Conveyor 15.1

[mikehearn]

This is a bugfix and maintenance release. It focuses on reducing the cost of using the cloud signing services offered by certificate authorities.

• Fixed an issue that could cause ERROR_ACCESS_DENIED to be returned by the Win32 CreateProcess API when invoking non-primary EXEs in some install types. This can occur when using the NodeJS exec API and is a bug in Windows that is now worked around for all EXEs that are included in your package input files. The necessary changes to the EXE files won't be made to EXEs inside archives. Make sure that any EXEs you plan to invoke are unpacked into your install directory.
• macOS Electron apps now uses the standard Electron build instead of the Mac App Store build. This avoids bugs that only exist in the App Store build at a small cost in download size.
• Fixed an issue that could cause conveyor run to fail for Linux Electron apps.

There's a new command for understanding the contents of the disk cache, conveyor print-cache-entries. It shows you the hash key, first line of the full cache key, size, how long an entry took to compute, when it was last accessed and the carrying cost (higher = more likely to be evicted). You can also use this command to print out the full cache key for any given entry, which may help understand the system better. The output is sorted in descending order of eviction priority.

Cost optimization

Cloud signing services from DigiCert or SSL.com can charge high prices for each digital signature they serve. This release of Conveyor adds optimizations to reduce the cost. As long as you don't clear your disk cache there should be fewer signature operations consumed by this release.

1. Input files that are pre-signed will be used as-is. You can therefore reduce costs by running conveyor make windows-app, letting it sign your EXE/DLL files, then copying them out of the output directory over your input files. Now those files won't be signed again. Note that this only applies to files signed by your configured signing identity, so virus scanners and other tools will still see a consistent set of signatures.
2. Signatures are now held in the cache standalone, reducing the space consumed in the cache and therefore the likelihood of them being flushed. Previously Conveyor cached entire signed binaries which could use a lot of space for apps that have many large native modules.
3. When using CA provided cloud signing services, the cost of a flushing a signature is considered much higher than normal. This means Conveyor will prefer deleting other things from the cache to deleting signatures.