build/entitlements.mac.plist (1)

11-12: Disable library validation for Widevine. Adding com.apple.security.cs.disable-library-validation is necessary for loading Widevine CDM components, but be aware this relaxes macOS library validation and can increase the attack surface. Consider adding a comment to document this requirement for future maintainers.

CONTRIBUTING.md (1)

73-80: Refine markdown link and wording.

• Replace the bare URL with a markdown link to comply with linting (MD034).
• Simplify the phrasing by removing "in order to".

-## Widevine VMP Signing (Advanced)
-This build pipeline contains Widevine VMP Signing Capabilities. However, you will have to create an account in order to enable it.
-Create an Account: https://github.com/castlabs/electron-releases/wiki/EVS#creating-an-evs-account
-Once logged in, the app will be automatically VMP-signed, and you can enjoy Widevine Protected Content!
+## Widevine VMP Signing (Advanced)
+This build pipeline supports Widevine VMP signing. You must create an account to enable it.
+- Create an EVS account: [EVS account creation guide](https://github.com/castlabs/electron-releases/wiki/EVS#creating-an-evs-account)
+Once logged in, the app will be automatically VMP-signed, allowing playback of Widevine protected content.

🧰 Tools

🪛 LanguageTool

[style] ~75-~75: Consider a more concise word here.
Context: ...ver, you will have to create an account in order to enable it. Create an Account: https://...

(IN_ORDER_TO_PREMIUM)

🪛 markdownlint-cli2 (0.17.2)

77-77: Bare URL used
null

(MD034, no-bare-urls)

build/hooks/afterSign.js (2)

5-5: Fix JSDoc return type annotation

The JSDoc type annotation indicates a return type of void, but the function is async and returns a Promise.

-/** @type {(context: import("./types.js").PackContext) => void} */
+/** @type {(context: import("./types.js").PackContext) => Promise<void>} */

---

13-16: Improve error handling for better debugging

The current implementation silently swallows errors during signing, which might hide important failure information.

-    await signAppWithVMP(context.appOutDir)
-      .then(() => true)
-      .catch(() => false);
+    try {
+      await signAppWithVMP(context.appOutDir);
+    } catch (error) {
+      console.error(`Error during VMP signing: ${error.message}`);
+      // Continue build process despite signing failure
+    }

build/hooks/afterPack.js (2)

5-5: Fix JSDoc return type annotation

The JSDoc type annotation indicates a return type of void, but the function is async and returns a Promise.

-/** @type {(context: import("./types.js").PackContext) => void} */
+/** @type {(context: import("./types.js").PackContext) => Promise<void>} */

---

13-16: Improve error handling for better debugging

The current implementation silently swallows errors during signing, which might hide important failure information.

-    await signAppWithVMP(context.appOutDir)
-      .then(() => true)
-      .catch(() => false);
+    try {
+      await signAppWithVMP(context.appOutDir);
+    } catch (error) {
+      console.error(`Error during VMP signing: ${error.message}`);
+      // Continue build process despite signing failure
+    }

docs/contributing/updating-electron.md (2)

7-31: Consider adding a verification step for the update process

The guide would benefit from adding a step to verify that the updated Electron version works correctly with Widevine CDM before finalizing the update.

Consider adding:

5a. Test that Widevine CDM is working correctly:
   - Build the application with `bun run build`
   - Open a Widevine-protected streaming service (like Netflix or Disney+)
   - Verify playback works as expected

---

38-38: Add link to the specific Bun issue

For better reference, consider making the issue reference a clickable link.

-This is because of a [bun issue](https://github.com/oven-sh/bun/issues/19585), which causes `git clone` of the fork to fail.
+This is because of a [bun issue #19585](https://github.com/oven-sh/bun/issues/19585), which causes `git clone` of the fork to fail.

build/hooks/components/castlabs-evs.js (3)

10-14: Simplify platform-specific path logic

The current code sets the same signPath value for both platforms, making the separate conditional branches unnecessary.

-  let signPath = null;
-  if (process.platform === "darwin") {
-    signPath = appOutDir;
-  } else if (process.platform === "win32") {
-    signPath = appOutDir;
-  }
+  // Only sign on supported platforms
+  const supportedPlatforms = ["darwin", "win32"];
+  const signPath = supportedPlatforms.includes(process.platform) ? appOutDir : null;

---

20-20: Add error handling for Python command execution

The code assumes python3 is in the PATH, which might not be true in all environments. Consider adding validation or fallback options.

-        const signProcess = spawn("python3", ["-m", "castlabs_evs.vmp", "--no-ask", "sign-pkg", signPath]);
+        // Try python3 first, fall back to python if needed
+        const pythonCommand = process.platform === "win32" ? "python" : "python3";
+        const signProcess = spawn(pythonCommand, ["-m", "castlabs_evs.vmp", "--no-ask", "sign-pkg", signPath]);

---

41-44: Add timeout handling for signing process

The current implementation doesn't handle cases where the signing process might hang indefinitely.

+        // Set timeout to prevent hanging indefinitely
+        const timeout = setTimeout(() => {
+          console.error("Signing process timed out after 5 minutes");
+          signProcess.kill();
+          reject(new Error("Signing process timed out"));
+        }, 5 * 60 * 1000);
+
         signProcess.on("error", (error) => {
           console.error("Error in signing process:", error.message);
+          clearTimeout(timeout);
           reject(error);
         });
+
+        signProcess.on("close", (code) => {
+          clearTimeout(timeout);
+          // ... existing code ...
+        });

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

CONTRIBUTING.md (1)

73-79: Refine phrasing for clarity and conciseness.

Consider replacing “contains Widevine VMP Signing Capabilities” with a more direct phrase and streamlining “in order to enable it” to “to enable it”.

Apply this diff:

- This build pipeline contains Widevine VMP Signing Capabilities. However, you will have to create an account in order to enable it.
+ This build pipeline includes Widevine VMP signing capabilities. However, you will have to create an account to enable them.

🧰 Tools

🪛 LanguageTool

[style] ~75-~75: Consider a more concise word here.
Context: ...ver, you will have to create an account in order to enable it. Create an Account: https://...

(IN_ORDER_TO_PREMIUM)

docs/contributing/updating-electron.md (4)

11-16: Remove comments from JSON code snippets.

The JSON examples include // Template and // Example comments, which are not valid JSON. Consider either using a pseudo-JSON snippet or removing the inline comments:

- ```json
- // Template
- "electron": "github:castlabs/electron-releases#<version>",
-
- // Example
- "electron": "github:castlabs/electron-releases#v35.3.0+wvcus",
- ```
+ ```jsonc
+ "electron": "github:castlabs/electron-releases#<version>"
+
+ // Example:
+ "electron": "github:castlabs/electron-releases#v35.3.0+wvcus"
+ ```

---

18-18: Add missing article for clarity.

The instruction should read “update the bun.lock file” instead of “update bun.lock file.”

Apply this diff:

- 3. Run `bun install` to update `bun.lock` file.
+ 3. Run `bun install` to update the `bun.lock` file.

🧰 Tools

🪛 LanguageTool

[uncategorized] ~18-~18: You might be missing the article “the” here.
Context: ...s", ``` 3. Run bun install to update `bun.lock` file. 4. Find the electron en...

(AI_EN_LECTOR_MISSING_DETERMINER_THE)

---

23-28: Clean up comments in bun.lock snippet.

Similar to the package.json snippet, the snippet for bun.lock contains // Template and // Example comments, which aren’t valid JSON. Consider changing to jsonc or removing comments:

- ```json
- // Template
- "electron": ["electron@git+ssh://github.com/castlabs/electron-releases#<commit_hash>", "..."],
-
- // Example
- "electron": ["electron@git+ssh://github.com/castlabs/electron-releases#c3d0eae09e098fbf33873ecbb95a8ca0fb5e48f5", "..."],
- ```
+ ```jsonc
+ "electron": [
+   "electron@git+ssh://github.com/castlabs/electron-releases#<commit_hash>",
+   "..."
+ ]
+
+ // Example:
+ // "electron": ["electron@git+ssh://github.com/castlabs/electron-releases#c3d0eae09e098fbf33873ecbb95a8ca0fb5e48f5", "..."]
+ ```

---

35-35: Clarify cache cleanup instruction.

Change “delete bun's cache” to “delete the Bun cache” and capitalize consistently:

- 7. Additionally, you can delete bun's cache at `~/.bun/install/cache`, delete `node_modules`, and re-run `bun install` to make sure everything would work as expected.
+ 7. Additionally, you can delete the Bun cache at `~/.bun/install/cache`, remove `node_modules`, and re-run `bun install` to ensure everything works as expected.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro