fix(desktop): rotate Tauri updater signing key - #8511
Merged
Conversation
The original minisign private key paired with the pubkey in tauri.conf.json was lost and could not be recovered from any local worktree or branch. Generate a fresh keypair and update the public key so the TAURI_SIGNING_PRIVATE_KEY GitHub Secret can sign updater artifacts for the first stable Tauri desktop release.
Collaborator
qwen-code-ci-bot
previously requested changes
Aug 4, 2026
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for unblocking the desktop release pipeline, @yiliang114!
Admission stops at the template check: the PR body doesn't follow the PR template. Missing sections:
## Reviewer Test Plan(with### How to verify,### Evidence (Before & After),### Tested on)## Risk & Scope## Linked Issues- the Chinese translation
<details>block
Two points that are worth putting in those sections, and would make this quick to re-gate:
- How to verify — the only real end-to-end proof for a key rotation is the post-merge draft release run you describe (
draft=true, dry_run=false), since the repo itself cannot prove the secret matches the new pubkey. Worth stating that explicitly, plus what a reviewer should look for in that run's log. - Risk & Scope — the part reviewers will ask about:
desktop-v0.0.4,desktop-v0.0.5, anddesktop-latestare already published, and every build shipped so far embeds the old pubkey (this PR is the first change to that config line). The publishedlatest-mac.ymlondesktop-latestalso carries nosignature:field, so auto-update for existing installs looks broken already — and after this rotation, anything signed with the new key will never verify against the old embedded pubkey. Existing users would need a manual re-download. Please confirm that's the accepted tradeoff (and whether 0.0.4/0.0.5 have real user installs), and note in "Not validated" that the secret pairing is not verifiable from the repo — only via the draft release run.
Once the body is updated, re-run with @qwen-code /triage.
中文说明
感谢推进桌面端发布流程,@yiliang114!
准入检查在模板这一步暂停:PR 描述未遵循 PR 模板。缺少的章节:
## Reviewer Test Plan(含### How to verify、### Evidence (Before & After)、### Tested on)## Risk & Scope## Linked Issues- 中文翻译的
<details>块
有两点值得写进这些章节,补上之后也方便重新过门禁:
- How to verify —— 密钥轮换唯一的端到端验证,就是你描述的合并后草稿发布运行(
draft=true, dry_run=false),因为仓库本身无法证明 secret 与新公钥配对。建议明确写出来,并说明审阅者应该在该运行的日志里确认什么。 - Risk & Scope —— 审阅者一定会问的部分:
desktop-v0.0.4、desktop-v0.0.5、desktop-latest已经发布,目前为止所有构建内嵌的都是旧公钥(本 PR 是第一次改动这行配置)。desktop-latest上已发布的latest-mac.yml也没有signature:字段,所以现有安装的自动更新看起来本来就是坏的——而本次轮换之后,用新密钥签名的更新包永远无法通过旧内嵌公钥的校验,老用户只能手动重新下载。请确认这是可接受的取舍(以及 0.0.4/0.0.5 是否已有真实用户安装),并在"Not validated"中说明:secret 配对无法从仓库侧验证——只能通过草稿发布运行来证明。
补全 PR 描述后,用 @qwen-code /triage 重新触发检查。
— Qwen Code · qwen3.8-max
Contributor
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
Collaborator
|
All four review agents are now running in parallel. While they work, I've already completed the scope & linkage checks:
Waiting for the agents to report their findings. |
Collaborator
|
Correctness agent done — no issues found (migration complete, consumers key-agnostic, endpoint flow consistent). Waiting on the Security, Quality, and Test Coverage agents. |
Collaborator
|
Security agent done — no issues (public-key-only diff, no shipped client trusts the old key, no verification weakening, HTTPS endpoint). Waiting on Quality and Test Coverage agents. |
Collaborator
|
Quality agent done — no issues. One agent remaining (Test Coverage). |
Collaborator
|
All four agents returned zero findings. Before composing the published review, loading the publication language/tone guidance. |
Collaborator
|
All four review agents returned zero findings, and every claim in the PR body checked out against repo evidence. Final review summary: Review summary — no blockers found (verified at head The rotation is safe at this point: nothing shipped yet trusts the old key, and the scope matches the description exactly — one line, one file. What I verified
Not blocking, but worth closing the loop before merge
|
Collaborator
Author
|
@qwen-code-review-bot approve if no blockers |
Collaborator
|
The new head is tree-identical to the reviewed commit — the extra commits are empty CI re-trigger commits. All verification stands. Composing the approval reply. LGTM — no blockers, approving. The current head (
The earlier template-gate review is also addressed — the PR body now has all required sections. CI is in flight on this head (Desktop Shell already green, ubuntu Test running); the merge queue will re-validate the merged tree anyway. |
yiliang114
enabled auto-merge
August 4, 2026 06:45
chiga0
approved these changes
Aug 4, 2026
chiga0
left a comment
chiga0
left a comment
Collaborator
There was a problem hiding this comment.
Code Review Overview (AI Generated)
PR: #8511 fix(desktop): rotate Tauri updater signing key
Type: Bug fix / release blocker
Change size: +1/-1 across 1 file
Findings Summary
- Critical/Major: 0
- Minor: 0
- Nit: 1（commit 历史里有 3 条 CI rerun 的 chore commit，合并前建议 squash）
Key Observations
PR 仅把 packages/desktop-shell/src-tauri/tauri.conf.json 里的 Tauri updater 公钥替换为新 minisign 密钥对的公钥。我已独立验证新公钥的 minisign key ID 为 9319E432E5E6E25C，与 PR 描述一致；旧 key ID 在仓库中已无其他引用；TAURI_SIGNING_PRIVATE_KEY secret 已配置；现有 desktop-v0.0.5 发布产物为 Electron 更新通道，没有 Tauri 签名产物，因此不存在会破坏的现有 Tauri 客户端。
Cross-Validation
| Finding | Other Reviewer | My Assessment |
|---|---|---|
| PR body 缺少模板章节（Reviewer Test Plan / Risk & Scope / Linked Issues / 中文说明） | qwen-code-ci-bot | 已确认在 HEAD 已补全，模板检查项已满足 |
| 已发布的 desktop-v0.0.4/0.0.5 内嵌旧公钥，轮换后老用户需手动重下载 | qwen-code-ci-bot | 已确认——现有 release 是 Electron latest-mac.yml 通道，无 Tauri 签名产物，PR 描述中已说明这是可接受的取舍 |
| LGTM | doudouOUC | 已阅，独立审查后同样认为可合并 |
Additional Audit Coverage
除现有 reviewer 关注点外，我还独立检查了以下内容：
- 公钥格式与 key ID：base64 解码后校验 minisign 二进制格式（
Ed算法标识 + key ID + 32 字节公钥），并通过字节序转换确认 key ID 与注释一致。 - 旧密钥残留：全仓库搜索旧 key ID
CDDA57A02F99CC30与新 key ID，确认旧 key 已无引用。 - GitHub Secret 配置：
gh secret list确认TAURI_SIGNING_PRIVATE_KEY已存在。 - Release 产物：检查
desktop-v0.0.5release assets，确认只有 Electron 更新产物，没有.app.tar.gz.sig等 Tauri updater 签名产物。 - Workflow 签名校验门：
.github/workflows/desktop-release.yml中Require updater signing key for publishing步骤仅在dry_run=false时要求TAURI_SIGNING_PRIVATE_KEY，且dry_run=true时使用--no-sign，逻辑正确。
Final Verdict
APPROVE。这是一个最小化的配置修复，解除了首次稳定 Tauri 桌面发布的阻塞项，风险可控。建议在合并前 squash 掉重复的 CI rerun commit。
This review was generated by QoderWork AI
Collaborator
|
Released in v0.21.6. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Replaces the Tauri updater public key in the desktop shell configuration with a freshly generated minisign keypair, and configures the matching private key as a GitHub Secret.
Why it's needed
The original minisign private key paired with the public key in the Tauri configuration (key ID
CDDA57A02F99CC30) was lost during development — it was not saved to any local worktree, branch, or shell history. Without the matching private key, theTAURI_SIGNING_PRIVATE_KEYGitHub Secret cannot be configured, and the release workflow hard-blocks any published release run that lacks it (theRequire updater signing key for publishingstep exits with an error). This is the only remaining blocker for the first stable Tauri macOS desktop release.Reviewer Test Plan
How to verify
tauri.conf.jsondecodes to minisign public key ID9319E432E5E6E25C.TAURI_SIGNING_PRIVATE_KEYsecret exists in the QwenLM/qwen-code repository (check viagh secret list).draft=true, dry_run=false— theRequire updater signing key for publishingstep should pass, and the build should produce signed.app.tar.gz.sigupdater artifacts.Evidence (Before & After)
N/A — no user-visible change; single config field replacement.
Tested on
Environment (optional)
N/A — single field change in Tauri configuration, verified by key generation output.
Risk & Scope
--no-sign), there are no existing Tauri clients to break.draft=true, dry_run=falserelease run. Windows and Linux signing secrets are not affected.latest-mac.ymlupdater feed and is unaffected.Linked Issues
中文说明
本 PR 做了什么
将桌面壳 Tauri 配置中的 updater 公钥替换为新生成的 minisign 密钥对，并将对应的私钥配置为 GitHub Secret。
为什么需要
Tauri 配置中原来的公钥（minisign key ID
CDDA57A02F99CC30）对应的私钥在开发过程中丢失——没有保存到任何本地 worktree、分支或 shell history 中。没有配对的私钥，就无法配置TAURI_SIGNING_PRIVATE_KEYGitHub Secret，而 release workflow 在dry_run=false时会硬阻塞（Require updater signing key for publishing步骤直接报错退出）。这是 Tauri 桌面应用首次稳定发布的唯一剩余阻塞项。验证计划
如何验证
tauri.conf.json中新公钥解码后 minisign key ID 为9319E432E5E6E25C。TAURI_SIGNING_PRIVATE_KEYsecret（通过gh secret list查看）。draft=true, dry_run=false的 Desktop Release workflow——Require updater signing key for publishing步骤应通过，构建应生成签名的.app.tar.gz.sigupdater 产物。证据（前后对比）
N/A——无用户可见变更，仅替换单个配置字段。
测试环境
环境（可选）
N/A——Tauri 配置单字段变更，通过密钥生成输出验证。
风险与范围
--no-sign的 dry run），不存在会被破坏的现有 Tauri 客户端。draft=true, dry_run=false发布运行。Windows 和 Linux 签名 secret 不受影响。latest-mac.ymlupdater feed，不受影响。关联 Issue