Chore: bump electron-builder by Lemonexe · Pull Request #24136 · trezor/trezor-suite

Lemonexe · 2026-01-04T17:36:15Z

Description

Bump electron-builder, which has not been done for a long time because of issues with macOS signing. That proved to be a bug in electron-builder, so this PR adds a patch until it is fixed upstream.
Fix a weird packaging problem that bundles the whole app in the app (caused by some version of electron-builder, but I don't think it's really a bug).
Reenable ASAR interity on macOS, because it now seems to work fine ✔️ (I did not investigate whether the cause was electron or electron-builder).
Cleanup files in electron builder config, as some exclusions were no longer necessary

CI build desktop apps OK ✔️

Notes for QA

test Suite Desktop on all three platforms:
installs
runs
updates (that can be tested during release tests)

I briefly verified on Linux x64, Windows 11 x64 and macOS ARM, both locally built & CI builds ✔️

Related Issue

Resolve #18919
Resolve #17057

🔍🖥️ Suite web test results: View in Currents

🔍🖥️ Suite desktop test results: View in Currents

socket-security · 2026-01-04T17:37:35Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

npm/electron-updater@6.7.3

View full report

Lemonexe · 2026-01-04T18:34:55Z

        '!node_modules/ajv/lib',
        '!node_modules/blake-hash/**/{build,src}',
        '!node_modules/usb/**/{libusb,libusb_config,src}',
+        '!node_modules/@trezor/**', // prevent inclusion of @trezor/suite-desktop, which would recurse


This is how the recursive hell looks like – app.asar.unpacked would contain the entire trezor suite 😅
https://github.com/user-attachments/assets/94d5cc72-6ed6-4f39-a5c2-e438ffa15ef0

When I fixed that, I noticed that the artifacts are +23 MB larger, but I confirmed that this is not fault of electron-builder ✔️ , it's our JS build that has grown, probably due to dependencies. Images have grown +3 MB.

Cool, maybe you could add a comment that these modules are already bundled by Webpack into the dist folder.

Added, and I cleaned up some of the exclusions, which are no longer necessary. By comparing the app.asar, I identified only those that are useful. 4eb9500

Lemonexe · 2026-01-04T18:35:41Z

        icon: 'build/static/images/desktop/512x512.icns',
        artifactName: 'Trezor-Suite-${version}-mac-${arch}.${ext}',
-        hardenedRuntime: true,
+        hardenedRuntime: isCodesignBuild,


lest the installed app crashes with

$ "/Applications/Trezor Suite.app/Contents/MacOS/Trezor Suite" Termination Reason: Namespace DYLD, Code 1 Library missing Library not loaded: @rpath/Electron Framework.framework/Electron Framework Referenced from: <4C4C44E4-5555-3144-A158-EDA204878E47> /Applications/Trezor Suite.app/Contents/MacOS/Trezor Suite Reason: tried: '/Applications/Trezor Suite.app/Contents/Frameworks/Electron Framework.framework/Electron Framework' (code signature in <4C4C44A0-5555-3144-A1EB-8E38D66573A7> '/Applications/Trezor Suite.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework' not valid for use in process: mapping process and mapped file (non-platform) have different Team IDs), '/Applications/Trezor Suite.app/Contents/Frameworks/Electron Framework.framework/Electron Framework' (code signature in <4C4C44A0-5555-3144-A1EB-8E38D66573A7> '/Applications/Trezor Suite.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework' not valid for use in process: mapping process and mapped file (non-platform) have different Team IDs) (terminated at launch; ignore backtrace)

Lemonexe · 2026-01-04T18:50:54Z

+            }
+         }
+     }
+     async signApp(packContext, isAsar) {


I made an upstream PR in electron-userland/electron-builder#9481

trezor-bot · 2026-01-04T19:00:26Z

✅ Previously successful run of [Test] PR Suite Web e2e tests workflow has been found.
⏭️ Skipping tests for this run.
💡 If you are unsure about your latest changes, please rerun the workflow manually. (Use the Re-run all jobs option)

trezor-bot · 2026-01-04T19:00:27Z

✅ Previously successful run of [Test] PR Suite Desktop e2e tests workflow has been found.
⏭️ Skipping tests for this run.
💡 If you are unsure about your latest changes, please rerun the workflow manually. (Use the Re-run all jobs option)

Lemonexe · 2026-01-04T19:33:51Z

@SocketSecurity ignore npm/electron-updater@6.7.3
I briefly checked upstream of electron-updater changes, LGTM.
But the changeset is too large to review properly, so I did not read it all.

Lemonexe · 2026-01-05T12:01:14Z

-    */
-    if (electronPlatformName !== 'win32') {
+    // As of Electron 39, ASAR integrity is not supported on Linux, so we set the appropriate fuses for Windows and macOS
+    if (electronPlatformName !== 'win32' && electronPlatformName !== 'darwin') {


I confirmed that it is working on 🍎 :

$ npx @electron/fuses read --app "/Applications/Trezor Suite.app" Analyzing app: Trezor Suite.app Fuse Version: v1 RunAsNode is Enabled EnableCookieEncryption is Disabled EnableNodeOptionsEnvironmentVariable is Enabled EnableNodeCliInspectArguments is Enabled EnableEmbeddedAsarIntegrityValidation is Enabled OnlyLoadAppFromAsar is Enabled LoadBrowserProcessSpecificV8Snapshot is Disabled GrantFileProtocolExtraPrivileges is Enabled

komret · 2026-01-06T09:23:35Z

        '!node_modules/ajv/lib',
        '!node_modules/blake-hash/**/{build,src}',
        '!node_modules/usb/**/{libusb,libusb_config,src}',
+        '!node_modules/@trezor/**', // prevent inclusion of @trezor/suite-desktop, which would recurse


Cool, maybe you could add a comment that these modules are already bundled by Webpack into the dist folder.

Lemonexe added dependencies Pull requests that update a dependency file build-desktop This will trigger the build of desktop apps for your PR labels Jan 4, 2026

Lemonexe commented Jan 4, 2026

View reviewed changes

Lemonexe force-pushed the chore/bump-electron-builder branch from 6f1ede5 to 8278ad7 Compare January 4, 2026 19:00

Lemonexe marked this pull request as ready for review January 4, 2026 19:38

Lemonexe requested review from komret, martykan and mroz22 as code owners January 4, 2026 19:38

Lemonexe force-pushed the chore/bump-electron-builder branch from 8278ad7 to 13bdba8 Compare January 5, 2026 10:12

Lemonexe commented Jan 5, 2026

View reviewed changes

komret approved these changes Jan 6, 2026

View reviewed changes

Lemonexe force-pushed the chore/bump-electron-builder branch from 13bdba8 to 475887e Compare January 6, 2026 11:20

Lemonexe mentioned this pull request Jan 6, 2026

Bump foundation deps 2026.1 #24168

Merged

Lemonexe force-pushed the chore/bump-electron-builder branch from 475887e to 4eb9500 Compare January 6, 2026 13:55

Lemonexe and others added 3 commits January 8, 2026 17:53

chore(suite-desktop): bump electron-builder & related

cb7c064

chore(suite-desktop): fix macOS ad-hoc signing for local build

87201af

chore(suite-desktop): cleanup electron-builder files

d105ec8

Lemonexe force-pushed the chore/bump-electron-builder branch from 4eb9500 to d105ec8 Compare January 8, 2026 16:57

Lemonexe enabled auto-merge (rebase) January 8, 2026 17:14

Lemonexe merged commit 8471996 into develop Jan 8, 2026
33 of 34 checks passed

Lemonexe deleted the chore/bump-electron-builder branch January 8, 2026 17:30

Lemonexe restored the chore/bump-electron-builder branch January 8, 2026 19:04

Lemonexe deleted the chore/bump-electron-builder branch January 8, 2026 19:04

Lemonexe mentioned this pull request Jan 28, 2026

chore(suite-desktop): bump electron-builder #24753

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Chore: bump electron-builder#24136

Chore: bump electron-builder#24136
Lemonexe merged 3 commits intodevelopfrom
chore/bump-electron-builder

Lemonexe commented Jan 4, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jan 4, 2026 •

edited

Loading

Uh oh!

Lemonexe Jan 4, 2026

Uh oh!

komret Jan 6, 2026

Uh oh!

Lemonexe Jan 6, 2026

Uh oh!

Lemonexe Jan 4, 2026

Uh oh!

Lemonexe Jan 4, 2026

Uh oh!

trezor-bot Bot commented Jan 4, 2026 •

edited

Loading

Uh oh!

trezor-bot Bot commented Jan 4, 2026 •

edited

Loading

Uh oh!

Lemonexe commented Jan 4, 2026

Uh oh!

Lemonexe Jan 5, 2026

Uh oh!

komret Jan 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Lemonexe commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Notes for QA

Related Issue

Uh oh!

socket-security Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lemonexe Jan 4, 2026

Choose a reason for hiding this comment

Uh oh!

komret Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

Lemonexe Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

Lemonexe Jan 4, 2026

Choose a reason for hiding this comment

Uh oh!

Lemonexe Jan 4, 2026

Choose a reason for hiding this comment

Uh oh!

trezor-bot Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

trezor-bot Bot commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lemonexe commented Jan 4, 2026

Uh oh!

Lemonexe Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

komret Jan 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Lemonexe commented Jan 4, 2026 •

edited

Loading

socket-security Bot commented Jan 4, 2026 •

edited

Loading

trezor-bot Bot commented Jan 4, 2026 •

edited

Loading

trezor-bot Bot commented Jan 4, 2026 •

edited

Loading