From 2f7d4f1fcddb0ec981206212d18aca7a3f8eb42b Mon Sep 17 00:00:00 2001 From: Aavash Date: Sun, 18 Oct 2026 18:31:51 +0545 Subject: [PATCH] chore(deps): bump rustls to 0.23.46, remove zip deps, check updater feed formats --- .github/workflows/release.yml | 33 +++++++++++++++++++++++------ src-tauri/Cargo.lock | 40 +++-------------------------------- src-tauri/Cargo.toml | 4 +++- 3 files changed, 33 insertions(+), 44 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fb48174..339ea03 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -262,7 +262,7 @@ jobs: if: needs.prepare.outputs.release == 'true' runs-on: ubuntu-22.04 steps: - - name: Every platform is in latest.json + - name: Every platform has an installable bundle in latest.json env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} TAG: ${{ needs.prepare.outputs.tag }} @@ -271,18 +271,39 @@ jobs: gh release download "$TAG" \ --repo "$GITHUB_REPOSITORY" --pattern latest.json --dir . - missing=0 + # Feed URLs are asset API links, so map them back to file names. + gh release view "$TAG" --repo "$GITHUB_REPOSITORY" \ + --json assets -q '.assets[] | "\(.apiUrl) \(.name)"' > assets.txt + + # The updater is built without its `zip` feature (src-tauri/Cargo.toml), so Windows and + # Linux take only a bare installer. A zipped one fails on Windows, and on Linux a + # .AppImage.tar.gz is written over the AppImage as-is, which breaks the install. + failed=0 for platform in darwin-aarch64 darwin-x86_64 linux-x86_64 windows-x86_64; do url=$(jq -r --arg p "$platform" '.platforms[$p].url // ""' latest.json) signature=$(jq -r --arg p "$platform" '.platforms[$p].signature // ""' latest.json) if [ -z "$url" ] || [ -z "$signature" ]; then echo "::error::latest.json has no signed bundle for $platform" - missing=1 - else - echo "$platform -> $url" + failed=1 + continue + fi + + name=$(awk -v u="$url" '$1 == u { print $2 }' assets.txt) + if [ -z "$name" ]; then + echo "::error::$platform points at $url, which is not an asset of $TAG" + failed=1 + continue fi + + case "$platform:$name" in + darwin-*:*.app.tar.gz | linux-*:*.AppImage | windows-*:*-setup.exe | windows-*:*.msi) + echo "$platform -> $name" ;; + *) + echo "::error::$platform points at $name, a format this updater cannot install" + failed=1 ;; + esac done - exit "$missing" + exit "$failed" # A plain version moves the updater feed. A pre-release is published but offered to nobody. publish: diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 1e0fe05..574ffa2 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -110,15 +110,6 @@ version = "1.0.103" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" -[[package]] -name = "arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1" -dependencies = [ - "derive_arbitrary", -] - [[package]] name = "arc-swap" version = "1.9.2" @@ -1117,7 +1108,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c54e03a951783e8b327515db3f2a2fd0e3bed362a96b066f341ce66ed49b4ead" dependencies = [ "data-encoding", - "syn 1.0.109", + "syn 3.0.3", ] [[package]] @@ -1151,17 +1142,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "derive_arbitrary" -version = "1.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.118", -] - [[package]] name = "derive_more" version = "2.1.1" @@ -4737,9 +4717,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.45" +version = "0.23.46" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" +checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf" dependencies = [ "log", "once_cell", @@ -5473,7 +5453,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237" dependencies = [ "proc-macro2", - "quote", "unicode-ident", ] @@ -5865,7 +5844,6 @@ dependencies = [ "tokio", "url", "windows-sys 0.60.2", - "zip", ] [[package]] @@ -7787,18 +7765,6 @@ dependencies = [ "syn 2.0.118", ] -[[package]] -name = "zip" -version = "4.6.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1" -dependencies = [ - "arbitrary", - "crc32fast", - "indexmap 2.14.0", - "memchr", -] - [[package]] name = "zmij" version = "1.0.21" diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 932b9f0..a6cd850 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -45,7 +45,9 @@ tauri-plugin-opener = "2" tauri-plugin-fs = "2" tauri-plugin-dialog = "2" tauri-plugin-window-state = "2" -tauri-plugin-updater = "2" +# No `zip` feature: it only unpacks zipped Windows installers and tar.gz AppImages, and the feed +# ships a bare setup.exe and AppImage (`createUpdaterArtifacts: true`). macOS tar.gz is unaffected. +tauri-plugin-updater = { version = "2", default-features = false, features = ["rustls-tls", "system-proxy"] } # Asking the OS is the only honest answer to "am I registered"; a settings bool would drift. tauri-plugin-autostart = "2" serde = { version = "1", features = ["derive"] }