fix(sign-windows): pin SSD 2.9.14, dismiss version-check modal, add CI screenshots#131
Merged
fix(sign-windows): pin SSD 2.9.14, dismiss version-check modal, add CI screenshots#131
Conversation
…debug The sign-windows job started failing during v0.15.0 around what looks like a second OAuth panel opened by SimplySign Desktop, but the failure mode is invisible in headless Xvfb. Add a scrot loop that captures the display every 2s, a dump_windows helper called at the four key handoff points, and an if: failure() artifact upload so the screenshots come back from CI.
Screenshots from the v0.0.0-debug1 run showed a "Newer application version is available (2.9.14)" modal popping in front of the login form right when xdotool started typing. The modal stole focus, swallowed the email and TOTP keystrokes, and the first Return only dismissed the modal; the WebKit OAuth panel was left without cached credentials, so the second Get Softcards List call (jsign signing) opened an empty panel that Certum cancels after 60s. Pin to 2.9.14-9.4.3.0 so the modal does not appear, and dismiss any version-check modal defensively in case Certum advertises a newer release in the future.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
sign-windowsjob in the release workflow has been failing since v0.15.0on 2026-05-03. Root cause turned out to be a SimplySign Desktop "Newer
application version is available (2.9.14)" modal popping in front of the
login form right when xdotool started typing — it stole focus, swallowed
the credentials and TOTP, and left the WebKit OAuth panel in a state where
the second
Get Softcards Listcall (jsign signing) opened an empty panelthat Certum cancelled after 60s.
Three changes:
2.9.14-9.4.3.0so the version-check modaldoesn't appear in the first place.
Escapeon anyApplication version checkwindow before thecredential-typing flow, so we don't break again the next time Certum
advertises a newer release.
dump_windowsX11 enumeration inwindows-sign.sh,plus an
if: failure()artifact upload in the release workflow. Costsnothing while green; surfaces the next regression in seconds instead of
guessing through 7-min CI cycles.
Test plan
(run 25290238615) — uploaded screenshots showed the version-check
modal sitting on top of the login form.
(run 25290930608) —
vykar.exe,vykar-server.exe,vykar-gui.exeall signed and verified with RFC3161 timestamps.
v0.15.0and confirm the full release workflow succeedsend-to-end including
publish.