@rightkit/release 0.2.81 → 0.2.82

package/build-release.mjs

@@ -168,7 +168,15 @@ try {
     // outlived the change that was supposed to retire them.
     pipeline: PIPELINE_FINGERPRINT,
     configSha256: hashFile(configPath),
-    receiptInputs: ["raw-exe", "installer", "embedding"].map((phase) => path.join(receiptRoot, `windows-${phase}.json`)),
+    // Resolve each phase receipt the same way signing does: the config's
+    // sign.receipt / sign.installerReceipt override wins, the default
+    // windows-<phase>.json name is only the fallback. Hardcoding the default
+    // here made the seal read a path the signer never wrote whenever a config
+    // (e.g. an architecture-qualified receipt) overrode it.
+    receiptInputs: ["raw-exe", "installer", "embedding"].map((phase) => {
+      const configured = phase === "raw-exe" ? target.sign?.receipt : phase === "installer" ? target.sign?.installerReceipt : undefined;
+      return configured ? path.resolve(appRoot, configured) : path.join(receiptRoot, `windows-${phase}.json`);
+    }),
   } : null;
   if (signingIdentity) inputHashes[".right-release/signing-identity.json"] = hashFileText(JSON.stringify(signingIdentity));
   const cargoLock = nativeLayout.lockPath;
@@ -435,7 +443,15 @@ function sealRelease({ configRoot, managedCargoTarget, nativeLayout, sealedDir,
     commit,
     platform,
     cacheKey,
-    signing: signingIdentity ? { ...signingIdentity, receipts: signingIdentity.receiptInputs.map((file) => ({ file, sha256: hashFile(file) })) } : null,
+    // Portable contracts sign only raw executables — installer/embedding
+    // receipts legitimately never exist there. Seal every receipt that was
+    // produced, but never zero: a signed platform with no receipt at all is
+    // an unsound seal, not a portable release.
+    signing: signingIdentity ? { ...signingIdentity, receipts: (() => {
+      const present = signingIdentity.receiptInputs.filter((file) => existsSync(file));
+      if (present.length === 0) throw new Error(`no signing receipts found to seal; expected at least ${signingIdentity.receiptInputs[0]}`);
+      return present.map((file) => ({ file, sha256: hashFile(file) }));
+    })() } : null,
     files,
     routes,
     inputs: inputHashes,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.81",
+  "version": "0.2.82",
   "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { access, readFile, readdir } from "node:fs/promises";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
@@ -378,6 +378,12 @@ async function runNativeFinalizer({ finalizer, nativeAssembly, target, root, sig
     ...finalizer,
     args: finalizer.args.map((arg) => expandFinalizerToken(arg, { provenance, outputPath, packageIdentity })),
   };
+  // A finalization receipt at outputPath from a PREVIOUS run must not
+  // survive into this one: the file is preferred over the finalizer's
+  // stdout below, and a stale receipt carries the prior run's provenance,
+  // which fails the identity check against this run's mint. Any file
+  // present after the finalizer returns was written by this run.
+  if (!opts.dryRun) rmSync(outputPath, { force: true });
   const stdout = await runCommand(finalizerCommand, root, {
     captureStdout: true,
     env: {

package/rightkit-versions.json

@@ -22,7 +22,7 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.81",
+    "@rightkit/release": "0.2.82",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },