Repository navigation
🐛 [fix] (packaging) Remove Squirrel from Windows releases - #211
Conversation
🐛 [fix] Remove the Squirrel target, release upload path, asset renamer, package dependency, and current documentation references. - Keep NSIS as the supported auto-update installer and preserve MSI, portable, and archive targets. 🛡️ [fix] Reject Squirrel-named artifacts and ExecutionStub helpers before packaged-app smoke launches. - Fail closed on malformed npm audit responses and allow only the two known unpatched Docusaurus image-size advisory cascades. 🔒️ [fix] Replace extract-zip with traversal- and symlink-safe yauzl extraction for Electron downloads. ⬆️ [build] Refresh compatible root and Docusaurus dependencies, Node 26.7.0, and npm 12.0.2. - Pin the known-compatible lint and formatting toolchain instead of accepting the breaking shared-config major. - Explicitly deny the transitive electron-winstaller install script under npm 12. 🧪 [test] Add packaging, extraction, audit, and workflow regression coverage. 📝 [docs] Align installation, release, development, and dependency inventories with the supported artifact set.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Greetings, thanks for opening a pull request, I'll look when I can. |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 79 |
| Duplication | -1 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. @@ Coverage Diff @@
## main #211 +/- ##
=======================================
Coverage 63.09% 63.09%
=======================================
Files 8 8
Lines 1084 1084
Branches 208 208
=======================================
Hits 684 684
Misses 299 299
Partials 101 101
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cf3d47cf22
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| {}, | ||
| commandRunner | ||
| ) | ||
| ).toThrow("forbidden Squirrel packaging artifacts"); |
There was a problem hiding this comment.
On Linux and macOS, this assertion cannot pass because runPackagedSmoke() ultimately calls findForbiddenWindowsPackagingArtifacts() with its default process.platform; the scanner therefore returns early instead of reporting the fixture's Windows artifacts, and the empty commandRunner produces a different error. This breaks npm test in the Ubuntu release gate in Build.yml, the Ubuntu dependency-validation job, and the Linux/macOS release-rehearsal matrix. Inject a Windows platform into this path or isolate the host-dependent assertion.
Useful? React with 👍 / 👎.
| const packagingInspectionPath = configuredExecutablePath | ||
| ? path.dirname(resolvedExecutablePath) | ||
| : resolvedReleaseDistPath; |
There was a problem hiding this comment.
On Windows, supplying --executable or FFV_PACKAGED_APP makes this inspect only the executable's immediate directory, even when --release-dist explicitly identifies the complete release output. For example, an executable under release-dist/win-unpacked passes when a leaked release-dist/squirrel-windows directory exists beside it; the added test fixture includes exactly this layout but its _ExecutionStub.exe masks the missed sibling. Prefer the supplied release directory, or otherwise inspect a common release root, so the new artifact guard covers the full output.
Useful? React with 👍 / 👎.
♻️ [refactor] Divide ZIP entry extraction, symlink verification, audit result validation, npm command resolution, and captured-failure handling into focused helpers. - Preserve the traversal, symlink, exact-advisory, and fail-closed behavior while bringing every changed method below the repository's Codacy complexity and length thresholds. 🧪 [test] Re-run the focused extraction and audit regressions, formatter, root lint, and both audit gates.
🐛 [fix] Remove the host-platform shortcut from Squirrel artifact discovery so Linux release-assembly and dependency-validation runners reject Windows Squirrel output before launching a package. 🧪 [test] Keep the regression platform-independent and verify the command runner is never reached when forbidden output exists.
|
What changed
*_ExecutionStub.exeleaks into release output.extract-zipwith guardedyauzlextraction and make the audit exception fail closed.Why
Discussion #208 reported antivirus detections on the Windows download. Artifact-level checks isolated the strongest trigger to Squirrel's
ExecutionStub.exe, even though FitFileViewer updates through NSIS/electron-updater and the Squirrel release assets had almost no usage. Removing that unused packaging path also prevents the helper from contaminating shared Windows staging output used by the other targets.The release will still be unsigned because no Windows signing credential is configured. This should remove the concrete Squirrel false-positive source, but it cannot guarantee that reputation-based scanners or SmartScreen will stop warning.
Validation
npm run release:verifyimage-sizeadvisories accepted by the gaterelease-disttree: no threats, exit code 0.actionlintandgit diff --checkpassed.git verify-commit.Release plan
After CI and review pass, merge this PR and dispatch the standard Build workflow as a patch release (
v30.0.2) with signing explicitly not required. Then verify the published asset inventory and scan the exact release artifacts before following up in Discussion #208.