Skip to content

fix(release): flip the exact fuse set the free EVS accepts #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lippdev merged 1 commit into from
Oct 27, 2026
Merged

fix(release): flip the exact fuse set the free EVS accepts #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions app/scripts/after-pack.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,18 @@ import { evsPlan, vmpCommand } from "./evs.mjs";

/** @param {import("electron-builder").AfterPackContext} context */
export default async function afterPack(context) {
// The free EVS signs only this exact fuse wire (castLabs FAQ, "Can I use @electron/fuses"); any other set, including
// a subset, is refused with "Binary signature denied". Fuses outside it stay at their defaults.
await flipFuses(executablePath(context), {
version: FuseVersion.V1,
[FuseV1Options.RunAsNode]: false,
[FuseV1Options.EnableCookieEncryption]: true,
[FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
[FuseV1Options.EnableNodeCliInspectArguments]: false,
[FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
[FuseV1Options.OnlyLoadAppFromAsar]: true,
[FuseV1Options.LoadBrowserProcessSpecificV8Snapshot]: false,
[FuseV1Options.GrantFileProtocolExtraPrivileges]: true,
});
vmpSign(context);
if (context.electronPlatformName !== "darwin") return;
Expand Down
2 changes: 2 additions & 0 deletions docs/DRM-EVS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ A partir daí, toda release de Windows e macOS assina a CDM no `afterPack`. A pr

Regras de conduta do serviço, do próprio wiki da castLabs: uma conta basta (use redefinição de senha se perder o acesso), não force assinatura nova quando a existente vale, e a assinatura correta para este app é `streaming` — o `sign-pkg` usa esse tipo por padrão, e o suporte a licença persistente saiu da CDM do navegador a partir do ECS v42.

O EVS gratuito só assina um binário idêntico ao da castLabs, com uma exceção: o conjunto fixo de fuses da [FAQ](https://github.com/castlabs/electron-releases/wiki/FAQ#can-i-use-electronfuses-with-the-free-version-of-ecs-and-evs). O `after-pack.mjs` grava exatamente esse conjunto. Qualquer fuse a mais, a menos ou com outro valor faz o serviço responder `ValidityError: Binary signature denied`; foi o que derrubou a assinatura da 0.1.0-alpha.

## Como conferir depois de assinar

Na máquina, com o app instalado:
Expand Down
Loading