Files
OwnCord/.github/workflows
J3vbandClaude Opus 5 9d75890f50 fix(release): sign the stripped AppImage from the env, not a temp key file (#1310)
Both Linux release jobs died at "Strip host-incompatible libs from AppImage
and re-sign":

    error: the argument '--private-key-path <PRIVATE_KEY_PATH>'
           cannot be used with '--private-key <PRIVATE_KEY>'

The step exports TAURI_SIGNING_PRIVATE_KEY so it can write the key to a temp
file, then passes that file with -f. But TAURI_SIGNING_PRIVATE_KEY *is* the
env form of --private-key, so the CLI saw the key supplied twice and aborted.
The strip itself had already succeeded ("stripped 4 bundled wayland libs"),
so only the re-sign was lost — and with it both Linux jobs, which skipped
the publish job.

Signing straight from the env drops the mktemp/printf/trap entirely and
keeps the private key off the runner's disk.

Not a regression from the release: the strip-and-re-sign step arrived on
main with #1297 in this very release, so this code path had never run on a
tag before. CI does not exercise it — ci.yml's tauri-build has no strip or
signing step, which is why all three Tauri builds passed there.

The publish job's server-update signing keeps -f deliberately: it signs with
SERVER_UPDATE_SIGNING_PRIVATE_KEY, which the CLI does not read from the
environment, so there is no conflict to avoid there.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-01 22:24:54 +02:00
..
2026-08-01 22:06:14 +02:00
2026-03-17 02:09:45 +01:00