Add signed launcher self-updates and publish Linux 0.1.3

2026-09-10 02:47:16 +03:00
parent bf43254c57
commit bb4b1f8051
55 changed files with 6286 additions and 43 deletions
@@ -0,0 +1,44 @@
+# ShaCraft metadata-only updater patch
+
+This directory vendors the Rust/build portion of the official
+`tauri-plugin-updater` **2.11.0** crate. Files were copied from the local Cargo
+registry cache, and every copied file was checked byte-for-byte against the
+cached `.crate` archive before applying this patch. No replacement crate was
+downloaded for this vendoring step.
+
+Upstream: <https://github.com/tauri-apps/plugins-workspace/tree/6aa2854f314481a459be1189b02c65a2450789ab/plugins/updater>
+
+The published archive's SHA-256 is
+`b28d8cabdeb0564f03ae261963de4bc3d98321cd3d213e76a81b7d344e5df606`.
+The original registry `.cargo_vcs_info.json`, normalized `Cargo.toml` and
+`Cargo.toml.orig` are retained for provenance. Unused upstream JS source, package
+lockfile, changelog and Cargo cache marker are omitted; `api-iife.js` is retained
+because the official build script references it.
+
+## Local change
+
+Only `src/updater.rs` changes upstream Rust behavior. The new public method
+`Updater::check_metadata(&self, raw_json: serde_json::Value) -> Result<Option<Update>>`
+is synchronous and performs **no HTTP requests**. It uses the existing release
+deserializer, current-version/comparator decision, platform URL/signature
+selection and `Update` construction. `Updater::check()` keeps its original
+endpoint iteration and validation, then calls this same method. Its accepted
+release is parsed again by the helper; endpoint selection and error semantics
+are preserved.
+
+ShaCraft fetches a size-limited metadata response and verifies its signature in
+its own native trust boundary before passing that exact JSON value to this
+method. This avoids asking the upstream `check()` path to fetch and parse a
+second, potentially unbounded metadata response. This helper does not itself
+authenticate metadata; callers must enforce their own policy.
+
+The upstream package download, Minisign verification and all platform installer
+implementations are unchanged by this patch. ShaCraft's own native integration
+may choose a separate bounded download and installation path.
+
+## License and maintenance
+
+Upstream is dual licensed **Apache-2.0 OR MIT**. Both full license files,
+`LICENSE.spdx`, copyright notices and `SECURITY.md` remain in this directory.
+Rebase this small patch when upgrading the dependency, retain upstream notices,
+and repeat native updater tests before release.