@rightkit/release 0.2.77 → 0.2.79

package/direct-bootstrap.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestWithAzure } from "./sign-release-manifest.mjs";
 import { validateCycloneDxSbom, validateInTotoSlsaProvenance } from "./supply-chain-evidence.mjs";
@@ -73,8 +73,18 @@ function assertGitHubAssetUrl(url) {
 
 export function createPortableArchive({ sourceDir, outputPath, commandRunner = spawnSync }) {
   const source = realpathSync(sourceDir);
-  mkdirSync(dirname(outputPath), { recursive: true });
-  const result = commandRunner("tar", ["-a", "-c", "-f", resolve(outputPath), "-C", source, "."], {
+  const outputDir = resolve(dirname(outputPath));
+  mkdirSync(outputDir, { recursive: true });
+  // On Windows, resolve the System32 bsdtar explicitly: PATH often finds GNU
+  // tar (Git Bash) first, which reads a colon in -f as a remote host spec and
+  // cannot write zip at all — its -a silently emits plain tar bytes for a
+  // .zip suffix. bsdtar writes a real zip. Run from the output directory with
+  // a bare filename so the invocation stays safe under either tar.
+  const tarProgram = process.platform === "win32"
+    ? join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe")
+    : "tar";
+  const result = commandRunner(tarProgram, ["-a", "-c", "-f", basename(outputPath), "-C", source, "."], {
+    cwd: outputDir,
     encoding: "utf8",
     windowsHide: true,
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.77",
+  "version": "0.2.79",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/registry-parity.mjs

@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { basename, join } from 'node:path';
+import { basename, join, relative } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const packageRoot = fileURLToPath(new URL('.', import.meta.url));
@@ -58,7 +58,10 @@ function runPnpm(args, options = {}) {
 
 async function extract(archive, destination) {
   await mkdir(destination, { recursive: true });
-  execFileSync('tar', ['-xzf', archive, '-C', destination], { stdio: 'pipe' });
+  // GNU tar reads the colon in an absolute Windows path (C:\...) as a remote
+  // host spec, and MSYS tar rejects absolute Windows -C targets; run from the
+  // destination with a relative archive path so no absolute path reaches tar.
+  execFileSync('tar', ['-xzf', relative(destination, archive)], { cwd: destination, stdio: 'pipe' });
   return join(destination, 'package');
 }
 

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.77",
+    "@rightkit/release": "0.2.79",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },