ci: verify signed packages before protected draft publication

scripts/release-verifier/.gitignore

@@ -0,0 +1 @@
+/target/

scripts/release-verifier/Cargo.lock

@@ -0,0 +1,23 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "minisign-verify"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
+
+[[package]]
+name = "shacraft-release-verifier"
+version = "0.1.0"
+dependencies = [
+ "base64",
+ "minisign-verify",
+]

scripts/release-verifier/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "shacraft-release-verifier"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+base64 = "=0.22.1"
+minisign-verify = "=0.2.5"

scripts/release-verifier/src/main.rs

@@ -0,0 +1,32 @@
+//! Uses precisely the Tauri updater 2.11 signature verification primitive.
+//! Upstream: plugins/updater/src/updater.rs::verify_signature (MIT/Apache-2.0).
+use base64::Engine;
+use minisign_verify::{PublicKey, Signature};
+use std::{env, fs, process::ExitCode};
+
+fn verify() -> Result<(), Box<dyn std::error::Error>> {
+    let args: Vec<_> = env::args_os().skip(1).collect();
+    if args.len() != 3 {
+        return Err("expected PUBLIC_KEY_FILE DATA_FILE SIGNATURE_FILE".into());
+    }
+    let decode = |path: &std::ffi::OsStr| -> Result<String, Box<dyn std::error::Error>> {
+        let encoded = fs::read_to_string(path)?;
+        let bytes = base64::engine::general_purpose::STANDARD.decode(encoded.trim())?;
+        Ok(String::from_utf8(bytes)?)
+    };
+    let public_key = PublicKey::decode(&decode(&args[0])?)?;
+    let signature = Signature::decode(&decode(&args[2])?)?;
+    public_key.verify(&fs::read(&args[1])?, &signature, true)?;
+    Ok(())
+}
+
+fn main() -> ExitCode {
+    match verify() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(_) => {
+            // Never echo key material or signer diagnostics into release logs.
+            eprintln!("Tauri updater signature verification failed");
+            ExitCode::FAILURE
+        }
+    }
+}