macOS packaging spends most of its time signing Git Credential Manager, which Maka does not use

[Joob1n]

The macOS package job spends most of its wall clock signing binaries Maka never runs.

electron-builder signs every executable under extraResources individually, and each codesign --timestamp makes a network round trip to Apple's timestamp authority. Measured on the bundled Git distribution (node_modules/dugite/git):

Group	Executables	Size
Git Credential Manager + its .NET runtime	219	68.9 MiB
git, scalar, git-lfs, git-http-push, …	48	19.1 MiB
share/git-core/templates sample hooks	14	~0
Total	281	88 MiB

78% of the signing work is Git Credential Manager, which Maka does not use — credentials live in its own credentials.json under the 0700/0600 contract in SECURITY.md, and nothing in apps/desktop or packages/* invokes GCM.

During a local macOS package the signing step held at ~0% CPU for over 13 minutes: the cost is not compute, it is 281 sequential network round trips.

Suggested fix: drop the Git Credential Manager tree from what gets packaged (an extraResources filter, or a prune step over the dugite copy before packaging), and confirm git still functions for the operations Maka performs. That removes ~69 MiB from the artifact and roughly three quarters of the signing round trips.

Verified, so the issue does not repeat a wrong guess: I first assumed the cost came from broken hard links duplicating the git binary hundreds of times. That is wrong. Scanning the tree programmatically — excluding symlinks, which is what fooled a shasum spot check, since most libexec/git-core entries are symlinks to git — there are 281 real executables with 274 distinct contents. True duplication is 3 groups totalling 5.1 MiB, so restoring hard links is not the win here.

Related: #3146 already records the ~95 MiB Git Credential Manager / SkiaSharp payload as a size item. This issue is the same payload seen from the packaging-time side, and the fix is shared.

[Joob1n]

I measured this while packaging locally and plan to implement it — after my open PRs land, so it does not collide with #3148, which touches the same config file.

[Joob1n]

Closing this: the premise did not survive measurement. Recording why rather than deleting it, so the next person does not re-derive the same mistake.

"281 executables" counted the executable bit, not signable binaries. codesign signs Mach-O. The tree has:

	count
files with the executable bit	281
actual Mach-O binaries	31
.dll files	216
…of those that are Mach-O	0

The 216 .dll files are PE32+ Mono/.Net assembly — Windows-format IL, chmod +x by the distribution, which codesign does not touch on macOS. Git Credential Manager's share of the signable files is 18 of 31, not 219 of 281. The "78% of the signing work" figure follows from the wrong denominator and does not hold.

The signing time is not spent on the bundled Git at all. Reading what codesign was actually invoked on during a package:

Electron Framework.framework/Versions/A/Resources/nb_FEMININE.lproj/…
Electron Framework.framework/Versions/A/Resources/fr_MASCULINE.lproj/…

Electron ships 220 .lproj locale bundles, 65 MiB, each signed individually. That 281 and 220 are close is a coincidence that made the original guess look confirmed.

I could not establish what does drive packaging time, and I am not leaving a theory here dressed as a finding. electronLanguages: ['en', 'zh_CN'] does cut the bundles 220 → 2, but it did not reproduce as a speedup: 1223s before, 1402s after — slower, on single samples. Timestamp round trips measured 285–2019 ms on the same machine, so per-run noise exceeds the effect being measured. Separating them needs repeated sampling at ~20 minutes a run, which I have not done.

For whoever picks this up: the same step on CI runners over two weeks ran 507s, 385s, 394s, 422s, 435s, 369s, 463s — no trend, no proxy involved. The cost is real and shared; nothing established here explains it. A fresh issue should start from that, not from this one.

The size finding was real and moves to #3428 — Git Credential Manager and its .NET runtime are 223 files and 103.1 MiB that Maka disables at the call site. Measured: −133 MB installed, −44.6 MB downloaded. That issue carries the evidence and the verification that git still works without it.