From 49f4cbcfd59ae8f74c12ea53bd566f2a77f504af Mon Sep 17 00:00:00 2001
From: Dylan Audius <dylan@audius.co>
Date: Thu, 24 Sep 2026 13:04:20 -0700
Subject: [PATCH] fix(desktop): pass the keychain password to
 set-key-partition-list

electron-builder passes the .p12 password as the keychain password when
it calls `security set-key-partition-list` on the temp keychain it just
created. macOS 26.6 now checks that password, so Mac signing fails with
SecKeychainUnlock on every run since the runner image moved to 26.6.
Still unfixed upstream as of electron-builder 26.15.3, so patch it.

Also drop jq from the Windows/Linux Slack steps; the builder container
doesn't have it, which marked successful publishes as failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/web.yml            |  6 ++++--
 patches/app-builder-lib+25.1.8.patch | 23 +++++++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 patches/app-builder-lib+25.1.8.patch

diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 56f8c18a192..5c37181dce8 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -1173,7 +1173,8 @@ jobs:
           SLACK_WEBHOOK: ${{ secrets.SLACK_DAILY_DEPLOY_WEBHOOK }}
         run: |
           cd packages/web
-          deploying_version=$(jq -r '.version' package.json)
+          # The electronuserland/builder image has no jq
+          deploying_version=$(node -p "require('./package.json').version")
           job_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           json_content="{ \"blocks\": [{ \"type\": \"section\", \"text\": { \"type\": \"mrkdwn\", \"text\": \"Deployed production <${job_url}|v${deploying_version}> to desktop win \n\" } }]}"
           curl -f -X POST -H 'Content-type: application/json' --data "$json_content" $SLACK_WEBHOOK
@@ -1231,7 +1232,8 @@ jobs:
           SLACK_WEBHOOK: ${{ secrets.SLACK_DAILY_DEPLOY_WEBHOOK }}
         run: |
           cd packages/web
-          deploying_version=$(jq -r '.version' package.json)
+          # The electronuserland/builder image has no jq
+          deploying_version=$(node -p "require('./package.json').version")
           job_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           json_content="{ \"blocks\": [{ \"type\": \"section\", \"text\": { \"type\": \"mrkdwn\", \"text\": \"Deployed production <${job_url}|v${deploying_version}> to desktop linux \n\" } }]}"
           curl -f -X POST -H 'Content-type: application/json' --data "$json_content" $SLACK_WEBHOOK
diff --git a/patches/app-builder-lib+25.1.8.patch b/patches/app-builder-lib+25.1.8.patch
new file mode 100644
index 00000000000..d17fb8a5652
--- /dev/null
+++ b/patches/app-builder-lib+25.1.8.patch
@@ -0,0 +1,23 @@
+diff --git a/node_modules/app-builder-lib/out/codeSign/macCodeSign.js b/node_modules/app-builder-lib/out/codeSign/macCodeSign.js
+index 1befc03..4aff642 100644
+--- a/node_modules/app-builder-lib/out/codeSign/macCodeSign.js
++++ b/node_modules/app-builder-lib/out/codeSign/macCodeSign.js
+@@ -158,15 +158,15 @@ async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIK
+     if (cscIKeyPassword) {
+         cscPasswords.push(cscIKeyPassword);
+     }
+-    return await importCerts(keychainFile, certPaths, cscPasswords);
++    return await importCerts(keychainFile, certPaths, cscPasswords, keychainPassword);
+ }
+-async function importCerts(keychainFile, paths, keyPasswords) {
++async function importCerts(keychainFile, paths, keyPasswords, keychainPassword) {
+     for (let i = 0; i < paths.length; i++) {
+         const password = keyPasswords[i];
+         await (0, builder_util_1.exec)("/usr/bin/security", ["import", paths[i], "-k", keychainFile, "-T", "/usr/bin/codesign", "-T", "/usr/bin/productbuild", "-P", password]);
+         // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p
+         // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996
+-        await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]);
++        await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", keychainPassword, keychainFile]);
+     }
+     return {
+         keychainFile,