From a06b21d6eb37009943edd8a2eeac781db1300d88 Mon Sep 17 00:00:00 2001 From: Julian Chang Date: Thu, 2 Jul 2026 09:31:38 -0400 Subject: [PATCH] 1.1.7 --- .../actions/publish-artifacts/package.json | 2 +- .github/workflows/oneclient_release.yml | 74 +++++++++++++++++++ .../oneclient.artifact-configuration.xml | 21 ++++++ Cargo.lock | 14 ++-- Cargo.toml | 2 +- apps/oneclient/desktop/package.json | 2 +- apps/onelauncher/desktop/package.json | 2 +- package.json | 2 +- packages/core/package.json | 2 +- packages/gamemode/package.json | 2 +- packages/scripts/package.json | 2 +- 11 files changed, 110 insertions(+), 15 deletions(-) create mode 100644 .signpath/oneclient.artifact-configuration.xml diff --git a/.github/actions/publish-artifacts/package.json b/.github/actions/publish-artifacts/package.json index 4751c916..0d407327 100644 --- a/.github/actions/publish-artifacts/package.json +++ b/.github/actions/publish-artifacts/package.json @@ -1,6 +1,6 @@ { "name": "@onelauncher/action-publish-artifacts", - "version": "1.1.6", + "version": "1.1.7", "private": true, "description": "Next-generation open source Minecraft launcher", "license": "GPL-3.0-only", diff --git a/.github/workflows/oneclient_release.yml b/.github/workflows/oneclient_release.yml index 11ae8779..2cce3afa 100644 --- a/.github/workflows/oneclient_release.yml +++ b/.github/workflows/oneclient_release.yml @@ -7,6 +7,8 @@ jobs: publish-tauri: permissions: contents: write + # Required so SignPath can download the uploaded build artifact. + actions: read strategy: fail-fast: false matrix: @@ -125,3 +127,75 @@ jobs: args: ${{ matrix.args }} projectPath: ./apps/oneclient/desktop/ uploadUpdaterJson: true + + # ---- Windows Authenticode signing via SignPath (windows-latest only) ---- + # The installer must be Authenticode-signed BEFORE its Tauri updater signature is + # computed, otherwise auto-update breaks: the .sig covers the *unsigned* bytes and no + # longer verifies once SignPath alters the exe. tauri-action already built and uploaded + # the unsigned exe + latest.json, so here we: SignPath-sign -> recompute the updater + # .sig over the SIGNED exe -> replace the release exe and patch latest.json's signature. + + - name: Locate Windows installer + if: matrix.platform == 'windows-latest' + id: installer + shell: bash + run: echo "path=$(ls target/release/bundle/nsis/*-setup.exe | head -n1)" >> "$GITHUB_OUTPUT" + + - name: Upload unsigned installer + if: matrix.platform == 'windows-latest' + id: upload-unsigned + uses: actions/upload-artifact@v4 + with: + name: oneclient-windows-installer-unsigned + path: ${{ steps.installer.outputs.path }} + + - name: Submit SignPath signing request + if: matrix.platform == 'windows-latest' + uses: signpath/github-action-submit-signing-request@v1 + with: + api-token: ${{ secrets.SIGNPATH_API_TOKEN }} + organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }} + project-slug: onelauncher + signing-policy-slug: test-signing + artifact-configuration-slug: onelauncher-installer + github-artifact-id: ${{ steps.upload-unsigned.outputs.artifact-id }} + wait-for-completion: true + output-artifact-directory: signed + + - name: Recompute updater signature over signed installer + if: matrix.platform == 'windows-latest' + id: resign + shell: bash + run: | + signed="$(ls signed/*-setup.exe | head -n1)" + echo "signed=$signed" >> "$GITHUB_OUTPUT" + # Writes "$signed.sig" (minisign) over the Authenticode-signed bytes. + pnpm -w oneclient:desktop tauri signer sign \ + --private-key "${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}" \ + --password "${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}" \ + "$signed" + + - name: Publish signed installer and patch updater manifest + if: matrix.platform == 'windows-latest' + shell: bash + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: oneclient-${{ env.RELEASE_VERSION }} + run: | + signed="${{ steps.resign.outputs.signed }}" + # Replace the release installer with the Authenticode-signed one (same filename). + gh release upload "$TAG" "$signed" --clobber + # Patch latest.json: swap the windows-x86_64 signature for the recomputed one. + gh release download "$TAG" -p latest.json -D manifest --clobber + SIG="$(cat "$signed.sig")" python3 - <<'PY' + import json, os + p = "manifest/latest.json" + with open(p) as f: + data = json.load(f) + for key, plat in data.get("platforms", {}).items(): + if key.startswith("windows-"): + plat["signature"] = os.environ["SIG"] + with open(p, "w") as f: + json.dump(data, f, indent=2) + PY + gh release upload "$TAG" manifest/latest.json --clobber diff --git a/.signpath/oneclient.artifact-configuration.xml b/.signpath/oneclient.artifact-configuration.xml new file mode 100644 index 00000000..faa11293 --- /dev/null +++ b/.signpath/oneclient.artifact-configuration.xml @@ -0,0 +1,21 @@ + + + + + + + + + + diff --git a/Cargo.lock b/Cargo.lock index 05f073f7..6192e640 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3761,7 +3761,7 @@ checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" [[package]] name = "oneclient_gui" -version = "1.1.6" +version = "1.1.7" dependencies = [ "anyhow", "chrono", @@ -3798,7 +3798,7 @@ dependencies = [ [[package]] name = "onelauncher_core" -version = "1.1.6" +version = "1.1.7" dependencies = [ "anyhow", "async-compression", @@ -3864,7 +3864,7 @@ dependencies = [ [[package]] name = "onelauncher_entity" -version = "1.1.6" +version = "1.1.7" dependencies = [ "chrono", "interfrost", @@ -3880,7 +3880,7 @@ dependencies = [ [[package]] name = "onelauncher_gamemode" -version = "1.1.6" +version = "1.1.7" dependencies = [ "cc", "libc", @@ -3888,7 +3888,7 @@ dependencies = [ [[package]] name = "onelauncher_gui" -version = "1.1.6" +version = "1.1.7" dependencies = [ "anyhow", "chrono", @@ -3922,7 +3922,7 @@ dependencies = [ [[package]] name = "onelauncher_macro" -version = "1.1.6" +version = "1.1.7" dependencies = [ "proc-macro2", "quote", @@ -3931,7 +3931,7 @@ dependencies = [ [[package]] name = "onelauncher_migration" -version = "1.1.6" +version = "1.1.7" dependencies = [ "async-trait", "chrono", diff --git a/Cargo.toml b/Cargo.toml index f1a64d9d..54e62b0e 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -22,7 +22,7 @@ homepage = "https://polyfrost.org/projects/onelauncher" license = "GPL-3.0-only" readme = "README.md" repository = "https://github.com/Polyfrost/OneLauncher" -version = "1.1.6" +version = "1.1.7" [workspace.dependencies] # workspace diff --git a/apps/oneclient/desktop/package.json b/apps/oneclient/desktop/package.json index 52c5a2f1..386015d0 100644 --- a/apps/oneclient/desktop/package.json +++ b/apps/oneclient/desktop/package.json @@ -1,7 +1,7 @@ { "name": "@oneclient/desktop", "type": "module", - "version": "1.1.6", + "version": "1.1.7", "private": true, "description": "Next-generation open source Minecraft launcher", "license": "GPL-3.0-only", diff --git a/apps/onelauncher/desktop/package.json b/apps/onelauncher/desktop/package.json index f0d9aba6..f0c2bb2b 100644 --- a/apps/onelauncher/desktop/package.json +++ b/apps/onelauncher/desktop/package.json @@ -1,7 +1,7 @@ { "name": "@onelauncher/desktop", "type": "module", - "version": "1.1.6", + "version": "1.1.7", "private": true, "description": "Next-generation open source Minecraft launcher", "license": "GPL-3.0-only", diff --git a/package.json b/package.json index f3093c01..4aaf94fc 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "@onelauncher/root", "type": "module", - "version": "1.1.6", + "version": "1.1.7", "private": true, "engineStrict": true, "description": "Next-generation open source Minecraft launcher and tools for interacting with Polyfrost", diff --git a/packages/core/package.json b/packages/core/package.json index 1461f321..2a7e9ced 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@onelauncher/core", - "version": "1.1.6", + "version": "1.1.7", "description": "Next-generation open source Minecraft launcher core", "license": "GPL-3.0-only", "repository": { diff --git a/packages/gamemode/package.json b/packages/gamemode/package.json index d500aa09..f671e461 100644 --- a/packages/gamemode/package.json +++ b/packages/gamemode/package.json @@ -1,6 +1,6 @@ { "name": "@onelauncher/gamemode", - "version": "1.1.6", + "version": "1.1.7", "description": "Next-generation open source Minecraft launcher feral gamemode bindings", "license": "GPL-3.0-only", "repository": { diff --git a/packages/scripts/package.json b/packages/scripts/package.json index 4ca833bc..91328d0f 100644 --- a/packages/scripts/package.json +++ b/packages/scripts/package.json @@ -1,7 +1,7 @@ { "name": "@onelauncher/scripts", "type": "module", - "version": "1.1.6", + "version": "1.1.7", "private": true, "description": "Scripts for developing OneLauncher", "license": "GPL-3.0-only",