Commit 83381d4

`release.yml` runs `configure_tauri_release.py` before compiling aw-tauri.

It writes the release version to `aw-tauri/src-tauri/tauri.conf.json`, which

Tauri embeds as its package version. `generate_latest_json.py` uses the same

`tauri_version()` conversion for the manifest: `v0.14.0b5` becomes

`0.14.0-beta.5`. Original AW spellings remain in asset filenames and tag URLs.

Development builds also receive a SemVer version, with a `dev.g<hash>` suffix.

The standard build keeps its checked-in updater endpoint and public key.

Research builds use only:

Configure these repository settings before a research tag or manual build:

| Setting | Purpose |

| --- | --- |

| Variable `TAURI_UPDATER_PUBLIC_KEY_RESEARCH` | Base64-encoded minisign public-key file emitted by Tauri's signer |

| Secret `TAURI_SIGNING_PRIVATE_KEY_RESEARCH` | Research-only signing key in Tauri's expected format |

| Secret `TAURI_SIGNING_PRIVATE_KEY_PASSWORD_RESEARCH` | Password for that key (empty for an unencrypted key) |

The workflow selects secret **names** by edition. A missing research secret

never falls back to a standard secret. The configurator rejects a research

public key containing the standard key material, even if its comment or key

ID differs. Research tag/manual builds fail if either key is missing.

Secretless research PR smoke builds clear both updater endpoints and the

public key. They cannot consume the standard channel.

`aw-tauri/Makefile` enables `bundle.createUpdaterArtifacts` by passing a

`--config` override to the Tauri build when `TAURI_SIGNING_PRIVATE_KEY` is

present. That setting is therefore absent from the checked-in JSON even

though release builds produce signatures. Both the initial build and the

research-profile rebuild receive the edition's selected signing key.

This configuration does not create the `research-updates` branch, publish

its manifest, verify that a private key matches the configured public key,

or change any already installed client. Before offering an update:

- Provision the channel and verify its public URL. Publish only a complete,

verified manifest after its versioned release is public; use a normal

fast-forward commit with an expected parent and a monotonic version check

so a late release job cannot overwrite a newer feed.

- Verify actual bundle signatures with the research key and reject standard

signatures. Config/fixture checks alone are insufficient.

- Verify the built app's version, equal-version no-update, one newer-version

upgrade, and no repeated offer after restart. Both versions must preserve

the research profile, privacy defaults, install identity, and bundled

watchers/aw-sync. Native updater bundles and full AW packages require a

payload-equivalence check.

- Replace or verifiably contain any already distributed research app that

embedded the standard endpoint/key **before publishing a valid standard

stable manifest**. A future configuration cannot repair an installed app.

The pipeline creates a draft versioned release. Its `latest-research.json`

asset is distinct from the live branch feed; uploading the asset does not

advance that feed. Do not publish the draft until these gates are satisfied.

Initialize the pinned `aw-tauri` submodule, then run:

python3 -m pytest scripts/tests/test_generate_latest_json.py scripts/tests/test_configure_tauri_release.py -q

These tests execute both CLIs against the pinned config, exercise missing and

same-key rejection, preserve standard trust, and check both directions of

asset partitioning. Dummy signatures in these fixtures do not prove signing

or installation.

import argparse

import base64

import binascii

import json

import os

import sys

from pathlib import Path

from generate_latest_json import tauri_version

RESEARCH_ENDPOINT = (

"https://raw.githubusercontent.com/ActivityWatch/activitywatch/"

"research-updates/latest-research.json"

)

STANDARD_ENDPOINT = "https://github.com/ActivityWatch/activitywatch/releases/latest/download/latest.json"

def msi_rejects(version: str) -> bool:

"""True if Tauri's msi (WiX) bundler will reject this SemVer version.

if "-" not in version:

return False

prerelease = version.split("-", 1)[1]

return not all(part.isdigit() for part in prerelease.split("."))

def public_key(encoded: str) -> bytes:

"""Read Tauri's base64-wrapped minisign public key, ignoring its comment."""

try:

lines = base64.b64decode(encoded, validate=True).decode("ascii").splitlines()

if len(lines) != 2 or not lines[0].startswith("untrusted comment: "):

raise ValueError("invalid public key envelope")

packet = base64.b64decode(lines[1], validate=True)

if len(packet) != 42 or packet[:2] != b"Ed":

raise ValueError("invalid public key packet")

return packet[10:]

except (ValueError, UnicodeError, binascii.Error) as exc:

raise ValueError("Expected a base64-encoded minisign public key") from exc

def configure(

path: Path,

version: str,

research: bool,

require_signing_key: bool,

*,

platform: str = sys.platform,

) -> None:

config = json.loads(path.read_text(encoding="utf-8"))

tv = tauri_version(version)

config["version"] = tv

if platform == "win32" and msi_rejects(tv):

bundle = config.setdefault("bundle", {})

if bundle.get("targets") == "all":

# Windows only ever produces msi+nsis from "all"; drop msi and

# keep nsis, which accepts the full AW pre-release scheme.

bundle["targets"] = ["nsis"]

if research:

updater = config["plugins"]["updater"]

if updater["endpoints"] != [STANDARD_ENDPOINT]:

raise ValueError(

"Unexpected source updater endpoint; review before patching"

)

research_key = os.environ.get("TAURI_UPDATER_PUBLIC_KEY_RESEARCH", "").strip()

signing_key = os.environ.get("TAURI_SIGNING_PRIVATE_KEY", "").strip()

if require_signing_key and (not research_key or not signing_key):

raise ValueError(

"Research releases require their own public and signing keys"

)

if research_key:

if public_key(research_key) == public_key(updater["pubkey"]):

raise ValueError(

"Research updater key must differ from the standard key"

)

updater["pubkey"] = research_key

updater["endpoints"] = [RESEARCH_ENDPOINT]

else:

if signing_key:

raise ValueError("Research signing key supplied without its public key")

# Secretless PR smoke builds must never retain standard update trust.

updater["pubkey"] = ""

updater["endpoints"] = []

path.write_text(json.dumps(config, indent=2) + "\n", encoding="utf-8")

def main() -> None:

parser = argparse.ArgumentParser(description=__doc__)

parser.add_argument("--config", type=Path, required=True)

parser.add_argument("--version", required=True)

parser.add_argument("--research", action="store_true")

parser.add_argument("--require-signing-key", action="store_true")

args = parser.parse_args()

try:

configure(args.config, args.version, args.research, args.require_signing_key)

except (ValueError, KeyError) as exc:

parser.exit(1, f"ERROR: {exc}\n")

if __name__ == "__main__":

main()

def tauri_version(version: str) -> str:

"""Convert AW release/dev labels to the SemVer embedded by Tauri.

version = normalize_version(version)

number = r"(?:0|[1-9][0-9]*)"

match = re.fullmatch(

rf"(?P<base>{number}\.{number}\.{number})"

rf"(?:(?P<pre>a|b|rc)(?P<serial>{number}))?"

r"(?:\.dev-(?P<dev>[0-9a-f]+|unknown))?",

version,

)

if not match:

raise ValueError(f"Unsupported ActivityWatch version: {version!r}")

suffix = []

if match["pre"]:

suffix.extend(

({"a": "alpha", "b": "beta", "rc": "rc"}[match["pre"]], match["serial"])

)

if match["dev"]:

# Prefix hashes so an all-digit hash with a leading zero stays valid.

suffix.extend(("dev", "g" + match["dev"]))

return match["base"] + ("-" + ".".join(suffix) if suffix else "")

manifest = build_manifest(tauri_version(version), args.notes, platforms)