fix(build): resolve Windows auto-update checksum failure (#1790)

The Squirrel.Windows updater was failing with "Checksummed file size
doesn't match" because the RELEASES file on the CDN referenced nupkg
files from older versions that no longer existed (HTTP 403).

Root cause: `remoteReleases` in maker-squirrel fetched the CDN's
existing RELEASES and appended new entries, accumulating historical
references. But `aws s3 sync --delete` in the release workflow
correctly removed old nupkgs from the `latest/` path, creating a
mismatch between RELEASES entries and actual files.

Changes:
- Remove `remoteReleases` and set `noDelta: true` so each build
  produces a RELEASES file with only the current version's entry
- Add `postMake` hook to strip UTF-8 BOM from RELEASES files
  (defense-in-depth against a known electron-winstaller issue)

Made-with: Cursor

Author: samuv

forge.config.ts

@@ -11,6 +11,7 @@ import { ensureThv } from './utils/fetch-thv'
 import MakerTarGz from './utils/forge-makers/MakerTarGz'
 import MakerDMGWithArch from './utils/forge-makers/MakerDMGWithArch'
 import { isPrerelease } from './utils/pre-release'
+import { stripBomFromReleasesFiles } from './utils/forge-makers/strip-bom-from-releases'
 import packageJson from './package.json'
 
 function isValidPlatform(platform: string): platform is NodeJS.Platform {
@@ -112,14 +113,14 @@ const config: ForgeConfig = {
   makers: [
     {
       name: '@electron-forge/maker-squirrel',
-      config: (arch: string) => ({
+      config: () => ({
         setupIcon: './icons/icon.ico',
         setupExe: 'ToolHive Setup.exe',
         noMsi: true,
         authors: 'Stacklok',
         exe: 'ToolHive.exe',
         name: 'ToolHive',
-        remoteReleases: `https://releases.toolhive.dev/${isPrerelease() ? 'pre-release' : 'stable'}/latest/win32/${arch}`,
+        noDelta: true,
         windowsSign:
           process.env.SM_HOST && process.env.SM_API_KEY
             ? { hookModulePath: './utils/digicert-hook.js' }
@@ -217,6 +218,10 @@ const config: ForgeConfig = {
   ],
 
   hooks: {
+    postMake: async (_config, makeResults) => {
+      await stripBomFromReleasesFiles(makeResults)
+      return makeResults
+    },
     // copy sqlite deps that already compiled
     packageAfterCopy: async (_config, buildPath) => {
       const fs = await import('node:fs')

utils/forge-makers/strip-bom-from-releases.ts

@@ -0,0 +1,39 @@
+import { promises as fs } from 'node:fs'
+import type { ForgeMakeResult } from '@electron-forge/shared-types'
+
+const UTF8_BOM = Buffer.from([0xef, 0xbb, 0xbf])
+
+/**
+ * Strips the UTF-8 BOM from RELEASES files produced by Squirrel.Windows.
+ *
+ * electron-winstaller generates RELEASES files with a UTF-8 BOM prefix (EF BB BF).
+ * Squirrel.Windows fails to parse BOM-prefixed RELEASES when computing checksums,
+ * causing "Checksummed file size doesn't match" errors during client updates.
+ */
+export async function stripBomFromReleasesFiles(
+  makeResults: ForgeMakeResult[]
+): Promise<void> {
+  for (const result of makeResults) {
+    const releasesFiles = result.artifacts.filter((f) => f.endsWith('RELEASES'))
+
+    for (const releasesPath of releasesFiles) {
+      try {
+        const content = await fs.readFile(releasesPath)
+
+        if (
+          content.length >= 3 &&
+          content[0] === UTF8_BOM[0] &&
+          content[1] === UTF8_BOM[1] &&
+          content[2] === UTF8_BOM[2]
+        ) {
+          await fs.writeFile(releasesPath, content.subarray(3))
+          console.log(`[postMake] Stripped UTF-8 BOM from ${releasesPath}`)
+        }
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+          console.warn(`[postMake] Could not process RELEASES file: ${error}`)
+        }
+      }
+    }
+  }
+}