
+    "rightkit-tauri": "0.1.0"
+  },
+  "stagedCargo": {
+    "rightkit-license": "0.1.3",
+    "rightkit-tauri": "0.1.1"
+  },
+  "swift": {
+    "rightkit-swift": {
+      "url": "https://github.com/bogusyogi/rightkit-swift.git",
+      "version": "0.1.1"
+    }
+  }
+}

package/sign-macos.mjs

@@ -2,8 +2,9 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 
 const args = process.argv.slice(2);
 const dryRun = args.includes("--dry-run");
@@ -20,8 +21,8 @@ if (dryRun) {
   process.exit(0);
 }
 if (process.platform !== "darwin") fail("macOS signing must run on macOS");
-const identity = process.env.APPLE_DEVELOPER_ID?.trim();
-if (!identity) fail("set APPLE_DEVELOPER_ID to an installed Developer ID Application signing identity");
+let identity;
+try { identity = resolveMacosDeveloperIdIdentity(); } catch (error) { fail(error.message); }
 for (const file of files) if (!existsSync(file)) fail(`missing file: ${file}`);
 
 const evidence = [];

package/sign-release-manifest.mjs

@@ -1,7 +1,8 @@
 import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
+import { signingEnv } from "./signing-env.mjs";
 
 export const RIGHTRELEASE_MANIFEST_SIGNER = Object.freeze({
   id: "azure-artifact-signing-damned-ventures-v1",
@@ -73,6 +74,7 @@ export function signReleaseManifestWithAzure({
 
   const temp = mkdtempSync(join(tmpdir(), "rightrelease-manifest-sign-"));
   const metadata = metadataPath || materializeMetadata(temp, env);
+  const signingEnvironment = signingEnv(environment, env);
   const catalogDir = join(temp, "catalog");
   mkdirSync(catalogDir, { recursive: true });
   const catalog = join(catalogDir, "catalog.cat");
@@ -84,15 +86,15 @@ export function signReleaseManifestWithAzure({
     "New-FileCatalog -Path $ManifestPath -CatalogFilePath $CatalogDirectory -CatalogVersion 2.0 | Out-Null",
   ].join("\r\n") + "\r\n");
   try {
-    const generation = commandRunner(powershellPath, ["-NoProfile", "-File", generator, resolve(manifestPath), catalogDir], { encoding: "utf8", windowsHide: true, env: environment });
+    const generation = commandRunner(powershellPath, ["-NoProfile", "-File", generator, resolve(manifestPath), catalogDir], { encoding: "utf8", windowsHide: true, env: signingEnvironment });
     if (generation?.status !== 0) throw new Error(`RightRelease manifest catalog generation failed: ${String(generation?.stderr ?? "").trim()}`);
     if (!existsSync(catalog) || !statSync(catalog).isFile()) throw new Error("RightRelease manifest catalog was not produced");
     const result = commandRunner(signtool, [
       "sign", "/v", "/fd", "SHA256", "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256",
       "/dlib", dlib, "/dmdf", metadata, catalog,
-    ], { encoding: "utf8", windowsHide: true, env: environment });
-    if (result?.status !== 0) throw new Error(`RightRelease manifest signing failed: ${String(result?.stderr ?? "").trim()}`);
-    const inspection = inspectCatalog({ manifestPath: resolve(manifestPath), signaturePath: catalog, commandRunner, powershellPath, environment });
+    ], { encoding: "utf8", windowsHide: true, env: signingEnvironment });
+    if (result?.status !== 0) throw new Error(`RightRelease manifest signing failed: ${String(result?.stderr ?? "").trim()}\n${String(result?.stdout ?? "").slice(-1200)}`);
+    const inspection = inspectCatalog({ manifestPath: resolve(manifestPath), signaturePath: catalog, commandRunner, powershellPath, environment: signingEnvironment });
     if (inspection.verified !== true || inspection.catalogStatus !== "Valid" || inspection.signatureStatus !== "Valid") throw new Error("RightRelease manifest catalog verification failed");
     if (normalizeSubject(inspection.subject) !== normalizeSubject(RIGHTRELEASE_MANIFEST_SIGNER.subject) || !CERTIFICATE_SHA256.test(inspection.certificateSha256 ?? "")) throw new Error("RightRelease manifest signer identity does not match protected Azure profile");
     mkdirSync(dirname(signaturePath), { recursive: true });

package/sign-updater.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { execFileSync, spawnSync } from "node:child_process";
+import { execFileSync, spawnSync } from "./background-process.mjs";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";

package/sign-windows.mjs

@@ -3,7 +3,8 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
+import { azureCliCandidates, signingEnv } from "./signing-env.mjs";
 
 const EXCLUDE_CREDENTIALS = [
   "ManagedIdentityCredential",
@@ -34,7 +35,7 @@ if (dryRun) {
 if (process.platform !== "win32") fail("Windows signing must run on Windows");
 for (const file of files) if (!existsSync(file)) fail(`missing file: ${file}`);
 
-const childEnv = signingEnv();
+const childEnv = signingEnv(process.env, env);
 const signtool = findFirst([env("AZURE_SIGNTOOL_PATH"), env("SIGNTOOL_PATH"), ...signtoolCandidates()]);
 if (!signtool) fail("signtool.exe not found; set AZURE_SIGNTOOL_PATH or install Windows SDK Build Tools");
 if (verifyOnly) {
@@ -86,19 +87,6 @@ function metadataPath(dir) {
   return file;
 }
 
-function signingEnv() {
-  const paths = [path.dirname(findFirst(azureCliCandidates()) ?? ""), env("PATH")].filter(Boolean);
-  return { ...process.env, PATH: paths.join(path.delimiter) };
-}
-
-function azureCliCandidates() {
-  return [
-    path.join(env("LOCALAPPDATA") || "", "AzureCLI", "bin", "az.cmd"),
-    path.join(env("ProgramFiles(x86)") || "C:\\Program Files (x86)", "Microsoft SDKs", "Azure", "CLI2", "wbin", "az.cmd"),
-    path.join(env("ProgramFiles") || "C:\\Program Files", "Microsoft SDKs", "Azure", "CLI2", "wbin", "az.cmd"),
-  ];
-}
-
 function signtoolCandidates() {
   return [
     ...sdkBuildToolsCandidates(),

package/signing-env.mjs

@@ -0,0 +1,29 @@
+import { existsSync } from "node:fs";
+import { delimiter, dirname, join } from "node:path";
+
+// DefaultAzureCredential's AzureCliCredential resolves `az` through the child
+// PATH. Signing children must inherit an augmented PATH or signing fails with
+// a bare "unexpected internal error" whenever `az` is installed outside the
+// ambient PATH.
+export function signingEnv(environment, env) {
+  const azDir = dirnameOfFirstExisting(azureCliCandidates(env));
+  // Windows env blocks are case-insensitive; preserve the ambient key casing
+  // (usually "Path") so the augmented value replaces it instead of producing
+  // a shadowed duplicate the resolver never reads.
+  const pathKey = Object.keys(environment).find((key) => key.toLowerCase() === "path") ?? "PATH";
+  const basePath = env("PATH") || environment[pathKey] || "";
+  return { ...environment, [pathKey]: [azDir, basePath].filter(Boolean).join(delimiter) };
+}
+
+export function azureCliCandidates(env) {
+  return [
+    join(env("LOCALAPPDATA") || "", "AzureCLI", "bin", "az.cmd"),
+    join(env("ProgramFiles(x86)") || "C:\\Program Files (x86)", "Microsoft SDKs", "Azure", "CLI2", "wbin", "az.cmd"),
+    join(env("ProgramFiles") || "C:\\Program Files", "Microsoft SDKs", "Azure", "CLI2", "wbin", "az.cmd"),
+  ];
+}
+
+function dirnameOfFirstExisting(candidates) {
+  const found = candidates.find((candidate) => candidate && existsSync(candidate));
+  return found ? dirname(found) : null;
+}

package/standalone-clone-verify.mjs

@@ -1,7 +1,7 @@
 import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath } from "node:url";
 
 export const DEFAULT_APPS = Object.freeze([

package/upload-large.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { accessSync, statSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 
 const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
 const BUCKETS = new Map([

package/upload-release.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { pathToFileURL } from "node:url";
 import { prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";