Electron Auto-Update Failing Code Signature Validation & SHA512 Checksum Mismatch

[balasaravanan3502]

Description

A portion (~10%) of our desktop application users are experiencing persistent update failures with two related error patterns.

These users are unable to receive automatic updates and get stuck on older versions, requiring manual reinstallation.

Environment

Package Versions:

• electron-updater: 6.3.9
• electron: 37.2.6

Update Infrastructure:

• S3 bucket for auto-updates
• Generic provider configuration

Error Patterns

Error 1: Code Signature Validation Failure

Code signature at URL file:///Users/<user>/Library/Caches/ai.app.desktop.ShipIt/update.O8KoRoc/App.app/ 
did not pass validation: code failed to satisfy specified code requirement(s)
Code signature at URL file:///Users/<user>/Library/Caches/ai.app.desktop.ShipIt/update.O8KoRoc/App.app/ did not pass validation: code failed to satisfy specified code requirement(s)

Error 2: SHA512 Checksum Mismatch

Error: sha512 checksum mismatch, expected CwYXUVS2CQCXTr43YbAPJHa8GiXjxvENqkat4h6YlcNz+V7GW1zT/Gw7SfOxk+u4YWgDs0AxVx7HIj6jQXX2uQ==, got Po/DroGaCMMmzDckTcJ5xtVMhLSk8W18B1rOWZuxb+dn5a8ppdBTjonoBiSOxD/169uYyrBg6fyhbCnqtDrRDw==

In the above case CwYXUVS2CQCXTr43YbAPJHa8GiXjxvENqkat4h6YlcNz is the current latest version

Code Spinnet:

export class UpdateEvents {

  constructor() {
    const feedUrl = new URL(process.env.UPDATE_CHANNEL, process.env.UPDATE_SERVER_URL).href;

    logger.debug(`Update: Setting feed URL to ${feedUrl}`);

    autoUpdater.setFeedURL({
      channel: 'latest',
      provider: 'generic',
      url: feedUrl,
    });

    autoUpdater.autoDownload = true;
    autoUpdater.autoInstallOnAppQuit = true;

    this.registerHandlers();
  }

  private registerHandlers(): void {
    autoUpdater.on('checking-for-update', () => {
      logger.debug('Update: Checking for updates');
    });

    autoUpdater.on('update-available', (info) => {
      logger.debug(`Update: Update available - version ${info.version}`);
    });

    autoUpdater.on('update-downloaded', (info) => {
      logger.debug(`Update: Update downloaded - version ${info.version}`);
      
      autoUpdater.quitAndInstall();
    });


    autoUpdater.on('error', (err) => {
      logger.error('Update: Error checking for updates', err);
    });
  }

  static bootstrap() {
    new UpdateEvents();
  }
}