@rightkit/release 0.2.30 → 0.2.31

package/create-mac-updater.mjs

@@ -23,6 +23,10 @@ const outputPath = path.resolve(cwd, output);
 if (!dryRun && !existsSync(appPath)) fail(`signed app not found: ${appPath}`);
 
 const env = { ...process.env };
+// bsdtar otherwise serializes macOS extended attributes as AppleDouble `._*`
+// entries. Tauri's Rust extractor writes those entries as real bundle files,
+// invalidating the Developer ID seal and causing syspolicyd to trash the app.
+env.COPYFILE_DISABLE = "1";
 if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
   try {
     env.TAURI_SIGNING_PRIVATE_KEY = execFileSync(
@@ -50,7 +54,8 @@ run("tar", [
 run("pnpm", ["exec", "tauri", "signer", "sign", outputPath]);
 
 function run(command, commandArgs) {
-  console.log(`${dryRun ? "[dry-run] " : ""}${command} ${commandArgs.join(" ")}`);
+  const envPrefix = command === "tar" ? "COPYFILE_DISABLE=1 " : "";
+  console.log(`${dryRun ? "[dry-run] " : ""}${envPrefix}${command} ${commandArgs.join(" ")}`);
   if (dryRun) return;
   const result = spawnSync(command, commandArgs, { cwd, env, stdio: "inherit" });
   if (result.status !== 0) process.exit(result.status ?? 1);

package/create-mac-updater.test.mjs

@@ -8,7 +8,7 @@ const helper = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url
 test("documents the final signed-app to signed-updater sequence in dry-run mode", () => {
   const result = spawnSync(process.execPath, [helper, "--app", "bundle/Test.app", "--output", "bundle/Test.app.tar.gz", "--dry-run"], { encoding: "utf8" });
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /tar .*Test\.app\.tar\.gz.*Test\.app\/Contents/);
+  assert.match(result.stdout, /COPYFILE_DISABLE=1 tar .*Test\.app\.tar\.gz.*Test\.app\/Contents/);
   assert.doesNotMatch(result.stdout, / Test\.app$/m);
   assert.match(result.stdout, /tauri signer sign .*Test\.app\.tar\.gz/);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.30",
+  "version": "0.2.31",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/right-suite-contract.test.mjs

@@ -317,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.29");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.30");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -327,10 +327,10 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.30",
+    "@rightkit/release": "0.2.31",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22"],
+    "@rightkit/release": ["0.2.22", "0.2.29"],
   });
   const licensePackage = JSON.parse(readFileSync(
     path.join(workspace, "tools/rightkit/packages/license/package.json"),

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.29",
+    "@rightkit/release": "0.2.30",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
@@ -15,10 +15,10 @@
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.30"
+    "@rightkit/release": "0.2.31"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22"]
+    "@rightkit/release": ["0.2.22", "0.2.29"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",