[Astro-Han]

Summary

Nightly 87 failed while stapling Maka.app: @electron/notarize@2.5.0 configures retries but never schedules them, so a lost CloudKit connection aborts packaging after notarization has succeeded. Use the upstream fix from electron/notarize#306, released in 3.1.2, through an override limited to app-builder-lib's 2.5.0 dependency. Future dependency versions can advance normally.

Keep app notarization in electron-builder. The regression test uses its actual notarization caller and mocks only native commands: the first ticket request loses its connection, the second succeeds, and notarization is submitted exactly once. Existing DMG recovery tests remain because they protect a separate artifact stage. The dependency update also removes notarize's old fs-extra dependency.

Failure: https://github.com/apache/maka/actions/runs/38812884226/job/116697017344

Verification

• The new regression fails with the original dependency on the observed exit 68 / NSURLErrorDomain Code=-1005 error and passes with 3.1.2.
• Clean npm ci with npm 11.19.0; all dependency patches apply.
• Node 22.19.0: all 5 stapling tests pass.
• Node 24.21.0: all 26 stapling, Nightly packaging and workflow policy tests pass.
• npm run format, npm run lint, npm run check:third-party-notices and git diff --check pass.
• Native commands are simulated in the regression. A fresh signed Nightly is still needed to verify the Apple service path. Full workspace tests and typecheck were not run; this changes a build dependency and an MJS test only.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex investigated the failure, updated the dependency and added the regression test.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[me2seeks]

Reviewed at 9a5931a. No blocking findings.

Verified the observed Nightly failure and the electron-builder caller, scoped override, lockfile resolution, ESM loading and Node compatibility. Clean dependency installation with lifecycle scripts skipped, followed by the repository dependency patches, succeeded. All 30 focused stapling/Nightly tests passed; all 5 stapling tests also passed on Node 22.19.0. The new regression fails with the original 2.5.0 dependency on exit 68 / NSURLErrorDomain Code=-1005 and passes with 3.1.2, with exactly one notarization submission. Changed-file Biome checks and git diff --check passed. Hosted checks are green and there are no review threads.

Native commands were simulated; the live Apple service path still needs a fresh signed Nightly.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

At 9a5931ab, I found no P0–P2 issue. CI is green.

What I checked:

• Fix is real. In 3.1.2, notarize() wraps stapleApp in promise-retry with retries: 3, so a transient stapler failure (exit 68) is retried after notarization succeeds, without submitting again.
• ESM-only package loaded from CJS. 3.x is "type": "module" with engines.node >= 22.12.0. app-builder-lib 26.15.3 loads it through dynamicImport("@electron/notarize"), not require, and the module has no top-level await. The repository requires Node >= 22.19.0, so both paths are fine.
• Options compatibility. MacTargetHelper.getNotarizeOptions passes { tool: "notarytool", appPath, ...credentials }. 3.1.2 spreads the extra tool key into the notarytool options, where it is ignored, and keeps the same password, API-key and keychain credential shapes. The release workflow uses API-key credentials (APPLE_API_KEY*). The regression uses the password path, but the retry is independent of credentials.
• Override scope. app-builder-lib is the only consumer of @electron/notarize in the lockfile, and the latest stable app-builder-lib (26.15.3) still pins 2.5.0, so the version-scoped override is needed today. The dropped fs-extra@9 subtree was only used by notarize 2.x.

P3 (no action needed now): the override key is pinned to exactly @electron/notarize@2.5.0. If app-builder-lib later moves to another 2.x version that still lacks the retry, the override silently stops applying. That seems acceptable given the intent to let future versions advance, but it may be worth a one-line comment, or a check in the stapling test that the resolved notarize version is at least 3.1.2.

As the PR says, an Apple-service run on a signed Nightly is still needed. Native commands are mocked here.