From ffc185aa2d4c9f73aaa4646e25650775077b6a08 Mon Sep 17 00:00:00 2001 From: Yaojia Wang Date: Thu, 30 Jul 2026 08:27:25 +0200 Subject: [PATCH] fix(desktop): stop shipping node-gyp, which broke codesign MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm run dist:mac` failed at the signing step: codesign --timestamp .../node_modules/node-gyp/gyp/pylib/gyp/generator/\ __pycache__/make.cpython-313.pyc → "A timestamp was expected but was not found." node-gyp only COMPILES native modules. Nothing loads it at runtime — node-pty resolves its prebuilt .node directly, and a grep over the packaged tree finds no require of it outside the package itself. But it vendors a Python tree, and `npmRebuild: true` runs it and leaves __pycache__/*.pyc behind. Those got copied into Contents/Resources and codesign then tried to sign Python bytecode, which takes the entire build down. Excluding it removes both the dead weight (5 MB) and the failure surface. Also excludes **/__pycache__ outright, so no Python bytecode can reach the bundle by another route. Verified on a real build: signature verifies --strict, node-gyp absent, zero .pyc in the bundle, public/style.css and build/main.js byte-identical to the repo, express/ws/web-push/qrcode/google-auth-library all still resolve from the packaged tree, and node-pty's Electron-ABI pty.node is in place. Note: the immediate failure was transient — a plain retry of the same config succeeded (Apple's timestamp server). So this is the durable fix for a landmine that would otherwise re-arm on every npmRebuild, not the cause of that one run. Deviation from the one-worktree-per-session rule: the desktop build packages from desktop/node_modules and its script does `cd .. && npm run build`, so it can only be exercised in the main checkout. Committed on develop directly. --- desktop/electron-builder.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/desktop/electron-builder.yml b/desktop/electron-builder.yml index 8af4cff..de55da0 100644 --- a/desktop/electron-builder.yml +++ b/desktop/electron-builder.yml @@ -56,6 +56,15 @@ extraResources: - "!7zip-bin/**" - "!@electron/**" - "!@develar/**" + # node-gyp only COMPILES native modules; nothing loads it at runtime (node-pty + # resolves its prebuilt .node directly). It also ships a vendored Python tree, + # and `npmRebuild` leaves __pycache__/*.pyc behind in it — codesign then tries + # to sign those and fails with "A timestamp was expected but was not found", + # taking the whole build down. Excluding the package removes both the dead + # weight and the failure surface. + - "!node-gyp/**" + # Belt and braces: no Python bytecode anywhere in the shipped tree. + - "!**/__pycache__/**" # Rebuild native deps (node-pty) against the Electron ABI before packaging + copy. npmRebuild: true mac: