Fix GitHub Actions build

.github/workflows/client-release.yml

@@ -83,6 +83,10 @@ jobs:
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
           security set-keychain-settings -t 3600 -u build.keychain
 
+          # Add build.keychain to the user keychain search list so that codesign
+          # (invoked later by tauri-action WITHOUT an explicit --keychain) can
+          # resolve the signing identity from it.
+          security list-keychains -d user -s build.keychain $(security list-keychains -d user | tr -d '"')
 
           echo "Created keychain"
 
@@ -118,8 +122,12 @@ jobs:
       - uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          # Do NOT set APPLE_CERTIFICATE / APPLE_CERTIFICATE_PASSWORD here. Doing so
+          # makes tauri-action import the cert into its own throwaway keychain and
+          # look up the identity by Apple-only name prefixes (e.g.
+          # "Developer ID Application:"), which never matches our "Drop OSS" cert
+          # and fails with "failed to resolve signing identity". Instead we rely on
+          # the build.keychain prepared above and only pass the resolved identity.
           APPLE_SIGNING_IDENTITY: ${{ env.CERT_ID }}
           NO_STRIP: true
         with:

.github/workflows/server-release.yml

@@ -89,8 +89,6 @@ jobs:
           build-args: |
             BUILD_DROP_VERSION=${{ steps.get_final_ver.outputs.final_ver }}
             BUILD_GIT_REF=${{ github.sha }}
-          context: ./server
-          file: ./server/Dockerfile
 
       - name: Export digest
         run: |

Dockerfile

@@ -1,6 +1,8 @@
 # syntax=docker/dockerfile:1
 
-FROM node:lts-alpine AS base
+# Pinned to bookworm so the glibc here matches the torrential build stage
+# and the libarchive runtime package is named `libarchive13` (trixie renames it to libarchive13t64).
+FROM node:lts-bookworm-slim AS base
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
 RUN corepack enable
@@ -20,11 +22,17 @@ FROM base AS deps
 RUN pnpm install --frozen-lockfile --ignore-scripts
 
 ### BUILD TORRENTIAL
-FROM rustlang/rust:nightly-alpine AS torrential-build
-RUN apk add musl-dev pkgconfig libarchive-dev libarchive
+# Bookworm-pinned to match the runtime image's glibc (a trixie build would not run on bookworm).
+FROM rustlang/rust:nightly-bookworm-slim AS torrential-build
+## libarchive-dev + pkg-config let libarchive3-sys link libarchive dynamically (glibc).
+## protobuf-compiler is kept for parity (torrential's build.rs uses a vendored protoc).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    pkg-config \
+    libarchive-dev \
+    protobuf-compiler \
+    && rm -rf /var/lib/apt/lists/*
 WORKDIR /build
 COPY . .
-RUN apk add protoc
 RUN cargo build --release --manifest-path ./torrential/Cargo.toml
 
 ### BUILD APP
@@ -34,7 +42,8 @@ ENV NODE_ENV=production
 ENV NUXT_TELEMETRY_DISABLED=1
 
 ## add git so drop can determine its git ref at build
-RUN apk add --no-cache git
+RUN apt-get update && apt-get install -y --no-install-recommends git \
+    && rm -rf /var/lib/apt/lists/*
 
 ## copy deps and rest of project files
 COPY . .
@@ -55,7 +64,19 @@ ENV NODE_ENV=production
 ENV NUXT_TELEMETRY_DISABLED=1
 
 # RUN --mount=type=cache,target=/root/.yarn YARN_CACHE_FOLDER=/root/.yarn yarn add --network-timeout 1000000 --no-lockfile --ignore-scripts prisma@6.11.1
-RUN apk add --no-cache pnpm 7zip nginx
+## runtime deps:
+##  - libarchive13: torrential now links libarchive dynamically (glibc build)
+##  - p7zip-full: provides the 7z CLI
+##  - nginx: front-end proxy
+##  - openssl + ca-certificates: required by Prisma's query engine on Debian
+## pnpm itself is provided by corepack (enabled in the base stage)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libarchive13 \
+    p7zip-full \
+    nginx \
+    openssl \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 RUN pnpm install prisma@7.3.0 --global
 # init prisma to download all required files
 RUN pnpm prisma init

desktop/package.json

@@ -7,7 +7,7 @@
     "tauri": "tauri"
   },
   "dependencies": {
-    "pino": "^9.7.0",
+    "pino": "^9.14.0",
     "pino-pretty": "^13.1.1",
     "tauri": "^0.15.0"
   },