From 16be935b91664da2ab63ff405d94b6b8e232ef59 Mon Sep 17 00:00:00 2001 From: "mr. m" <91018726+mr-cheffy@users.noreply.github.com> Date: Sat, 11 Apr 2026 18:17:22 +0200 Subject: [PATCH] Revert "no-bug: Sign mars after building them (gh-13213)" This reverts commit a4f0d01a88d10447682cfa29dde8b6aa16441c2a. --- .github/workflows/build.yml | 14 +++++ .github/workflows/linux-release-build.yml | 17 +++-- .../macos-universal-release-build.yml | 9 --- .github/workflows/windows-release-build.yml | 10 --- prefs/zen/split-view.yaml | 4 +- prefs/zen/workspaces.yaml | 2 +- prefs/zen/zen.yaml | 2 +- scripts/mar_sign.sh | 62 +++++++++++-------- 8 files changed, 61 insertions(+), 59 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3d0fe531c..00e8d76f1 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -505,6 +505,20 @@ jobs: run: | git clone https://github.com/zen-browser/windows-binaries.git .github/workflows/object --depth 1 + - name: Download signmar-linux-x86_64 from artifacts + uses: actions/download-artifact@v4 + with: + name: signmar-linux-x86_64 + + - name: Sign MAR files + env: + SIGNMAR: ${{ github.workspace }}/signmar-linux-x86_64/signmar + ZEN_MAR_SIGNING_PASSWORD: ${{ secrets.ZEN_MAR_SIGNING_PASSWORD }} + ZEN_SIGNING_CERT_PEM_BASE64: ${{ secrets.ZEN_SIGNING_CERT_PEM_BASE64 }} + ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64: ${{ secrets.ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64 }} + run: | + bash scripts/mar_sign.sh -s + - name: Copy update manifests env: RELEASE_BRANCH: ${{ inputs.update_branch }} diff --git a/.github/workflows/linux-release-build.yml b/.github/workflows/linux-release-build.yml index 50a7b954c..2ce7906cc 100644 --- a/.github/workflows/linux-release-build.yml +++ b/.github/workflows/linux-release-build.yml @@ -153,15 +153,6 @@ jobs: mv dist/zen-*.tar.xz "zen.linux-${{ matrix.arch }}.tar.xz" mv dist/output.mar linux${{ matrix.arch == 'aarch64' && '-aarch64' || '' }}.mar - - name: Sign MAR - env: - SIGNMAR: engine/obj-${{ matrix.arch == 'aarch64' && 'aarch64-unknown' || 'x86_64-pc' }}-linux-gnu/dist/bin/signmar - ZEN_MAR_SIGNING_PASSWORD: ${{ secrets.ZEN_MAR_SIGNING_PASSWORD }} - ZEN_SIGNING_CERT_PEM_BASE64: ${{ secrets.ZEN_SIGNING_CERT_PEM_BASE64 }} - ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64: ${{ secrets.ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64 }} - run: | - bash scripts/mar_sign.sh -s ./linux${{ matrix.arch == 'aarch64' && '-aarch64' || '' }}.mar - - name: Upload build artifact (binary) uses: actions/upload-artifact@v4 with: @@ -182,3 +173,11 @@ jobs: retention-days: 5 name: linux_update_manifest_${{ matrix.arch }} path: ./dist/update + + - name: Upload signmar + if: ${{ matrix.arch == 'x86_64' }} + uses: actions/upload-artifact@v4 + with: + retention-days: 2 + name: signmar-linux-x86_64 + path: engine/obj-x86_64-pc-linux-gnu/dist/bin/signmar diff --git a/.github/workflows/macos-universal-release-build.yml b/.github/workflows/macos-universal-release-build.yml index ea62c9667..dbc2130f0 100644 --- a/.github/workflows/macos-universal-release-build.yml +++ b/.github/workflows/macos-universal-release-build.yml @@ -247,15 +247,6 @@ jobs: npm run package -- --verbose mv ./dist/output.mar ./macos.mar - - name: Sign MAR - env: - SIGNMAR: engine/obj-x86_64-apple-darwin/dist/bin/signmar - ZEN_MAR_SIGNING_PASSWORD: ${{ secrets.ZEN_MAR_SIGNING_PASSWORD }} - ZEN_SIGNING_CERT_PEM_BASE64: ${{ secrets.ZEN_SIGNING_CERT_PEM_BASE64 }} - ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64: ${{ secrets.ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64 }} - run: | - bash scripts/mar_sign.sh -s ./macos.mar - - name: Upload build artifact (.mar) uses: actions/upload-artifact@v4 with: diff --git a/.github/workflows/windows-release-build.yml b/.github/workflows/windows-release-build.yml index 353732b61..a7260a733 100644 --- a/.github/workflows/windows-release-build.yml +++ b/.github/workflows/windows-release-build.yml @@ -281,16 +281,6 @@ jobs: mv ./dist/output.mar windows${{ matrix.arch == 'aarch64' && '-arm64' || '' }}.mar mv ./dist/zen.installer.exe ./zen.installer${{ matrix.arch == 'aarch64' && '-arm64' || '' }}.exe - - name: Sign MAR - if: ${{ !inputs.generate-gpo }} - env: - SIGNMAR: engine/obj-${{ matrix.arch }}-pc-windows-msvc/dist/bin/signmar - ZEN_MAR_SIGNING_PASSWORD: ${{ secrets.ZEN_MAR_SIGNING_PASSWORD }} - ZEN_SIGNING_CERT_PEM_BASE64: ${{ secrets.ZEN_SIGNING_CERT_PEM_BASE64 }} - ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64: ${{ secrets.ZEN_SIGNING_PRIVATE_KEY_PEM_BASE64 }} - run: | - bash scripts/mar_sign.sh -s ./windows${{ matrix.arch == 'aarch64' && '-arm64' || '' }}.mar - - name: Upload artifact (PGO) uses: actions/upload-artifact@v4 if: ${{ inputs.generate-gpo && matrix.arch == 'x86_64' }} diff --git a/prefs/zen/split-view.yaml b/prefs/zen/split-view.yaml index aa02b6def..869b4c459 100644 --- a/prefs/zen/split-view.yaml +++ b/prefs/zen/split-view.yaml @@ -15,7 +15,7 @@ value: true - name: zen.splitView.drag-over-split-delayMC - value: 350 + value: 1000 - name: zen.splitView.drag-over-split-threshold - value: 25 + value: 40 diff --git a/prefs/zen/workspaces.yaml b/prefs/zen/workspaces.yaml index 58a0499ac..400a4bc9e 100644 --- a/prefs/zen/workspaces.yaml +++ b/prefs/zen/workspaces.yaml @@ -33,7 +33,7 @@ value: true - name: zen.workspaces.dnd-switch-padding - value: 20 + value: 5 - name: zen.workspaces.debug value: "@cond" diff --git a/prefs/zen/zen.yaml b/prefs/zen/zen.yaml index 685bb3866..fd0dbd67f 100644 --- a/prefs/zen/zen.yaml +++ b/prefs/zen/zen.yaml @@ -27,7 +27,7 @@ value: 20 # Percentage of folder height to trigger dragover - name: zen.tabs.dnd-switch-space-delay - value: 500 # milliseconds + value: 800 # milliseconds - name: zen.ctrlTab.show-pending-tabs value: false diff --git a/scripts/mar_sign.sh b/scripts/mar_sign.sh index 43b9eb7e7..8b12a5d68 100644 --- a/scripts/mar_sign.sh +++ b/scripts/mar_sign.sh @@ -84,7 +84,7 @@ create_nss_config_dir() { openssl pkcs12 -export \ -inkey "$CERT_PATH_DIR/private_key.pem" \ -in "$CERT_PATH_DIR/cert.pem" \ - -name "mar_cert" \ + -name "private_key" \ -passout pass:"$ZEN_MAR_SIGNING_PASSWORD" \ -out "$CERT_PATH_DIR/private_key.p12" @@ -105,19 +105,7 @@ cleanup_certs() { rm -f "$CERT_PATH_DIR/cert.pem" } -sign_mar() { - local mar_file="$1" - - if [ -z "$mar_file" ]; then - echo "Error: .mar file path is required. Usage: $0 -s " >&2 - exit 1 - fi - - if [ ! -f "$mar_file" ]; then - echo "Error: .mar file not found at $mar_file" >&2 - exit 1 - fi - +sign_mars() { if [ ! -f "$SIGNMAR" ]; then echo "Error: signmar not found at $SIGNMAR. Build the engine first." >&2 exit 1 @@ -127,14 +115,34 @@ sign_mar() { create_nss_config_dir - echo "" - echo "Signing $mar_file..." - # mar [-C workingDir] -d NSSConfigDir -n certname -s archive.mar out_signed_archive.mar - "$SIGNMAR" -d "$NSS_CONFIG_DIR" -n "mar_cert" -s "$mar_file" "$mar_file".signed - echo "Signed $mar_file. Verifying signature..." - "$SIGNMAR" -d "$NSS_CONFIG_DIR" -n "mar_cert" -v "$mar_file".signed - mv "$mar_file".signed "$mar_file" - echo "Successfully signed $mar_file" + folders=( + linux.mar + linux-aarch64.mar + windows.mar + windows-arm64 + macos.mar + ) + # each folder will contain the .mar files for that platform, and the signature will be written in-place + for folder in "${folders[@]}"; do + if [ -d "$folder" ]; then + for mar_file in "$folder"/*.mar; do + if [ -f "$mar_file" ]; then + echo "" + echo "Signing $mar_file..." + # mar [-C workingDir] -d NSSConfigDir -n certname -s archive.mar out_signed_archive.mar + "$SIGNMAR" -d "$NSS_CONFIG_DIR" -n "private_key" -s "$mar_file" "$mar_file".signed + echo "Signed $mar_file. Verifying signature..." + "$SIGNMAR" -d "$NSS_CONFIG_DIR" -n "private_key" -v "$mar_file".signed + mv "$mar_file".signed "$mar_file" + echo "Successfully signed $mar_file" + else + echo "No .mar files found in $folder, skipping." + fi + done + else + echo "Directory $folder not found, skipping." + fi + done cleanup_certs } @@ -147,13 +155,13 @@ case "$1" in import_cert ;; -s) - sign_mar "$2" + sign_mars ;; *) - echo "Usage: $0 [-g] [-i] [-s ]" >&2 - echo " -g Generate MAR signing certificates" >&2 - echo " -i Import the certificate into the updater (release_primary.der)" >&2 - echo " -s Sign the given .mar file in-place" >&2 + echo "Usage: $0 [-g] [-i] [-s]" >&2 + echo " -g Generate MAR signing certificates" >&2 + echo " -i Import the certificate into the updater (release_primary.der)" >&2 + echo " -s Sign *.mar files in the current directory in-place" >&2 exit 1 ;; esac