230ecd85ad
Max's decision on PR #416, after its review measured who still read the key. tauri-plugin-updater looks up "{os}-{arch}-{installer}" first, and every version that ships the updater (v0.2.1 and later, plugin 2.10.0, tauri-utils 2.8.2 in each tag's Cargo.lock) carries its bundle-type marker, so .deb and .rpm installs never reach the generic key. Its last readers were the AppImage installs v0.4.3 to v0.4.5 (v0.4.2 targets a route that answers 404, earlier versions read GitHub) and binaries run outside a package; none of them can install the .deb it served, and the updater wrote that .deb over the running file. They now get TargetsNotFound when checking: an error on the Updates card, nothing installed. The key leaves the script, scripts/check-latest-json.jq and verify-release.sh together; the test compares the three lists. Docs fix the readers named by #416 (v0.4.2 is not one) and the CHANGELOG entry says what changes for those AppImage installs. Refs #320 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26 lines
1.5 KiB
Text
26 lines
1.5 KiB
Text
# Check of latest.json, the updater manifest, before release.yml deletes the
|
|
# published one from the package registry (#320). Once that version is
|
|
# deleted, installed apps find no update until a valid one is uploaded, so a
|
|
# manifest that fails this check stops the job and leaves the registry as is.
|
|
#
|
|
# Run as: jq -e --arg version <X.Y.Z> -f scripts/check-latest-json.jq latest.json
|
|
# -e turns false, null and any jq error (missing field, wrong type, invalid
|
|
# JSON) into a non-zero exit status: the check fails closed.
|
|
#
|
|
# The key set must stay the one scripts/build-latest-json.sh writes and
|
|
# .claude/skills/release/scripts/verify-release.sh expects.
|
|
# scripts/build-latest-json.test.mjs runs this file on the script's output and
|
|
# on broken manifests, and compares the three lists, on every pull request
|
|
# through check-frontend: a misaligned list shows before the tag, not at it.
|
|
# Written for jq 1.6, the version ubuntu:22.04 ships.
|
|
#
|
|
# Not checked here: that each signature belongs to its own file. The script's
|
|
# test checks it before the merge, and verify-release.sh after publication
|
|
# (the file: field of the minisign trusted comment).
|
|
|
|
.version == $version
|
|
and (.platforms | keys) == ["linux-x86_64-deb", "linux-x86_64-rpm", "windows-x86_64"]
|
|
and all(.platforms[]; (.signature | type) == "string" and (.signature | length) > 0)
|
|
and (.platforms["linux-x86_64-deb"].url | endswith(".deb"))
|
|
and (.platforms["linux-x86_64-rpm"].url | endswith(".rpm"))
|
|
and (.platforms["windows-x86_64"].url | endswith(".exe"))
|