Skip to content

[codex] Guard desktop release signing#25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DragonnZhang merged 2 commits into from
Jun 10, 2026
Merged

[codex] Guard desktop release signing #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5ca3ff1
fix(desktop): remove duplicate app version setting
DragonnZhang Jun 8, 2026
568e47a
fix: guard desktop release signing
DragonnZhang Jun 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 76 additions & 8 deletions .github/workflows/desktop-release.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -46,6 +46,11 @@ on:
required: true
default: false
type: boolean
allow_unsigned_test_release:
description: "Allow unsigned macOS/Windows artifacts only for prerelease testing."
required: true
default: false
type: boolean
clobber:
description: "Replace same-named assets when uploading to an existing release."
required: true
Expand DownExpand Up@@ -281,11 +286,18 @@ jobs:
- name: Configure optional signing secrets
shell: bash
env:
IS_DRY_RUN: ${{ inputs.dry_run }}
APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
ALLOW_UNSIGNED_TEST_RELEASE: ${{ inputs.allow_unsigned_test_release }}
IS_PRERELEASE: ${{ inputs.prerelease }}
MAC_CSC_KEY_PASSWORD_SECRET: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
MAC_CSC_LINK_SECRET: ${{ secrets.MAC_CSC_LINK }}
CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
WIN_CSC_KEY_PASSWORD_SECRET: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
WIN_CSC_LINK_SECRET: ${{ secrets.WIN_CSC_LINK }}
SENTRY_ELECTRON_INGEST_URL_SECRET: ${{ secrets.SENTRY_ELECTRON_INGEST_URL }}
run: |
set -euo pipefail
Expand All@@ -305,15 +317,71 @@ jobs:
} >> "$GITHUB_ENV"
}

if [ -n "$CSC_LINK_SECRET" ]; then
append_env "CSC_LINK" "$CSC_LINK_SECRET"
append_env "CSC_KEY_PASSWORD" "$CSC_KEY_PASSWORD_SECRET"
append_env "APPLE_ID" "$APPLE_ID_SECRET"
append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
mac_csc_link="${MAC_CSC_LINK_SECRET:-$CSC_LINK_SECRET}"
mac_csc_key_password="${MAC_CSC_KEY_PASSWORD_SECRET:-$CSC_KEY_PASSWORD_SECRET}"

allow_unsigned_artifacts() {
if [ "$IS_DRY_RUN" = "true" ]; then
return 0
fi

if [ "$ALLOW_UNSIGNED_TEST_RELEASE" = "true" ] && [ "$IS_PRERELEASE" = "true" ]; then
return 0
fi

return 1
}

if [ "$RUNNER_OS" = "macOS" ]; then
if [ -n "$mac_csc_link" ]; then
if [ -z "$mac_csc_key_password" ]; then
echo "::error::MAC_CSC_LINK/CSC_LINK is configured, but MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD is missing."
exit 1
fi

append_env "CSC_LINK" "$mac_csc_link"
append_env "CSC_KEY_PASSWORD" "$mac_csc_key_password"
append_env "APPLE_ID" "$APPLE_ID_SECRET"
append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
else
if ! allow_unsigned_artifacts; then
echo "::error::Published macOS desktop releases require MAC_CSC_LINK/CSC_LINK and MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD so auto-update signature validation can pass."
exit 1
fi

if [ "$IS_DRY_RUN" = "false" ]; then
echo "::warning::Publishing an unsigned macOS prerelease for manual testing. Auto-update validation is not supported for this artifact."
fi

echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
fi
elif [ "$RUNNER_OS" = "Windows" ]; then
if [ -n "$WIN_CSC_LINK_SECRET" ]; then
if [ -z "$WIN_CSC_KEY_PASSWORD_SECRET" ]; then
echo "::error::WIN_CSC_LINK is configured, but WIN_CSC_KEY_PASSWORD is missing."
exit 1
fi

append_env "WIN_CSC_LINK" "$WIN_CSC_LINK_SECRET"
append_env "WIN_CSC_KEY_PASSWORD" "$WIN_CSC_KEY_PASSWORD_SECRET"
else
if ! allow_unsigned_artifacts; then
echo "::error::Published Windows desktop releases require WIN_CSC_LINK and WIN_CSC_KEY_PASSWORD."
exit 1
fi

if [ "$IS_DRY_RUN" = "false" ]; then
echo "::warning::Publishing an unsigned Windows prerelease for manual testing. Windows may show Unknown Publisher / SmartScreen warnings."
else
echo "Windows signing certificate is not configured; Windows dry-run artifacts will be unsigned."
fi
fi
else
echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
if [ "$RUNNER_OS" != "Linux" ] && [ -n "$CSC_LINK_SECRET" ]; then
echo "::warning::CSC_LINK is configured but not used on $RUNNER_OS."
fi
fi

append_env "SENTRY_ELECTRON_INGEST_URL" "$SENTRY_ELECTRON_INGEST_URL_SECRET"
Expand Down
44 changes: 44 additions & 0 deletions apps/electron/src/main/__tests__/auto-update-signature.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
import { describe, expect, it } from 'bun:test'

import {
getMacAppBundlePath,
parseMacCodeSignatureStatus,
} from '../auto-update-signature'

describe('auto-update-signature', () => {
it('maps an executable path back to the macOS app bundle', () => {
expect(getMacAppBundlePath('/Applications/OpenWork.app/Contents/MacOS/OpenWork'))
.toBe('/Applications/OpenWork.app')
})

it('rejects ad-hoc signatures because they pin updates to a cdhash', () => {
const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
'Signature=adhoc',
'TeamIdentifier=not set',
].join('\n'))

expect(status.trustedForAutoUpdate).toBe(false)
expect(status.reason).toBe('adhoc-signature')
})

it('rejects unsigned apps', () => {
const status = parseMacCodeSignatureStatus(
'/Applications/OpenWork.app',
1,
'/Applications/OpenWork.app: code object is not signed at all',
)

expect(status.trustedForAutoUpdate).toBe(false)
expect(status.reason).toBe('codesign-failed')
})

it('accepts signed apps with a TeamIdentifier', () => {
const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
'Authority=Developer ID Application: Example Inc (ABCDE12345)',
'TeamIdentifier=ABCDE12345',
].join('\n'))

expect(status.trustedForAutoUpdate).toBe(true)
expect(status.teamIdentifier).toBe('ABCDE12345')
})
})
75 changes: 75 additions & 0 deletions apps/electron/src/main/auto-update-signature.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
import { spawnSync } from 'child_process'
import * as path from 'path'

export interface MacCodeSignatureStatus {
trustedForAutoUpdate: boolean
appBundlePath: string
reason?: 'codesign-failed' | 'adhoc-signature' | 'missing-team-identifier'
signature?: string
teamIdentifier?: string
diagnostic?: string
}

function parseCodesignField(output: string, field: string): string | undefined {
const match = output.match(new RegExp(`^${field}=(.*)$`, 'm'))
return match?.[1]?.trim()
}

export function getMacAppBundlePath(executablePath: string): string {
return path.dirname(path.dirname(path.dirname(executablePath)))
}

export function parseMacCodeSignatureStatus(
appBundlePath: string,
exitStatus: number | null,
output: string,
): MacCodeSignatureStatus {
if (exitStatus !== 0) {
return {
trustedForAutoUpdate: false,
appBundlePath,
reason: 'codesign-failed',
diagnostic: output.trim(),
}
}

const signature = parseCodesignField(output, 'Signature')
const teamIdentifier = parseCodesignField(output, 'TeamIdentifier')

if (signature === 'adhoc') {
return {
trustedForAutoUpdate: false,
appBundlePath,
reason: 'adhoc-signature',
signature,
teamIdentifier,
}
}

if (!teamIdentifier || teamIdentifier === 'not set') {
return {
trustedForAutoUpdate: false,
appBundlePath,
reason: 'missing-team-identifier',
signature,
teamIdentifier,
}
}

return {
trustedForAutoUpdate: true,
appBundlePath,
signature,
teamIdentifier,
}
}

export function getCurrentMacCodeSignatureStatus(executablePath: string): MacCodeSignatureStatus {
const appBundlePath = getMacAppBundlePath(executablePath)
const result = spawnSync('/usr/bin/codesign', ['-d', '-vvv', appBundlePath], {
encoding: 'utf8',
})
const output = `${result.stdout ?? ''}${result.stderr ?? ''}`

return parseMacCodeSignatureStatus(appBundlePath, result.status, output)
}
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
[codex] Guard desktop release signing by DragonnZhang · Pull Request #25 · modelstudioai/openwork · GitHub
Skip to content
[codex] Guard desktop release signing#25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

DragonnZhang
merged 2 commits into

from

Jun 10, 2026
 Merged


[codex] Guard desktop release signing
#25
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
5ca3ff1

fix(desktop): remove duplicate app version setting


DragonnZhang Jun 8, 2026
568e47a

fix: guard desktop release signing


DragonnZhang Jun 10, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


84 changes: 76 additions & 8 deletions
.github/workflows/desktop-release.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,6 +46,11 @@ on:
 required: true
 default: false
 type: boolean
 allow_unsigned_test_release:
 description: "Allow unsigned macOS/Windows artifacts only for prerelease testing."
 required: true
 default: false
 type: boolean
 clobber:
 description: "Replace same-named assets when uploading to an existing release."
 required: true
Expand DownExpand Up@@ -281,11 +286,18 @@ jobs:
 - name: Configure optional signing secrets
 shell: bash
 env:
 IS_DRY_RUN: ${{ inputs.dry_run }}
 APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
 APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
 APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
 ALLOW_UNSIGNED_TEST_RELEASE: ${{ inputs.allow_unsigned_test_release }}
 IS_PRERELEASE: ${{ inputs.prerelease }}
 MAC_CSC_KEY_PASSWORD_SECRET: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
 MAC_CSC_LINK_SECRET: ${{ secrets.MAC_CSC_LINK }}
 CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
 CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
 WIN_CSC_KEY_PASSWORD_SECRET: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
 WIN_CSC_LINK_SECRET: ${{ secrets.WIN_CSC_LINK }}
 SENTRY_ELECTRON_INGEST_URL_SECRET: ${{ secrets.SENTRY_ELECTRON_INGEST_URL }}
 run: |
 set -euo pipefail
Expand All@@ -305,15 +317,71 @@ jobs:
 } >> "$GITHUB_ENV"
 }

 if [ -n "$CSC_LINK_SECRET" ]; then
 append_env "CSC_LINK" "$CSC_LINK_SECRET"
 append_env "CSC_KEY_PASSWORD" "$CSC_KEY_PASSWORD_SECRET"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 mac_csc_link="${MAC_CSC_LINK_SECRET:-$CSC_LINK_SECRET}"
 mac_csc_key_password="${MAC_CSC_KEY_PASSWORD_SECRET:-$CSC_KEY_PASSWORD_SECRET}"

 allow_unsigned_artifacts() {
 if [ "$IS_DRY_RUN" = "true" ]; then
 return 0
 fi

 if [ "$ALLOW_UNSIGNED_TEST_RELEASE" = "true" ] && [ "$IS_PRERELEASE" = "true" ]; then
 return 0
 fi

 return 1
 }

 if [ "$RUNNER_OS" = "macOS" ]; then
 if [ -n "$mac_csc_link" ]; then
 if [ -z "$mac_csc_key_password" ]; then
 echo "::error::MAC_CSC_LINK/CSC_LINK is configured, but MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "CSC_LINK" "$mac_csc_link"
 append_env "CSC_KEY_PASSWORD" "$mac_csc_key_password"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published macOS desktop releases require MAC_CSC_LINK/CSC_LINK and MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD so auto-update signature validation can pass."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned macOS prerelease for manual testing. Auto-update validation is not supported for this artifact."
 fi

 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 fi
 elif [ "$RUNNER_OS" = "Windows" ]; then
 if [ -n "$WIN_CSC_LINK_SECRET" ]; then
 if [ -z "$WIN_CSC_KEY_PASSWORD_SECRET" ]; then
 echo "::error::WIN_CSC_LINK is configured, but WIN_CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "WIN_CSC_LINK" "$WIN_CSC_LINK_SECRET"
 append_env "WIN_CSC_KEY_PASSWORD" "$WIN_CSC_KEY_PASSWORD_SECRET"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published Windows desktop releases require WIN_CSC_LINK and WIN_CSC_KEY_PASSWORD."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned Windows prerelease for manual testing. Windows may show Unknown Publisher / SmartScreen warnings."
 else
 echo "Windows signing certificate is not configured; Windows dry-run artifacts will be unsigned."
 fi
 fi
 else
 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 if [ "$RUNNER_OS" != "Linux" ] && [ -n "$CSC_LINK_SECRET" ]; then
 echo "::warning::CSC_LINK is configured but not used on $RUNNER_OS."
 fi
 fi

 append_env "SENTRY_ELECTRON_INGEST_URL" "$SENTRY_ELECTRON_INGEST_URL_SECRET"
Expand Down

44 changes: 44 additions & 0 deletions
apps/electron/src/main/__tests__/auto-update-signature.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
import { describe, expect, it } from 'bun:test'

import {
 getMacAppBundlePath,
 parseMacCodeSignatureStatus,
} from '../auto-update-signature'

describe('auto-update-signature', () => {
 it('maps an executable path back to the macOS app bundle', () => {
 expect(getMacAppBundlePath('/Applications/OpenWork.app/Contents/MacOS/OpenWork'))
 .toBe('/Applications/OpenWork.app')
 })

 it('rejects ad-hoc signatures because they pin updates to a cdhash', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Signature=adhoc',
 'TeamIdentifier=not set',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('adhoc-signature')
 })

 it('rejects unsigned apps', () => {
 const status = parseMacCodeSignatureStatus(
 '/Applications/OpenWork.app',
 1,
 '/Applications/OpenWork.app: code object is not signed at all',
 )

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('codesign-failed')
 })

 it('accepts signed apps with a TeamIdentifier', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Authority=Developer ID Application: Example Inc (ABCDE12345)',
 'TeamIdentifier=ABCDE12345',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(true)
 expect(status.teamIdentifier).toBe('ABCDE12345')
 })
})

75 changes: 75 additions & 0 deletions
apps/electron/src/main/auto-update-signature.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
import { spawnSync } from 'child_process'
import * as path from 'path'

export interface MacCodeSignatureStatus {
 trustedForAutoUpdate: boolean
 appBundlePath: string
 reason?: 'codesign-failed' | 'adhoc-signature' | 'missing-team-identifier'
 signature?: string
 teamIdentifier?: string
 diagnostic?: string
}

function parseCodesignField(output: string, field: string): string | undefined {
 const match = output.match(new RegExp(`^${field}=(.*)$`, 'm'))
 return match?.[1]?.trim()
}

export function getMacAppBundlePath(executablePath: string): string {
 return path.dirname(path.dirname(path.dirname(executablePath)))
}

export function parseMacCodeSignatureStatus(
 appBundlePath: string,
 exitStatus: number | null,
 output: string,
): MacCodeSignatureStatus {
 if (exitStatus !== 0) {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'codesign-failed',
 diagnostic: output.trim(),
 }
 }

 const signature = parseCodesignField(output, 'Signature')
 const teamIdentifier = parseCodesignField(output, 'TeamIdentifier')

 if (signature === 'adhoc') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'adhoc-signature',
 signature,
 teamIdentifier,
 }
 }

 if (!teamIdentifier || teamIdentifier === 'not set') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'missing-team-identifier',
 signature,
 teamIdentifier,
 }
 }

 return {
 trustedForAutoUpdate: true,
 appBundlePath,
 signature,
 teamIdentifier,
 }
}

export function getCurrentMacCodeSignatureStatus(executablePath: string): MacCodeSignatureStatus {
 const appBundlePath = getMacAppBundlePath(executablePath)
 const result = spawnSync('/usr/bin/codesign', ['-d', '-vvv', appBundlePath], {
 encoding: 'utf8',
 })
 const output = `${result.stdout ?? ''}${result.stderr ?? ''}`

 return parseMacCodeSignatureStatus(appBundlePath, result.status, output)
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
[codex] Guard desktop release signing by DragonnZhang · Pull Request #25 · modelstudioai/openwork · GitHub
Skip to content
[codex] Guard desktop release signing#25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

DragonnZhang
merged 2 commits into

from

Jun 10, 2026
 Merged


[codex] Guard desktop release signing
#25
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
5ca3ff1

fix(desktop): remove duplicate app version setting


DragonnZhang Jun 8, 2026
568e47a

fix: guard desktop release signing


DragonnZhang Jun 10, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


84 changes: 76 additions & 8 deletions
.github/workflows/desktop-release.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,6 +46,11 @@ on:
 required: true
 default: false
 type: boolean
 allow_unsigned_test_release:
 description: "Allow unsigned macOS/Windows artifacts only for prerelease testing."
 required: true
 default: false
 type: boolean
 clobber:
 description: "Replace same-named assets when uploading to an existing release."
 required: true
Expand DownExpand Up@@ -281,11 +286,18 @@ jobs:
 - name: Configure optional signing secrets
 shell: bash
 env:
 IS_DRY_RUN: ${{ inputs.dry_run }}
 APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
 APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
 APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
 ALLOW_UNSIGNED_TEST_RELEASE: ${{ inputs.allow_unsigned_test_release }}
 IS_PRERELEASE: ${{ inputs.prerelease }}
 MAC_CSC_KEY_PASSWORD_SECRET: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
 MAC_CSC_LINK_SECRET: ${{ secrets.MAC_CSC_LINK }}
 CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
 CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
 WIN_CSC_KEY_PASSWORD_SECRET: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
 WIN_CSC_LINK_SECRET: ${{ secrets.WIN_CSC_LINK }}
 SENTRY_ELECTRON_INGEST_URL_SECRET: ${{ secrets.SENTRY_ELECTRON_INGEST_URL }}
 run: |
 set -euo pipefail
Expand All@@ -305,15 +317,71 @@ jobs:
 } >> "$GITHUB_ENV"
 }

 if [ -n "$CSC_LINK_SECRET" ]; then
 append_env "CSC_LINK" "$CSC_LINK_SECRET"
 append_env "CSC_KEY_PASSWORD" "$CSC_KEY_PASSWORD_SECRET"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 mac_csc_link="${MAC_CSC_LINK_SECRET:-$CSC_LINK_SECRET}"
 mac_csc_key_password="${MAC_CSC_KEY_PASSWORD_SECRET:-$CSC_KEY_PASSWORD_SECRET}"

 allow_unsigned_artifacts() {
 if [ "$IS_DRY_RUN" = "true" ]; then
 return 0
 fi

 if [ "$ALLOW_UNSIGNED_TEST_RELEASE" = "true" ] && [ "$IS_PRERELEASE" = "true" ]; then
 return 0
 fi

 return 1
 }

 if [ "$RUNNER_OS" = "macOS" ]; then
 if [ -n "$mac_csc_link" ]; then
 if [ -z "$mac_csc_key_password" ]; then
 echo "::error::MAC_CSC_LINK/CSC_LINK is configured, but MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "CSC_LINK" "$mac_csc_link"
 append_env "CSC_KEY_PASSWORD" "$mac_csc_key_password"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published macOS desktop releases require MAC_CSC_LINK/CSC_LINK and MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD so auto-update signature validation can pass."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned macOS prerelease for manual testing. Auto-update validation is not supported for this artifact."
 fi

 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 fi
 elif [ "$RUNNER_OS" = "Windows" ]; then
 if [ -n "$WIN_CSC_LINK_SECRET" ]; then
 if [ -z "$WIN_CSC_KEY_PASSWORD_SECRET" ]; then
 echo "::error::WIN_CSC_LINK is configured, but WIN_CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "WIN_CSC_LINK" "$WIN_CSC_LINK_SECRET"
 append_env "WIN_CSC_KEY_PASSWORD" "$WIN_CSC_KEY_PASSWORD_SECRET"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published Windows desktop releases require WIN_CSC_LINK and WIN_CSC_KEY_PASSWORD."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned Windows prerelease for manual testing. Windows may show Unknown Publisher / SmartScreen warnings."
 else
 echo "Windows signing certificate is not configured; Windows dry-run artifacts will be unsigned."
 fi
 fi
 else
 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 if [ "$RUNNER_OS" != "Linux" ] && [ -n "$CSC_LINK_SECRET" ]; then
 echo "::warning::CSC_LINK is configured but not used on $RUNNER_OS."
 fi
 fi

 append_env "SENTRY_ELECTRON_INGEST_URL" "$SENTRY_ELECTRON_INGEST_URL_SECRET"
Expand Down

44 changes: 44 additions & 0 deletions
apps/electron/src/main/__tests__/auto-update-signature.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
import { describe, expect, it } from 'bun:test'

import {
 getMacAppBundlePath,
 parseMacCodeSignatureStatus,
} from '../auto-update-signature'

describe('auto-update-signature', () => {
 it('maps an executable path back to the macOS app bundle', () => {
 expect(getMacAppBundlePath('/Applications/OpenWork.app/Contents/MacOS/OpenWork'))
 .toBe('/Applications/OpenWork.app')
 })

 it('rejects ad-hoc signatures because they pin updates to a cdhash', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Signature=adhoc',
 'TeamIdentifier=not set',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('adhoc-signature')
 })

 it('rejects unsigned apps', () => {
 const status = parseMacCodeSignatureStatus(
 '/Applications/OpenWork.app',
 1,
 '/Applications/OpenWork.app: code object is not signed at all',
 )

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('codesign-failed')
 })

 it('accepts signed apps with a TeamIdentifier', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Authority=Developer ID Application: Example Inc (ABCDE12345)',
 'TeamIdentifier=ABCDE12345',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(true)
 expect(status.teamIdentifier).toBe('ABCDE12345')
 })
})

75 changes: 75 additions & 0 deletions
apps/electron/src/main/auto-update-signature.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
import { spawnSync } from 'child_process'
import * as path from 'path'

export interface MacCodeSignatureStatus {
 trustedForAutoUpdate: boolean
 appBundlePath: string
 reason?: 'codesign-failed' | 'adhoc-signature' | 'missing-team-identifier'
 signature?: string
 teamIdentifier?: string
 diagnostic?: string
}

function parseCodesignField(output: string, field: string): string | undefined {
 const match = output.match(new RegExp(`^${field}=(.*)$`, 'm'))
 return match?.[1]?.trim()
}

export function getMacAppBundlePath(executablePath: string): string {
 return path.dirname(path.dirname(path.dirname(executablePath)))
}

export function parseMacCodeSignatureStatus(
 appBundlePath: string,
 exitStatus: number | null,
 output: string,
): MacCodeSignatureStatus {
 if (exitStatus !== 0) {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'codesign-failed',
 diagnostic: output.trim(),
 }
 }

 const signature = parseCodesignField(output, 'Signature')
 const teamIdentifier = parseCodesignField(output, 'TeamIdentifier')

 if (signature === 'adhoc') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'adhoc-signature',
 signature,
 teamIdentifier,
 }
 }

 if (!teamIdentifier || teamIdentifier === 'not set') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'missing-team-identifier',
 signature,
 teamIdentifier,
 }
 }

 return {
 trustedForAutoUpdate: true,
 appBundlePath,
 signature,
 teamIdentifier,
 }
}

export function getCurrentMacCodeSignatureStatus(executablePath: string): MacCodeSignatureStatus {
 const appBundlePath = getMacAppBundlePath(executablePath)
 const result = spawnSync('/usr/bin/codesign', ['-d', '-vvv', appBundlePath], {
 encoding: 'utf8',
 })
 const output = `${result.stdout ?? ''}${result.stderr ?? ''}`

 return parseMacCodeSignatureStatus(appBundlePath, result.status, output)
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
[codex] Guard desktop release signing by DragonnZhang · Pull Request #25 · modelstudioai/openwork · GitHub
Skip to content
[codex] Guard desktop release signing#25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

DragonnZhang
merged 2 commits into

from

Jun 10, 2026
 Merged


[codex] Guard desktop release signing
#25
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
5ca3ff1

fix(desktop): remove duplicate app version setting


DragonnZhang Jun 8, 2026
568e47a

fix: guard desktop release signing


DragonnZhang Jun 10, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


84 changes: 76 additions & 8 deletions
.github/workflows/desktop-release.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,6 +46,11 @@ on:
 required: true
 default: false
 type: boolean
 allow_unsigned_test_release:
 description: "Allow unsigned macOS/Windows artifacts only for prerelease testing."
 required: true
 default: false
 type: boolean
 clobber:
 description: "Replace same-named assets when uploading to an existing release."
 required: true
Expand DownExpand Up@@ -281,11 +286,18 @@ jobs:
 - name: Configure optional signing secrets
 shell: bash
 env:
 IS_DRY_RUN: ${{ inputs.dry_run }}
 APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
 APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
 APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
 ALLOW_UNSIGNED_TEST_RELEASE: ${{ inputs.allow_unsigned_test_release }}
 IS_PRERELEASE: ${{ inputs.prerelease }}
 MAC_CSC_KEY_PASSWORD_SECRET: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
 MAC_CSC_LINK_SECRET: ${{ secrets.MAC_CSC_LINK }}
 CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
 CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
 WIN_CSC_KEY_PASSWORD_SECRET: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
 WIN_CSC_LINK_SECRET: ${{ secrets.WIN_CSC_LINK }}
 SENTRY_ELECTRON_INGEST_URL_SECRET: ${{ secrets.SENTRY_ELECTRON_INGEST_URL }}
 run: |
 set -euo pipefail
Expand All@@ -305,15 +317,71 @@ jobs:
 } >> "$GITHUB_ENV"
 }

 if [ -n "$CSC_LINK_SECRET" ]; then
 append_env "CSC_LINK" "$CSC_LINK_SECRET"
 append_env "CSC_KEY_PASSWORD" "$CSC_KEY_PASSWORD_SECRET"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 mac_csc_link="${MAC_CSC_LINK_SECRET:-$CSC_LINK_SECRET}"
 mac_csc_key_password="${MAC_CSC_KEY_PASSWORD_SECRET:-$CSC_KEY_PASSWORD_SECRET}"

 allow_unsigned_artifacts() {
 if [ "$IS_DRY_RUN" = "true" ]; then
 return 0
 fi

 if [ "$ALLOW_UNSIGNED_TEST_RELEASE" = "true" ] && [ "$IS_PRERELEASE" = "true" ]; then
 return 0
 fi

 return 1
 }

 if [ "$RUNNER_OS" = "macOS" ]; then
 if [ -n "$mac_csc_link" ]; then
 if [ -z "$mac_csc_key_password" ]; then
 echo "::error::MAC_CSC_LINK/CSC_LINK is configured, but MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "CSC_LINK" "$mac_csc_link"
 append_env "CSC_KEY_PASSWORD" "$mac_csc_key_password"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published macOS desktop releases require MAC_CSC_LINK/CSC_LINK and MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD so auto-update signature validation can pass."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned macOS prerelease for manual testing. Auto-update validation is not supported for this artifact."
 fi

 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 fi
 elif [ "$RUNNER_OS" = "Windows" ]; then
 if [ -n "$WIN_CSC_LINK_SECRET" ]; then
 if [ -z "$WIN_CSC_KEY_PASSWORD_SECRET" ]; then
 echo "::error::WIN_CSC_LINK is configured, but WIN_CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "WIN_CSC_LINK" "$WIN_CSC_LINK_SECRET"
 append_env "WIN_CSC_KEY_PASSWORD" "$WIN_CSC_KEY_PASSWORD_SECRET"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published Windows desktop releases require WIN_CSC_LINK and WIN_CSC_KEY_PASSWORD."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned Windows prerelease for manual testing. Windows may show Unknown Publisher / SmartScreen warnings."
 else
 echo "Windows signing certificate is not configured; Windows dry-run artifacts will be unsigned."
 fi
 fi
 else
 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 if [ "$RUNNER_OS" != "Linux" ] && [ -n "$CSC_LINK_SECRET" ]; then
 echo "::warning::CSC_LINK is configured but not used on $RUNNER_OS."
 fi
 fi

 append_env "SENTRY_ELECTRON_INGEST_URL" "$SENTRY_ELECTRON_INGEST_URL_SECRET"
Expand Down

44 changes: 44 additions & 0 deletions
apps/electron/src/main/__tests__/auto-update-signature.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
import { describe, expect, it } from 'bun:test'

import {
 getMacAppBundlePath,
 parseMacCodeSignatureStatus,
} from '../auto-update-signature'

describe('auto-update-signature', () => {
 it('maps an executable path back to the macOS app bundle', () => {
 expect(getMacAppBundlePath('/Applications/OpenWork.app/Contents/MacOS/OpenWork'))
 .toBe('/Applications/OpenWork.app')
 })

 it('rejects ad-hoc signatures because they pin updates to a cdhash', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Signature=adhoc',
 'TeamIdentifier=not set',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('adhoc-signature')
 })

 it('rejects unsigned apps', () => {
 const status = parseMacCodeSignatureStatus(
 '/Applications/OpenWork.app',
 1,
 '/Applications/OpenWork.app: code object is not signed at all',
 )

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('codesign-failed')
 })

 it('accepts signed apps with a TeamIdentifier', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Authority=Developer ID Application: Example Inc (ABCDE12345)',
 'TeamIdentifier=ABCDE12345',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(true)
 expect(status.teamIdentifier).toBe('ABCDE12345')
 })
})

75 changes: 75 additions & 0 deletions
apps/electron/src/main/auto-update-signature.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
import { spawnSync } from 'child_process'
import * as path from 'path'

export interface MacCodeSignatureStatus {
 trustedForAutoUpdate: boolean
 appBundlePath: string
 reason?: 'codesign-failed' | 'adhoc-signature' | 'missing-team-identifier'
 signature?: string
 teamIdentifier?: string
 diagnostic?: string
}

function parseCodesignField(output: string, field: string): string | undefined {
 const match = output.match(new RegExp(`^${field}=(.*)$`, 'm'))
 return match?.[1]?.trim()
}

export function getMacAppBundlePath(executablePath: string): string {
 return path.dirname(path.dirname(path.dirname(executablePath)))
}

export function parseMacCodeSignatureStatus(
 appBundlePath: string,
 exitStatus: number | null,
 output: string,
): MacCodeSignatureStatus {
 if (exitStatus !== 0) {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'codesign-failed',
 diagnostic: output.trim(),
 }
 }

 const signature = parseCodesignField(output, 'Signature')
 const teamIdentifier = parseCodesignField(output, 'TeamIdentifier')

 if (signature === 'adhoc') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'adhoc-signature',
 signature,
 teamIdentifier,
 }
 }

 if (!teamIdentifier || teamIdentifier === 'not set') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'missing-team-identifier',
 signature,
 teamIdentifier,
 }
 }

 return {
 trustedForAutoUpdate: true,
 appBundlePath,
 signature,
 teamIdentifier,
 }
}

export function getCurrentMacCodeSignatureStatus(executablePath: string): MacCodeSignatureStatus {
 const appBundlePath = getMacAppBundlePath(executablePath)
 const result = spawnSync('/usr/bin/codesign', ['-d', '-vvv', appBundlePath], {
 encoding: 'utf8',
 })
 const output = `${result.stdout ?? ''}${result.stderr ?? ''}`

 return parseMacCodeSignatureStatus(appBundlePath, result.status, output)
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
[codex] Guard desktop release signing by DragonnZhang · Pull Request #25 · modelstudioai/openwork · GitHub
Skip to content
[codex] Guard desktop release signing#25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

DragonnZhang
merged 2 commits into

from

Jun 10, 2026
 Merged


[codex] Guard desktop release signing
#25
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
5ca3ff1

fix(desktop): remove duplicate app version setting


DragonnZhang Jun 8, 2026
568e47a

fix: guard desktop release signing


DragonnZhang Jun 10, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


84 changes: 76 additions & 8 deletions
.github/workflows/desktop-release.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,6 +46,11 @@ on:
 required: true
 default: false
 type: boolean
 allow_unsigned_test_release:
 description: "Allow unsigned macOS/Windows artifacts only for prerelease testing."
 required: true
 default: false
 type: boolean
 clobber:
 description: "Replace same-named assets when uploading to an existing release."
 required: true
Expand DownExpand Up@@ -281,11 +286,18 @@ jobs:
 - name: Configure optional signing secrets
 shell: bash
 env:
 IS_DRY_RUN: ${{ inputs.dry_run }}
 APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
 APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
 APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
 ALLOW_UNSIGNED_TEST_RELEASE: ${{ inputs.allow_unsigned_test_release }}
 IS_PRERELEASE: ${{ inputs.prerelease }}
 MAC_CSC_KEY_PASSWORD_SECRET: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
 MAC_CSC_LINK_SECRET: ${{ secrets.MAC_CSC_LINK }}
 CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
 CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
 WIN_CSC_KEY_PASSWORD_SECRET: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
 WIN_CSC_LINK_SECRET: ${{ secrets.WIN_CSC_LINK }}
 SENTRY_ELECTRON_INGEST_URL_SECRET: ${{ secrets.SENTRY_ELECTRON_INGEST_URL }}
 run: |
 set -euo pipefail
Expand All@@ -305,15 +317,71 @@ jobs:
 } >> "$GITHUB_ENV"
 }

 if [ -n "$CSC_LINK_SECRET" ]; then
 append_env "CSC_LINK" "$CSC_LINK_SECRET"
 append_env "CSC_KEY_PASSWORD" "$CSC_KEY_PASSWORD_SECRET"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 mac_csc_link="${MAC_CSC_LINK_SECRET:-$CSC_LINK_SECRET}"
 mac_csc_key_password="${MAC_CSC_KEY_PASSWORD_SECRET:-$CSC_KEY_PASSWORD_SECRET}"

 allow_unsigned_artifacts() {
 if [ "$IS_DRY_RUN" = "true" ]; then
 return 0
 fi

 if [ "$ALLOW_UNSIGNED_TEST_RELEASE" = "true" ] && [ "$IS_PRERELEASE" = "true" ]; then
 return 0
 fi

 return 1
 }

 if [ "$RUNNER_OS" = "macOS" ]; then
 if [ -n "$mac_csc_link" ]; then
 if [ -z "$mac_csc_key_password" ]; then
 echo "::error::MAC_CSC_LINK/CSC_LINK is configured, but MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "CSC_LINK" "$mac_csc_link"
 append_env "CSC_KEY_PASSWORD" "$mac_csc_key_password"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published macOS desktop releases require MAC_CSC_LINK/CSC_LINK and MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD so auto-update signature validation can pass."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned macOS prerelease for manual testing. Auto-update validation is not supported for this artifact."
 fi

 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 fi
 elif [ "$RUNNER_OS" = "Windows" ]; then
 if [ -n "$WIN_CSC_LINK_SECRET" ]; then
 if [ -z "$WIN_CSC_KEY_PASSWORD_SECRET" ]; then
 echo "::error::WIN_CSC_LINK is configured, but WIN_CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "WIN_CSC_LINK" "$WIN_CSC_LINK_SECRET"
 append_env "WIN_CSC_KEY_PASSWORD" "$WIN_CSC_KEY_PASSWORD_SECRET"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published Windows desktop releases require WIN_CSC_LINK and WIN_CSC_KEY_PASSWORD."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned Windows prerelease for manual testing. Windows may show Unknown Publisher / SmartScreen warnings."
 else
 echo "Windows signing certificate is not configured; Windows dry-run artifacts will be unsigned."
 fi
 fi
 else
 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 if [ "$RUNNER_OS" != "Linux" ] && [ -n "$CSC_LINK_SECRET" ]; then
 echo "::warning::CSC_LINK is configured but not used on $RUNNER_OS."
 fi
 fi

 append_env "SENTRY_ELECTRON_INGEST_URL" "$SENTRY_ELECTRON_INGEST_URL_SECRET"
Expand Down

44 changes: 44 additions & 0 deletions
apps/electron/src/main/__tests__/auto-update-signature.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
import { describe, expect, it } from 'bun:test'

import {
 getMacAppBundlePath,
 parseMacCodeSignatureStatus,
} from '../auto-update-signature'

describe('auto-update-signature', () => {
 it('maps an executable path back to the macOS app bundle', () => {
 expect(getMacAppBundlePath('/Applications/OpenWork.app/Contents/MacOS/OpenWork'))
 .toBe('/Applications/OpenWork.app')
 })

 it('rejects ad-hoc signatures because they pin updates to a cdhash', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Signature=adhoc',
 'TeamIdentifier=not set',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('adhoc-signature')
 })

 it('rejects unsigned apps', () => {
 const status = parseMacCodeSignatureStatus(
 '/Applications/OpenWork.app',
 1,
 '/Applications/OpenWork.app: code object is not signed at all',
 )

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('codesign-failed')
 })

 it('accepts signed apps with a TeamIdentifier', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Authority=Developer ID Application: Example Inc (ABCDE12345)',
 'TeamIdentifier=ABCDE12345',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(true)
 expect(status.teamIdentifier).toBe('ABCDE12345')
 })
})

75 changes: 75 additions & 0 deletions
apps/electron/src/main/auto-update-signature.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
import { spawnSync } from 'child_process'
import * as path from 'path'

export interface MacCodeSignatureStatus {
 trustedForAutoUpdate: boolean
 appBundlePath: string
 reason?: 'codesign-failed' | 'adhoc-signature' | 'missing-team-identifier'
 signature?: string
 teamIdentifier?: string
 diagnostic?: string
}

function parseCodesignField(output: string, field: string): string | undefined {
 const match = output.match(new RegExp(`^${field}=(.*)$`, 'm'))
 return match?.[1]?.trim()
}

export function getMacAppBundlePath(executablePath: string): string {
 return path.dirname(path.dirname(path.dirname(executablePath)))
}

export function parseMacCodeSignatureStatus(
 appBundlePath: string,
 exitStatus: number | null,
 output: string,
): MacCodeSignatureStatus {
 if (exitStatus !== 0) {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'codesign-failed',
 diagnostic: output.trim(),
 }
 }

 const signature = parseCodesignField(output, 'Signature')
 const teamIdentifier = parseCodesignField(output, 'TeamIdentifier')

 if (signature === 'adhoc') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'adhoc-signature',
 signature,
 teamIdentifier,
 }
 }

 if (!teamIdentifier || teamIdentifier === 'not set') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'missing-team-identifier',
 signature,
 teamIdentifier,
 }
 }

 return {
 trustedForAutoUpdate: true,
 appBundlePath,
 signature,
 teamIdentifier,
 }
}

export function getCurrentMacCodeSignatureStatus(executablePath: string): MacCodeSignatureStatus {
 const appBundlePath = getMacAppBundlePath(executablePath)
 const result = spawnSync('/usr/bin/codesign', ['-d', '-vvv', appBundlePath], {
 encoding: 'utf8',
 })
 const output = `${result.stdout ?? ''}${result.stderr ?? ''}`

 return parseMacCodeSignatureStatus(appBundlePath, result.status, output)
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
[codex] Guard desktop release signing by DragonnZhang · Pull Request #25 · modelstudioai/openwork · GitHub
Skip to content
[codex] Guard desktop release signing#25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

DragonnZhang
merged 2 commits into

from

Jun 10, 2026
 Merged


[codex] Guard desktop release signing
#25
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
5ca3ff1

fix(desktop): remove duplicate app version setting


DragonnZhang Jun 8, 2026
568e47a

fix: guard desktop release signing


DragonnZhang Jun 10, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


84 changes: 76 additions & 8 deletions
.github/workflows/desktop-release.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,6 +46,11 @@ on:
 required: true
 default: false
 type: boolean
 allow_unsigned_test_release:
 description: "Allow unsigned macOS/Windows artifacts only for prerelease testing."
 required: true
 default: false
 type: boolean
 clobber:
 description: "Replace same-named assets when uploading to an existing release."
 required: true
Expand DownExpand Up@@ -281,11 +286,18 @@ jobs:
 - name: Configure optional signing secrets
 shell: bash
 env:
 IS_DRY_RUN: ${{ inputs.dry_run }}
 APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
 APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
 APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
 ALLOW_UNSIGNED_TEST_RELEASE: ${{ inputs.allow_unsigned_test_release }}
 IS_PRERELEASE: ${{ inputs.prerelease }}
 MAC_CSC_KEY_PASSWORD_SECRET: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
 MAC_CSC_LINK_SECRET: ${{ secrets.MAC_CSC_LINK }}
 CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
 CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
 WIN_CSC_KEY_PASSWORD_SECRET: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
 WIN_CSC_LINK_SECRET: ${{ secrets.WIN_CSC_LINK }}
 SENTRY_ELECTRON_INGEST_URL_SECRET: ${{ secrets.SENTRY_ELECTRON_INGEST_URL }}
 run: |
 set -euo pipefail
Expand All@@ -305,15 +317,71 @@ jobs:
 } >> "$GITHUB_ENV"
 }

 if [ -n "$CSC_LINK_SECRET" ]; then
 append_env "CSC_LINK" "$CSC_LINK_SECRET"
 append_env "CSC_KEY_PASSWORD" "$CSC_KEY_PASSWORD_SECRET"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 mac_csc_link="${MAC_CSC_LINK_SECRET:-$CSC_LINK_SECRET}"
 mac_csc_key_password="${MAC_CSC_KEY_PASSWORD_SECRET:-$CSC_KEY_PASSWORD_SECRET}"

 allow_unsigned_artifacts() {
 if [ "$IS_DRY_RUN" = "true" ]; then
 return 0
 fi

 if [ "$ALLOW_UNSIGNED_TEST_RELEASE" = "true" ] && [ "$IS_PRERELEASE" = "true" ]; then
 return 0
 fi

 return 1
 }

 if [ "$RUNNER_OS" = "macOS" ]; then
 if [ -n "$mac_csc_link" ]; then
 if [ -z "$mac_csc_key_password" ]; then
 echo "::error::MAC_CSC_LINK/CSC_LINK is configured, but MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "CSC_LINK" "$mac_csc_link"
 append_env "CSC_KEY_PASSWORD" "$mac_csc_key_password"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published macOS desktop releases require MAC_CSC_LINK/CSC_LINK and MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD so auto-update signature validation can pass."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned macOS prerelease for manual testing. Auto-update validation is not supported for this artifact."
 fi

 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 fi
 elif [ "$RUNNER_OS" = "Windows" ]; then
 if [ -n "$WIN_CSC_LINK_SECRET" ]; then
 if [ -z "$WIN_CSC_KEY_PASSWORD_SECRET" ]; then
 echo "::error::WIN_CSC_LINK is configured, but WIN_CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "WIN_CSC_LINK" "$WIN_CSC_LINK_SECRET"
 append_env "WIN_CSC_KEY_PASSWORD" "$WIN_CSC_KEY_PASSWORD_SECRET"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published Windows desktop releases require WIN_CSC_LINK and WIN_CSC_KEY_PASSWORD."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned Windows prerelease for manual testing. Windows may show Unknown Publisher / SmartScreen warnings."
 else
 echo "Windows signing certificate is not configured; Windows dry-run artifacts will be unsigned."
 fi
 fi
 else
 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 if [ "$RUNNER_OS" != "Linux" ] && [ -n "$CSC_LINK_SECRET" ]; then
 echo "::warning::CSC_LINK is configured but not used on $RUNNER_OS."
 fi
 fi

 append_env "SENTRY_ELECTRON_INGEST_URL" "$SENTRY_ELECTRON_INGEST_URL_SECRET"
Expand Down

44 changes: 44 additions & 0 deletions
apps/electron/src/main/__tests__/auto-update-signature.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
import { describe, expect, it } from 'bun:test'

import {
 getMacAppBundlePath,
 parseMacCodeSignatureStatus,
} from '../auto-update-signature'

describe('auto-update-signature', () => {
 it('maps an executable path back to the macOS app bundle', () => {
 expect(getMacAppBundlePath('/Applications/OpenWork.app/Contents/MacOS/OpenWork'))
 .toBe('/Applications/OpenWork.app')
 })

 it('rejects ad-hoc signatures because they pin updates to a cdhash', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Signature=adhoc',
 'TeamIdentifier=not set',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('adhoc-signature')
 })

 it('rejects unsigned apps', () => {
 const status = parseMacCodeSignatureStatus(
 '/Applications/OpenWork.app',
 1,
 '/Applications/OpenWork.app: code object is not signed at all',
 )

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('codesign-failed')
 })

 it('accepts signed apps with a TeamIdentifier', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Authority=Developer ID Application: Example Inc (ABCDE12345)',
 'TeamIdentifier=ABCDE12345',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(true)
 expect(status.teamIdentifier).toBe('ABCDE12345')
 })
})

75 changes: 75 additions & 0 deletions
apps/electron/src/main/auto-update-signature.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
import { spawnSync } from 'child_process'
import * as path from 'path'

export interface MacCodeSignatureStatus {
 trustedForAutoUpdate: boolean
 appBundlePath: string
 reason?: 'codesign-failed' | 'adhoc-signature' | 'missing-team-identifier'
 signature?: string
 teamIdentifier?: string
 diagnostic?: string
}

function parseCodesignField(output: string, field: string): string | undefined {
 const match = output.match(new RegExp(`^${field}=(.*)$`, 'm'))
 return match?.[1]?.trim()
}

export function getMacAppBundlePath(executablePath: string): string {
 return path.dirname(path.dirname(path.dirname(executablePath)))
}

export function parseMacCodeSignatureStatus(
 appBundlePath: string,
 exitStatus: number | null,
 output: string,
): MacCodeSignatureStatus {
 if (exitStatus !== 0) {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'codesign-failed',
 diagnostic: output.trim(),
 }
 }

 const signature = parseCodesignField(output, 'Signature')
 const teamIdentifier = parseCodesignField(output, 'TeamIdentifier')

 if (signature === 'adhoc') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'adhoc-signature',
 signature,
 teamIdentifier,
 }
 }

 if (!teamIdentifier || teamIdentifier === 'not set') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'missing-team-identifier',
 signature,
 teamIdentifier,
 }
 }

 return {
 trustedForAutoUpdate: true,
 appBundlePath,
 signature,
 teamIdentifier,
 }
}

export function getCurrentMacCodeSignatureStatus(executablePath: string): MacCodeSignatureStatus {
 const appBundlePath = getMacAppBundlePath(executablePath)
 const result = spawnSync('/usr/bin/codesign', ['-d', '-vvv', appBundlePath], {
 encoding: 'utf8',
 })
 const output = `${result.stdout ?? ''}${result.stderr ?? ''}`

 return parseMacCodeSignatureStatus(appBundlePath, result.status, output)
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
[codex] Guard desktop release signing by DragonnZhang · Pull Request #25 · modelstudioai/openwork · GitHub
Skip to content
[codex] Guard desktop release signing#25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

DragonnZhang
merged 2 commits into

from

Jun 10, 2026
 Merged


[codex] Guard desktop release signing
#25
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
5ca3ff1

fix(desktop): remove duplicate app version setting


DragonnZhang Jun 8, 2026
568e47a

fix: guard desktop release signing


DragonnZhang Jun 10, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


84 changes: 76 additions & 8 deletions
.github/workflows/desktop-release.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,6 +46,11 @@ on:
 required: true
 default: false
 type: boolean
 allow_unsigned_test_release:
 description: "Allow unsigned macOS/Windows artifacts only for prerelease testing."
 required: true
 default: false
 type: boolean
 clobber:
 description: "Replace same-named assets when uploading to an existing release."
 required: true
Expand DownExpand Up@@ -281,11 +286,18 @@ jobs:
 - name: Configure optional signing secrets
 shell: bash
 env:
 IS_DRY_RUN: ${{ inputs.dry_run }}
 APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
 APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
 APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
 ALLOW_UNSIGNED_TEST_RELEASE: ${{ inputs.allow_unsigned_test_release }}
 IS_PRERELEASE: ${{ inputs.prerelease }}
 MAC_CSC_KEY_PASSWORD_SECRET: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
 MAC_CSC_LINK_SECRET: ${{ secrets.MAC_CSC_LINK }}
 CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
 CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
 WIN_CSC_KEY_PASSWORD_SECRET: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
 WIN_CSC_LINK_SECRET: ${{ secrets.WIN_CSC_LINK }}
 SENTRY_ELECTRON_INGEST_URL_SECRET: ${{ secrets.SENTRY_ELECTRON_INGEST_URL }}
 run: |
 set -euo pipefail
Expand All@@ -305,15 +317,71 @@ jobs:
 } >> "$GITHUB_ENV"
 }

 if [ -n "$CSC_LINK_SECRET" ]; then
 append_env "CSC_LINK" "$CSC_LINK_SECRET"
 append_env "CSC_KEY_PASSWORD" "$CSC_KEY_PASSWORD_SECRET"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 mac_csc_link="${MAC_CSC_LINK_SECRET:-$CSC_LINK_SECRET}"
 mac_csc_key_password="${MAC_CSC_KEY_PASSWORD_SECRET:-$CSC_KEY_PASSWORD_SECRET}"

 allow_unsigned_artifacts() {
 if [ "$IS_DRY_RUN" = "true" ]; then
 return 0
 fi

 if [ "$ALLOW_UNSIGNED_TEST_RELEASE" = "true" ] && [ "$IS_PRERELEASE" = "true" ]; then
 return 0
 fi

 return 1
 }

 if [ "$RUNNER_OS" = "macOS" ]; then
 if [ -n "$mac_csc_link" ]; then
 if [ -z "$mac_csc_key_password" ]; then
 echo "::error::MAC_CSC_LINK/CSC_LINK is configured, but MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "CSC_LINK" "$mac_csc_link"
 append_env "CSC_KEY_PASSWORD" "$mac_csc_key_password"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published macOS desktop releases require MAC_CSC_LINK/CSC_LINK and MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD so auto-update signature validation can pass."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned macOS prerelease for manual testing. Auto-update validation is not supported for this artifact."
 fi

 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 fi
 elif [ "$RUNNER_OS" = "Windows" ]; then
 if [ -n "$WIN_CSC_LINK_SECRET" ]; then
 if [ -z "$WIN_CSC_KEY_PASSWORD_SECRET" ]; then
 echo "::error::WIN_CSC_LINK is configured, but WIN_CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "WIN_CSC_LINK" "$WIN_CSC_LINK_SECRET"
 append_env "WIN_CSC_KEY_PASSWORD" "$WIN_CSC_KEY_PASSWORD_SECRET"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published Windows desktop releases require WIN_CSC_LINK and WIN_CSC_KEY_PASSWORD."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned Windows prerelease for manual testing. Windows may show Unknown Publisher / SmartScreen warnings."
 else
 echo "Windows signing certificate is not configured; Windows dry-run artifacts will be unsigned."
 fi
 fi
 else
 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 if [ "$RUNNER_OS" != "Linux" ] && [ -n "$CSC_LINK_SECRET" ]; then
 echo "::warning::CSC_LINK is configured but not used on $RUNNER_OS."
 fi
 fi

 append_env "SENTRY_ELECTRON_INGEST_URL" "$SENTRY_ELECTRON_INGEST_URL_SECRET"
Expand Down

44 changes: 44 additions & 0 deletions
apps/electron/src/main/__tests__/auto-update-signature.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
import { describe, expect, it } from 'bun:test'

import {
 getMacAppBundlePath,
 parseMacCodeSignatureStatus,
} from '../auto-update-signature'

describe('auto-update-signature', () => {
 it('maps an executable path back to the macOS app bundle', () => {
 expect(getMacAppBundlePath('/Applications/OpenWork.app/Contents/MacOS/OpenWork'))
 .toBe('/Applications/OpenWork.app')
 })

 it('rejects ad-hoc signatures because they pin updates to a cdhash', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Signature=adhoc',
 'TeamIdentifier=not set',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('adhoc-signature')
 })

 it('rejects unsigned apps', () => {
 const status = parseMacCodeSignatureStatus(
 '/Applications/OpenWork.app',
 1,
 '/Applications/OpenWork.app: code object is not signed at all',
 )

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('codesign-failed')
 })

 it('accepts signed apps with a TeamIdentifier', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Authority=Developer ID Application: Example Inc (ABCDE12345)',
 'TeamIdentifier=ABCDE12345',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(true)
 expect(status.teamIdentifier).toBe('ABCDE12345')
 })
})

75 changes: 75 additions & 0 deletions
apps/electron/src/main/auto-update-signature.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
import { spawnSync } from 'child_process'
import * as path from 'path'

export interface MacCodeSignatureStatus {
 trustedForAutoUpdate: boolean
 appBundlePath: string
 reason?: 'codesign-failed' | 'adhoc-signature' | 'missing-team-identifier'
 signature?: string
 teamIdentifier?: string
 diagnostic?: string
}

function parseCodesignField(output: string, field: string): string | undefined {
 const match = output.match(new RegExp(`^${field}=(.*)$`, 'm'))
 return match?.[1]?.trim()
}

export function getMacAppBundlePath(executablePath: string): string {
 return path.dirname(path.dirname(path.dirname(executablePath)))
}

export function parseMacCodeSignatureStatus(
 appBundlePath: string,
 exitStatus: number | null,
 output: string,
): MacCodeSignatureStatus {
 if (exitStatus !== 0) {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'codesign-failed',
 diagnostic: output.trim(),
 }
 }

 const signature = parseCodesignField(output, 'Signature')
 const teamIdentifier = parseCodesignField(output, 'TeamIdentifier')

 if (signature === 'adhoc') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'adhoc-signature',
 signature,
 teamIdentifier,
 }
 }

 if (!teamIdentifier || teamIdentifier === 'not set') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'missing-team-identifier',
 signature,
 teamIdentifier,
 }
 }

 return {
 trustedForAutoUpdate: true,
 appBundlePath,
 signature,
 teamIdentifier,
 }
}

export function getCurrentMacCodeSignatureStatus(executablePath: string): MacCodeSignatureStatus {
 const appBundlePath = getMacAppBundlePath(executablePath)
 const result = spawnSync('/usr/bin/codesign', ['-d', '-vvv', appBundlePath], {
 encoding: 'utf8',
 })
 const output = `${result.stdout ?? ''}${result.stderr ?? ''}`

 return parseMacCodeSignatureStatus(appBundlePath, result.status, output)
}
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
[codex] Guard desktop release signing by DragonnZhang · Pull Request #25 · modelstudioai/openwork · GitHub
Skip to content
[codex] Guard desktop release signing#25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

DragonnZhang
merged 2 commits into

from

Jun 10, 2026
 Merged


[codex] Guard desktop release signing
#25
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
5ca3ff1

fix(desktop): remove duplicate app version setting


DragonnZhang Jun 8, 2026
568e47a

fix: guard desktop release signing


DragonnZhang Jun 10, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


84 changes: 76 additions & 8 deletions
.github/workflows/desktop-release.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -46,6 +46,11 @@ on:
 required: true
 default: false
 type: boolean
 allow_unsigned_test_release:
 description: "Allow unsigned macOS/Windows artifacts only for prerelease testing."
 required: true
 default: false
 type: boolean
 clobber:
 description: "Replace same-named assets when uploading to an existing release."
 required: true
Expand DownExpand Up@@ -281,11 +286,18 @@ jobs:
 - name: Configure optional signing secrets
 shell: bash
 env:
 IS_DRY_RUN: ${{ inputs.dry_run }}
 APPLE_APP_SPECIFIC_PASSWORD_SECRET: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
 APPLE_ID_SECRET: ${{ secrets.APPLE_ID }}
 APPLE_TEAM_ID_SECRET: ${{ secrets.APPLE_TEAM_ID }}
 ALLOW_UNSIGNED_TEST_RELEASE: ${{ inputs.allow_unsigned_test_release }}
 IS_PRERELEASE: ${{ inputs.prerelease }}
 MAC_CSC_KEY_PASSWORD_SECRET: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
 MAC_CSC_LINK_SECRET: ${{ secrets.MAC_CSC_LINK }}
 CSC_KEY_PASSWORD_SECRET: ${{ secrets.CSC_KEY_PASSWORD }}
 CSC_LINK_SECRET: ${{ secrets.CSC_LINK }}
 WIN_CSC_KEY_PASSWORD_SECRET: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
 WIN_CSC_LINK_SECRET: ${{ secrets.WIN_CSC_LINK }}
 SENTRY_ELECTRON_INGEST_URL_SECRET: ${{ secrets.SENTRY_ELECTRON_INGEST_URL }}
 run: |
 set -euo pipefail
Expand All@@ -305,15 +317,71 @@ jobs:
 } >> "$GITHUB_ENV"
 }

 if [ -n "$CSC_LINK_SECRET" ]; then
 append_env "CSC_LINK" "$CSC_LINK_SECRET"
 append_env "CSC_KEY_PASSWORD" "$CSC_KEY_PASSWORD_SECRET"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 mac_csc_link="${MAC_CSC_LINK_SECRET:-$CSC_LINK_SECRET}"
 mac_csc_key_password="${MAC_CSC_KEY_PASSWORD_SECRET:-$CSC_KEY_PASSWORD_SECRET}"

 allow_unsigned_artifacts() {
 if [ "$IS_DRY_RUN" = "true" ]; then
 return 0
 fi

 if [ "$ALLOW_UNSIGNED_TEST_RELEASE" = "true" ] && [ "$IS_PRERELEASE" = "true" ]; then
 return 0
 fi

 return 1
 }

 if [ "$RUNNER_OS" = "macOS" ]; then
 if [ -n "$mac_csc_link" ]; then
 if [ -z "$mac_csc_key_password" ]; then
 echo "::error::MAC_CSC_LINK/CSC_LINK is configured, but MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "CSC_LINK" "$mac_csc_link"
 append_env "CSC_KEY_PASSWORD" "$mac_csc_key_password"
 append_env "APPLE_ID" "$APPLE_ID_SECRET"
 append_env "APPLE_APP_SPECIFIC_PASSWORD" "$APPLE_APP_SPECIFIC_PASSWORD_SECRET"
 append_env "APPLE_TEAM_ID" "$APPLE_TEAM_ID_SECRET"
 echo "CSC_IDENTITY_AUTO_DISCOVERY=true" >> "$GITHUB_ENV"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published macOS desktop releases require MAC_CSC_LINK/CSC_LINK and MAC_CSC_KEY_PASSWORD/CSC_KEY_PASSWORD so auto-update signature validation can pass."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned macOS prerelease for manual testing. Auto-update validation is not supported for this artifact."
 fi

 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 fi
 elif [ "$RUNNER_OS" = "Windows" ]; then
 if [ -n "$WIN_CSC_LINK_SECRET" ]; then
 if [ -z "$WIN_CSC_KEY_PASSWORD_SECRET" ]; then
 echo "::error::WIN_CSC_LINK is configured, but WIN_CSC_KEY_PASSWORD is missing."
 exit 1
 fi

 append_env "WIN_CSC_LINK" "$WIN_CSC_LINK_SECRET"
 append_env "WIN_CSC_KEY_PASSWORD" "$WIN_CSC_KEY_PASSWORD_SECRET"
 else
 if ! allow_unsigned_artifacts; then
 echo "::error::Published Windows desktop releases require WIN_CSC_LINK and WIN_CSC_KEY_PASSWORD."
 exit 1
 fi

 if [ "$IS_DRY_RUN" = "false" ]; then
 echo "::warning::Publishing an unsigned Windows prerelease for manual testing. Windows may show Unknown Publisher / SmartScreen warnings."
 else
 echo "Windows signing certificate is not configured; Windows dry-run artifacts will be unsigned."
 fi
 fi
 else
 echo "CSC_IDENTITY_AUTO_DISCOVERY=false" >> "$GITHUB_ENV"
 if [ "$RUNNER_OS" != "Linux" ] && [ -n "$CSC_LINK_SECRET" ]; then
 echo "::warning::CSC_LINK is configured but not used on $RUNNER_OS."
 fi
 fi

 append_env "SENTRY_ELECTRON_INGEST_URL" "$SENTRY_ELECTRON_INGEST_URL_SECRET"
Expand Down

44 changes: 44 additions & 0 deletions
apps/electron/src/main/__tests__/auto-update-signature.test.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
import { describe, expect, it } from 'bun:test'

import {
 getMacAppBundlePath,
 parseMacCodeSignatureStatus,
} from '../auto-update-signature'

describe('auto-update-signature', () => {
 it('maps an executable path back to the macOS app bundle', () => {
 expect(getMacAppBundlePath('/Applications/OpenWork.app/Contents/MacOS/OpenWork'))
 .toBe('/Applications/OpenWork.app')
 })

 it('rejects ad-hoc signatures because they pin updates to a cdhash', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Signature=adhoc',
 'TeamIdentifier=not set',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('adhoc-signature')
 })

 it('rejects unsigned apps', () => {
 const status = parseMacCodeSignatureStatus(
 '/Applications/OpenWork.app',
 1,
 '/Applications/OpenWork.app: code object is not signed at all',
 )

 expect(status.trustedForAutoUpdate).toBe(false)
 expect(status.reason).toBe('codesign-failed')
 })

 it('accepts signed apps with a TeamIdentifier', () => {
 const status = parseMacCodeSignatureStatus('/Applications/OpenWork.app', 0, [
 'Authority=Developer ID Application: Example Inc (ABCDE12345)',
 'TeamIdentifier=ABCDE12345',
 ].join('\n'))

 expect(status.trustedForAutoUpdate).toBe(true)
 expect(status.teamIdentifier).toBe('ABCDE12345')
 })
})

75 changes: 75 additions & 0 deletions
apps/electron/src/main/auto-update-signature.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
import { spawnSync } from 'child_process'
import * as path from 'path'

export interface MacCodeSignatureStatus {
 trustedForAutoUpdate: boolean
 appBundlePath: string
 reason?: 'codesign-failed' | 'adhoc-signature' | 'missing-team-identifier'
 signature?: string
 teamIdentifier?: string
 diagnostic?: string
}

function parseCodesignField(output: string, field: string): string | undefined {
 const match = output.match(new RegExp(`^${field}=(.*)$`, 'm'))
 return match?.[1]?.trim()
}

export function getMacAppBundlePath(executablePath: string): string {
 return path.dirname(path.dirname(path.dirname(executablePath)))
}

export function parseMacCodeSignatureStatus(
 appBundlePath: string,
 exitStatus: number | null,
 output: string,
): MacCodeSignatureStatus {
 if (exitStatus !== 0) {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'codesign-failed',
 diagnostic: output.trim(),
 }
 }

 const signature = parseCodesignField(output, 'Signature')
 const teamIdentifier = parseCodesignField(output, 'TeamIdentifier')

 if (signature === 'adhoc') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'adhoc-signature',
 signature,
 teamIdentifier,
 }
 }

 if (!teamIdentifier || teamIdentifier === 'not set') {
 return {
 trustedForAutoUpdate: false,
 appBundlePath,
 reason: 'missing-team-identifier',
 signature,
 teamIdentifier,
 }
 }

 return {
 trustedForAutoUpdate: true,
 appBundlePath,
 signature,
 teamIdentifier,
 }
}

export function getCurrentMacCodeSignatureStatus(executablePath: string): MacCodeSignatureStatus {
 const appBundlePath = getMacAppBundlePath(executablePath)
 const result = spawnSync('/usr/bin/codesign', ['-d', '-vvv', appBundlePath], {
 encoding: 'utf8',
 })
 const output = `${result.stdout ?? ''}${result.stderr ?? ''}`

 return parseMacCodeSignatureStatus(appBundlePath, result.status, output)
}
Loading