(maka) 05/06: fix(release): omit NSIS input file timestamps

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

Astro-Han pushed a commit to branch fix/windows-reproducible-payload
in repository https://gitbox.apache.org/repos/asf/maka.git

commit 7b8573fad4726d4d518d898540f6286138099c0b
Author: AstroHan <le...@outlook.com>
AuthorDate: Thu Sep 3 00:48:43 2026 +0800

    fix(release): omit NSIS input file timestamps
    
    The only differing NSIS header fields are the build-time FILETIMEs of app-64.7z and the uninstaller. SetDateSave off removes those fields at compilation without changing the embedded bytes. A real NSIS fixture verifies identical output after changing input timestamps; the full Windows release remains the acceptance test.
    
    Generated-by: Codex
---
 apps/desktop/build/installer.nsh       |  4 ++++
 scripts/windows-archive-repro.test.mjs | 40 ++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/apps/desktop/build/installer.nsh b/apps/desktop/build/installer.nsh
index 2a5d723e96..c0e2f08aef 100644
--- a/apps/desktop/build/installer.nsh
+++ b/apps/desktop/build/installer.nsh
@@ -76,6 +76,10 @@
 # expand at their insertion points. Functions therefore read exclusively from
 # the $maka* variables assigned in customInit.
 
+# The archive and uninstaller bytes are stable; their build-time mtimes are not.
+# Their installation does not depend on preserving those input file dates.
+SetDateSave off
+
 !ifndef BUILD_UNINSTALLER
 
 !include LogicLib.nsh
diff --git a/scripts/windows-archive-repro.test.mjs b/scripts/windows-archive-repro.test.mjs
index f3411aa1e4..52e313707f 100644
--- a/scripts/windows-archive-repro.test.mjs
+++ b/scripts/windows-archive-repro.test.mjs
@@ -24,8 +24,10 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
 import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
 import { archive } from 'app-builder-lib/out/targets/archive.js';
 import { getPath7za } from 'app-builder-lib/out/toolsets/7zip.js';
+import { getMakeNsisPath } from 'app-builder-lib/out/toolsets/windows.js';
 
 test('the Windows ZIP path produces identical bytes regardless of input modification time', async (t) => {
   const root = await mkdtemp(join(tmpdir(), 'maka-archive-repro-'));
@@ -52,3 +54,41 @@ test('the Windows ZIP path produces identical bytes regardless of input modifica
   }
   assert.ok(results[0].equals(results[1]), 'ZIP bytes changed with the input file timestamp');
 });
+
+test('the NSIS include produces identical bytes regardless of embedded file modification time', async (t) => {
+  const root = await mkdtemp(join(tmpdir(), 'maka-nsis-repro-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const file = join(root, 'payload.txt');
+  const payload = 'identical NSIS payload';
+  await writeFile(file, payload);
+  const script = join(root, 'fixture.nsi');
+  const include = fileURLToPath(new URL('../apps/desktop/build/installer.nsh', import.meta.url));
+  await writeFile(
+    script,
+    `
+!define BUILD_UNINSTALLER
+!include "${include}"
+Name "Maka timestamp fixture"
+OutFile "fixture.exe"
+RequestExecutionLevel user
+SetCompress off
+Section
+  SetOutPath "$TEMP"
+  File "payload.txt"
+SectionEnd
+`,
+  );
+  const nsis = await getMakeNsisPath();
+  const results = [];
+  for (const date of [new Date('2024-01-01T00:00:00Z'), new Date('2024-02-02T00:00:00Z')]) {
+    await utimes(file, date, date);
+    await promisify(execFile)(nsis.path, ['-V2', script], {
+      cwd: root,
+      env: { ...process.env, ...nsis.env },
+    });
+    const bytes = await readFile(join(root, 'fixture.exe'));
+    assert.ok(bytes.includes(Buffer.from(payload)), 'NSIS fixture lost its embedded payload');
+    results.push(bytes);
+  }
+  assert.ok(results[0].equals(results[1]), 'NSIS bytes changed with the embedded file timestamp');
+});


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org