Distillation

Date: Jul 21, 2026

• 🟡 (13:04) User requested rigorous adversarial CORRECTNESS review of Electron build-config cleanup PR, focus strictly on real bugs, especially macOS notarization/signing regression risk; explicitly told to ignore style/cosmetics.
• 🔴 (13:04) Repo: /home/byk/Code/getsentry/spotlight, branch chore/remove-redundant-notarize-afterSign, PR #1336, base main.
• 🔴 (13:04) User described PR #1336 changes: (1) packages/spotlight/electron-builder.cjs removes let afterSign = "scripts/notarize.cjs", afterSign = undefined line, and afterSign, config key; (2) deletes packages/spotlight/scripts/notarize.cjs (afterSign hook calling @electron/notarize's notarize() with APPLE_API_KEY/APPLE_API_KEY_ID/APPLE_API_ISSUER); (3) removes @electron/notarize from packages/spotlight/package.json devDependencies + lockfile update.
• 🟡 (13:04) User's thesis to verify/refute: electron-builder auto-notarizes internally when APPLE_API_KEY+APPLE_API_KEY_ID+APPLE_API_ISSUER env vars are set, making the afterSign script redundant.
• 🟡 (13:06) [requested-review] Assistant read git diff origin/main...chore/remove-redundant-notarize-afterSign; confirmed diff matches description. Noted incidental lockfile changes: removed transitive @electron/asar@3.2.13, @types/glob@7.2.0, @types/minimatch@5.1.2; @electron/universal@1.5.1 repointed to @electron/asar@3.4.1 (was 3.2.13).
• 🟡 (13:06) Evidence: packages/spotlight/electron-builder.cjs mac config uses hardenedRuntime:true, gatekeeperAssess:false, entitlements build/entitlements.mac.plist, cscLink/cscKeyPassword from CSC_LINK/CSC_KEY_PASSWORD env, identity:null only when CSC_LINK/CSC_KEY_PASSWORD absent, no notarize key, no afterSign key (post-change). build:mac script = "./electron-builder.cjs", electron-builder version ^26.15.7 (package.json:24,105).
• 🟡 (13:06) Evidence: node_modules/.pnpm/app-builder-lib@26.15.7.../app-builder-lib/out/macPackager.js — sign() method (lines 290-321): line 296-298 handles null identity; line 311 doSign(); lines 317-319 if (!isMas) { await this.helper.notarizeIfProvided(appPath); } — notarize runs AFTER signing, only for non-MAS targets.
• 🟡 (13:06) Evidence: node_modules/.pnpm/app-builder-lib@26.15.7.../mac/MacTargetHelper.js — getNotarizeOptions() (lines 219-255): checks APPLE_ID/APPLE_APP_SPECIFIC_PASSWORD/APPLE_TEAM_ID first (notarytool tool="notarytool"), then lines 236-244 checks APPLE_API_KEY/APPLE_API_KEY_ID/APPLE_API_ISSUER (throws InvalidConfigurationError if only some set), then APPLE_KEYCHAIN/APPLE_KEYCHAIN_PROFILE, else returns undefined. notarizeIfProvided() (lines 256-270): skips only if platformSpecificBuildOptions.notarize === false (line 258) or getNotarizeOptions returns undefined (line 263); otherwise dynamicImport("@electron/notarize") and calls notarize(options), logging "notarization successful" (line 269) on success.
• 🟡 (13:07) Evidence: .github/workflows/build.yml has TWO distinct jobs with different Apple env var naming: Linux build job (lines 70-95) exports APPLE_CERT_DATA, APPLE_API_KEY (base64 bundle), then derives APPLE_API_KEY_ISSUER_ID, APPLE_API_KEY_ID, APPLE_API_KEY_P8_PATH, APPLE_API_KEY_PATH (uses rcodesign, not electron-builder, Linux fossilize signing). Separate electron-mac job "Setup Apple API Key for Notarization" step (lines 393-408) exports APPLE_API_ISSUER, APPLE_API_KEY_ID, APPLE_API_KEY=/tmp/apple_key.pem; "Build and Sign Electron App" step (lines 410-419) sets CSC_LINK/CSC_KEY_PASSWORD and runs pnpm build:mac (working-directory packages/spotlight).
• 🟡 (13:07) Deleted packages/spotlight/scripts/notarize.cjs read env vars appleApiKeyId=process.env.APPLE_API_KEY_ID, appleApiKey=process.env.APPLE_API_KEY, appleApiIssuer=process.env.APPLE_API_ISSUER — identical names to both the internal app-builder-lib path and the electron-mac CI job exports.
• 🟡 (13:08) Evidence: pnpm-lock.yaml shows app-builder-lib@24.13.3 depends on @electron/notarize@2.2.1; app-builder-lib@26.15.7 (the version electron-builder@26.15.7 uses) depends on @electron/notarize@2.5.0 (pnpm-lock.yaml:10340) — confirms transitive dependency remains after removing direct devDependency.
• 🟡 (13:08) Confirmed on disk: node_modules/.pnpm/@electron+notarize@2.5.0/node_modules/@electron/notarize exists and is resolvable from app-builder-lib@26.15.7's location (dynamicImport resolves relative to app-builder-lib, not spotlight package.json).
• 🟡 (13:08) Assistant ran pnpm install --frozen-lockfile --lockfile-only in a throwaway /tmp copy (not modifying real tree) — exit code 0, "Done in 751ms using pnpm v9.15.9" — confirms lockfile is valid/consistent with branch's package.json. Scratch cleaned up afterward.
• 🟡 (13:08) Repo-wide grep for notarize.cjs / scripts/notarize / @electron/notarize / afterSign across packages/, .github/, turbo.json, all package.json files: no other consumers found; only hits were pnpm-lock.yaml transitive package entries. scripts/ dir contained only notarize.cjs (now removed).
• 🟡 (13:09) Assistant's final verdict: PR #1336 is SAFE TO MERGE — no real regression risk to notarization or signing. All 5 investigated concerns (internal notarize path fires; env-var-name alignment between electron-mac CI job and app-builder-lib; afterSign script redundancy; signing unaffected; no other consumers of deleted file/dep; package.json/lockfile correctness) resolved as severity NONE. Key finding: the "APPLE_API_KEY_ISSUER_ID" name mismatch is a non-issue because it only appears in the separate Linux build job (rcodesign/fossilize signing), not the electron-mac job that runs electron-builder's mac notarize.
• 🟡 (13:09) Residual risk noted by assistant: electron-mac job only runs on push to main/release/* branches, so full end-to-end notarization proof for this PR comes post-merge (same as prior PRs #1334/#1335 referenced for comparison); mechanism assessed as identical to already-green run on main.