From 4e162bf5636f90d14928b6fb6be0f71f3d35a1c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20Flor=C3=AAncio?= <carlosmflorencio@gmail.com>
Date: Thu, 16 Jul 2026 15:31:03 +0100
Subject: [PATCH] fix(release): build macOS updater bundles (#1733)

---
 .../scripts/release-workflow-contract_test.py | 17 +++++++++++++++++
 .github/workflows/release.yml                 | 13 +++++++++++--
 scripts/release-desktop.test.sh               | 19 +++++++++++++++++++
 scripts/release/verify-desktop-assets.sh      | 18 ++++++++++++++++--
 4 files changed, 63 insertions(+), 4 deletions(-)

diff --git a/.github/scripts/release-workflow-contract_test.py b/.github/scripts/release-workflow-contract_test.py
index a7db2657f3..0878d8f171 100644
--- a/.github/scripts/release-workflow-contract_test.py
+++ b/.github/scripts/release-workflow-contract_test.py
@@ -128,6 +128,23 @@ class ReleaseWorkflowContractTest(unittest.TestCase):
             r"needs\.prepare\.outputs\.tag \}\}\^\{commit\}",
         )
 
+    def test_macos_signed_build_selects_updater_bundle(self) -> None:
+        build = step_block("Build Tauri desktop app")
+        collect = step_block("Collect desktop artifacts")
+        initialize = 'tauri_bundles="${{ matrix.tauri_bundles }}"'
+        append = 'tauri_bundles="${tauri_bundles},updater"'
+        invoke = '--bundles "$tauri_bundles"'
+
+        self.assertIn('[[ "${{ matrix.platform }}" == macos-*', build)
+        self.assertIn('"${UPDATER_SIGNING_ENABLED:-false}" = "true"', build)
+        self.assertIn(initialize, build)
+        self.assertIn(append, build)
+        self.assertIn(invoke, build)
+        self.assertLess(build.index(initialize), build.index(append))
+        self.assertLess(build.index(append), build.index(invoke))
+        self.assertIn('"${UPDATER_SIGNING_ENABLED:-false}" = "true"', collect)
+        self.assertIn('"$DESKTOP_ASSET_VERIFIER" --require-updaters', collect)
+
     def test_macos_dmg_build_has_retry_timeout_and_diagnostics(self) -> None:
         build = step_block("Build Tauri desktop app")
         self.assertIn("timeout-minutes: 70", build)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a623202c2b..81ee1b90f6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -848,9 +848,13 @@ jobs:
             unset WINDOWS_TIMESTAMP_URL
             unset WINDOWS_SIGNTOOL_PATH
           fi
+          tauri_bundles="${{ matrix.tauri_bundles }}"
           updater_config='{"bundle":{"createUpdaterArtifacts":false}}'
           if [ "${UPDATER_SIGNING_ENABLED:-false}" = "true" ]; then
             updater_config='{"bundle":{"createUpdaterArtifacts":"v1Compatible"}}'
+            if [[ "${{ matrix.platform }}" == macos-* ]]; then
+              tauri_bundles="${tauri_bundles},updater"
+            fi
           else
             unset TAURI_SIGNING_PRIVATE_KEY
             unset TAURI_SIGNING_PRIVATE_KEY_PASSWORD
@@ -917,7 +921,7 @@ jobs:
               pnpm tauri build \
                 --features desktop-runtime \
                 --target "${{ matrix.rust_target }}" \
-                --bundles "${{ matrix.tauri_bundles }}" \
+                --bundles "$tauri_bundles" \
                 --config "$updater_config"
           }
 
@@ -1070,7 +1074,12 @@ jobs:
             exit 1
           fi
 
-          bash "$DESKTOP_ASSET_VERIFIER" "$out_dir" "${{ matrix.platform }}"
+          if [ "${UPDATER_SIGNING_ENABLED:-false}" = "true" ]; then
+            bash "$DESKTOP_ASSET_VERIFIER" --require-updaters \
+              "$out_dir" "${{ matrix.platform }}"
+          else
+            bash "$DESKTOP_ASSET_VERIFIER" "$out_dir" "${{ matrix.platform }}"
+          fi
           ls -lh "$out_dir"
 
       - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
diff --git a/scripts/release-desktop.test.sh b/scripts/release-desktop.test.sh
index 44947879d6..6d87bed29e 100644
--- a/scripts/release-desktop.test.sh
+++ b/scripts/release-desktop.test.sh
@@ -172,6 +172,25 @@ printf 'unsigned macOS artifact\n' > "$macos_artifact"
   "$macos_assets_dir" macos-arm64 >/dev/null
 pass "verify-desktop-assets accepts macOS artifacts without optional updater bundles"
 
+if "$ROOT_DIR/scripts/release/verify-desktop-assets.sh" --require-updaters \
+  "$macos_assets_dir" macos-arm64 >"$OUT_FILE" 2>"$ERR_FILE"; then
+  fail "verify-desktop-assets should require a key-enabled macOS updater bundle"
+fi
+grep -q "Missing updater artifact for platform: macos-arm64" "$ERR_FILE" || \
+  fail "verify-desktop-assets did not explain the missing macOS updater bundle"
+pass "verify-desktop-assets requires key-enabled updater bundles"
+
+macos_updater="$macos_assets_dir/kandev-desktop-macos-arm64-Kandev.app.tar.gz"
+printf 'signed macOS updater\n' > "$macos_updater"
+printf 'signature\n' > "$macos_updater.sig"
+"$ROOT_DIR/scripts/release/write-sha256.sh" \
+  "$macos_updater" "$macos_updater.sha256"
+"$ROOT_DIR/scripts/release/write-sha256.sh" \
+  "$macos_updater.sig" "$macos_updater.sig.sha256"
+"$ROOT_DIR/scripts/release/verify-desktop-assets.sh" --require-updaters \
+  "$macos_assets_dir" macos-arm64 >/dev/null
+pass "verify-desktop-assets accepts signed required updater bundles"
+
 missing_assets_dir="$TMP_DIR/missing-assets"
 mkdir -p "$missing_assets_dir"
 if "$ROOT_DIR/scripts/release/verify-desktop-assets.sh" \
diff --git a/scripts/release/verify-desktop-assets.sh b/scripts/release/verify-desktop-assets.sh
index 9f5c133da7..70714e566a 100755
--- a/scripts/release/verify-desktop-assets.sh
+++ b/scripts/release/verify-desktop-assets.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 usage() {
   cat <<'EOF'
-Usage: verify-desktop-assets.sh <assets-dir> [platform...]
+Usage: verify-desktop-assets.sh [--require-updaters] <assets-dir> [platform...]
 
 Checks that each required platform has at least one desktop artifact named:
 
@@ -14,6 +14,8 @@ and that every matching artifact has a sibling .sha256 file. If no platform is
 given, all supported desktop platforms are required. Signed Tauri updater
 artifacts (`*.app.tar.gz`, `*.AppImage.tar.gz`, and `*.nsis.zip`) must have a
 matching `*.sig` file, and signatures without their updater bundle are rejected.
+When --require-updaters is set, every requested platform must also include its
+signed updater bundle.
 EOF
 }
 
@@ -22,7 +24,13 @@ if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
   exit 0
 fi
 
-ASSETS_DIR="${1:?Usage: verify-desktop-assets.sh <assets-dir> [platform...]}"
+REQUIRE_UPDATERS=false
+if [ "${1:-}" = "--require-updaters" ]; then
+  REQUIRE_UPDATERS=true
+  shift
+fi
+
+ASSETS_DIR="${1:?Usage: verify-desktop-assets.sh [--require-updaters] <assets-dir> [platform...]}"
 shift || true
 
 if [ "$#" -gt 0 ]; then
@@ -86,7 +94,9 @@ for platform in "${REQUIRED_PLATFORMS[@]}"; do
   fi
 
   updater_suffix="$(updater_suffix_for_platform "$platform")"
+  updater_found=0
   for updater_bundle in "$ASSETS_DIR"/kandev-desktop-"$platform"-$updater_suffix; do
+    updater_found=$((updater_found + 1))
     if [ ! -f "$updater_bundle.sig" ]; then
       echo "Missing updater signature: $updater_bundle.sig" >&2
       exit 1
@@ -99,6 +109,10 @@ for platform in "${REQUIRED_PLATFORMS[@]}"; do
       exit 1
     fi
   done
+  if [ "$REQUIRE_UPDATERS" = true ] && [ "$updater_found" -eq 0 ]; then
+    echo "Missing updater artifact for platform: $platform" >&2
+    exit 1
+  fi
 done
 
 echo "Desktop release assets verified in $ASSETS_DIR"