app-builder-lib 27.0.0-alpha.8 → 27.0.0-alpha.9

package/scheme.json

@@ -520,6 +520,23 @@
             "string"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updaterCacheDirName": {
           "type": [
             "null",
@@ -654,6 +671,23 @@
             "number"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updateProvider": {
           "description": "The Provider to provide UpdateInfo regarding available updates.  Required\nto use custom providers with electron-updater.",
           "typeof": "function"
@@ -935,7 +969,8 @@
           "enum": [
             "dir",
             "file",
-            "link"
+            "link",
+            "position"
           ],
           "type": "string"
         },
@@ -1247,14 +1282,14 @@
           "type": "array"
         },
         "entitlements": {
-          "description": "Path to the main app entitlements file.\nFalls back to `build/entitlements.mac.plist` if it exists, then to `@electron/osx-sign`'s\nbuilt-in defaults.",
+          "description": "Path to the main app entitlements file. Resolved relative to the build resources directory, then the project directory.\nFalls back to `build/entitlements.mac.plist` (or `build/entitlements.mas.plist` for MAS targets) if it exists.\nOtherwise `mac` builds use the bundled default, which grants only `com.apple.security.cs.allow-jit`\n(ad-hoc builds use a bundled ad-hoc template that also disables library validation), and MAS builds use\n`@electron/osx-sign`'s built-in sandboxed `default.mas.plist`.",
           "type": [
             "null",
             "string"
           ]
         },
         "entitlementsInherit": {
-          "description": "Path to child entitlements inherited by embedded frameworks and bundles.\nFalls back to `build/entitlements.mac.inherit.plist` if it exists.",
+          "description": "Path to child entitlements inherited by embedded frameworks and bundles. Resolved relative to the build resources directory, then the project directory.\nFalls back to `build/entitlements.mac.inherit.plist` (or `build/entitlements.mas.inherit.plist` for MAS targets) if it exists.\nOtherwise nested binaries receive `@electron/osx-sign`'s per-file defaults (renderer/GPU helpers: `allow-jit`;\nplugin helper: Chromium's looser set; everything else: `default.darwin.plist`); ad-hoc `mac` builds use the\nbundled ad-hoc template instead.",
           "type": [
             "null",
             "string"
@@ -1755,6 +1790,23 @@
             "number"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updaterCacheDirName": {
           "type": [
             "null",
@@ -1897,6 +1949,23 @@
             "string"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updaterCacheDirName": {
           "type": [
             "null",
@@ -1979,6 +2048,23 @@
             "string"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updaterCacheDirName": {
           "type": [
             "null",
@@ -2090,6 +2176,23 @@
             "number"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updaterCacheDirName": {
           "type": [
             "null",
@@ -2478,6 +2581,17 @@
           "default": "AppImage",
           "description": "Target package type: list of `AppImage`, `flatpak`, `snap`, `deb`, `rpm`, `freebsd`, `pacman`, `p5p`, `apk`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n\nelectron-builder [docker image](https://www.electron.build/docs/features/multi-platform-build#docker) can be used to build Linux targets on any platform.\n\nPlease [do not put an AppImage into another archive](https://github.com/probonopd/AppImageKit/wiki/Creating-AppImages#common-mistake) like a .zip or .tar.gz."
         },
+        "updateManifest": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/UpdateManifestSigningOptions"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Ed25519 signing of the auto-update manifest (`latest*.yml`). When configured, each manifest is signed\nand electron-updater verifies the signature (against the embedded public key) before downloading an update.\nPrefer supplying the key via the `ELECTRON_BUILDER_UPDATE_SIGN_KEY` / `ELECTRON_BUILDER_UPDATE_SIGN_KEY_FILE` environment variables in CI."
+        },
         "vendor": {
           "description": "The vendor. Defaults to [author](https://www.electron.build/configuration#author).",
           "type": [
@@ -3212,6 +3326,17 @@
             }
           ],
           "description": "Options forwarded to `@electron/universal` when building a universal (multi-arch) app.\nHas no effect unless the target arch is `universal`."
+        },
+        "updateManifest": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/UpdateManifestSigningOptions"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Ed25519 signing of the auto-update manifest (`latest*.yml`). When configured, each manifest is signed\nand electron-updater verifies the signature (against the embedded public key) before downloading an update.\nPrefer supplying the key via the `ELECTRON_BUILDER_UPDATE_SIGN_KEY` / `ELECTRON_BUILDER_UPDATE_SIGN_KEY_FILE` environment variables in CI."
         }
       },
       "type": "object"
@@ -3693,6 +3818,17 @@
             }
           ],
           "description": "Options forwarded to `@electron/universal` when building a universal (multi-arch) app.\nHas no effect unless the target arch is `universal`."
+        },
+        "updateManifest": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/UpdateManifestSigningOptions"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Ed25519 signing of the auto-update manifest (`latest*.yml`). When configured, each manifest is signed\nand electron-updater verifies the signature (against the embedded public key) before downloading an update.\nPrefer supplying the key via the `ELECTRON_BUILDER_UPDATE_SIGN_KEY` / `ELECTRON_BUILDER_UPDATE_SIGN_KEY_FILE` environment variables in CI."
         }
       },
       "type": "object"
@@ -4367,8 +4503,14 @@
           "type": "boolean"
         },
         "differentialPackage": {
-          "description": "Marks the package as built with differential download support for the update server.",
-          "type": "boolean"
+          "default": true,
+          "description": "Marks the package as built with differential download support for the update server, and selects how the\napp package is compressed:\n\n- `false` — no differential download support.\n- `\"store-asar\"` — differential-aware, with the app's `resources/app.asar` stored uncompressed (7-Zip\n  `Copy`) inside the package. The differential updater diffs the *compressed* package with a\n  content-defined blockmap, and the asar is a single compressed member — so any change to app code\n  re-downloads the entire compressed asar (~100% of the member; its header rewrite alone diverges every\n  block). Storing it keeps unchanged regions byte-identical between releases, making the delta\n  proportional to what actually changed (measured on a ~32 MB asar: a one-line source change cost 0.2%\n  instead of 100%). Trade-off: the installer and full package grow by roughly what compressing the asar\n  saved.\n- anything else (`true`, `\"compressed\"`, unset) — differential-aware, whole package compressed.",
+          "enum": [
+            "compressed",
+            false,
+            "store-asar",
+            true
+          ]
         },
         "displayLanguageSelector": {
           "default": false,
@@ -4383,11 +4525,21 @@
           ]
         },
         "include": {
-          "description": "The path to NSIS include script to customize installer. Defaults to `build/installer.nsh`. See [Custom NSIS script](#custom-nsis-script).",
-          "type": [
-            "null",
-            "string"
-          ]
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "The path to NSIS include script to customize installer, or an array of such paths to include multiple scripts. Defaults to `build/installer.nsh`. See [Custom NSIS script](#custom-nsis-script).\n\nEach path is resolved relative to the [build resources directory](https://www.electron.build/docs/configuration#buildresources) first and then relative to the project directory.\nWhen an array is provided, all scripts are included in the specified order."
         },
         "installerHeader": {
           "default": "build/installerHeader.bmp",
@@ -4723,8 +4875,14 @@
           "type": "boolean"
         },
         "differentialPackage": {
-          "description": "Marks the package as built with differential download support for the update server.",
-          "type": "boolean"
+          "default": true,
+          "description": "Marks the package as built with differential download support for the update server, and selects how the\napp package is compressed:\n\n- `false` — no differential download support.\n- `\"store-asar\"` — differential-aware, with the app's `resources/app.asar` stored uncompressed (7-Zip\n  `Copy`) inside the package. The differential updater diffs the *compressed* package with a\n  content-defined blockmap, and the asar is a single compressed member — so any change to app code\n  re-downloads the entire compressed asar (~100% of the member; its header rewrite alone diverges every\n  block). Storing it keeps unchanged regions byte-identical between releases, making the delta\n  proportional to what actually changed (measured on a ~32 MB asar: a one-line source change cost 0.2%\n  instead of 100%). Trade-off: the installer and full package grow by roughly what compressing the asar\n  saved.\n- anything else (`true`, `\"compressed\"`, unset) — differential-aware, whole package compressed.",
+          "enum": [
+            "compressed",
+            false,
+            "store-asar",
+            true
+          ]
         },
         "displayLanguageSelector": {
           "default": false,
@@ -4739,11 +4897,21 @@
           ]
         },
         "include": {
-          "description": "The path to NSIS include script to customize installer. Defaults to `build/installer.nsh`. See [Custom NSIS script](#custom-nsis-script).",
-          "type": [
-            "null",
-            "string"
-          ]
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "The path to NSIS include script to customize installer, or an array of such paths to include multiple scripts. Defaults to `build/installer.nsh`. See [Custom NSIS script](#custom-nsis-script).\n\nEach path is resolved relative to the [build resources directory](https://www.electron.build/docs/configuration#buildresources) first and then relative to the project directory.\nWhen an array is provided, all scripts are included in the specified order."
         },
         "installerHeader": {
           "default": "build/installerHeader.bmp",
@@ -5974,6 +6142,23 @@
             "string"
           ]
         },
+        "include": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "The path to NSIS include script to customize the portable launcher, or an array of such paths to include multiple scripts. See [Custom NSIS script](#custom-nsis-script).\n\nEach path is resolved relative to the [build resources directory](https://www.electron.build/docs/configuration#buildresources) first and then relative to the project directory.\nWhen an array is provided, all scripts are included in the specified order.\n\nUnlike the installer targets, the portable target does **not** fall back to `build/installer.nsh` — a custom script is only included when this option is explicitly set."
+        },
         "publish": {
           "anyOf": [
             {
@@ -6180,6 +6365,23 @@
             "number"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updaterCacheDirName": {
           "type": [
             "null",
@@ -6684,6 +6886,23 @@
             "number"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updaterCacheDirName": {
           "type": [
             "null",
@@ -7539,6 +7758,23 @@
             "number"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updaterCacheDirName": {
           "type": [
             "null",
@@ -8016,6 +8252,23 @@
             "number"
           ]
         },
+        "updateManifestPublicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 public key(s) (PEM or base64 SPKI) used by electron-updater to verify the signed update\nmanifest before downloading — the install's trust list. A manifest is accepted when any listed key\nvalidates one of its signatures. Embedded into `app-update.yml` at build time when update manifest\nsigning is enabled: a single string for one key, an array for several. Managed by electron-builder —\npopulated from `updateManifest.publicKey` or derived from the configured signing key(s); setting it\nmanually in the `publish` configuration is rejected as a configuration error."
+        },
         "updaterCacheDirName": {
           "type": [
             "null",
@@ -8040,10 +8293,6 @@
             "string"
           ]
         },
-        "customSquirrelVendorDir": {
-          "description": "The custom squirrel vendor dir. If not specified will use the Squirrel.Windows that is shipped with electron-installer(https://github.com/electron/windows-installer/tree/main/vendor).\nAfter https://github.com/electron-userland/electron-builder-binaries/pull/56 merged, will add `electron-builder-binaries` to get the latest version of squirrel.",
-          "type": "string"
-        },
         "iconUrl": {
           "description": "A URL to an ICO file to use as the application icon (displayed in Control Panel > Programs and Features). Defaults to the Electron icon.\n\nPlease note — [local icon file url is not accepted](https://github.com/atom/grunt-electron-installer/issues/73), must be https/http.\n\nIf you don't plan to build windows installer, you can omit it.\nIf your project repository is public on GitHub, it will be `https://github.com/${u}/${p}/blob/master/build/icon.ico?raw=true` by default.",
           "type": [
@@ -8273,6 +8522,22 @@
           "default": "latest",
           "description": "Version of the 7-Zip binary bundle used internally to extract `.7z` and `.tar.xz` archives.\n\nSet to a {@link ToolsetCustom} object to supply your own 7za binary.\nThe `url` must point to a directory (or a `.tar.gz`/`.zip` archive of one) that contains\n`bin/7za` (macOS/Linux) or `bin/7za.exe` (Windows).\n\n**Bootstrap constraint:** the custom bundle itself must be a `.tar.gz` or `.zip` archive\n(or a bare `file://` directory). `.7z` and `.tar.xz` archives cannot be used here because\nextracting them requires 7za — a circular dependency.\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.0.0\"` | Shipped the 32-bit `7za.exe` for every Windows arch (1.75 GiB memory cap, no LZMA2 multithreading on x64/arm64) |\n| `\"1.0.1\"` | Correct per-arch Windows binaries (x64, ia32, arm64) |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/7zip/CHANGELOG.md"
         },
+        "squirrel": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ToolsetCustom"
+            },
+            {
+              "enum": [
+                "1.1.1",
+                "latest"
+              ],
+              "type": "string"
+            }
+          ],
+          "default": "latest",
+          "description": "Version of the `squirrel.windows` bundle used to build Squirrel.Windows installers.\n\nThe bundle ships the Squirrel vendor toolset under `electron-winstaller/vendor/`:\n- **`Squirrel.exe`** / **`Squirrel-Mono.exe`** — releasify the app into `Setup.exe` (and an optional MSI).\n- **`SyncReleases.exe`** — downloads prior releases to produce delta packages.\n- **`nuget.exe`**, **`7z`** — pack the app into a `.nupkg` and compress release assets.\n\n`rcedit.exe` is provisioned from the {@link winCodeSign} toolset at runtime (on every platform;\nunder Wine on non-Windows hosts). Building an MSI additionally uses the shared WiX toolset.\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.1.1\"` | Squirrel.Windows 2.0.1 (patched) with a standalone, checksum-verified `nuget.exe` 6.14.0 |\n\nSet to a {@link ToolsetCustom} object to supply your own bundle — it must contain the\n`electron-winstaller/vendor/` subtree. Only used when building the `squirrelWindows` target.\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/squirrel.windows/CHANGELOG.md"
+        },
         "winCodeSign": {
           "anyOf": [
             {
@@ -8303,13 +8568,14 @@
               "enum": [
                 "0.0.0",
                 "1.0.1",
-                "latest"
+                "latest",
+                "system"
               ],
               "type": "string"
             }
           ],
           "default": "latest",
-          "description": "Version of the Wine bundle used to run Windows tools (NSIS, rcedit, signtool) on\nnon-Windows hosts (macOS and Linux).\n\nWine is only required when building Windows targets on a non-Windows machine. On Windows,\nthis setting has no effect.\n\nAvailable versions:\n| Version | Wine version | Platform support | Notes |\n|---------|-------------|-----------------|-------|\n| `\"0.0.0\"` | 4.0.1 | macOS | Legacy portable bundle (pre-v27) |\n| `\"1.0.1\"` | 11.0 | macOS | Supports arm64 macOS via Rosetta |\n\nTo use a custom Wine binary, use a `ToolsetCustom` object.\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/wine/CHANGELOG.md"
+          "description": "Version of the Wine bundle used to run Windows tools (NSIS, rcedit, signtool) on\nnon-Windows hosts (macOS and Linux).\n\nWine is only required when building Windows targets on a non-Windows machine. On Windows,\nthis setting has no effect.\n\nAvailable versions:\n| Version | Wine version | Platform support | Notes |\n|---------|-------------|-----------------|-------|\n| `\"0.0.0\"` | 4.0.1 | macOS | Legacy portable bundle (pre-v27) |\n| `\"1.0.1\"` | 11.0 | macOS | Supports arm64 macOS via Rosetta |\n| `\"system\"` | host install | macOS, Linux | Uses the `wine` binary on `PATH` instead of a bundle |\n\n`\"system\"` is the replacement for the `USE_SYSTEM_WINE` environment variable removed in v27, and\nis what `\"latest\"` (the default) currently resolves to on every platform: the published `\"1.0.1\"`\nbundles ship no PE builtins, so a host Wine installation is required to build Windows targets on\nmacOS or Linux.\n\nTo use a custom Wine binary, use a `ToolsetCustom` object.\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/wine/CHANGELOG.md"
         }
       },
       "type": "object"
@@ -8336,6 +8602,63 @@
       ],
       "type": "object"
     },
+    "UpdateManifestSigningOptions": {
+      "additionalProperties": false,
+      "properties": {
+        "publicKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "The Ed25519 public key(s) (PEM or base64 SPKI) embedded into `app-update.yml` as the updater's trust list.\nThe updater accepts a manifest when any listed key validates one of its signatures. Optional — when\nomitted the public key of every configured signing key is derived and embedded. Set it explicitly to trust\nadditional keys ahead of a rotation (for example `[current, next]`) or when the private key is held by an\nexternal signer."
+        },
+        "signingKey": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Ed25519 private key(s) in PEM (PKCS#8) format used to sign the update manifest. A single PEM string may\ncontain several concatenated keys, or pass an array with one key each; the manifest is signed by every key\n(dual-signing for [key rotation](https://www.electron.build/features/key-rotation)) and the first key also\nfills the legacy single `signature` field.\nSecret — prefer the `ELECTRON_BUILDER_UPDATE_SIGN_KEY` environment variable in CI over committing this to config."
+        },
+        "signingKeyFile": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": [
+                "null",
+                "string"
+              ]
+            }
+          ],
+          "description": "Path(s) to file(s) containing the Ed25519 private key (PEM, PKCS#8). Alternative to `signingKey`.\nAn array signs with every listed key, in order. Relative paths are resolved against the project directory."
+        }
+      },
+      "type": "object"
+    },
     "WindowsAzureSigningConfig": {
       "additionalProperties": false,
       "description": "The `signtool /dlib` Azure Trusted Signing integration was introduced in `toolsets.winCodeSign: 1.3.0`.\nThe legacy PowerShell integration is deprecated, but leverages the same underlying Azure APIs, so both interfaces share the same config shape.",
@@ -8758,6 +9081,17 @@
           "default": "nsis",
           "description": "The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable app](https://www.electron.build/nsis#portable) without installation), `appx`, `msix`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\nAppX and MSIX packages can be built on Windows 10 or Windows Server 2012 R2 (version 6.3+) or later, and on macOS via Parallels Desktop.\n\nTo use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency."
         },
+        "updateManifest": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/UpdateManifestSigningOptions"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Ed25519 signing of the auto-update manifest (`latest*.yml`). When configured, each manifest is signed\nand electron-updater verifies the signature (against the embedded public key) before downloading an update.\nPrefer supplying the key via the `ELECTRON_BUILDER_UPDATE_SIGN_KEY` / `ELECTRON_BUILDER_UPDATE_SIGN_KEY_FILE` environment variables in CI."
+        },
         "verifyUpdateCodeSignature": {
           "default": true,
           "description": "Whether the NSIS auto-updater should verify the Authenticode signature of a downloaded update\nbefore installing it. This is a **runtime** check performed by your app via electron-updater,\nnot a build-time check.\n\nWhen enabled (the default), the resolved [publisher name](#publisherName) is embedded into\n`app-update.yml` at build time. At update time electron-updater inspects the certificate that\nsigned the downloaded installer and compares its subject (Distinguished Name / Common Name)\nagainst that publisher name, refusing to install on a mismatch. This prevents a tampered or\nmaliciously substituted update from being installed.\n\nSet to `false` to skip verification — in which case the publisher name is **not** embedded.\nDisable this only if your updates are not Authenticode-signed.",
@@ -10026,6 +10360,17 @@
       ],
       "description": "Pinned versions of the binary toolsets electron-builder downloads and uses internally.\n\nEach property selects a specific release of the corresponding tool bundle. Set a property to\n`\"0.0.0\"` to force the legacy bundle (pre-v27 behaviour). Leave a property unset (or set it to\n`\"latest\"`) to use the modern default (newest bundle) for that toolset.\n\nNote: Toolset versioning can drop intermediate releases (such as if a problem is discovered in a bundle). If you need to pin to a specific release, check the release notes for the toolset to ensure the version you specify is valid."
     },
+    "updateManifest": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/UpdateManifestSigningOptions"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Ed25519 signing of the auto-update manifest (`latest*.yml`). When configured, each manifest is signed\nand electron-updater verifies the signature (against the embedded public key) before downloading an update.\nPrefer supplying the key via the `ELECTRON_BUILDER_UPDATE_SIGN_KEY` / `ELECTRON_BUILDER_UPDATE_SIGN_KEY_FILE` environment variables in CI."
+    },
     "win": {
       "anyOf": [
         {

package/templates/entitlements.mac.adhoc.plist

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <!-- Default entitlements for ad-hoc (`identity: "-"`) signing with the hardened runtime enabled.
+         Ad-hoc signatures carry no Team ID, so library validation rejects every framework and native module in
+         the bundle and the app fails to launch. Disabling it is required for such builds to run at all — which
+         is why this template exists separately from `entitlements.mac.plist` and is never used for builds
+         signed with a real identity. -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+  </dict>
+</plist>

package/templates/entitlements.mac.plist

@@ -2,13 +2,16 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
-    <!-- https://github.com/electron/electron-notarize#prerequisites -->
+    <!-- V8 compiles JavaScript at runtime, so the main app needs the JIT exception under the hardened runtime.
+         Chromium grants nothing else to the browser process:
+         https://source.chromium.org/chromium/chromium/src/+/main:chrome/app/app-entitlements.plist
+
+         `com.apple.security.cs.allow-unsigned-executable-memory` and
+         `com.apple.security.cs.disable-library-validation` are deliberately NOT granted here — modern Electron
+         does not need them in the main process, and both materially weaken the hardened runtime. Add them to
+         your own `build/entitlements.mac.plist` only if you actually need them (for example, loading a
+         framework or native module signed by another team). -->
     <key>com.apple.security.cs.allow-jit</key>
     <true/>
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-    <true/>
-    <!-- https://github.com/electron-userland/electron-builder/issues/3940 -->
-    <key>com.apple.security.cs.disable-library-validation</key>
-    <true/>
   </dict>
 </plist>