J3vb/OwnCord
1
0
Fork 0
mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): sign the stripped AppImage from the env, not a temp key file (#1310)

Browse Source 
Both Linux release jobs died at "Strip host-incompatible libs from AppImage
and re-sign":

    error: the argument '--private-key-path <PRIVATE_KEY_PATH>'
           cannot be used with '--private-key <PRIVATE_KEY>'

The step exports TAURI_SIGNING_PRIVATE_KEY so it can write the key to a temp
file, then passes that file with -f. But TAURI_SIGNING_PRIVATE_KEY *is* the
env form of --private-key, so the CLI saw the key supplied twice and aborted.
The strip itself had already succeeded ("stripped 4 bundled wayland libs"),
so only the re-sign was lost — and with it both Linux jobs, which skipped
the publish job.

Signing straight from the env drops the mktemp/printf/trap entirely and
keeps the private key off the runner's disk.

Not a regression from the release: the strip-and-re-sign step arrived on
main with #1297 in this very release, so this code path had never run on a
tag before. CI does not exercise it — ci.yml's tauri-build has no strip or
signing step, which is why all three Tauri builds passed there.

The publish job's server-update signing keeps -f deliberately: it signs with
SERVER_UPDATE_SIGNING_PRIVATE_KEY, which the CLI does not read from the
environment, so there is no conflict to avoid there.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
J3vb
2026-08-01 22:24:54 +02:00
committed by GitHub
co-authored by Claude Opus 5
parent 086979b7e8
commit 9d75890f50
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+14 -10
View File
@@ -152,11 +152,13 @@ jobs:
TARBALL="$APPIMAGE.tar.gz"
rm -f "$TARBALL" "$APPIMAGE.sig" "$TARBALL.sig"
tar czf "$TARBALL" -C "$(dirname "$APPIMAGE")" "$(basename "$APPIMAGE")"
KEY_PATH=$(mktemp)
printf '%s' "$TAURI_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
trap 'rm -f "$KEY_PATH"' EXIT
npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
# Sign straight from the environment. TAURI_SIGNING_PRIVATE_KEY is
# the env form of --private-key, so ALSO passing -f/--private-key-path
# makes the CLI abort: "the argument '--private-key-path' cannot be
# used with '--private-key'". Keeping the key in the env instead of a
# temp file also keeps it off the runner's disk.
npx tauri signer sign -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
npx tauri signer sign -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
- name: Stage Linux release assets
shell: bash
@@ -303,11 +305,13 @@ jobs:
TARBALL="$APPIMAGE.tar.gz"
rm -f "$TARBALL" "$APPIMAGE.sig" "$TARBALL.sig"
tar czf "$TARBALL" -C "$(dirname "$APPIMAGE")" "$(basename "$APPIMAGE")"
KEY_PATH=$(mktemp)
printf '%s' "$TAURI_SIGNING_PRIVATE_KEY" > "$KEY_PATH"
trap 'rm -f "$KEY_PATH"' EXIT
npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
npx tauri signer sign -f "$KEY_PATH" -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
# Sign straight from the environment. TAURI_SIGNING_PRIVATE_KEY is
# the env form of --private-key, so ALSO passing -f/--private-key-path
# makes the CLI abort: "the argument '--private-key-path' cannot be
# used with '--private-key'". Keeping the key in the env instead of a
# temp file also keeps it off the runner's disk.
npx tauri signer sign -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$APPIMAGE"
npx tauri signer sign -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" "$TARBALL"
- name: Stage Linux ARM64 release assets
shell: bash