@rightkit/release 0.2.29 → 0.2.31

package/create-mac-updater.mjs

@@ -23,6 +23,10 @@ const outputPath = path.resolve(cwd, output);
 if (!dryRun && !existsSync(appPath)) fail(`signed app not found: ${appPath}`);
 
 const env = { ...process.env };
+// bsdtar otherwise serializes macOS extended attributes as AppleDouble `._*`
+// entries. Tauri's Rust extractor writes those entries as real bundle files,
+// invalidating the Developer ID seal and causing syspolicyd to trash the app.
+env.COPYFILE_DISABLE = "1";
 if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
   try {
     env.TAURI_SIGNING_PRIVATE_KEY = execFileSync(
@@ -38,11 +42,20 @@ env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD ??= "";
 
 rmSync(outputPath, { force: true });
 rmSync(`${outputPath}.sig`, { force: true });
-run("tar", ["-czf", outputPath, "-C", path.dirname(appPath), path.basename(appPath)]);
+// Tauri 2.10 strips the first path component while extracting. Omitting the explicit
+// App.app/ directory entry prevents it from unpacking that entry onto its existing temp dir.
+run("tar", [
+  "-czf",
+  outputPath,
+  "-C",
+  path.dirname(appPath),
+  path.join(path.basename(appPath), "Contents"),
+]);
 run("pnpm", ["exec", "tauri", "signer", "sign", outputPath]);
 
 function run(command, commandArgs) {
-  console.log(`${dryRun ? "[dry-run] " : ""}${command} ${commandArgs.join(" ")}`);
+  const envPrefix = command === "tar" ? "COPYFILE_DISABLE=1 " : "";
+  console.log(`${dryRun ? "[dry-run] " : ""}${envPrefix}${command} ${commandArgs.join(" ")}`);
   if (dryRun) return;
   const result = spawnSync(command, commandArgs, { cwd, env, stdio: "inherit" });
   if (result.status !== 0) process.exit(result.status ?? 1);

package/create-mac-updater.test.mjs

@@ -8,6 +8,7 @@ const helper = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url
 test("documents the final signed-app to signed-updater sequence in dry-run mode", () => {
   const result = spawnSync(process.execPath, [helper, "--app", "bundle/Test.app", "--output", "bundle/Test.app.tar.gz", "--dry-run"], { encoding: "utf8" });
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /tar .*Test\.app\.tar\.gz.*Test\.app/);
+  assert.match(result.stdout, /COPYFILE_DISABLE=1 tar .*Test\.app\.tar\.gz.*Test\.app\/Contents/);
+  assert.doesNotMatch(result.stdout, / Test\.app$/m);
   assert.match(result.stdout, /tauri signer sign .*Test\.app\.tar\.gz/);
 });

package/legal-contract.mjs

@@ -135,15 +135,8 @@ export function assertLegalReleaseContract(root, legal, appName, platform) {
     appendices.push({ ...appendix, absolutePath: realFile });
   }
 
-  // The in-app gate is the SINGLE assent surface (Adrian, 2026-07-17). An
-  // installer/DMG can only PRESENT the text: it cannot record who agreed, cannot ask
-  // the individual-vs-enterprise basis, and passive updaters reach neither — so a
-  // license page is duplicate presentation that captures nothing. This gate
-  // previously REQUIRED bundle.licenseFile; it now requires its absence.
-  //
-  // Checked on EVERY platform, not just Windows: one bundle.licenseFile drives BOTH
-  // the NSIS license page and the macOS DMG SLA (branded-dmg.mjs derives its --eula
-  // from it), so a win-only check would let a mac build reintroduce the SLA.
+  // The in-app gate is the single assent surface. An installer or DMG can only
+  // present text; it cannot record who agreed or the individual/enterprise basis.
   if (typeof legal.tauriConfig !== "string") fail(appName, "the legal gate requires legal.tauriConfig");
   const tauriPath = path.resolve(appRoot, legal.tauriConfig);
   if (!within(appRoot, tauriPath) || !existsSync(tauriPath)) fail(appName, `missing Tauri config: ${legal.tauriConfig}`);

package/legal-contract.test.mjs

@@ -46,8 +46,6 @@ function fixture() {
     })),
   };
   writeFileSync(path.join(legalDir, "legal-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
-  // No bundle.licenseFile: the in-app gate is the single assent surface, so a
-  // compliant app ships an installer with no license page (Adrian, 2026-07-17).
   writeFileSync(
     path.join(tauriDir, "tauri.conf.json"),
     `${JSON.stringify({ bundle: { publisher: "Damned Ventures LLC" } }, null, 2)}\n`,
@@ -107,8 +105,6 @@ test("rejects a Windows installer license page: the in-app gate is the only asse
 });
 
 test("rejects a macOS DMG SLA too — one licenseFile drives both bundlers", () => {
-  // branded-dmg.mjs derives its --eula from bundle.licenseFile, so a Windows-only
-  // check would let a mac release quietly reintroduce the mount-time SLA.
   const { root, legal } = fixture();
   writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }));
   assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /licenseFile must be absent/i);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.29",
+  "version": "0.2.31",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/publish-update.test.mjs

@@ -193,10 +193,10 @@ test("requires the durable release credential before the first patch upload", ()
     ...process.env,
     APPDATA: path.join(path.dirname(config), "empty-appdata"),
     RIGHT_RELEASE_TIER: "patch",
+    RIGHTAPPS_RELEASE_TOKEN_FILE: path.join(path.dirname(config), "missing-release-token"),
     RIGHTAPPS_ADMIN_TOKEN: "expired-admin-session",
   };
   delete env.RIGHTAPPS_RELEASE_TOKEN;
-  delete env.RIGHTAPPS_RELEASE_TOKEN_FILE;
   const result = spawnSync(process.execPath, [publisher, "--config", config, "--platform", "win"], {
     encoding: "utf8",
     env,

package/release-token.mjs

@@ -23,7 +23,11 @@ export async function loadReleaseToken({ env = process.env, platform = process.p
   if (direct) return direct;
 
   if (env.RIGHTAPPS_RELEASE_TOKEN_FILE) {
-    return readTokenFile(path.resolve(env.RIGHTAPPS_RELEASE_TOKEN_FILE));
+    try {
+      return await readTokenFile(path.resolve(env.RIGHTAPPS_RELEASE_TOKEN_FILE));
+    } catch (error) {
+      throw new Error(`RIGHTAPPS_RELEASE_TOKEN is unavailable (${error.message})`);
+    }
   }
 
   if (platform === "win32") {

package/release.mjs

@@ -16,7 +16,11 @@ const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
 const RIGHTKIT_VERSIONS = JSON.parse(readFileSync(path.resolve(TOOL_ROOT, "rightkit-versions.json"), "utf8"));
 const VERSION = RIGHTKIT_VERSIONS.stagedNpm?.["@rightkit/release"] ?? RIGHTKIT_VERSIONS.npm["@rightkit/release"];
 const TIERS = new Set(["patch", "update"]);
-const RIGHTKIT_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.npm, RIGHTKIT_VERSIONS.stagedNpm);
+const RIGHTKIT_ALLOWED = buildAllowedVersions(
+  RIGHTKIT_VERSIONS.npm,
+  RIGHTKIT_VERSIONS.stagedNpm,
+  RIGHTKIT_VERSIONS.legacyNpm,
+);
 const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
 
@@ -249,11 +253,15 @@ async function validateRightKitPackageContract(root, appName) {
   }
 }
 
-function buildAllowedVersions(published = {}, staged = {}) {
+function buildAllowedVersions(published = {}, staged = {}, legacy = {}) {
   const allowed = new Map();
-  for (const [name, version] of [...Object.entries(published), ...Object.entries(staged)]) {
+  for (const [name, value] of [
+    ...Object.entries(published),
+    ...Object.entries(staged),
+    ...Object.entries(legacy),
+  ]) {
     const versions = allowed.get(name) ?? new Set();
-    versions.add(version);
+    for (const version of Array.isArray(value) ? value : [value]) versions.add(version);
     allowed.set(name, versions);
   }
   return allowed;