From 96ec7ba60f0c9abea5937ba6203f2614dc2419e4 Mon Sep 17 00:00:00 2001 From: CRT Date: Thu, 29 Oct 2026 19:40:29 +0700 Subject: [PATCH] desktop-release: sign by key path only (a TAURI_SIGNING_PRIVATE_KEY in the env made the signer refuse both) --- tools/desktop-release.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tools/desktop-release.ts b/tools/desktop-release.ts index 21de8e1..974fb6c 100644 --- a/tools/desktop-release.ts +++ b/tools/desktop-release.ts @@ -220,7 +220,11 @@ function updaterKey(): string { function signFile(file: string): string { const key = updaterKey(); rmSync(`${file}.sig`, { force: true }); - run(['bunx', 'tauri', 'signer', 'sign', '-f', key, '-p', '', file], { cwd: APP_DIR, env: { ...process.env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: '' } }); + // the key goes by path only: a TAURI_SIGNING_PRIVATE_KEY left in the env (a bundle step, the shell) made the signer + // refuse "--private-key-path cannot be used with --private-key" (0.8.59) + const env = { ...process.env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: '' }; + delete env.TAURI_SIGNING_PRIVATE_KEY; delete env.TAURI_SIGNING_PRIVATE_KEY_PATH; + run(['bunx', 'tauri', 'signer', 'sign', '-f', key, '-p', '', file], { cwd: APP_DIR, env }); const sig = readFileSync(`${file}.sig`, 'utf8').trim(); const v = verifySig(readFileSync(file), sig, confPubkey()); if (!v.ok) fail(`${basename(file)}: fresh signature does not verify (${v.reason})`);