From d0f591893b13ab3863b7d878f6ad3302f29c75bb Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Tue, 23 Jun 2026 09:50:46 +0200
Subject: [PATCH] fix(release): validate DMG resize slack

---
 scripts/create-dmg.sh           | 10 ++++++++++
 test/scripts/create-dmg.test.ts | 12 ++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/scripts/create-dmg.sh b/scripts/create-dmg.sh
index 13051fc3f16..23c64ad19f9 100755
--- a/scripts/create-dmg.sh
+++ b/scripts/create-dmg.sh
@@ -84,10 +84,20 @@ require_positive_integer() {
   fi
 }
 
+require_nonnegative_integer() {
+  local name="$1"
+  local raw="$2"
+  if [[ ! "$raw" =~ ^(0|[1-9][0-9]*)$ || "${#raw}" -gt 9 ]]; then
+    echo "Error: $name must be a finite non-negative integer: '$raw'" >&2
+    exit 1
+  fi
+}
+
 require_integer_list DMG_WINDOW_BOUNDS "$DMG_WINDOW_BOUNDS" 4
 require_integer_list DMG_APP_POS "$DMG_APP_POS" 2
 require_integer_list DMG_APPS_POS "$DMG_APPS_POS" 2
 require_positive_integer DMG_ICON_SIZE "$DMG_ICON_SIZE"
+require_nonnegative_integer DMG_EXTRA_SECTORS "$DMG_EXTRA_SECTORS"
 
 to_applescript_list4() {
   local raw="$1"
diff --git a/test/scripts/create-dmg.test.ts b/test/scripts/create-dmg.test.ts
index 2fcb3dfad55..7650ee53ad6 100644
--- a/test/scripts/create-dmg.test.ts
+++ b/test/scripts/create-dmg.test.ts
@@ -195,6 +195,18 @@ describe("create-dmg plist validation", () => {
     expect(script).not.toContain('tell application "Finder" to close every window');
   });
 
+  it("fails malformed DMG resize slack before creating images", () => {
+    const script = readFileSync(scriptPath, "utf8");
+    const validationBlock = script.slice(
+      script.indexOf("require_integer_list()"),
+      script.indexOf('to_applescript_list4()'),
+    );
+
+    expect(validationBlock).toContain("require_nonnegative_integer()");
+    expect(validationBlock).toContain('require_nonnegative_integer DMG_EXTRA_SECTORS "$DMG_EXTRA_SECTORS"');
+    expect(validationBlock).toContain("must be a finite non-negative integer");
+  });
+
   it.runIf(process.platform === "darwin")(
     "fails before hdiutil when required plist keys are missing",
     () => {