fix: avoid shell interpolation in postinstall codesign

[anupamme]

Summary

Replace the shell-based codesign invocation in scripts/postinstall.js with execFileSync() so filenames are passed as process arguments rather than interpolated into a shell command.

Changes

• Replace execSync() with execFileSync() for the codesign invocation.
• Preserve the existing findFiles() traversal and filenames unchanged.
• Add regression coverage for filenames containing spaces, quotes, and backslashes.

Security

This removes shell interpretation of the discovered filename while preserving existing postinstall behavior.

[abasiri]

Thanks for this. The execFileSync('codesign', ['--sign', '-', '--force', file], ...) change is useful: passing the filename as an argument removes the shell-interpolation risk.

Please drop the safeName changes and keep the original path.join(dir, entry.name) and entry.name.endsWith(suffix) traversal. Backslashes are valid characters in Unix filenames, so stripping them changes the path. I reproduced this with a file named native\addon.node: findFiles() returns a path to nativeaddon.node, which does not exist. The signing failure is then silently swallowed by the surrounding catch. Directory names containing backslashes would also cause their contents to be skipped.

The direct argument array already handles the quoting concern without modifying filenames. With the traversal restored, this should be a small, straightforward fix to land. Please also check filenames containing spaces, quotes and backslashes with a stubbed signer so the regression is covered without invoking the postinstall rebuild.

[anupamme]

Thanks for catching this and reproducing the backslash case. You're right — the filename sanitization is unnecessary once the argument is passed directly to execFileSync().

I've removed the safeName changes, restored the original path.join(dir, entry.name) traversal, and kept the fix focused on replacing the shell-based execSync() call with execFileSync().

I've also added regression coverage (test/postinstall.test.js) for filenames containing spaces, quotes, and backslashes using a stubbed signer, so the tests don't invoke the actual postinstall rebuild/codesign flow. To make that testable I added a require.main === module guard around the top-level script body — postinstall.js is only ever run directly via node scripts/postinstall.js (postinstall/build scripts), never required elsewhere, so this doesn't change runtime behavior.

[abasiri]

Thanks @anupamme for the fix and for following up on the filename handling and regression tests!

I pushed a small test portability follow-up: the Unix-only filesystem cases now skip on Windows, while the stubbed signer tests use path strings without creating files and still run on every platform. I also added these tests to the build workflow so they run on all four CI targets.

All 199 tests pass locally with current main, and the postinstall tests have passed on Windows, macOS, and both Linux targets. The remaining builds are finishing; once they're green, I'll merge this. Thanks again for the contribution!