From 95f2b8acb4c8f92a46bf49c62dbd467fd17a5b62 Mon Sep 17 00:00:00 2001
From: tianma-if <yingwaizhiying@gmail.com>
Date: Sun, 30 Aug 2026 11:30:37 +0800
Subject: [PATCH] fix(ci): normalize Windows ASAR paths in package audit

---
 scripts/desktop-build-workflow.test.mjs | 4 ++++
 scripts/verify-desktop-package.mjs      | 7 +++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/scripts/desktop-build-workflow.test.mjs b/scripts/desktop-build-workflow.test.mjs
index 497318d3..035e5d4f 100644
--- a/scripts/desktop-build-workflow.test.mjs
+++ b/scripts/desktop-build-workflow.test.mjs
@@ -3,6 +3,7 @@ import { describe, expect, test } from "bun:test";
 
 const workflow = readFileSync(new URL("../.github/workflows/desktop-build.yml", import.meta.url), "utf8");
 const mobileWorkflow = readFileSync(new URL("../.github/workflows/mobile-build.yml", import.meta.url), "utf8");
+const desktopPackageVerifier = readFileSync(new URL("./verify-desktop-package.mjs", import.meta.url), "utf8");
 
 function step(name) {
   const start = workflow.indexOf(`      - name: ${name}\n`);
@@ -78,5 +79,8 @@ describe("desktop release workflow", () => {
     expect(workflow).toContain("allow-missing-windows-signature");
     expect(workflow).toContain("name: Audit signed Windows update");
     expect(workflow).toContain("verify-windows-update-release.mjs");
+    expect(desktopPackageVerifier).toContain(
+      'path.replaceAll("\\\\", "/")',
+    );
   });
 });
diff --git a/scripts/verify-desktop-package.mjs b/scripts/verify-desktop-package.mjs
index 4632d1e7..45f5d922 100644
--- a/scripts/verify-desktop-package.mjs
+++ b/scripts/verify-desktop-package.mjs
@@ -25,6 +25,9 @@ const files = walk(outputDirectory);
 const matchingPrefix = (prefix) => files.filter((path) => basename(path).startsWith(prefix));
 const requestedPlatform = process.env.EDGE_EVER_VERIFY_TARGET ?? process.platform;
 const requestedArch = process.env.EDGE_EVER_DESKTOP_ARCH ?? process.arch;
+const listAsarFiles = (asarPath) => new Set(
+  listPackage(asarPath).map((path) => path.replaceAll("\\", "/")),
+);
 
 const verifyMachOArch = (path, arch, label) => {
   const result = spawnSync("lipo", ["-archs", path], { encoding: "utf8" });
@@ -72,7 +75,7 @@ if (requestedPlatform === "darwin") {
   verifyMachOArch(sidecar, requestedArch, "Rust sidecar");
   const asarPath = join(appResources, "app.asar");
   assert.ok(existsSync(asarPath), `macOS app bundle is missing app.asar: ${asarPath}`);
-  const asarFiles = new Set(listPackage(asarPath));
+  const asarFiles = listAsarFiles(asarPath);
   assert.ok(asarFiles.has("/src/preload/index.cjs"), "macOS app bundle must contain the sandbox-compatible CommonJS preload");
   assert.ok(!asarFiles.has("/src/preload/index.mjs"), "macOS app bundle must not contain the unsupported ESM preload");
   const appIconPath = join(appResources, "icon.icns");
@@ -100,7 +103,7 @@ if (requestedPlatform === "darwin") {
   verifyPeX64(sidecar, "Rust sidecar");
   const asarPath = join(resources, "app.asar");
   assert.ok(existsSync(asarPath), `Windows app bundle is missing app.asar: ${asarPath}`);
-  const asarFiles = new Set(listPackage(asarPath));
+  const asarFiles = listAsarFiles(asarPath);
   assert.ok(asarFiles.has("/src/preload/index.cjs"), "Windows app bundle must contain the sandbox-compatible CommonJS preload");
   assert.ok(!asarFiles.has("/src/preload/index.mjs"), "Windows app bundle must not contain the unsupported ESM preload");
 } else if (requestedPlatform === "linux") {