From acff95f920a1bda08bb799f29b78a789883f1bea Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Mon, 27 Jul 2026 15:16:13 -0400 Subject: [PATCH] ci: re-sign the AppImage after de-bundling, or Linux updates can never verify MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The de-bundle step deletes the AppImage and repackages it without the host graphics libraries — necessary, and it runs AFTER tauri signed the original. So the .sig published on the release described a file that no longer existed, and every Linux in-app update would have failed signature verification. Worth naming the failure mode: the error would have said the signature didn't match, which points at the key, the manifest, or the download — anywhere except "a later build step rewrote the file after signing it". The Windows lane hid it too, because nothing post-processes the NSIS installer, so the one platform already verified working was the one platform that couldn't reveal the bug. Signs the file that actually ships, and fails the build if no .sig comes out rather than quietly publishing an unverifiable bundle. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi --- .forgejo/workflows/desktop.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/.forgejo/workflows/desktop.yml b/.forgejo/workflows/desktop.yml index dbb595d..f3984fa 100644 --- a/.forgejo/workflows/desktop.yml +++ b/.forgejo/workflows/desktop.yml @@ -108,6 +108,29 @@ jobs: - name: De-bundle AppImage graphics libraries run: bash desktop/packaging/appimage/debundle-graphics.sh + # MUST run after de-bundling, not before. The step above DELETES the AppImage + # and repackages it, so the signature tauri produced during the build now + # describes a file that no longer exists. Publishing that stale .sig would make + # every Linux update fail verification — and the error names a signature + # mismatch, which points nowhere near "a later build step rewrote the file". + # Windows needs no equivalent: nothing post-processes the NSIS installer. + - name: Re-sign the de-bundled AppImage + env: + TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }} + TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }} + run: | + if [ -z "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then + echo "No signing key — the build produced no signature to replace." + exit 0 + fi + appimage="$(find target/release/bundle/appimage -name '*.AppImage' -type f | head -1)" + [ -n "$appimage" ] || { echo "ERROR: no AppImage found to re-sign" >&2; exit 1; } + rm -f "$appimage.sig" + cargo tauri signer sign "$appimage" + [ -s "$appimage.sig" ] || { echo "ERROR: re-signing produced no .sig" >&2; exit 1; } + echo "Re-signed $(basename "$appimage")" + working-directory: desktop/src-tauri + # install.sh hands the .deb to every Debian/Ubuntu user, so the package's # Depends must be right BEFORE a release exists. Prints the generated # control file and cross-checks it against what the ELF actually needs