dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 6 Packages Projects Releases Wiki Activity

fix(release): validate updater signing from workflow revision (#1726)

Browse Source
This commit is contained in:
Carlos Florêncio
2026-07-16 10:59:13 +01:00
committed by GitHub
parent 486baa8e54
commit 460ec9ff2f
10 changed files with 90 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/release-desktop.test.sh
+1
View File
@@ -225,4 +225,5 @@ fi
grep -q "Checksum verification failed" "$ERR_FILE" || fail "verify-desktop-assets did not explain checksum mismatch"
pass "verify-desktop-assets rejects checksum mismatches"
bash "$ROOT_DIR/scripts/release/updater-signing-ready.test.sh"
bash "$ROOT_DIR/scripts/release/updater-manifest.test.sh"
scripts/release/updater-manifest.test.sh
-21
View File
@@ -3,7 +3,6 @@ set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
SCRIPT="$ROOT_DIR/scripts/release/updater-manifest.mjs"
SIGNING_READY_SCRIPT="$ROOT_DIR/scripts/release/updater-signing-ready.sh"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT
@@ -224,23 +223,3 @@ if generate_manifest "$partial_assets" --allow-unsigned >"$TMP_DIR/out" 2>"$TMP_
fi
grep -q "Incomplete updater artifact set" "$TMP_DIR/err" || fail "partial set error was not actionable"
pass "partial signed updater feeds fail closed"
TAURI_SIGNING_PRIVATE_KEY=test-key MACOS_SIGNING_ENABLED=false \
bash "$SIGNING_READY_SCRIPT" macos-arm64 >/dev/null
pass "macOS updater artifacts require only the updater key"
TAURI_SIGNING_PRIVATE_KEY=test-key WINDOWS_SIGNING_ENABLED=false \
bash "$SIGNING_READY_SCRIPT" windows-x64 >/dev/null
pass "Windows updater artifacts require only the updater key"
TAURI_SIGNING_PRIVATE_KEY=test-key MACOS_SIGNING_ENABLED=false WINDOWS_SIGNING_ENABLED=false \
bash "$SIGNING_READY_SCRIPT" linux-arm64 >/dev/null
pass "Linux updater artifacts require only the updater key"
if env -u TAURI_SIGNING_PRIVATE_KEY bash "$SIGNING_READY_SCRIPT" macos-arm64 \
>"$TMP_DIR/out" 2>"$TMP_DIR/err"; then
fail "updater artifacts should require the Tauri updater key on every platform"
fi
grep -q "require TAURI_SIGNING_PRIVATE_KEY" "$TMP_DIR/err" || \
fail "missing updater key failure was not actionable"
pass "every updater artifact requires the Tauri updater key"
scripts/release/updater-signing-ready.sh
+2 -1
View File
@@ -10,9 +10,10 @@ if [ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
fi
case "$platform" in
macos-aarch64 | macos-x86_64 | windows-x86_64 | linux-x86_64 | linux-aarch64) ;;
macos-arm64 | macos-x64 | linux-x64 | linux-arm64 | windows-x64) ;;
*)
echo "Unsupported updater platform: $platform" >&2
echo "Expected one of: macos-arm64, macos-x64, linux-x64, linux-arm64, windows-x64" >&2
exit 1
;;
esac
scripts/release/updater-signing-ready.test.sh
Executable
+51
View File
@@ -0,0 +1,51 @@
#!/usr/bin/env bash
set -euo pipefail
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
SCRIPT="$ROOT_DIR/scripts/release/updater-signing-ready.sh"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT
fail() {
echo "FAIL: $*" >&2
exit 1
}
valid_platforms=(macos-arm64 macos-x64 linux-x64 linux-arm64 windows-x64)
for platform in "${valid_platforms[@]}"; do
TAURI_SIGNING_PRIVATE_KEY=test-key \
MACOS_SIGNING_ENABLED=false \
WINDOWS_SIGNING_ENABLED=false \
bash "$SCRIPT" "$platform" >"$TMP_DIR/out" 2>"$TMP_DIR/err" || \
fail "updater signing readiness rejected release platform $platform"
grep -q "complete for $platform" "$TMP_DIR/out" || \
fail "updater signing readiness did not confirm $platform"
done
unsupported_platforms=(
macos-aarch64
macos-x86_64
linux-x86_64
linux-aarch64
windows-x86_64
)
misspelled_platforms=(linux-x65)
for platform in "${unsupported_platforms[@]}" "${misspelled_platforms[@]}"; do
if TAURI_SIGNING_PRIVATE_KEY=test-key bash "$SCRIPT" "$platform" \
>"$TMP_DIR/out" 2>"$TMP_DIR/err"; then
fail "updater signing readiness accepted unsupported platform $platform"
fi
grep -q "Unsupported updater platform: $platform" "$TMP_DIR/err" || \
fail "unsupported platform error did not identify $platform"
grep -q "macos-arm64, macos-x64, linux-x64, linux-arm64, windows-x64" \
"$TMP_DIR/err" || fail "unsupported platform error did not list accepted values"
done
if env -u TAURI_SIGNING_PRIVATE_KEY bash "$SCRIPT" linux-x64 \
>"$TMP_DIR/out" 2>"$TMP_DIR/err"; then
fail "updater signing readiness accepted a missing updater key"
fi
grep -q "require TAURI_SIGNING_PRIVATE_KEY" "$TMP_DIR/err" || \
fail "missing updater key error was not actionable"
echo "PASS: updater signing readiness accepts the release matrix and only requires the updater key"