fix(mac): clean failed notary zip staging

This commit is contained in:
Vincent Koc 2026-06-20 19:25:38 +02:00
parent 85f552bf37
commit aea050b43e
No known key found for this signature in database
2 changed files with 29 additions and 0 deletions

View file

@ -154,6 +154,13 @@ SKIP_NOTARIZE="${SKIP_NOTARIZE:-0}"
NOTARIZE=1
SKIP_DSYM="${SKIP_DSYM:-0}"
SKIP_DMG="${SKIP_DMG:-0}"
NOTARY_ZIP_PENDING_CLEANUP=0
cleanup_notary_zip() {
if [[ "$NOTARY_ZIP_PENDING_CLEANUP" == "1" ]]; then
rm -f "$NOTARY_ZIP"
fi
}
if [[ "$SKIP_NOTARIZE" == "1" ]]; then
NOTARIZE=0
@ -185,9 +192,13 @@ fi
if [[ "$NOTARIZE" == "1" ]]; then
echo "📦 Notary zip: $NOTARY_ZIP"
rm -f "$NOTARY_ZIP"
NOTARY_ZIP_PENDING_CLEANUP=1
trap cleanup_notary_zip EXIT
ditto -c -k --sequesterRsrc --keepParent "$APP" "$NOTARY_ZIP"
STAPLE_APP_PATH="$APP" "$ROOT_DIR/scripts/notarize-mac-artifact.sh" "$NOTARY_ZIP"
rm -f "$NOTARY_ZIP"
NOTARY_ZIP_PENDING_CLEANUP=0
trap - EXIT
fi
echo "📦 Zip: $ZIP"

View file

@ -232,6 +232,24 @@ describe("package-mac-dist plist validation", () => {
expect(result.stderr).not.toContain("node reran after failed install");
});
it("cleans the temporary notary zip when notarization exits early", () => {
const script = readFileSync(scriptPath, "utf8");
const notaryBlock = script.slice(
script.indexOf('if [[ "$NOTARIZE" == "1" ]]'),
script.indexOf('if [[ "$SKIP_DMG" != "1" ]]'),
);
expect(script).toContain("cleanup_notary_zip()");
expect(notaryBlock).toContain("NOTARY_ZIP_PENDING_CLEANUP=1");
expect(notaryBlock).toContain("trap cleanup_notary_zip EXIT");
expect(notaryBlock).toContain(
'STAPLE_APP_PATH="$APP" "$ROOT_DIR/scripts/notarize-mac-artifact.sh" "$NOTARY_ZIP"',
);
expect(notaryBlock).toContain('rm -f "$NOTARY_ZIP"');
expect(notaryBlock).toContain("NOTARY_ZIP_PENDING_CLEANUP=0");
expect(notaryBlock).toContain("trap - EXIT");
});
it("fails closed when required dSYM outputs are missing", () => {
const script = readFileSync(scriptPath, "utf8");
const dsymBlock = script.slice(script.indexOf('if [[ "$SKIP_DSYM" != "1" ]]'));