1.1.7
This commit is contained in:
Julian Chang
parent
467164a945
commit
a06b21d6eb
11 changed files with 110 additions and 15 deletions
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "@onelauncher/action-publish-artifacts",
|
||||
"version": "1.1.6",
|
||||
"version": "1.1.7",
|
||||
"private": true,
|
||||
"description": "Next-generation open source Minecraft launcher",
|
||||
"license": "GPL-3.0-only",
|
||||
|
|
|
|||
74
.github/workflows/oneclient_release.yml
vendored
74
.github/workflows/oneclient_release.yml
vendored
|
|
@ -7,6 +7,8 @@ jobs:
|
|||
publish-tauri:
|
||||
permissions:
|
||||
contents: write
|
||||
# Required so SignPath can download the uploaded build artifact.
|
||||
actions: read
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
|
|
@ -125,3 +127,75 @@ jobs:
|
|||
args: ${{ matrix.args }}
|
||||
projectPath: ./apps/oneclient/desktop/
|
||||
uploadUpdaterJson: true
|
||||
|
||||
# ---- Windows Authenticode signing via SignPath (windows-latest only) ----
|
||||
# The installer must be Authenticode-signed BEFORE its Tauri updater signature is
|
||||
# computed, otherwise auto-update breaks: the .sig covers the *unsigned* bytes and no
|
||||
# longer verifies once SignPath alters the exe. tauri-action already built and uploaded
|
||||
# the unsigned exe + latest.json, so here we: SignPath-sign -> recompute the updater
|
||||
# .sig over the SIGNED exe -> replace the release exe and patch latest.json's signature.
|
||||
|
||||
- name: Locate Windows installer
|
||||
if: matrix.platform == 'windows-latest'
|
||||
id: installer
|
||||
shell: bash
|
||||
run: echo "path=$(ls target/release/bundle/nsis/*-setup.exe | head -n1)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Upload unsigned installer
|
||||
if: matrix.platform == 'windows-latest'
|
||||
id: upload-unsigned
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: oneclient-windows-installer-unsigned
|
||||
path: ${{ steps.installer.outputs.path }}
|
||||
|
||||
- name: Submit SignPath signing request
|
||||
if: matrix.platform == 'windows-latest'
|
||||
uses: signpath/github-action-submit-signing-request@v1
|
||||
with:
|
||||
api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
|
||||
organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
|
||||
project-slug: onelauncher
|
||||
signing-policy-slug: test-signing
|
||||
artifact-configuration-slug: onelauncher-installer
|
||||
github-artifact-id: ${{ steps.upload-unsigned.outputs.artifact-id }}
|
||||
wait-for-completion: true
|
||||
output-artifact-directory: signed
|
||||
|
||||
- name: Recompute updater signature over signed installer
|
||||
if: matrix.platform == 'windows-latest'
|
||||
id: resign
|
||||
shell: bash
|
||||
run: |
|
||||
signed="$(ls signed/*-setup.exe | head -n1)"
|
||||
echo "signed=$signed" >> "$GITHUB_OUTPUT"
|
||||
# Writes "$signed.sig" (minisign) over the Authenticode-signed bytes.
|
||||
pnpm -w oneclient:desktop tauri signer sign \
|
||||
--private-key "${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}" \
|
||||
--password "${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}" \
|
||||
"$signed"
|
||||
|
||||
- name: Publish signed installer and patch updater manifest
|
||||
if: matrix.platform == 'windows-latest'
|
||||
shell: bash
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
TAG: oneclient-${{ env.RELEASE_VERSION }}
|
||||
run: |
|
||||
signed="${{ steps.resign.outputs.signed }}"
|
||||
# Replace the release installer with the Authenticode-signed one (same filename).
|
||||
gh release upload "$TAG" "$signed" --clobber
|
||||
# Patch latest.json: swap the windows-x86_64 signature for the recomputed one.
|
||||
gh release download "$TAG" -p latest.json -D manifest --clobber
|
||||
SIG="$(cat "$signed.sig")" python3 - <<'PY'
|
||||
import json, os
|
||||
p = "manifest/latest.json"
|
||||
with open(p) as f:
|
||||
data = json.load(f)
|
||||
for key, plat in data.get("platforms", {}).items():
|
||||
if key.startswith("windows-"):
|
||||
plat["signature"] = os.environ["SIG"]
|
||||
with open(p, "w") as f:
|
||||
json.dump(data, f, indent=2)
|
||||
PY
|
||||
gh release upload "$TAG" manifest/latest.json --clobber
|
||||
|
|
|
|||
21
.signpath/oneclient.artifact-configuration.xml
Normal file
21
.signpath/oneclient.artifact-configuration.xml
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!--
|
||||
SignPath artifact configuration for the OneClient Windows installer.
|
||||
|
||||
GitHub Actions wraps every uploaded artifact in a ZIP archive, so the root
|
||||
element MUST be <zip-file> (see https://docs.signpath.io/trusted-build-systems/github).
|
||||
|
||||
The NSIS bundle produced by Tauri is named e.g. "OneClient_1.1.6_x64-setup.exe",
|
||||
so we match it with a wildcard instead of a fixed, version-specific name.
|
||||
|
||||
Upload this file in the SignPath portal:
|
||||
Project "onelauncher" -> Artifact Configurations -> slug "onelauncher-installer"
|
||||
-->
|
||||
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
|
||||
<zip-file>
|
||||
<pe-file path="**/*-setup.exe" min-matches="1" max-matches="unbounded">
|
||||
<!-- optionally, add metadata constraints: product-name, product-version, file-version, company-name, copyright, original-filename -->
|
||||
<authenticode-sign />
|
||||
</pe-file>
|
||||
</zip-file>
|
||||
</artifact-configuration>
|
||||
14
Cargo.lock
generated
14
Cargo.lock
generated
|
|
@ -3761,7 +3761,7 @@ checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
|
|||
|
||||
[[package]]
|
||||
name = "oneclient_gui"
|
||||
version = "1.1.6"
|
||||
version = "1.1.7"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"chrono",
|
||||
|
|
@ -3798,7 +3798,7 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "onelauncher_core"
|
||||
version = "1.1.6"
|
||||
version = "1.1.7"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"async-compression",
|
||||
|
|
@ -3864,7 +3864,7 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "onelauncher_entity"
|
||||
version = "1.1.6"
|
||||
version = "1.1.7"
|
||||
dependencies = [
|
||||
"chrono",
|
||||
"interfrost",
|
||||
|
|
@ -3880,7 +3880,7 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "onelauncher_gamemode"
|
||||
version = "1.1.6"
|
||||
version = "1.1.7"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"libc",
|
||||
|
|
@ -3888,7 +3888,7 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "onelauncher_gui"
|
||||
version = "1.1.6"
|
||||
version = "1.1.7"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"chrono",
|
||||
|
|
@ -3922,7 +3922,7 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "onelauncher_macro"
|
||||
version = "1.1.6"
|
||||
version = "1.1.7"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
|
|
@ -3931,7 +3931,7 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "onelauncher_migration"
|
||||
version = "1.1.6"
|
||||
version = "1.1.7"
|
||||
dependencies = [
|
||||
"async-trait",
|
||||
"chrono",
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ homepage = "https://polyfrost.org/projects/onelauncher"
|
|||
license = "GPL-3.0-only"
|
||||
readme = "README.md"
|
||||
repository = "https://github.com/Polyfrost/OneLauncher"
|
||||
version = "1.1.6"
|
||||
version = "1.1.7"
|
||||
|
||||
[workspace.dependencies]
|
||||
# workspace
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{
|
||||
"name": "@oneclient/desktop",
|
||||
"type": "module",
|
||||
"version": "1.1.6",
|
||||
"version": "1.1.7",
|
||||
"private": true,
|
||||
"description": "Next-generation open source Minecraft launcher",
|
||||
"license": "GPL-3.0-only",
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{
|
||||
"name": "@onelauncher/desktop",
|
||||
"type": "module",
|
||||
"version": "1.1.6",
|
||||
"version": "1.1.7",
|
||||
"private": true,
|
||||
"description": "Next-generation open source Minecraft launcher",
|
||||
"license": "GPL-3.0-only",
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{
|
||||
"name": "@onelauncher/root",
|
||||
"type": "module",
|
||||
"version": "1.1.6",
|
||||
"version": "1.1.7",
|
||||
"private": true,
|
||||
"engineStrict": true,
|
||||
"description": "Next-generation open source Minecraft launcher and tools for interacting with Polyfrost",
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "@onelauncher/core",
|
||||
"version": "1.1.6",
|
||||
"version": "1.1.7",
|
||||
"description": "Next-generation open source Minecraft launcher core",
|
||||
"license": "GPL-3.0-only",
|
||||
"repository": {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "@onelauncher/gamemode",
|
||||
"version": "1.1.6",
|
||||
"version": "1.1.7",
|
||||
"description": "Next-generation open source Minecraft launcher feral gamemode bindings",
|
||||
"license": "GPL-3.0-only",
|
||||
"repository": {
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{
|
||||
"name": "@onelauncher/scripts",
|
||||
"type": "module",
|
||||
"version": "1.1.6",
|
||||
"version": "1.1.7",
|
||||
"private": true,
|
||||
"description": "Scripts for developing OneLauncher",
|
||||
"license": "GPL-3.0-only",
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue