From 336c077bc179049607cde532c6df776e6726a85c Mon Sep 17 00:00:00 2001 From: zpyoung Date: Mon, 19 Oct 2026 14:39:15 -0500 Subject: [PATCH] fix(release): check the mac terminal host against the fork's signing team v1.4.230 added a signed-team check for the packaged macOS terminal host with upstream's Developer ID team hardcoded, so every fork release build fails 'signed team is , expected 6CX3WHS9HZ' after signing. Read the team from APPLE_TEAM_ID, which the publish step already passes for notarization, and fail a release build that omits it so the check can never silently turn off. --- config/electron-builder.config.cjs | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/config/electron-builder.config.cjs b/config/electron-builder.config.cjs index f5cbd3607c73..5835807ed418 100644 --- a/config/electron-builder.config.cjs +++ b/config/electron-builder.config.cjs @@ -194,8 +194,14 @@ const macUsageDescriptions = { NSBonjourServices: ['_http._tcp', '_https._tcp'], ...MACOS_FOLDER_USAGE_DESCRIPTIONS } -// Developer ID team that signs every release-channel mac build. -const ORCA_MAC_TEAM_ID = '6CX3WHS9HZ' +/** The Developer ID team the fork's release credentials sign with; a release build must name one. */ +function readReleaseMacTeamId() { + const teamId = process.env.APPLE_TEAM_ID?.trim() + if (!teamId) { + throw new Error('APPLE_TEAM_ID is required for a macOS release build.') + } + return teamId +} /** @type {import('electron-builder').Configuration} */ module.exports = { @@ -836,7 +842,7 @@ async function packageMacTerminalHost(appPath, context) { appPath, arch, usageDescriptions: macUsageDescriptions, - expectedTeamId: isMacRelease ? ORCA_MAC_TEAM_ID : null + expectedTeamId: isMacRelease ? readReleaseMacTeamId() : null }) }