@rightkit/release 0.2.78 → 0.2.80

package/direct-bootstrap.mjs

@@ -75,10 +75,15 @@ export function createPortableArchive({ sourceDir, outputPath, commandRunner = s
   const source = realpathSync(sourceDir);
   const outputDir = resolve(dirname(outputPath));
   mkdirSync(outputDir, { recursive: true });
-  // GNU tar reads a colon in -f as a remote host spec, so an absolute
-  // Windows path (C:\...) fails with "Cannot connect to C:". Run from the
-  // output directory and pass a bare filename instead.
-  const result = commandRunner("tar", ["-a", "-c", "-f", basename(outputPath), "-C", source, "."], {
+  // On Windows, resolve the System32 bsdtar explicitly: PATH often finds GNU
+  // tar (Git Bash) first, which reads a colon in -f as a remote host spec and
+  // cannot write zip at all — its -a silently emits plain tar bytes for a
+  // .zip suffix. bsdtar writes a real zip. Run from the output directory with
+  // a bare filename so the invocation stays safe under either tar.
+  const tarProgram = process.platform === "win32"
+    ? join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe")
+    : "tar";
+  const result = commandRunner(tarProgram, ["-a", "-c", "-f", basename(outputPath), "-C", source, "."], {
     cwd: outputDir,
     encoding: "utf8",
     windowsHide: true,

package/native-release-finalization.mjs

@@ -227,7 +227,18 @@ export function validateNativeFinalizationOutput(output, {
     throw new Error("native finalizer archive digest mismatch");
   }
   if (output.archive?.path != null && PLACEHOLDER.test(String(output.archive.path))) throw new Error("native finalizer archive path is a placeholder");
-  return { ...output, provenance, signedArtifacts: signed, ...(archiveSha256 ? { archiveSha256 } : {}) };
+  // Echo the canonical signed set only when the finalizer actually declared
+  // one. Injecting `signedArtifacts: []` into an output that never mentioned
+  // signed artifacts turns "not declared" into a declared-empty identity,
+  // which createNativeFinalizationReceipt then rejects against the real
+  // signed set as an identity mismatch.
+  const declaredSigned = output.signedArtifacts != null || output.signed != null;
+  return {
+    ...output,
+    provenance,
+    ...(declaredSigned ? { signedArtifacts: signed } : {}),
+    ...(archiveSha256 ? { archiveSha256 } : {}),
+  };
 }
 
 export const validateNativeFinalization = validateNativeFinalizationOutput;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.78",
+  "version": "0.2.80",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/registry-parity.mjs

@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { basename, join } from 'node:path';
+import { basename, join, relative } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const packageRoot = fileURLToPath(new URL('.', import.meta.url));
@@ -58,7 +58,10 @@ function runPnpm(args, options = {}) {
 
 async function extract(archive, destination) {
   await mkdir(destination, { recursive: true });
-  execFileSync('tar', ['-xzf', archive, '-C', destination], { stdio: 'pipe' });
+  // GNU tar reads the colon in an absolute Windows path (C:\...) as a remote
+  // host spec, and MSYS tar rejects absolute Windows -C targets; run from the
+  // destination with a relative archive path so no absolute path reaches tar.
+  execFileSync('tar', ['-xzf', relative(destination, archive)], { cwd: destination, stdio: 'pipe' });
   return join(destination, 'package');
 }
 

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.78",
+    "@rightkit/release": "0.2.80",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },