fix(release): verify legacy installers against legacy resources

Author: zhiiw

scripts/verify-packaged-app.mjs

@@ -738,6 +738,10 @@ export async function assertPackagedResources(
     // reads it at runtime, so current builds must carry it — but a
     // previously released baseline predates it.
     requireCanonicalIcon = true,
+    // The pinned Windows upgrade baseline predates bundled npm. Current
+    // artifacts must carry it, while that historical baseline is verified
+    // against the release contract that applied when it shipped.
+    requireBundledNpm = true,
   } = {},
 ) {
   if (bundledGitContract !== 'forbidden' && bundledGitContract !== 'legacy-required') {
@@ -747,9 +751,13 @@ export async function assertPackagedResources(
   const required = [
     'app.asar',
     'bundled-tools.json',
-    'bundled-npm.json',
-    join('npm', 'bin', 'npm-cli.js'),
-    join('licenses', 'npm-cli', 'LICENSE'),
+    ...(requireBundledNpm
+      ? [
+          'bundled-npm.json',
+          join('npm', 'bin', 'npm-cli.js'),
+          join('licenses', 'npm-cli', 'LICENSE'),
+        ]
+      : []),
     ...(requiresLegacyBundledGit
       ? [
           'bundled-git.json',

scripts/verify-packaged-app.test.mjs

@@ -49,6 +49,29 @@ test('packaged resources forbid the retired bundled Git distribution', async ()
   }
 });
 
+test('requires bundled npm only for the current release contract', async () => {
+  const currentPaths = [];
+  await assertPackagedResources('resources', {
+    requirePath: async (path) => currentPaths.push(path),
+    forbidPath: async () => {},
+    requireWindowsSandbox: false,
+  });
+  assert.ok(currentPaths.includes(join('resources', 'bundled-npm.json')));
+  assert.ok(currentPaths.includes(join('resources', 'npm', 'bin', 'npm-cli.js')));
+  assert.ok(currentPaths.includes(join('resources', 'licenses', 'npm-cli', 'LICENSE')));
+
+  const legacyPaths = [];
+  await assertPackagedResources('resources', {
+    requirePath: async (path) => legacyPaths.push(path),
+    forbidPath: async () => {},
+    requireWindowsSandbox: false,
+    requireBundledNpm: false,
+  });
+  assert.equal(legacyPaths.includes(join('resources', 'bundled-npm.json')), false);
+  assert.equal(legacyPaths.includes(join('resources', 'npm', 'bin', 'npm-cli.js')), false);
+  assert.equal(legacyPaths.includes(join('resources', 'licenses', 'npm-cli', 'LICENSE')), false);
+});
+
 test('legacy packaged resources require the historical bundled Git contract', async () => {
   const required = [];
   const forbidden = [];

scripts/verify-windows-x64.mjs

@@ -130,6 +130,7 @@ export async function verifyPackagedWindowsApp(
     requireDisclaimer: requiresCurrentContract,
     bundledGitContract: requiresCurrentContract ? 'forbidden' : 'legacy-required',
     requireCanonicalIcon: requiresCurrentContract,
+    requireBundledNpm: requiresCurrentContract,
   });
   if (requiresCurrentContract) await assertPackagedDependencyClosure(resources);
   else await requirePath(join(resources, 'git', 'cmd', 'git.exe'));