xiaoxue_admin
/
orca
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(updater): restore Windows update signature verification (#7861) 

Co-authored-by: Orca <help@stably.ai>
This commit is contained in:
Brennan Benson 2026-07-08 22:28:13 -07:00 committed by GitHub
parent 478ef07038
commit ed529a011b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 14 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/main/updater.test.ts
View File

@ -1766,11 +1766,14 @@ describe('updater', () => {
expect(setPendingUpdateNudgeId).toHaveBeenCalledWith(null)
})
// Why: issue #631 — the Windows auto-updater fails because installed
// versions signed with the wrong certificate have a stale publisherName
// in app-update.yml. verifyUpdateCodeSignature must be overridden on
// Windows so electron-updater skips Authenticode verification.
it('overrides verifyUpdateCodeSignature on Windows to skip signing verification', async () => {
// Why: the Windows auto-updater must keep electron-updater's built-in
// Authenticode verification, which checks the downloaded installer against
// the SignPath Foundation publisherName that electron-builder embeds in
// app-update.yml. A no-op verifyUpdateCodeSignature override would silently
// accept every installer, so setup must NOT install one. (The issue #631
// stale-publisherName problem that once justified an override is resolved now
// that SignPath builds embed the correct publisherName.)
it('does not disable Windows Authenticode verification on win32', async () => {
vi.stubGlobal('process', { ...process, platform: 'win32' })
const { setupAutoUpdater } = await import('./updater')
@ -1780,11 +1783,7 @@ describe('updater', () => {
setupAutoUpdater(mainWindow as never)
// The override should be set on the autoUpdater mock
const override = (autoUpdaterMock as Record<string, unknown>).verifyUpdateCodeSignature
expect(override).toBeTypeOf('function')
// Calling it should resolve to null (meaning "signature valid, skip check")
await expect((override as () => Promise<string | null>)()).resolves.toBeNull()
expect((autoUpdaterMock as Record<string, unknown>).verifyUpdateCodeSignature).toBeUndefined()
})
it('does not override verifyUpdateCodeSignature on non-Windows platforms', async () => {

15
src/main/updater.ts
View File

@ -1,6 +1,5 @@
/* eslint-disable max-lines */
import { app, BrowserWindow, powerMonitor } from 'electron'
import type { NsisUpdater } from 'electron-updater'
import { is } from '@electron-toolkit/utils'
import type { UpdateCheckOptions, UpdateStatus } from '../shared/types'
import { killAllPty } from './ipc/pty'
@ -1269,15 +1268,11 @@ export function setupAutoUpdater(
debug: (m: unknown) => console.debug('[autoUpdater]', m)
} as never
// Why: older Windows installs either have no publisherName or have the
// stale macOS Apple Developer ID publisherName from issue #631. Keep the
// migration path open while SignPath-signed builds roll out.
//
// TODO: re-enable after SignPath-signed builds with the explicit Windows
// publisherName have been the minimum supported updater source for a while.
if (process.platform === 'win32') {
;(autoUpdater as NsisUpdater).verifyUpdateCodeSignature = () => Promise.resolve(null)
}
// Why: Windows update integrity is enforced by electron-updater's built-in
// Authenticode check against the `publisherName` (SignPath Foundation) that
// electron-builder embeds in app-update.yml. Do NOT re-add a
// `verifyUpdateCodeSignature` override — a no-op override silently accepts
// every downloaded installer, disabling signature verification entirely.
// Use the generic provider with GitHub's /releases/latest/download/ URL as
// the startup fallback so electron-updater can fetch the manifest