ci: verify signed packages before protected draft publication

scripts/release-verifier/src/main.rs

@@ -0,0 +1,32 @@
+//! Uses precisely the Tauri updater 2.11 signature verification primitive.
+//! Upstream: plugins/updater/src/updater.rs::verify_signature (MIT/Apache-2.0).
+use base64::Engine;
+use minisign_verify::{PublicKey, Signature};
+use std::{env, fs, process::ExitCode};
+
+fn verify() -> Result<(), Box<dyn std::error::Error>> {
+    let args: Vec<_> = env::args_os().skip(1).collect();
+    if args.len() != 3 {
+        return Err("expected PUBLIC_KEY_FILE DATA_FILE SIGNATURE_FILE".into());
+    }
+    let decode = |path: &std::ffi::OsStr| -> Result<String, Box<dyn std::error::Error>> {
+        let encoded = fs::read_to_string(path)?;
+        let bytes = base64::engine::general_purpose::STANDARD.decode(encoded.trim())?;
+        Ok(String::from_utf8(bytes)?)
+    };
+    let public_key = PublicKey::decode(&decode(&args[0])?)?;
+    let signature = Signature::decode(&decode(&args[2])?)?;
+    public_key.verify(&fs::read(&args[1])?, &signature, true)?;
+    Ok(())
+}
+
+fn main() -> ExitCode {
+    match verify() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(_) => {
+            // Never echo key material or signer diagnostics into release logs.
+            eprintln!("Tauri updater signature verification failed");
+            ExitCode::FAILURE
+        }
+    }
+}