Don't resign SEA binary

.github/workflows/release.yml

@@ -89,15 +89,6 @@ jobs:
       - name: Install yaak CLI
         run: go install github.com/yaakapp/yaakcli@latest
 
-      - name: Build plugins
-        working-directory: ${{ env.YAAK_PLUGINS_DIR }}
-        run: |
-          npm ci
-          npm run build
-
-      - name: Copy plugins
-        run: node scripts/copy-plugins.cjs
-
       - name: Run lint
         run: npm run lint
 
@@ -111,6 +102,7 @@ jobs:
 
       - uses: tauri-apps/tauri-action@v0
         env:
+          YAAK_PLUGINS_DIR: ${{ env.YAAK_PLUGINS_DIR }}
           NODE_ARCH: ${{ matrix.node_arch }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}

package.json

@@ -15,8 +15,9 @@
     "build:icon:dev": "tauri icon design/icon-dev.png --output ./src-tauri/icons/dev",
     "build": "run-p build:*",
     "build:js": "vite build",
-    "build:download-protoc": "node scripts/download-protoc.cjs",
-    "build:plugin-runtime": "npm run --prefix plugin-runtime build && node scripts/copy-plugins.cjs",
+    "build:vendor-protoc": "node scripts/vendor-protoc.cjs",
+    "build:vendor-plugins": "node scripts/vendor-plugins.cjs",
+    "build:plugin-runtime": "npm run --prefix plugin-runtime build",
     "test": "vitest",
     "coverage": "vitest run --coverage",
     "prepare": "husky install",

plugin-runtime/scripts/generate-sea.cjs

@@ -49,15 +49,16 @@ try {
 
 unlinkSync(blobPath);
 
-console.log('Re-signing Node.js');
-try {
-  if (process.platform === 'darwin') execSync(`codesign --sign - ${tmpNodePath}`);
-  else if (process.platform === 'win32') execSync(`"${getSigntoolLocation()}" sign /fd SHA256 ${tmpNodePath}`);
-  /* Nothing for Linux */
-} catch (err) {
-  console.log('Failed sign', err);
-  process.exit(1);
-}
+// NOTE: Don't need to resign, as Tauri will sign the sidecar binaries during release
+// console.log('Re-signing Node.js');
+// try {
+//   // if (process.platform === 'darwin') execSync(`codesign --sign - ${tmpNodePath}`);
+//   // else if (process.platform === 'win32') execSync(`"${getSigntoolLocation()}" sign /fd SHA256 ${tmpNodePath}`);
+//   /* Nothing for Linux */
+// } catch (err) {
+//   console.log('Failed sign', err);
+//   process.exit(1);
+// }
 
 const key = `${process.platform}_${process.env.NODE_ARCH ?? process.arch}`;
 const dstPath = path.join(destDir, DST_BIN_MAP[key]);

scripts/vendor-plugins.cjs

@@ -1,12 +1,19 @@
 const {readdirSync, cpSync} = require("node:fs");
 const path = require("node:path");
-console.log('-----> Starting copy plugins script');
+const {execSync} = require("node:child_process");
 const PLUGINS_DIR = process.env.YAAK_PLUGINS_DIR;
 if (!PLUGINS_DIR) {
   console.log("YAAK_PLUGINS_DIR is not set");
   process.exit(1);
 }
 
+console.log('Installing Yaak plugins dependencies', PLUGINS_DIR);
+execSync('npm ci', {cwd: PLUGINS_DIR});
+console.log('Building Yaak plugins', PLUGINS_DIR);
+execSync('npm run build', {cwd: PLUGINS_DIR});
+
+console.log('Copying Yaak plugins to', PLUGINS_DIR);
+
 const pluginsRoot = path.join(PLUGINS_DIR, 'plugins');
 for (const name of readdirSync(pluginsRoot)) {
   const dir = path.join(pluginsRoot, name);