Signed app for updater issue | Tauri Apps | Page 1

wary tendon Apr 20, 2025, 1:56 PM

#

I have created a signed package for updater plugin. I have used the public key generated by the cargo generate and base64 decoded it looks like this

untrusted comment: minisign public key: C07B7C519EE6B39D
RWSds+aeUXx7wB8ImuRGBnmT9fCEUIjWueVz1YG/FVb7GN7oudAg1zq0

It is 56 chars and it fails on InvalidEncodig issue. I am looking into the updater and minisign code and it expects the public key to be 74 binary length, but my public key (provided by cargo tauri build command) has length just 42. How to fix it? Thanks

Snimek_obrazovky_2025-04-20_v_15.53.59.png

wary tendon Apr 20, 2025, 2:57 PM

#

A code reference to minisign_verify https://github.com/jedisct1/rust-minisign-verify/blob/95d1db8d3140726b79e4260602e55c64e8e3052d/src/lib.rs#L122-L158

GitHub

rust-minisign-verify/src/lib.rs at 95d1db8d3140726b79e4260602e55c64...

A small Rust crate to verify Minisign signatures. Contribute to jedisct1/rust-minisign-verify development by creating an account on GitHub.

green nova Apr 21, 2025, 10:41 AM

#

did you maybe simply copied the key incorrectly? i can't remember the command exactly but i remember someone here used a cli command to copy it and for some reason it cut off parts of it.

#

did you try regenerating it? == is it consistent?

wary tendon Apr 21, 2025, 2:22 PM

#

I am trying all I can. I tried to generate keys with different minisign cli tool (not cargo signer generate) and it generates similar keys, but those are not validated as well. Either format or key length does not match or signature is not valid

wary tendon Apr 21, 2025, 5:51 PM

#

My summary today is theat the cargo tauri signer generate generates invalid public key that is not accepter when validating signed package. If I use standalone minisign tool, I can generate proper keys, sign the package, but validation fails once tauri downloads the package. Tested on Mac and Windows. Not sure how to move forward now

green nova Apr 22, 2025, 11:11 AM

#

which tauri-cli version are you using?

#

and did you install it with the --locked flag? Wondering if there's some inner dep update being weird.

#

on that note, does the npm tauri cli show the same behavior?

wary tendon Apr 23, 2025, 5:30 AM

#

I am using cli version 2.5.0 and probably witout the --locked flag

#Signed app for updater issue