feat(KAN-58): add macOS actions and Hetzner release pipeline

.github/workflows/macos-release.yml

@@ -2,8 +2,6 @@ name: macOS release to Hetzner
 
 on:
   push:
-    # Gitea enforces the configured macos-v* protection when tags are pushed.
-    # Reading /tag_protections requires admin rights unavailable to job tokens.
     tags:
       - "macos-v*"
   workflow_dispatch:
@@ -37,6 +35,7 @@ jobs:
     outputs:
       commit: ${{ steps.ref.outputs.commit }}
       tag: ${{ steps.ref.outputs.tag }}
+      runner: ${{ steps.ref.outputs.runner }}
     steps:
       - name: Check out repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -63,13 +62,31 @@ jobs:
           commit="$(git rev-parse --verify "refs/tags/$tag^{commit}")"
           git merge-base --is-ancestor "$commit" origin/main || { echo 'Release tag must belong to main.' >&2; exit 1; }
           git checkout --detach "$commit"
-          printf 'commit=%s\ntag=%s\n' "$commit" "$tag" >> "$GITHUB_OUTPUT"
+          printf 'commit=%s\ntag=%s\nrunner=%s\n' "$commit" "$tag" "$MACOS_RUNNER" >> "$GITHUB_OUTPUT"
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
 
+      - name: Require protected macOS release tags
+        shell: bash
+        env:
+          GITEA_TOKEN: ${{ github.token }}
+        run: |
+          set -Eeuo pipefail
+          curl --fail --silent --show-error \
+            --header "Authorization: Bearer $GITEA_TOKEN" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/tag_protections" \
+            --output "$RUNNER_TEMP/macos-tag-protections.json"
+          node --input-type=module - <<'JS'
+          import { readFileSync } from 'node:fs';
+          const rules = JSON.parse(readFileSync(`${process.env.RUNNER_TEMP}/macos-tag-protections.json`, 'utf8'));
+          if (!rules.some((rule) => rule.name_pattern === 'macos-v*')) {
+              throw new Error('Configure a protected macos-v* tag rule in Gitea before publishing.');
+          }
+          JS
+
       - name: Validate app versions and Hetzner configuration
         env:
           RELEASE_TAG: ${{ steps.ref.outputs.tag }}
@@ -80,8 +97,7 @@ jobs:
   release:
     name: Sign, notarize, verify and publish macOS
     needs: prepare
-    # Gitea resolves runner labels before outputs from prepare are available.
-    runs-on: ${{ vars.MACOS_RUNNER }}
+    runs-on: ${{ needs.prepare.outputs.runner }}
     timeout-minutes: 120
     env:
       RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
@@ -98,7 +114,6 @@ jobs:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
           S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
         run: |
@@ -111,7 +126,7 @@ jobs:
           xcodebuild -version
           xcrun --find notarytool
           aws --version | grep '^aws-cli/2\.' || { echo 'Install AWS CLI v2 permanently on this runner.' >&2; exit 1; }
-          for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_PASSWORD TAURI_SIGNING_PRIVATE_KEY S3_ACCESS_KEY_ID S3_SECRET_ACCESS_KEY; do
+          for name in APPLE_CERTIFICATE APPLE_CERTIFICATE_PASSWORD APPLE_PASSWORD S3_ACCESS_KEY_ID S3_SECRET_ACCESS_KEY; do
             [[ -n "${!name}" ]] || { echo "Missing repository secret: $name" >&2; exit 1; }
           done
 
@@ -176,19 +191,14 @@ jobs:
       - name: Build, sign and notarize with Tauri
         uses: tauri-apps/tauri-action@1deb371b0cd8bd54025b384f1cd735e725c4060f # v1.0.0
         env:
-          # The DMG bundler reads these variables separately from --ci.
-          CI: "true"
-          TAURI_BUNDLER_DMG_IGNORE_CI: "false"
           APPLE_ID: dev@petsch-studios.de
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         with:
           projectPath: native
           tauriScript: pnpm exec tauri
           args: >-
-            --ci --target ${{ env.MACOS_RELEASE_TARGET }} --bundles app,dmg
-            --config '{"bundle":{"createUpdaterArtifacts":true,"macOS":{"hardenedRuntime":true}}}'
+            --ci --target ${{ env.MACOS_RELEASE_TARGET }} --bundles app
+            --config '{"bundle":{"createUpdaterArtifacts":false,"macOS":{"hardenedRuntime":true}}}'
             -- --locked
           uploadUpdaterJson: false
           uploadUpdaterSignatures: false

native/macos-ci.mjs

@@ -2,8 +2,6 @@ import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import {
     appendFileSync,
-    copyFileSync,
-    readlinkSync,
     existsSync,
     mkdirSync,
     mkdtempSync,
@@ -14,7 +12,6 @@ import {
 } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import process from 'node:process';
-import { updateSource } from './update-manifest.mjs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import {
     appleTeamId,
@@ -31,10 +28,9 @@ export function releaseMetadata(
     const config = JSON.parse(
         readFileSync(join(directory, 'src-tauri/tauri.conf.json'), 'utf8'),
     );
-    const nativePackage = JSON.parse(
+    const packageVersion = JSON.parse(
         readFileSync(join(directory, 'package.json'), 'utf8'),
-    );
-    const packageVersion = nativePackage.version;
+    ).version;
     const cargoVersion = readFileSync(
         join(directory, 'src-tauri/Cargo.toml'),
         'utf8',
@@ -63,23 +59,6 @@ export function releaseMetadata(
             'The macOS product name and bundle identifier must stay unchanged.',
         );
     }
-    if (config.plugins?.updater?.pubkey !== updateSource.publicKey) {
-        throw new Error(
-            'The app updater key must match the permanent release key.',
-        );
-    }
-    if (
-        !/^\d+(?:\.\d+){0,2}$/.test(config.bundle?.macOS?.bundleVersion || '')
-    ) {
-        throw new Error(
-            'Set a numeric macOS bundleVersion for the About build number.',
-        );
-    }
-    if (!nativePackage.releaseNotes?.trim()) {
-        throw new Error(
-            'Add releaseNotes to native/package.json before publishing.',
-        );
-    }
     const target = env.MACOS_RELEASE_TARGET || 'aarch64-apple-darwin';
     const arch = {
         'aarch64-apple-darwin': 'arm64',
@@ -102,11 +81,9 @@ export function releaseMetadata(
     }
     return {
         version: config.version,
-        notes: nativePackage.releaseNotes,
         target,
         arch,
-        filename: `KanbanGit-${config.version}-${target}.dmg`,
-        updaterFilename: `KanbanGit-${config.version}-${target}.app.tar.gz`,
+        filename: `KanbanGit-${config.version}-${target}.zip`,
     };
 }
 
@@ -169,65 +146,25 @@ export function packageNotarizedApp({
     const staging = mkdtempSync(join(releaseRoot, '.pending-'));
     try {
         const archive = join(staging, metadata.filename);
-        const bundle = join(root, metadata.target, 'release/bundle');
-        copyFileSync(
-            join(
-                bundle,
-                'dmg',
-                `KanbanGit_${metadata.version}_${metadata.arch === 'arm64' ? 'aarch64' : 'x64'}.dmg`,
-            ),
+        run('ditto', [
+            '-c',
+            '-k',
+            '--sequesterRsrc',
+            '--keepParent',
+            app,
             archive,
-        );
-        const mounted = join(staging, 'mounted');
-        mkdirSync(mounted);
-        run('hdiutil', ['verify', archive]);
-        run('hdiutil', [
-            'attach',
-            archive,
-            '-readonly',
-            '-nobrowse',
-            '-mountpoint',
-            mounted,
         ]);
-        try {
-            if (
-                readlinkSync(join(mounted, 'Applications')) !== '/Applications'
-            ) {
-                throw new Error(
-                    'DMG must contain the Applications installation link.',
-                );
-            }
-            verifyNotarizedApp(join(mounted, 'KanbanGit.app'), metadata, run);
-        } finally {
-            run('hdiutil', ['detach', mounted]);
-        }
-        rmSync(mounted, { recursive: true, force: true });
-        const updateArchive = join(staging, metadata.updaterFilename);
-        copyFileSync(join(bundle, 'macos/KanbanGit.app.tar.gz'), updateArchive);
-        copyFileSync(
-            join(bundle, 'macos/KanbanGit.app.tar.gz.sig'),
-            `${updateArchive}.sig`,
-        );
-        if (!readFileSync(`${updateArchive}.sig`, 'utf8').trim()) {
-            throw new Error('The updater signature is missing.');
-        }
-        const extracted = join(staging, 'extracted');
-        mkdirSync(extracted);
-        run('tar', ['-xzf', updateArchive, '-C', extracted]);
-        verifyNotarizedApp(join(extracted, 'KanbanGit.app'), metadata, run);
-        rmSync(extracted, { recursive: true, force: true });
         const checksum = createHash('sha256')
             .update(readFileSync(archive))
             .digest('hex');
-        for (const name of [metadata.filename, metadata.updaterFilename]) {
-            const hash = createHash('sha256')
-                .update(readFileSync(join(staging, name)))
-                .digest('hex');
-            writeFileSync(
-                join(staging, `${name}.sha256`),
-                `${hash}  ${name}\n`,
-            );
-        }
+        writeFileSync(
+            `${archive}.sha256`,
+            `${checksum}  ${metadata.filename}\n`,
+        );
+        const extracted = join(staging, 'extracted');
+        run('ditto', ['-x', '-k', archive, extracted]);
+        verifyNotarizedApp(join(extracted, 'KanbanGit.app'), metadata, run);
+        rmSync(extracted, { recursive: true, force: true });
         renameSync(staging, destination);
         return { ...metadata, directory: destination, checksum };
     } finally {
@@ -254,7 +191,6 @@ if (
             appendFileSync(
                 process.env.GITHUB_OUTPUT,
                 Object.entries(output)
-                    .filter(([key]) => key !== 'notes')
                     .map(([key, value]) => `${key}=${value}\n`)
                     .join(''),
             );

native/macos-dmg.mjs

@@ -1,25 +0,0 @@
-import { mkdirSync, rmSync, symlinkSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-
-export function createDiskImage({ app, archive, identity, run }) {
-    const contents = join(dirname(archive), 'dmg-contents');
-    mkdirSync(contents);
-    try {
-        run('ditto', [app, join(contents, 'KanbanGit.app')]);
-        symlinkSync('/Applications', join(contents, 'Applications'));
-        run('hdiutil', [
-            'create',
-            '-volname',
-            'KanbanGit',
-            '-srcfolder',
-            contents,
-            '-format',
-            'UDZO',
-            archive,
-        ]);
-        run('codesign', ['--sign', identity, '--timestamp', archive]);
-        run('hdiutil', ['verify', archive]);
-    } finally {
-        rmSync(contents, { recursive: true, force: true });
-    }
-}

native/package.json

@@ -1,6 +1,6 @@
 {
     "name": "kanbangit-native",
-    "version": "0.1.2",
+    "version": "0.1.0",
     "private": true,
     "type": "module",
     "scripts": {
@@ -18,11 +18,9 @@
         "build:ios:device": "tauri ios build --debug --target aarch64 --export-method debugging --archive-only",
         "open:ios": "tauri ios dev --open --no-dev-server",
         "prepare:ios": "xcodegen generate --spec src-tauri/gen/apple/project.yml",
-        "test:ios": "xcodebuild -project src-tauri/gen/apple/kanbangit-native.xcodeproj -scheme kanbangit-native_iOS -configuration debug -destination \"platform=iOS Simulator,id=${IOS_SIMULATOR_ID:?Set IOS_SIMULATOR_ID to an installed simulator UUID}\" -parallel-testing-enabled NO CODE_SIGNING_ALLOWED=NO test",
-        "smoke:updater": "cargo test --manifest-path src-tauri/Cargo.toml --locked --features smoke-test,custom-protocol --test updater_smoke"
+        "test:ios": "xcodebuild -project src-tauri/gen/apple/kanbangit-native.xcodeproj -scheme kanbangit-native_iOS -configuration debug -destination \"platform=iOS Simulator,id=${IOS_SIMULATOR_ID:?Set IOS_SIMULATOR_ID to an installed simulator UUID}\" -parallel-testing-enabled NO CODE_SIGNING_ALLOWED=NO test"
     },
     "devDependencies": {
         "@tauri-apps/cli": "2.11.4"
-    },
-    "releaseNotes": "macOS updates can now be checked automatically or from the KanbanGit menu. Install releases from a drag-and-drop DMG. About KanbanGit shows the app version and build. Updates preserve your server settings and stored sessions and restart only after confirmation."
+    }
 }

native/publish-macos.mjs

@@ -10,15 +10,8 @@ import {
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import process from 'node:process';
-import { setTimeout } from 'node:timers/promises';
 import { pathToFileURL } from 'node:url';
 import { execute, releaseMetadata } from './macos-ci.mjs';
-import {
-    compareVersions,
-    updateManifest,
-    updateSource,
-    verifyUpdateSignature,
-} from './update-manifest.mjs';
 
 export function storageConfiguration(env = process.env) {
     const region = env.S3_REGION;
@@ -69,16 +62,8 @@ export async function publishMacos({
     metadata,
     run = execute,
     fetchPublic = fetch,
-    wait = setTimeout,
-    publicKey = updateSource.publicKey,
-    feedBase = updateSource.baseUrl,
 } = {}) {
     const storage = storageConfiguration(env);
-    if (`${storage.publicBase}/${storage.prefix}` !== feedBase) {
-        throw new Error(
-            'Release storage does not match the update source bundled in the app.',
-        );
-    }
     if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) {
         throw new Error(
             'Set the dedicated S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY release secrets.',
@@ -92,21 +77,6 @@ export async function publishMacos({
     if (checksumFile.toString() !== `${checksum}  ${metadata.filename}\n`) {
         throw new Error('Release archive does not match its SHA-256 file.');
     }
-    const updater = readFileSync(join(directory, metadata.updaterFilename));
-    const signature = readFileSync(
-        join(directory, `${metadata.updaterFilename}.sig`),
-        'utf8',
-    );
-    verifyUpdateSignature(updater, signature, publicKey);
-    const updateChecksum = readFileSync(
-        join(directory, `${metadata.updaterFilename}.sha256`),
-    );
-    if (
-        updateChecksum.toString() !==
-        `${sha256(updater)}  ${metadata.updaterFilename}\n`
-    ) {
-        throw new Error('Updater archive does not match its SHA-256 file.');
-    }
     const common = [
         '--endpoint-url',
         storage.endpoint,
@@ -124,26 +94,7 @@ export async function publishMacos({
             ...args,
         ]);
     }
-    const versioningOutput = s3('get-bucket-versioning', [
-        '--output',
-        'json',
-    ]).trim();
-    let versioning;
-    try {
-        // AWS CLI prints nothing for a successful empty VersioningConfiguration.
-        versioning = JSON.parse(versioningOutput || '{}');
-    } catch {
-        throw new Error('Invalid JSON from S3 bucket versioning check.');
-    }
-    if (
-        !versioning ||
-        typeof versioning !== 'object' ||
-        Array.isArray(versioning)
-    ) {
-        throw new Error(
-            'Invalid S3 bucket versioning response: expected an object.',
-        );
-    }
+    const versioning = JSON.parse(s3('get-bucket-versioning', []));
     if (versioning.Status) {
         throw new Error(
             'Use an unversioned release bucket: Hetzner does not support conditional writes on versioned buckets.',
@@ -152,44 +103,17 @@ export async function publishMacos({
     const staging = mkdtempSync(join(tmpdir(), 'kanbangit-s3-'));
     const keyPrefix = `${storage.prefix}/${metadata.target}/${metadata.version}`;
     const publicPrefix = `${storage.publicBase}/${keyPrefix}`;
-    async function verifyPublic(name, contents, prefix = publicPrefix) {
-        for (let attempt = 1; attempt <= 5; attempt++) {
-            let response;
-            try {
-                response = await fetchPublic(`${prefix}/${name}`, {
-                    redirect: 'error',
-                    signal: AbortSignal.timeout(60000),
-                });
-            } catch (error) {
-                if (attempt === 5) {
-                    throw new Error(
-                        `Public download request failed for ${name}: ${error.message}`,
-                    );
-                }
-                await wait(2000);
-                continue;
-            }
-            if (response.ok) {
-                if (
-                    sha256(Buffer.from(await response.arrayBuffer())) !==
-                    sha256(contents)
-                ) {
-                    throw new Error(
-                        `Public download verification failed for ${name}: SHA-256 mismatch.`,
-                    );
-                }
-                return;
-            }
-            await response.body?.cancel();
-            const retryable = [403, 404, 408, 429, 500, 502, 503, 504].includes(
-                response.status,
-            );
-            if (!retryable || attempt === 5) {
-                throw new Error(
-                    `Public download verification failed for ${name}: HTTP ${response.status}.`,
-                );
-            }
-            await wait(2000);
+    async function verifyPublic(name, contents) {
+        const response = await fetchPublic(`${publicPrefix}/${name}`, {
+            redirect: 'error',
+            signal: AbortSignal.timeout(60000),
+        });
+        if (
+            !response.ok ||
+            sha256(Buffer.from(await response.arrayBuffer())) !==
+                sha256(contents)
+        ) {
+            throw new Error(`Public download verification failed for ${name}.`);
         }
     }
     function putImmutable(name, contents, contentType) {
@@ -227,18 +151,7 @@ export async function publishMacos({
     }
     try {
         const files = [
-            [metadata.filename, archive, 'application/x-apple-diskimage'],
-            [metadata.updaterFilename, updater, 'application/gzip'],
-            [
-                `${metadata.updaterFilename}.sig`,
-                Buffer.from(signature),
-                'text/plain; charset=utf-8',
-            ],
-            [
-                `${metadata.updaterFilename}.sha256`,
-                updateChecksum,
-                'text/plain; charset=utf-8',
-            ],
+            [metadata.filename, archive, 'application/zip'],
             [
                 `${metadata.filename}.sha256`,
                 checksumFile,
@@ -249,7 +162,7 @@ export async function publishMacos({
             putImmutable(name, contents, type);
             await verifyPublic(name, contents);
         }
-        // Completion metadata is written only after every public artifact matches.
+        // This completion record is written only after both public downloads match.
         const manifest = Buffer.from(
             JSON.stringify(
                 {
@@ -265,84 +178,6 @@ export async function publishMacos({
         );
         putImmutable('release.json', manifest, 'application/json');
         await verifyPublic('release.json', manifest);
-        const latest = Buffer.from(
-            JSON.stringify(
-                updateManifest(
-                    metadata,
-                    publicPrefix,
-                    signature,
-                    metadata.notes,
-                ),
-                null,
-                2,
-            ) + '\n',
-        );
-        putImmutable('update.json', latest, 'application/json');
-        await verifyPublic('update.json', latest);
-        const latestPrefix = `${storage.prefix}/${metadata.target}`;
-        const latestKey = `${latestPrefix}/latest.json`;
-        const latestFile = join(staging, 'latest.json');
-        writeFileSync(latestFile, latest);
-        function publishLatest(condition) {
-            s3('put-object', [
-                '--key',
-                latestKey,
-                '--body',
-                latestFile,
-                ...condition,
-                '--content-type',
-                'application/json',
-                '--cache-control',
-                'no-cache, max-age=0, must-revalidate',
-                '--content-md5',
-                createHash('md5').update(latest).digest('base64'),
-            ]);
-        }
-        try {
-            publishLatest(['--if-none-match', '*']);
-        } catch (error) {
-            if (!/\(PreconditionFailed\)|\(412\)/.test(error.message)) {
-                throw error;
-            }
-            const previousFile = join(staging, 'previous-latest.json');
-            const response = JSON.parse(
-                s3('get-object', [
-                    '--key',
-                    latestKey,
-                    '--output',
-                    'json',
-                    previousFile,
-                ]),
-            );
-            const previousBytes = readFileSync(previousFile);
-            const previous = JSON.parse(previousBytes);
-            const comparison = compareVersions(
-                metadata.version,
-                previous.version,
-            );
-            if (comparison < 0) {
-                throw new Error('Refusing to downgrade the update feed.');
-            }
-            if (comparison === 0) {
-                if (!previousBytes.equals(latest)) {
-                    throw new Error(
-                        'Published update metadata differs; bump the app version.',
-                    );
-                }
-            } else {
-                if (!response.ETag) {
-                    throw new Error(
-                        'Cannot atomically update the feed without its ETag.',
-                    );
-                }
-                publishLatest(['--if-match', response.ETag]);
-            }
-        }
-        await verifyPublic(
-            'latest.json',
-            latest,
-            `${storage.publicBase}/${latestPrefix}`,
-        );
         return `${publicPrefix}/${metadata.filename}`;
     } finally {
         rmSync(staging, { recursive: true, force: true });

native/release-macos.mjs

@@ -13,7 +13,6 @@ import { dirname, join, resolve } from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { parseArgs } from 'node:util';
-import { createDiskImage } from './macos-dmg.mjs';
 
 export const appleTeamId = 'ZZX2KZGTHU';
 export const bundleIdentifier = 'de.kanbangit.desktop';
@@ -106,11 +105,6 @@ export function releaseMacos({
         throw new Error('--resume requires the Apple submission UUID.');
     }
 
-    if (!env.TAURI_SIGNING_PRIVATE_KEY?.trim()) {
-        throw new Error(
-            'Set TAURI_SIGNING_PRIVATE_KEY to the permanent updater signing key.',
-        );
-    }
     const identity = env.APPLE_SIGNING_IDENTITY?.trim();
     const profile = env.APPLE_NOTARY_KEYCHAIN_PROFILE?.trim();
 
@@ -411,42 +405,20 @@ export function releaseMacos({
             app,
         ]);
 
-        const name = `KanbanGit-${config.version}-${target}.dmg`;
+        const name = `KanbanGit-${config.version}-${target}.zip`;
         const archive = join(staging, name);
-        createDiskImage({
+        step('Packaging notarized download', 'ditto', [
+            '-c',
+            '-k',
+            '--sequesterRsrc',
+            '--keepParent',
             app,
             archive,
-            identity,
-            run: (command, args) =>
-                step('Packaging notarized download', command, args),
-        });
+        ]);
         const checksum = createHash('sha256')
             .update(readFileSync(archive))
             .digest('hex');
         writeFileSync(`${archive}.sha256`, `${checksum}  ${name}\n`);
-        const updaterName = `KanbanGit-${config.version}-${target}.app.tar.gz`;
-        const updaterArchive = join(staging, updaterName);
-        step('Packaging updater archive', 'tar', [
-            '-czf',
-            updaterArchive,
-            '-C',
-            dirname(app),
-            'KanbanGit.app',
-        ]);
-        step('Signing updater archive', 'pnpm', [
-            'exec',
-            'tauri',
-            'signer',
-            'sign',
-            updaterArchive,
-        ]);
-        const updaterChecksum = createHash('sha256')
-            .update(readFileSync(updaterArchive))
-            .digest('hex');
-        writeFileSync(
-            `${updaterArchive}.sha256`,
-            `${updaterChecksum}  ${updaterName}\n`,
-        );
         rmSync(submission, { force: true });
         renameSync(staging, destination);
         log(`Verified release: ${join(destination, name)}`);

native/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "kanbangit-native"
-version = "0.1.2"
+version = "0.1.0"
 description = "KanbanGit native application"
 edition = "2021"
 publish = false
@@ -13,9 +13,6 @@ crate-type = ["staticlib", "cdylib", "rlib"]
 tauri-build = { version = "2", features = [] }
 
 [dependencies]
-semver = "1"
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
 tauri = { version = "2", features = [] }
 
 [dev-dependencies]
@@ -30,11 +27,3 @@ custom-protocol = ["tauri/custom-protocol"]
 name = "macos_smoke"
 harness = false
 required-features = ["smoke-test"]
-
-[target.'cfg(target_os = "macos")'.dependencies]
-tauri-plugin-updater = "=2.12.0"
-
-[[test]]
-name = "updater_smoke"
-harness = false
-required-features = ["smoke-test"]

native/src-tauri/src/desktop.rs

@@ -2,7 +2,7 @@ use crate::locale::en;
 use crate::server::{validate_url, Server, DEFAULT_SERVER};
 use std::{path::PathBuf, sync::Mutex, time::Duration};
 use tauri::{
-    menu::{AboutMetadata, MenuBuilder, MenuItem, SubmenuBuilder},
+    menu::{MenuBuilder, SubmenuBuilder},
     webview::{NewWindowResponse, PageLoadEvent},
     AppHandle, Manager, Url, WebviewUrl, WebviewWindowBuilder, WindowEvent,
 };
@@ -247,11 +247,6 @@ fn open_workspace(app: &AppHandle, input: &str) -> Result<(), &'static str> {
 
 fn handle_launcher_action(app: &AppHandle, destination: &Url) {
     let result = match destination.path() {
-        "/action/updates" => {
-            #[cfg(target_os = "macos")]
-            crate::updates::show(app);
-            Ok(())
-        }
         "/action/open" => {
             let input = destination
                 .query_pairs()
@@ -299,24 +294,6 @@ pub fn builder() -> tauri::Builder<tauri::Wry> {
         let menu = MenuBuilder::new(app)
             .item(
                 &SubmenuBuilder::new(app, en::APP_NAME)
-                    .about_with_text(
-                        en::ABOUT,
-                        Some(AboutMetadata {
-                            name: Some(en::APP_NAME.into()),
-                            short_version: Some(app.package_info().version.to_string()),
-                            version: app.config().bundle.macos.bundle_version.clone(),
-                            ..Default::default()
-                        }),
-                    )
-                    .text("check-updates", en::CHECK_UPDATES)
-                    .item(&MenuItem::with_id(
-                        app,
-                        "install-update",
-                        en::INSTALL_UPDATE,
-                        false,
-                        None::<&str>,
-                    )?)
-                    .separator()
                     .text("server-settings", en::SERVER_SETTINGS)
                     .separator()
                     .quit()
@@ -341,21 +318,7 @@ pub fn builder() -> tauri::Builder<tauri::Wry> {
             )
             .build()?;
         app.set_menu(menu)?;
-        #[cfg(target_os = "macos")]
-        crate::updates::setup(app.handle())?;
         app.on_menu_event(|app, event| {
-            #[cfg(target_os = "macos")]
-            match event.id().as_ref() {
-                "check-updates" => {
-                    crate::updates::check(app, true);
-                    return;
-                }
-                "install-update" => {
-                    crate::updates::show(app);
-                    return;
-                }
-                _ => {}
-            }
             if event.id().as_ref() == "server-settings" {
                 show_launcher(app);
             } else if let Some(script) = match event.id().as_ref() {
@@ -400,8 +363,6 @@ pub fn builder() -> tauri::Builder<tauri::Wry> {
                     if payload.event() == PageLoadEvent::Finished {
                         let app = window.app_handle().clone();
                         update_launcher(&app);
-                        #[cfg(target_os = "macos")]
-                        crate::updates::refresh(&app);
                         std::thread::spawn(move || {
                             let handle = app.clone();
                             let _ = app.run_on_main_thread(move || {
@@ -521,10 +482,7 @@ mod tests {
 
     #[test]
     fn remote_pages_cannot_invoke_native_commands() {
-        let builder = tauri::test::mock_builder();
-        #[cfg(target_os = "macos")]
-        let builder = builder.plugin(tauri_plugin_updater::Builder::new().build());
-        let app = builder.build(context()).unwrap();
+        let app = tauri::test::mock_builder().build(context()).unwrap();
         let window = WebviewWindowBuilder::new(
             &app,
             "workspace-1",
@@ -533,8 +491,6 @@ mod tests {
         .build()
         .unwrap();
         for command in [
-            "plugin:updater|check",
-            "plugin:updater|download_and_install",
             "plugin:window|close",
             "plugin:webview|create_webview_window",
             "plugin:path|resolve_directory",

native/src-tauri/src/lib.rs

@@ -8,8 +8,6 @@ mod ios;
 mod locale;
 #[cfg(not(any(target_os = "android", target_os = "ios")))]
 mod server;
-#[cfg(target_os = "macos")]
-mod updates;
 
 #[cfg(target_os = "android")]
 pub use android::{builder, context};

native/src-tauri/src/locale.rs

@@ -1,9 +1,4 @@
 pub mod en {
-    pub const ABOUT: &str = "About KanbanGit";
-    pub const CHECK_UPDATES: &str = "Check For Updates…";
-    pub const INSTALL_UPDATE: &str = "Install Update…";
-    pub const UPDATE_BADGE: &str = "Update";
-    pub const UPDATES: &str = "KanbanGit Updates";
     pub const APP_NAME: &str = "KanbanGit";
     pub const SERVER_SETTINGS: &str = "Server settings…";
     pub const NAVIGATION: &str = "Navigation";

native/src-tauri/src/updates.rs

@@ -1,799 +0,0 @@
-use semver::Version;
-use serde::{Deserialize, Serialize};
-use std::{
-    fs,
-    io::Read,
-    path::Path,
-    sync::Mutex,
-    time::{Duration, Instant},
-};
-use tauri::{
-    webview::{NewWindowResponse, PageLoadEvent},
-    AppHandle, Manager, Url, WebviewUrl, WebviewWindowBuilder,
-};
-use tauri_plugin_updater::{Update, UpdaterExt};
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct Source {
-    base_url: String,
-    public_key: String,
-}
-fn source() -> &'static Source {
-    static SOURCE: std::sync::LazyLock<Source> = std::sync::LazyLock::new(|| {
-        serde_json::from_str(include_str!("../../update-source.json"))
-            .expect("Bundled update source must be valid")
-    });
-    &SOURCE
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-#[serde(rename_all = "camelCase")]
-struct Preferences {
-    automatic: bool,
-    interval_hours: u64,
-}
-impl Default for Preferences {
-    fn default() -> Self {
-        Self {
-            automatic: true,
-            interval_hours: 6,
-        }
-    }
-}
-impl Preferences {
-    fn valid(&self) -> bool {
-        [1, 6, 24].contains(&self.interval_hours)
-    }
-}
-
-#[derive(Clone, Serialize)]
-#[serde(rename_all = "camelCase")]
-struct View {
-    phase: &'static str,
-    current_version: String,
-    build: String,
-    version: Option<String>,
-    notes: Option<String>,
-    downloaded: u64,
-    total: Option<u64>,
-    error: Option<&'static str>,
-    preferences: Preferences,
-}
-struct State {
-    view: View,
-    update: Option<Update>,
-    last_check: Option<Instant>,
-}
-impl State {
-    fn busy(&self) -> bool {
-        matches!(
-            self.view.phase,
-            "checking" | "downloading" | "verifying" | "installing" | "restarting"
-        )
-    }
-    fn begin_check(&mut self, manual: bool, now: Instant) -> bool {
-        if self.busy()
-            || (!manual
-                && (!self.view.preferences.automatic
-                    || self.last_check.is_some_and(|last| {
-                        now.duration_since(last)
-                            < Duration::from_secs(self.view.preferences.interval_hours * 3600)
-                    })))
-        {
-            return false;
-        }
-        self.last_check = Some(now);
-        self.view.phase = "checking";
-        self.view.error = None;
-        self.update = None;
-        self.view.version = None;
-        self.view.notes = None;
-        true
-    }
-}
-fn target() -> String {
-    format!("{}-apple-darwin", std::env::consts::ARCH)
-}
-fn feed_url() -> Url {
-    Url::parse(&format!("{}/{}/latest.json", source().base_url, target())).unwrap()
-}
-fn newer_stable(current: &str, candidate: &str) -> bool {
-    match (Version::parse(current), Version::parse(candidate)) {
-        (Ok(current), Ok(candidate)) => {
-            candidate.pre.is_empty() && candidate.build.is_empty() && candidate > current
-        }
-        _ => false,
-    }
-}
-fn valid_download(current: &str, version: &str, url: &Url) -> bool {
-    newer_stable(current, version)
-        && url.as_str()
-            == format!(
-                "{}/{}/{version}/KanbanGit-{version}-{}.app.tar.gz",
-                source().base_url,
-                target(),
-                target()
-            )
-}
-fn trusted_navigation(url: &Url) -> bool {
-    url.scheme() == "tauri"
-        && url.host_str() == Some("localhost")
-        && url.port().is_none()
-        && url.username().is_empty()
-        && url.password().is_none()
-}
-pub fn refresh(app: &AppHandle) {
-    let (view, available, busy) = {
-        let state = app.state::<Mutex<State>>();
-        let state = state.lock().unwrap();
-        (state.view.clone(), state.update.is_some(), state.busy())
-    };
-    if let Some(menu) = app.menu().and_then(|m| m.get("install-update")) {
-        if let Some(item) = menu.as_menuitem() {
-            let _ = item.set_enabled(available && !busy);
-        }
-    }
-    if let Some(window) = app.get_webview_window("updates") {
-        let _ = window.set_badge_label(available.then(|| crate::locale::en::UPDATE_BADGE.into()));
-        if let Ok(json) = serde_json::to_string(&view) {
-            let _ = window.eval(format!("window.updateStatus?.({json})"));
-        }
-    }
-    if let Some(window) = app.get_webview_window("launcher") {
-        let _ = window.eval(format!("window.updateAvailable?.({available})"));
-    }
-}
-pub fn show(app: &AppHandle) {
-    if let Some(window) = app.get_webview_window("updates") {
-        let _ = window.show();
-        let _ = window.set_focus();
-    }
-    refresh(app);
-}
-fn fail(app: &AppHandle, message: &'static str) {
-    {
-        let state = app.state::<Mutex<State>>();
-        let mut state = state.lock().unwrap();
-        state.view.phase = "error";
-        state.view.error = Some(message);
-    }
-    refresh(app);
-}
-fn update_error(error: &tauri_plugin_updater::Error) -> &'static str {
-    use tauri_plugin_updater::Error;
-    match error {
-        Error::Minisign(_)
-        | Error::Base64(_)
-        | Error::SignatureUtf8(_)
-        | Error::SignedVersionMismatch { .. }
-        | Error::MissingSignedVersion => "signatureError",
-        Error::Serialization(_)
-        | Error::Semver(_)
-        | Error::TargetsNotFound(_)
-        | Error::TargetNotFound(_) => "metadataError",
-        _ => "networkError",
-    }
-}
-pub fn check(app: &AppHandle, manual: bool) {
-    if manual {
-        show(app);
-    }
-    let begin = app
-        .state::<Mutex<State>>()
-        .lock()
-        .unwrap()
-        .begin_check(manual, Instant::now());
-    if !begin {
-        return;
-    }
-    refresh(app);
-    let app = app.clone();
-    tauri::async_runtime::spawn(async move {
-        let result = async {
-            app.updater_builder()
-                .pubkey(&source().public_key)
-                .endpoints(vec![feed_url()])?
-                .timeout(Duration::from_secs(60))
-                .configure_client(|client| client.https_only(true))
-                .version_comparator(|current, release| {
-                    newer_stable(&current.to_string(), &release.version.to_string())
-                })
-                .build()?
-                .check()
-                .await
-        }
-        .await;
-        match result {
-            Ok(Some(mut update)) => {
-                if !valid_download(
-                    &update.current_version,
-                    &update.version,
-                    &update.download_url,
-                ) || update.signature.trim().is_empty()
-                {
-                    fail(&app, "metadataError");
-                    return;
-                }
-                update.timeout = Some(Duration::from_secs(600));
-                let state = app.state::<Mutex<State>>();
-                let mut state = state.lock().unwrap();
-                state.view.phase = "available";
-                state.view.version = Some(update.version.clone());
-                state.view.notes = update.body.clone();
-                state.update = Some(update);
-            }
-            Ok(None) => app.state::<Mutex<State>>().lock().unwrap().view.phase = "current",
-            Err(error) => {
-                fail(&app, update_error(&error));
-                return;
-            }
-        }
-        refresh(&app);
-    });
-}
-fn command(program: &str, args: &[&str]) -> Result<String, &'static str> {
-    let output = std::process::Command::new(program)
-        .args(args)
-        .output()
-        .map_err(|_| "verificationError")?;
-    if !output.status.success() {
-        return Err("verificationError");
-    }
-    Ok(String::from_utf8_lossy(&output.stdout).trim().to_owned())
-}
-fn matches_architecture(header: &[u8]) -> bool {
-    let expected_cpu: u32 = if cfg!(target_arch = "aarch64") {
-        0x0100_000c
-    } else {
-        0x0100_0007
-    };
-    header.len() >= 8
-        && header[..4] == [0xcf, 0xfa, 0xed, 0xfe]
-        && header[4..8] == expected_cpu.to_le_bytes()
-}
-fn verify_bundle(archive: &Path, directory: &Path, version: &str) -> Result<(), &'static str> {
-    command(
-        "/usr/bin/tar",
-        &[
-            "-xzf",
-            archive.to_str().ok_or("verificationError")?,
-            "-C",
-            directory.to_str().ok_or("verificationError")?,
-        ],
-    )?;
-    let app = directory.join("KanbanGit.app");
-    let plist = app.join("Contents/Info.plist");
-    let plist = plist.to_str().ok_or("verificationError")?;
-    for (field, expected) in [
-        ("CFBundleShortVersionString", version),
-        ("CFBundleIdentifier", "de.kanbangit.desktop"),
-    ] {
-        if command(
-            "/usr/bin/plutil",
-            &["-extract", field, "raw", "-o", "-", plist],
-        )? != expected
-        {
-            return Err("verificationError");
-        }
-    }
-    let executable = app.join("Contents/MacOS/kanbangit-native");
-    let mut header = [0u8; 8];
-    fs::File::open(executable)
-        .and_then(|mut file| file.read_exact(&mut header))
-        .map_err(|_| "verificationError")?;
-    if !matches_architecture(&header) {
-        return Err("verificationError");
-    }
-    command("/usr/bin/codesign", &["--verify", "--deep", "--strict", "-R", "=anchor apple generic and identifier \"de.kanbangit.desktop\" and certificate leaf[subject.OU] = \"ZZX2KZGTHU\" and certificate leaf[field.1.2.840.113635.100.6.1.13] exists", app.to_str().ok_or("verificationError")?])?;
-    Ok(())
-}
-fn install(app: &AppHandle, confirmed_version: Option<&str>) {
-    let update = {
-        let state = app.state::<Mutex<State>>();
-        let mut state = state.lock().unwrap();
-        if state.busy() {
-            return;
-        }
-        let Some(update) = state.update.clone() else {
-            return;
-        };
-        if confirmed_version != Some(update.version.as_str()) {
-            return;
-        }
-        state.view.phase = "downloading";
-        state.view.error = None;
-        state.view.downloaded = 0;
-        state.view.total = None;
-        update
-    };
-    refresh(app);
-    let app = app.clone();
-    tauri::async_runtime::spawn(async move {
-        let bytes = update
-            .download(
-                |chunk, total| {
-                    {
-                        let state = app.state::<Mutex<State>>();
-                        let mut state = state.lock().unwrap();
-                        state.view.downloaded += chunk as u64;
-                        state.view.total = total;
-                    }
-                    refresh(&app);
-                },
-                || {
-                    app.state::<Mutex<State>>().lock().unwrap().view.phase = "verifying";
-                    refresh(&app);
-                },
-            )
-            .await;
-        let bytes = match bytes {
-            Ok(bytes) => bytes,
-            Err(error) => {
-                fail(&app, update_error(&error));
-                return;
-            }
-        };
-        let handle = app.clone();
-        let result = tauri::async_runtime::spawn_blocking(move || -> Result<(), &'static str> {
-            let cache = handle
-                .path()
-                .app_cache_dir()
-                .map_err(|_| "installationError")?
-                .join("verified-update");
-            if cache.exists() {
-                fs::remove_dir_all(&cache).map_err(|_| "installationError")?;
-            }
-            fs::create_dir_all(&cache).map_err(|_| "installationError")?;
-            let archive = cache.join("update.tar.gz");
-            let result = (|| {
-                fs::write(&archive, &bytes).map_err(|_| "installationError")?;
-                verify_bundle(&archive, &cache, &update.version)?;
-                handle.state::<Mutex<State>>().lock().unwrap().view.phase = "installing";
-                refresh(&handle);
-                update.install(&bytes).map_err(|_| "installationError")
-            })();
-            let _ = fs::remove_dir_all(cache);
-            result
-        })
-        .await;
-        match result {
-            Ok(Ok(())) => {
-                app.state::<Mutex<State>>().lock().unwrap().view.phase = "restarting";
-                refresh(&app);
-                app.restart();
-            }
-            Ok(Err(message)) => fail(&app, message),
-            Err(_) => fail(&app, "installationError"),
-        }
-    });
-}
-fn action(app: &AppHandle, url: &Url) {
-    match url.path() {
-        "/updates/check" => check(app, true),
-        "/updates/install" => install(
-            app,
-            url.query_pairs()
-                .find(|(key, _)| key == "version")
-                .as_ref()
-                .map(|(_, value)| value.as_ref()),
-        ),
-        "/updates/preferences" => {
-            let params: std::collections::HashMap<_, _> = url.query_pairs().collect();
-            let preferences = Preferences {
-                automatic: params.get("automatic").is_some_and(|v| v == "true"),
-                interval_hours: params
-                    .get("interval")
-                    .and_then(|v| v.parse().ok())
-                    .unwrap_or(0),
-            };
-            if !preferences.valid() {
-                fail(app, "preferencesError");
-                return;
-            }
-            let saved = (|| -> Result<(), Box<dyn std::error::Error>> {
-                let directory = app.path().app_config_dir()?;
-                fs::create_dir_all(&directory)?;
-                let pending = directory.join("update-preferences.pending");
-                fs::write(&pending, serde_json::to_vec(&preferences)?)?;
-                fs::rename(pending, directory.join("update-preferences.json"))?;
-                Ok(())
-            })();
-            if saved.is_err() {
-                fail(app, "preferencesError");
-                return;
-            }
-            app.state::<Mutex<State>>().lock().unwrap().view.preferences = preferences;
-            refresh(app);
-        }
-        _ => {}
-    }
-}
-pub fn setup(app: &AppHandle) -> tauri::Result<()> {
-    app.plugin(
-        tauri_plugin_updater::Builder::new()
-            .pubkey(&source().public_key)
-            .build(),
-    )?;
-    let path = app.path().app_config_dir()?.join("update-preferences.json");
-    let (preferences, error) = match fs::read(path) {
-        Ok(bytes) => match serde_json::from_slice::<Preferences>(&bytes) {
-            Ok(p) if p.valid() => (p, None),
-            _ => (
-                Preferences {
-                    automatic: false,
-                    ..Default::default()
-                },
-                Some("preferencesError"),
-            ),
-        },
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
-            (Preferences::default(), None)
-        }
-        Err(_) => (
-            Preferences {
-                automatic: false,
-                ..Default::default()
-            },
-            Some("preferencesError"),
-        ),
-    };
-    app.manage(Mutex::new(State {
-        view: View {
-            phase: if error.is_some() { "error" } else { "idle" },
-            current_version: app.package_info().version.to_string(),
-            build: app
-                .config()
-                .bundle
-                .macos
-                .bundle_version
-                .clone()
-                .unwrap_or_else(|| app.package_info().version.to_string()),
-            version: None,
-            notes: None,
-            downloaded: 0,
-            total: None,
-            error,
-            preferences,
-        },
-        update: None,
-        last_check: None,
-    }));
-    let handle = app.clone();
-    let window = WebviewWindowBuilder::new(app, "updates", WebviewUrl::App("updates.html".into()))
-        .title(crate::locale::en::UPDATES)
-        .inner_size(560.0, 690.0)
-        .min_inner_size(420.0, 580.0)
-        .center()
-        .visible(false)
-        .on_navigation(move |url| {
-            if !trusted_navigation(url) {
-                return false;
-            }
-            if url.path().starts_with("/updates/") {
-                action(&handle, url);
-                return false;
-            }
-            url.path() == "/updates.html"
-        })
-        .on_new_window(|_, _| NewWindowResponse::Deny)
-        .on_page_load(|window, payload| {
-            if payload.event() == PageLoadEvent::Finished {
-                refresh(window.app_handle());
-            }
-        })
-        .build()?;
-    let hide = window.clone();
-    window.on_window_event(move |event| {
-        if let tauri::WindowEvent::CloseRequested { api, .. } = event {
-            api.prevent_close();
-            let _ = hide.hide();
-        }
-    });
-    let handle = app.clone();
-    std::thread::spawn(move || loop {
-        check(&handle, false);
-        std::thread::sleep(Duration::from_secs(30));
-    });
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    fn state() -> State {
-        State {
-            view: View {
-                phase: "idle",
-                current_version: "1.0.0".into(),
-                build: "1".into(),
-                version: None,
-                notes: None,
-                downloaded: 0,
-                total: None,
-                error: None,
-                preferences: Preferences::default(),
-            },
-            update: None,
-            last_check: None,
-        }
-    }
-    #[test]
-    fn accepts_only_newer_stable_versions_and_exact_release_paths() {
-        assert!(newer_stable("1.9.9", "1.10.0"));
-        for version in ["0.9.0", "1.0.0", "1.2.0-beta", "1.2.0+build", "invalid"] {
-            assert!(!newer_stable("1.0.0", version));
-        }
-        let good = format!(
-            "{}/{}/1.1.0/KanbanGit-1.1.0-{}.app.tar.gz",
-            source().base_url,
-            target(),
-            target()
-        );
-        assert!(valid_download(
-            "1.0.0",
-            "1.1.0",
-            &Url::parse(&good).unwrap()
-        ));
-        for input in [
-            good.replace("https:", "http:"),
-            good.replace(".app.tar.gz", ".dmg"),
-            good.replace("1.1.0/", "0.9.0/"),
-            good.replace(&target(), "foreign-apple-darwin"),
-            format!("{good}?token=anything"),
-            format!("{good}#fragment"),
-            good.replace("https://", "https://user@"),
-            "https://untrusted.example/update.app.tar.gz".into(),
-        ] {
-            assert!(!valid_download(
-                "1.0.0",
-                "1.1.0",
-                &Url::parse(&input).unwrap()
-            ));
-        }
-    }
-    #[test]
-    fn automatic_checks_start_once_then_respect_interval_and_opt_out() {
-        let mut state = state();
-        let now = Instant::now();
-        assert!(state.begin_check(false, now));
-        assert!(!state.begin_check(false, now));
-        state.view.phase = "current";
-        assert!(!state.begin_check(false, now + Duration::from_secs(6 * 3600 - 1)));
-        assert!(state.begin_check(false, now + Duration::from_secs(6 * 3600)));
-        state.view.phase = "current";
-        state.view.preferences.automatic = false;
-        assert!(!state.begin_check(false, now + Duration::from_secs(24 * 3600)));
-        assert!(state.begin_check(true, now + Duration::from_secs(24 * 3600)));
-    }
-    #[test]
-    fn manual_checks_retry_errors_but_never_overlap_downloads_or_installation() {
-        let mut state = state();
-        state.view.phase = "error";
-        state.view.error = Some("networkError");
-        assert!(state.begin_check(true, Instant::now()));
-        assert!(state.view.error.is_none());
-        for phase in [
-            "checking",
-            "downloading",
-            "verifying",
-            "installing",
-            "restarting",
-        ] {
-            state.view.phase = phase;
-            assert!(!state.begin_check(true, Instant::now()));
-        }
-    }
-    #[test]
-    fn preferences_validate_and_round_trip_without_server_settings() {
-        let p = Preferences {
-            automatic: false,
-            interval_hours: 24,
-        };
-        let json = serde_json::to_string(&p).unwrap();
-        let loaded: Preferences = serde_json::from_str(&json).unwrap();
-        assert!(!loaded.automatic);
-        assert_eq!(loaded.interval_hours, 24);
-        assert!(loaded.valid());
-        for interval in [0, 2, 100, u64::MAX] {
-            assert!(!Preferences {
-                automatic: true,
-                interval_hours: interval
-            }
-            .valid());
-        }
-    }
-    #[test]
-    fn update_actions_are_confined_to_the_local_trusted_window() {
-        assert!(trusted_navigation(
-            &Url::parse("tauri://localhost/updates/install").unwrap()
-        ));
-        for address in [
-            "https://kanbangit.de/updates/install",
-            "https://localhost/updates/install",
-            "tauri://user@localhost/updates/install",
-            "tauri://localhost:443/updates/install",
-            "tauri://other/updates/install",
-        ] {
-            assert!(!trusted_navigation(&Url::parse(address).unwrap()));
-        }
-    }
-    #[test]
-    fn rejects_foreign_or_invalid_mach_o_headers_without_developer_tools() {
-        let cpu: u32 = if cfg!(target_arch = "aarch64") {
-            0x0100_000c
-        } else {
-            0x0100_0007
-        };
-        let mut header = vec![0xcf, 0xfa, 0xed, 0xfe];
-        header.extend(cpu.to_le_bytes());
-        assert!(matches_architecture(&header));
-        header[4] ^= 1;
-        assert!(!matches_architecture(&header));
-        assert!(!matches_architecture(b"MZ"));
-        assert!(!matches_architecture(&[0; 8]));
-    }
-    #[test]
-    fn error_categories_offer_specific_retryable_messages() {
-        use tauri_plugin_updater::Error;
-        assert_eq!(
-            update_error(&Error::Network("offline".into())),
-            "networkError"
-        );
-        assert_eq!(
-            update_error(&Error::TargetNotFound("darwin-other".into())),
-            "metadataError"
-        );
-        assert_eq!(
-            update_error(&Error::SignatureUtf8("invalid".into())),
-            "signatureError"
-        );
-    }
-}
-
-#[cfg(test)]
-mod signed_upgrade_test {
-    use super::*;
-    use std::{io::Write, net::TcpListener};
-
-    #[test]
-    #[ignore = "Requires KANBANGIT_UPGRADE_BASE and KANBANGIT_UPGRADE_ARCHIVE pointing to two Developer-ID-signed macOS versions"]
-    fn installs_a_real_signed_upgrade_and_rejects_tampering() {
-        let base = std::env::var("KANBANGIT_UPGRADE_BASE").expect("Set the signed base app path");
-        let archive = std::env::var("KANBANGIT_UPGRADE_ARCHIVE")
-            .expect("Set the signed updater archive path");
-        let base_version = env!("CARGO_PKG_VERSION");
-        let mut next_version = Version::parse(base_version).unwrap();
-        next_version.patch += 1;
-        let candidate_version =
-            std::env::var("KANBANGIT_UPGRADE_VERSION").unwrap_or_else(|_| next_version.to_string());
-        assert!(newer_stable(base_version, &candidate_version));
-        let root = std::env::temp_dir().join(format!("kanbangit-upgrade-{}", std::process::id()));
-        fs::create_dir(&root).unwrap();
-        struct Cleanup(std::path::PathBuf);
-        impl Drop for Cleanup {
-            fn drop(&mut self) {
-                let _ = fs::remove_dir_all(&self.0);
-            }
-        }
-        let _cleanup = Cleanup(root.clone());
-        let installed = root.join("KanbanGit.app");
-        command("/usr/bin/ditto", &[&base, installed.to_str().unwrap()]).unwrap();
-        let data = root.join("user-data");
-        fs::create_dir(&data).unwrap();
-        fs::write(data.join("active-server"), "https://workspace.example/").unwrap();
-        fs::write(data.join("session"), "existing-session").unwrap();
-        let bytes = fs::read(&archive).unwrap();
-        let signature = fs::read_to_string(format!("{archive}.sig")).unwrap();
-        let verify_dir = root.join("verify");
-        fs::create_dir(&verify_dir).unwrap();
-        verify_bundle(Path::new(&archive), &verify_dir, &candidate_version).unwrap();
-        assert!(verify_bundle(Path::new(&archive), &verify_dir, base_version).is_err());
-        let listener = TcpListener::bind("127.0.0.1:0").unwrap();
-        let address = listener.local_addr().unwrap();
-        let download = bytes.clone();
-        let announced_version = candidate_version.clone();
-        let server = std::thread::spawn(move || {
-            for index in 0..3 {
-                let (mut stream, _) = listener.accept().unwrap();
-                stream
-                    .set_read_timeout(Some(Duration::from_secs(10)))
-                    .unwrap();
-                let mut request = [0; 4096];
-                let _ = stream.read(&mut request).unwrap();
-                let body = if index == 0 {
-                    serde_json::to_vec(&serde_json::json!({"version":announced_version, "platforms":{(format!("darwin-{}", std::env::consts::ARCH)): {"url":format!("http://{address}/update.tar.gz"), "signature":signature.trim()}}})).unwrap()
-                } else if index == 1 {
-                    b"tampered update".to_vec()
-                } else {
-                    download.clone()
-                };
-                write!(
-                    stream,
-                    "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
-                    body.len()
-                )
-                .unwrap();
-                stream.write_all(&body).unwrap();
-            }
-        });
-        let mut context = crate::desktop::context();
-        context.config_mut().plugins.0.insert("updater".into(), serde_json::json!({"pubkey":source().public_key, "dangerousInsecureTransportProtocol":true}));
-        let app = tauri::test::mock_builder()
-            .plugin(tauri_plugin_updater::Builder::new().build())
-            .build(context)
-            .unwrap();
-        let update = tauri::async_runtime::block_on(async {
-            app.updater_builder()
-                .executable_path(installed.join("Contents/MacOS/kanbangit-native"))
-                .endpoints(vec![
-                    Url::parse(&format!("http://{address}/latest.json")).unwrap()
-                ])
-                .unwrap()
-                .timeout(Duration::from_secs(20))
-                .build()
-                .unwrap()
-                .check()
-                .await
-                .unwrap()
-                .unwrap()
-        });
-        assert_eq!(update.current_version, base_version);
-        let rejected =
-            tauri::async_runtime::block_on(update.download(|_, _| {}, || {})).unwrap_err();
-        assert_eq!(update_error(&rejected), "signatureError");
-        let plist = installed.join("Contents/Info.plist");
-        assert_eq!(
-            command(
-                "/usr/bin/plutil",
-                &[
-                    "-extract",
-                    "CFBundleShortVersionString",
-                    "raw",
-                    "-o",
-                    "-",
-                    plist.to_str().unwrap()
-                ]
-            )
-            .unwrap(),
-            base_version
-        );
-        let verified = tauri::async_runtime::block_on(update.download(|_, _| {}, || {})).unwrap();
-        assert_eq!(verified, bytes);
-        update.install(verified).unwrap();
-        assert_eq!(
-            command(
-                "/usr/bin/plutil",
-                &[
-                    "-extract",
-                    "CFBundleShortVersionString",
-                    "raw",
-                    "-o",
-                    "-",
-                    plist.to_str().unwrap()
-                ]
-            )
-            .unwrap(),
-            candidate_version
-        );
-        command(
-            "/usr/bin/codesign",
-            &[
-                "--verify",
-                "--deep",
-                "--strict",
-                installed.to_str().unwrap(),
-            ],
-        )
-        .unwrap();
-        assert_eq!(
-            fs::read_to_string(data.join("active-server")).unwrap(),
-            "https://workspace.example/"
-        );
-        assert_eq!(
-            fs::read_to_string(data.join("session")).unwrap(),
-            "existing-session"
-        );
-        server.join().unwrap();
-    }
-}

native/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
     "$schema": "https://schema.tauri.app/config/2",
     "productName": "KanbanGit",
-    "version": "0.1.2",
+    "version": "0.1.0",
     "identifier": "de.kanbangit.desktop",
     "build": {
         "frontendDist": "../ui"
@@ -16,35 +16,10 @@
     },
     "bundle": {
         "active": true,
-        "targets": [
-            "app"
-        ],
-        "icon": [
-            "icons/icon.png",
-            "icons/icon.icns"
-        ],
+        "targets": ["app"],
+        "icon": ["icons/icon.png", "icons/icon.icns"],
         "macOS": {
-            "minimumSystemVersion": "14.0",
-            "bundleVersion": "2",
-            "dmg": {
-                "windowSize": {
-                    "width": 660,
-                    "height": 400
-                },
-                "appPosition": {
-                    "x": 180,
-                    "y": 170
-                },
-                "applicationFolderPosition": {
-                    "x": 480,
-                    "y": 170
-                }
-            }
-        }
-    },
-    "plugins": {
-        "updater": {
-            "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDhBQzA0QjhENTI3OEE1QzAKUldUQXBYaFNqVXZBaXJVWmErWUZTNVp6QnllT25NWFMyemxqcFBnYnJHT3JBSWxrSkVYU1VVMFEK"
+            "minimumSystemVersion": "14.0"
         }
     }
 }

native/src-tauri/tests/updater_smoke.rs

@@ -1,72 +0,0 @@
-#[cfg(target_os = "macos")]
-#[tauri::command]
-fn updater_smoke_report(app: tauri::AppHandle, passed: bool, reason: String) {
-    use tauri::Manager;
-    println!("Updater WebView test: passed={passed}, {reason}");
-    app.state::<std::sync::Arc<std::sync::atomic::AtomicBool>>()
-        .store(passed, std::sync::atomic::Ordering::SeqCst);
-    app.exit(if passed { 0 } else { 1 });
-}
-
-#[cfg(target_os = "macos")]
-fn main() {
-    use std::sync::{
-        atomic::{AtomicBool, Ordering},
-        Arc,
-    };
-    use tauri::webview::PageLoadEvent;
-    let passed = Arc::new(AtomicBool::new(false));
-
-    let plugin = tauri::plugin::Builder::<tauri::Wry>::new("updater-smoke")
-        .on_page_load(|window, payload| {
-            if window.label() != "updates" || payload.event() != PageLoadEvent::Finished { return; }
-            window.eval(r#"
-            (async () => {
-                try {
-                    for (let i = 0; i < 100 && !window.updateStatus; i++) await new Promise(r => setTimeout(r, 50));
-                    if (!window.updateStatus) throw new Error('Update UI did not load');
-                    const $ = id => document.getElementById(id);
-                    const state = { phase: 'current', currentVersion: '0.1.2', build: '2', version: null, notes: null, downloaded: 0, total: null, error: null, preferences: { automatic: true, intervalHours: 6 } };
-                    window.updateStatus(state);
-                    if (!$('installed').textContent.includes('0.1.2 (build 2)') || !$('install').hidden || $('check').disabled) throw new Error('Current version state failed');
-                    Object.assign(state, { phase: 'available', version: '0.1.3', notes: '<script>unsafe()</script>\nRelease notes' });
-                    window.updateStatus(state);
-                    if ($('install').hidden || $('release-notes').querySelector('script') || !$('release-notes').textContent.includes('<script>')) throw new Error('Available state or text escaping failed');
-                    $('install').click();
-                    if ($('install-confirmation').hidden || !$('install-confirmation').textContent.includes('Unsaved inputs')) throw new Error('Missing restart confirmation');
-                    $('cancel-install').click();
-                    if (!$('install-confirmation').hidden) throw new Error('Cancel failed');
-                    Object.assign(state, { phase: 'downloading', downloaded: 500, total: 1000 }); window.updateStatus(state);
-                    if (!$('check').disabled || !$('install').hidden || $('download-progress').value !== 500) throw new Error('Progress state failed');
-                    Object.assign(state, { phase: 'error', error: 'signatureError' }); window.updateStatus(state);
-                    if ($('install').hidden || !$('update-error').textContent.includes('Nothing was installed')) throw new Error('Retry failed');
-                    state.preferences.automatic = false; window.updateStatus(state);
-                    if ($('automatic').checked || !$('interval').disabled) throw new Error('Opt out failed');
-                    await window.__TAURI_INTERNALS__.invoke('updater_smoke_report', { passed: true, reason: '' });
-                } catch (error) {
-                    await window.__TAURI_INTERNALS__.invoke('updater_smoke_report', { passed: false, reason: error.message });
-                }
-            })();
-            "#).unwrap();
-        })
-        .build();
-    let mut context = kanbangit_native::context();
-    context.config_mut().identifier = format!("de.kanbangit.smoke.updates.{}", std::process::id());
-    let app = kanbangit_native::builder()
-        .manage(passed.clone())
-        .invoke_handler(tauri::generate_handler![updater_smoke_report])
-        .plugin(plugin)
-        .build(context)
-        .expect("App must start");
-    let handle = app.handle().clone();
-    std::thread::spawn(move || {
-        std::thread::sleep(std::time::Duration::from_secs(30));
-        handle.exit(1);
-    });
-    app.run_return(|_, _| {});
-    assert!(passed.load(Ordering::SeqCst), "Updater UI test must pass");
-}
-#[cfg(not(target_os = "macos"))]
-fn main() {
-    panic!("Requires macOS");
-}

native/tests/macos-ci.test.js

@@ -4,14 +4,12 @@ import {
     mkdirSync,
     mkdtempSync,
     readFileSync,
-    symlinkSync,
     rmSync,
     writeFileSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
-import { updateSource } from '../update-manifest.mjs';
 import {
     packageNotarizedApp,
     releaseMetadata,
@@ -24,8 +22,6 @@ function fixture(t) {
     mkdirSync(join(directory, 'src-tauri'));
     const config = {
         version: '1.2.3',
-        plugins: { updater: { pubkey: updateSource.publicKey } },
-        bundle: { macOS: { bundleVersion: '123' } },
         productName: 'KanbanGit',
         identifier: 'de.kanbangit.desktop',
     };
@@ -35,7 +31,7 @@ function fixture(t) {
     );
     writeFileSync(
         join(directory, 'package.json'),
-        JSON.stringify({ version: '1.2.3', releaseNotes: 'Release notes' }),
+        JSON.stringify({ version: '1.2.3' }),
     );
     writeFileSync(
         join(directory, 'src-tauri/Cargo.toml'),
@@ -46,21 +42,6 @@ function fixture(t) {
         APPLE_SIGNING_IDENTITY:
             'Developer ID Application: Example (ZZX2KZGTHU)',
     };
-    const bundle = join(
-        directory,
-        'src-tauri/target/aarch64-apple-darwin/release/bundle',
-    );
-    mkdirSync(join(bundle, 'dmg'), { recursive: true });
-    mkdirSync(join(bundle, 'macos'), { recursive: true });
-    writeFileSync(
-        join(bundle, 'dmg/KanbanGit_1.2.3_aarch64.dmg'),
-        'notarized archive',
-    );
-    writeFileSync(
-        join(bundle, 'macos/KanbanGit.app.tar.gz'),
-        'notarized updater',
-    );
-    writeFileSync(join(bundle, 'macos/KanbanGit.app.tar.gz.sig'), 'signature');
     const calls = [];
     const run = (command, args) => {
         calls.push({ command, args });
@@ -73,8 +54,8 @@ function fixture(t) {
         if (command === 'lipo') {
             return 'arm64';
         }
-        if (command === 'hdiutil' && args[0] === 'attach') {
-            symlinkSync('/Applications', join(args.at(-1), 'Applications'));
+        if (command === 'ditto' && args.includes('-c')) {
+            writeFileSync(args.at(-1), 'notarized archive');
         }
         return '';
     };
@@ -85,11 +66,9 @@ test('release metadata binds tag, all app versions, identity and architecture',
     const f = fixture(t);
     assert.deepEqual(releaseMetadata(f.env, f.directory), {
         version: '1.2.3',
-        notes: 'Release notes',
         target: 'aarch64-apple-darwin',
         arch: 'arm64',
-        filename: 'KanbanGit-1.2.3-aarch64-apple-darwin.dmg',
-        updaterFilename: 'KanbanGit-1.2.3-aarch64-apple-darwin.app.tar.gz',
+        filename: 'KanbanGit-1.2.3-aarch64-apple-darwin.zip',
     });
     assert.equal(
         releaseMetadata(
@@ -148,8 +127,8 @@ test('packages only a verified app and checks the extracted download again', (t)
         ),
         `${output.checksum}  ${output.filename}\n`,
     );
-    assert.equal(f.calls.filter((call) => call.command === 'spctl').length, 3);
-    assert.equal(f.calls.filter((call) => call.command === 'xcrun').length, 3);
+    assert.equal(f.calls.filter((call) => call.command === 'spctl').length, 2);
+    assert.equal(f.calls.filter((call) => call.command === 'xcrun').length, 2);
     assert.match(
         f.calls.findLast((call) => call.command === 'spctl').args.at(-1),
         /extracted\/KanbanGit\.app$/,
@@ -157,14 +136,7 @@ test('packages only a verified app and checks the extracted download again', (t)
     assert.throws(() => packageNotarizedApp(f), /already exists/);
 });
 
-for (const failure of [
-    'codesign',
-    'lipo',
-    'xcrun',
-    'spctl',
-    'hdiutil',
-    'tar',
-]) {
+for (const failure of ['codesign', 'lipo', 'xcrun', 'spctl', 'ditto']) {
     test(`does not publish local output when ${failure} verification fails`, (t) => {
         const f = fixture(t);
         const run = f.run;

native/tests/macos-release.test.js

@@ -40,7 +40,6 @@ function fixture(t, overrides = {}) {
         arch: 'arm64',
         log() {},
         env: {
-            TAURI_SIGNING_PRIVATE_KEY: 'test-private-key',
             APPLE_SIGNING_IDENTITY: identity,
             APPLE_NOTARY_KEYCHAIN_PROFILE: 'kanbangit-notary',
         },
@@ -58,11 +57,7 @@ function fixture(t, overrides = {}) {
                 );
             }
 
-            if (
-                command === 'pnpm' &&
-                args.includes('build') &&
-                !overrides.missingApp
-            ) {
+            if (command === 'pnpm' && !overrides.missingApp) {
                 const target = args[args.indexOf('--target') + 1];
                 mkdirSync(
                     join(
@@ -142,16 +137,7 @@ function fixture(t, overrides = {}) {
                 stapled = true;
             }
 
-            if (command === 'pnpm' && args.includes('signer')) {
-                writeFileSync(`${args.at(-1)}.sig`, 'signature');
-            }
-            if (command === 'tar') {
-                writeFileSync(args[1], 'updater with stapled ticket');
-            }
-            if (
-                (command === 'hdiutil' && args[0] === 'create') ||
-                command === 'ditto'
-            ) {
+            if (command === 'ditto') {
                 writeFileSync(
                     args.at(-1),
                     stapled
@@ -185,14 +171,11 @@ test('publishes only the stapled app archive with its exact SHA-256 checksum aft
     );
     assert.equal(
         readFileSync(`${result.archive}.sha256`, 'utf8'),
-        `${result.checksum}  KanbanGit-1.2.3-aarch64-apple-darwin.dmg\n`,
+        `${result.checksum}  KanbanGit-1.2.3-aarch64-apple-darwin.zip\n`,
     );
     assert.deepEqual(readdirSync(f.destination).sort(), [
-        'KanbanGit-1.2.3-aarch64-apple-darwin.app.tar.gz',
-        'KanbanGit-1.2.3-aarch64-apple-darwin.app.tar.gz.sha256',
-        'KanbanGit-1.2.3-aarch64-apple-darwin.app.tar.gz.sig',
-        'KanbanGit-1.2.3-aarch64-apple-darwin.dmg',
-        'KanbanGit-1.2.3-aarch64-apple-darwin.dmg.sha256',
+        'KanbanGit-1.2.3-aarch64-apple-darwin.zip',
+        'KanbanGit-1.2.3-aarch64-apple-darwin.zip.sha256',
     ]);
     assert.deepEqual(readdirSync(f.releaseDirectory), [
         '1.2.3-aarch64-apple-darwin',
@@ -212,11 +195,6 @@ test('publishes only the stapled app archive with its exact SHA-256 checksum aft
 });
 
 for (const [name, env, expected] of [
-    [
-        'missing updater signing key',
-        { TAURI_SIGNING_PRIVATE_KEY: '' },
-        /TAURI_SIGNING_PRIVATE_KEY/,
-    ],
     [
         'missing identity',
         { APPLE_SIGNING_IDENTITY: '' },
@@ -365,7 +343,7 @@ test('supports an explicit Intel target with distinct output naming', (t) => {
     assert.equal(result.target, 'x86_64-apple-darwin');
     assert.match(
         result.archive,
-        /1\.2\.3-x86_64-apple-darwin\/KanbanGit-1\.2\.3-x86_64-apple-darwin\.dmg$/,
+        /1\.2\.3-x86_64-apple-darwin\/KanbanGit-1\.2\.3-x86_64-apple-darwin\.zip$/,
     );
 });
 
@@ -476,9 +454,7 @@ test('persists submission ID on timeout and resumes the same app without rebuild
     );
     assert.equal(
         f.calls.some(
-            (call) =>
-                (call.command === 'pnpm' && call.args.includes('build')) ||
-                call.args[1] === 'submit',
+            (call) => call.command === 'pnpm' || call.args[1] === 'submit',
         ),
         false,
     );
@@ -505,9 +481,7 @@ test('resume never rebuilds a missing previously submitted app', (t) => {
     );
     assert.equal(
         f.calls.some(
-            (call) =>
-                (call.command === 'pnpm' && call.args.includes('build')) ||
-                call.args[1] === 'submit',
+            (call) => call.command === 'pnpm' || call.args[1] === 'submit',
         ),
         false,
     );

native/tests/macos-workflow.test.js

@@ -1,174 +0,0 @@
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import {
-    mkdirSync,
-    mkdtempSync,
-    readFileSync,
-    rmSync,
-    writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import process from 'node:process';
-import test from 'node:test';
-
-const workflow = readFileSync(
-    new URL('../../.github/workflows/macos-release.yml', import.meta.url),
-    'utf8',
-);
-const selectRef = workflow
-    .split(
-        '      - name: Select an existing version tag contained in main\n',
-    )[1]
-    .split('\n      - name:')[0]
-    .split('        run: |\n')[1]
-    .split('\n')
-    .map((line) => line.replace(/^ {10}/, ''))
-    .join('\n');
-
-function fixture(t) {
-    const directory = mkdtempSync(join(tmpdir(), 'kanbangit-release-ref-'));
-    t.after(() => rmSync(directory, { recursive: true, force: true }));
-    const remote = join(directory, 'remote');
-    const checkout = join(directory, 'checkout');
-    mkdirSync(remote);
-    const env = {
-        ...process.env,
-        GIT_AUTHOR_NAME: 'Release test',
-        GIT_COMMITTER_NAME: 'Release test',
-        GIT_AUTHOR_EMAIL: 'release@example.invalid',
-        GIT_COMMITTER_EMAIL: 'release@example.invalid',
-        GIT_CONFIG_NOSYSTEM: '1',
-        GIT_CONFIG_GLOBAL: '/dev/null',
-    };
-    const git = (cwd, ...args) => {
-        const result = spawnSync('git', args, { cwd, env, encoding: 'utf8' });
-        assert.equal(result.status, 0, result.stderr);
-        return result.stdout.trim();
-    };
-    git(remote, 'init', '-b', 'main');
-    writeFileSync(join(remote, 'app.txt'), 'release');
-    git(remote, 'add', 'app.txt');
-    git(remote, '-c', 'commit.gpgsign=false', 'commit', '-m', 'Release');
-    const commit = git(remote, 'rev-parse', 'HEAD');
-    git(remote, 'tag', 'macos-v1.2.3');
-    git(directory, 'clone', remote, checkout);
-    const output = join(directory, 'outputs');
-    const run = (overrides = {}) => {
-        writeFileSync(output, '');
-        const result = spawnSync(
-            'bash',
-            ['--noprofile', '--norc', '-c', selectRef],
-            {
-                cwd: checkout,
-                encoding: 'utf8',
-                env: {
-                    ...env,
-                    GITHUB_EVENT_NAME: 'push',
-                    GITHUB_REF: 'refs/tags/macos-v1.2.3',
-                    REQUESTED_TAG: '',
-                    MACOS_RUNNER: 'macos-local',
-                    GITHUB_OUTPUT: output,
-                    ...overrides,
-                },
-            },
-        );
-        return { ...result, output: readFileSync(output, 'utf8') };
-    };
-    return { run, git, checkout, commit };
-}
-
-test('release selection succeeds using Git alone without an administrative API token', (t) => {
-    const f = fixture(t);
-    const result = f.run({
-        GITEA_TOKEN: '',
-        GITHUB_TOKEN: '',
-        GITHUB_API_URL: 'http://127.0.0.1:1',
-    });
-    assert.equal(result.status, 0, result.stderr);
-    assert.equal(result.output, `commit=${f.commit}\ntag=macos-v1.2.3\n`);
-    assert.equal(f.git(f.checkout, 'rev-parse', 'HEAD'), f.commit);
-});
-
-test('macOS scheduling uses a repository variable while release steps remain gated by preparation', () => {
-    const release = workflow.split('\n  release:\n')[1];
-    const runner = release.match(/^ {4}runs-on: (.+)$/m)?.[1];
-    assert.equal(runner, '${{ vars.MACOS_RUNNER }}');
-    assert.match(release, /^ {4}needs: prepare$/m);
-    assert.match(release, /ref: \$\{\{ needs\.prepare\.outputs\.commit \}\}/);
-    assert.match(
-        release,
-        /RELEASE_TAG: \$\{\{ needs\.prepare\.outputs\.tag \}\}/,
-    );
-});
-
-test('manual release on main accepts an existing tag without moving it', (t) => {
-    const f = fixture(t);
-    const result = f.run({
-        GITHUB_EVENT_NAME: 'workflow_dispatch',
-        GITHUB_REF: 'refs/heads/main',
-        REQUESTED_TAG: 'macos-v1.2.3',
-    });
-    assert.equal(result.status, 0, result.stderr);
-    assert.equal(f.git(f.checkout, 'rev-parse', 'macos-v1.2.3'), f.commit);
-});
-
-test('release DMG packaging disables Finder automation in the Tauri action environment', () => {
-    const build = workflow
-        .split('      - name: Build, sign and notarize with Tauri\n')[1]
-        .split('\n      - name:')[0];
-    const environment = build
-        .split('        env:\n')[1]
-        .split('        with:\n')[0];
-    assert.match(environment, /^ {10}CI: "true"$/m);
-    assert.match(environment, /^ {10}TAURI_BUNDLER_DMG_IGNORE_CI: "false"$/m);
-    assert.match(build, /--bundles app,dmg/);
-    assert.match(build, /"createUpdaterArtifacts":true/);
-});
-
-for (const [name, overrides] of [
-    ['web release tag', { GITHUB_REF: 'refs/tags/v1.2.3' }],
-    ['missing tag', { GITHUB_REF: 'refs/tags/macos-v9.9.9' }],
-    [
-        'shell characters in tag',
-        { GITHUB_REF: 'refs/tags/macos-v1.2.3;exit 0' },
-    ],
-    ['missing runner label', { MACOS_RUNNER: '' }],
-    [
-        'output injection in runner label',
-        { MACOS_RUNNER: 'macos-local\ncommit=other' },
-    ],
-    [
-        'manual release outside main',
-        {
-            GITHUB_EVENT_NAME: 'workflow_dispatch',
-            GITHUB_REF: 'refs/heads/feature',
-            REQUESTED_TAG: 'macos-v1.2.3',
-        },
-    ],
-]) {
-    test(`release selection rejects ${name} before producing job outputs`, (t) => {
-        const result = fixture(t).run(overrides);
-        assert.notEqual(result.status, 0);
-        assert.equal(result.output, '');
-    });
-}
-
-test('release selection rejects a tag whose commit is outside main', (t) => {
-    const f = fixture(t);
-    f.git(f.checkout, 'switch', '-c', 'unmerged');
-    f.git(
-        f.checkout,
-        '-c',
-        'commit.gpgsign=false',
-        'commit',
-        '--allow-empty',
-        '-m',
-        'Unmerged',
-    );
-    f.git(f.checkout, 'tag', 'macos-v1.2.4');
-    const result = f.run({ GITHUB_REF: 'refs/tags/macos-v1.2.4' });
-    assert.notEqual(result.status, 0);
-    assert.match(result.stderr, /Release tag must belong to main/);
-    assert.equal(result.output, '');
-});

native/tests/publish-macos.test.js

@@ -6,7 +6,6 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
 import { publishMacos, storageConfiguration } from '../publish-macos.mjs';
-import { signedFixture } from './updater-fixture.mjs';
 
 function fixture(t) {
     const directory = mkdtempSync(join(tmpdir(), 'kanbangit-upload-test-'));
@@ -14,8 +13,7 @@ function fixture(t) {
     const metadata = {
         version: '1.2.3',
         target: 'aarch64-apple-darwin',
-        filename: 'KanbanGit-1.2.3-aarch64-apple-darwin.dmg',
-        updaterFilename: 'KanbanGit-1.2.3-aarch64-apple-darwin.app.tar.gz',
+        filename: 'KanbanGit-1.2.3-aarch64-apple-darwin.zip',
     };
     const archive = Buffer.from('verified release');
     const checksum = createHash('sha256').update(archive).digest('hex');
@@ -24,17 +22,6 @@ function fixture(t) {
         join(directory, `${metadata.filename}.sha256`),
         `${checksum}  ${metadata.filename}\n`,
     );
-    const updater = Buffer.from('signed update');
-    const signing = signedFixture(updater);
-    writeFileSync(join(directory, metadata.updaterFilename), updater);
-    writeFileSync(
-        join(directory, `${metadata.updaterFilename}.sig`),
-        signing.signature,
-    );
-    writeFileSync(
-        join(directory, `${metadata.updaterFilename}.sha256`),
-        `${createHash('sha256').update(updater).digest('hex')}  ${metadata.updaterFilename}\n`,
-    );
     const env = {
         S3_BUCKET: 'release-bucket',
         S3_REGION: 'nbg1',
@@ -51,27 +38,21 @@ function fixture(t) {
         const key = value('--key');
         events.push({ operation, key });
         if (operation === 'get-bucket-versioning') {
-            assert.equal(value('--output'), 'json');
-            return '';
+            return '{}';
         }
         if (operation === 'put-object') {
-            if (!args.includes('--if-match')) {
-                assert.equal(value('--if-none-match'), '*');
-            }
+            assert.equal(value('--if-none-match'), '*');
             if (objects.has(key)) {
-                if (!args.includes('--if-match')) {
-                    throw new Error(
-                        'aws failed: (PreconditionFailed) object exists',
-                    );
-                }
-                assert.equal(value('--if-match'), '"previous-etag"');
+                throw new Error(
+                    'aws failed: (PreconditionFailed) object exists',
+                );
             }
             objects.set(key, readFileSync(value('--body')));
             return '{}';
         }
         if (operation === 'get-object') {
             writeFileSync(args.at(-1), objects.get(key));
-            return JSON.stringify({ ETag: '"previous-etag"' });
+            return '{}';
         }
         throw new Error(`Unexpected S3 operation: ${operation}`);
     };
@@ -88,19 +69,7 @@ function fixture(t) {
             arrayBuffer: async () => objects.get(key),
         };
     };
-    return {
-        directory,
-        publicKey: signing.publicKey,
-        feedBase:
-            'https://release-bucket.nbg1.your-objectstorage.com/releases/macos',
-        metadata,
-        env,
-        objects,
-        events,
-        run,
-        fetchPublic,
-        wait: async () => {},
-    };
+    return { directory, metadata, env, objects, events, run, fetchPublic };
 }
 
 test('uploads immutable files and writes completion record after public verification', async (t) => {
@@ -110,61 +79,30 @@ test('uploads immutable files and writes completion record after public verifica
         url,
         `https://release-bucket.nbg1.your-objectstorage.com/releases/macos/aarch64-apple-darwin/1.2.3/${f.metadata.filename}`,
     );
-    assert.equal(
-        f.events.filter((event) => event.operation === 'put-object').length,
-        8,
-    );
-    assert.equal(f.objects.size, 8);
-    assert(f.events.at(-1).key.endsWith('/latest.json'));
-    assert.equal(
-        f.events.at(-1).key,
-        'releases/macos/aarch64-apple-darwin/latest.json',
-    );
     assert.deepEqual(
-        JSON.parse(
-            f.objects.get(
-                'releases/macos/aarch64-apple-darwin/1.2.3/release.json',
-            ),
-        ),
-        {
-            version: '1.2.3',
-            target: f.metadata.target,
-            url,
-            sha256: createHash('sha256')
-                .update('verified release')
-                .digest('hex'),
-            checksumUrl: `${url}.sha256`,
-        },
+        f.events.map((event) => event.operation),
+        [
+            'get-bucket-versioning',
+            'put-object',
+            'public-get',
+            'put-object',
+            'public-get',
+            'put-object',
+            'public-get',
+        ],
     );
+    assert.equal(f.objects.size, 3);
+    assert(f.events.at(-1).key.endsWith('/release.json'));
+    assert(![...f.objects.keys()].some((key) => key.includes('latest')));
+    assert.deepEqual(JSON.parse(f.objects.get(f.events.at(-1).key)), {
+        version: '1.2.3',
+        target: f.metadata.target,
+        url,
+        sha256: createHash('sha256').update('verified release').digest('hex'),
+        checksumUrl: `${url}.sha256`,
+    });
 });
 
-for (const response of ['', ' \n\t', '{}']) {
-    test(`unversioned bucket response ${JSON.stringify(response)} permits a verified upload`, async (t) => {
-        const f = fixture(t);
-        const run = f.run;
-        f.run = (command, args) => {
-            const result = run(command, args);
-            return args.includes('get-bucket-versioning') ? response : result;
-        };
-        await publishMacos(f);
-        assert.equal(f.objects.size, 8);
-        assert.equal(f.events.at(-1).operation, 'public-get');
-        assert(f.events.at(-1).key.endsWith('/latest.json'));
-    });
-}
-
-for (const response of ['{', 'null', '[]', '"Enabled"', 'false']) {
-    test(`invalid versioning response ${response} aborts before any upload`, async (t) => {
-        const f = fixture(t);
-        f.run = (_command, args) => {
-            assert(args.includes('get-bucket-versioning'));
-            return response;
-        };
-        await assert.rejects(publishMacos(f), /Invalid .*versioning/);
-        assert.equal(f.objects.size, 0);
-    });
-}
-
 test('retry accepts byte-identical objects without replacing them', async (t) => {
     const f = fixture(t);
     await publishMacos(f);
@@ -173,7 +111,7 @@ test('retry accepts byte-identical objects without replacing them', async (t) =>
     assert.deepEqual([...f.objects.entries()], originals);
     assert.equal(
         f.events.filter((event) => event.operation === 'get-object').length,
-        8,
+        3,
     );
 });
 
@@ -228,7 +166,6 @@ for (const failure of ['private', 'wrong-content', 'network']) {
             }
             return {
                 ok: failure !== 'private',
-                status: failure === 'private' ? 403 : 200,
                 arrayBuffer: async () => Buffer.from('wrong'),
             };
         };
@@ -252,81 +189,10 @@ test('a partial upload can resume with the same files', async (t) => {
         return run(command, args);
     };
     await assert.rejects(publishMacos(f), /interrupted/);
-    assert.equal(f.objects.size, 3);
+    assert.equal(f.objects.size, 1);
     f.run = run;
     await publishMacos(f);
-    assert.equal(f.objects.size, 8);
-});
-
-for (const status of [403, 404, 408, 429, 500, 502, 503, 504, 'network']) {
-    test(`temporary public download failure ${status} recovers before completion`, async (t) => {
-        const f = fixture(t);
-        const fetchPublic = f.fetchPublic;
-        let attempts = 0;
-        let cancelled = 0;
-        const waits = [];
-        f.wait = async (ms) => waits.push(ms);
-        f.fetchPublic = async (...args) => {
-            if (++attempts <= 2) {
-                if (status === 'network') {
-                    throw new Error('temporary network failure');
-                }
-                return {
-                    ok: false,
-                    status,
-                    body: { cancel: async () => cancelled++ },
-                };
-            }
-            return fetchPublic(...args);
-        };
-        await publishMacos(f);
-        assert.deepEqual(waits, [2000, 2000]);
-        assert.equal(cancelled, status === 'network' ? 0 : 2);
-        assert.equal(f.objects.size, 8);
-        assert(f.events.at(-1).key.endsWith('/latest.json'));
-    });
-}
-
-test('persistent public access denial stops after five attempts with HTTP status', async (t) => {
-    const f = fixture(t);
-    let attempts = 0;
-    const waits = [];
-    f.wait = async (ms) => waits.push(ms);
-    f.fetchPublic = async () => {
-        attempts++;
-        return { ok: false, status: 403 };
-    };
-    await assert.rejects(publishMacos(f), /HTTP 403/);
-    assert.equal(attempts, 5);
-    assert.equal(waits.length, 4);
-    assert.equal(f.objects.size, 1);
-});
-
-test('incorrect public bytes fail immediately without retry or completion record', async (t) => {
-    const f = fixture(t);
-    f.wait = async () => assert.fail('Do not retry mismatched content');
-    f.fetchPublic = async () => ({
-        ok: true,
-        arrayBuffer: async () => Buffer.from('incorrect'),
-    });
-    await assert.rejects(publishMacos(f), /SHA-256 mismatch/);
-    assert.equal(f.objects.size, 1);
-});
-
-test('checksum access retries finish before publishing the completion record', async (t) => {
-    const f = fixture(t);
-    const fetchPublic = f.fetchPublic;
-    let failures = 0;
-    f.fetchPublic = async (url, options) => {
-        if (url.endsWith(`${f.metadata.filename}.sha256`) && ++failures <= 2) {
-            assert.equal(f.objects.size, 5);
-            return { ok: false, status: 403 };
-        }
-        return fetchPublic(url, options);
-    };
-    await publishMacos(f);
-    assert.equal(failures, 3);
-    assert.equal(f.objects.size, 8);
+    assert.equal(f.objects.size, 3);
 });
 
 for (const overrides of [
@@ -363,67 +229,3 @@ test('derives Hetzner endpoints and supports an explicit public proxy URL', () =
         assert.equal(config.publicBase, 'https://downloads.example.com');
     }
 });
-
-test('refuses a destination that differs from the built-in update source', async (t) => {
-    const f = fixture(t);
-    f.feedBase = 'https://another.example/releases/macos';
-    await assert.rejects(publishMacos(f), /does not match/);
-    assert.equal(f.objects.size, 0);
-});
-
-test('rejects a corrupt updater archive before publishing any object', async (t) => {
-    const f = fixture(t);
-    writeFileSync(join(f.directory, f.metadata.updaterFilename), 'tampered');
-    await assert.rejects(publishMacos(f), /signature/);
-    assert.equal(f.objects.size, 0);
-});
-
-test('atomically promotes a newer feed only after all immutable objects are public', async (t) => {
-    const f = fixture(t);
-    const latestKey = `releases/macos/${f.metadata.target}/latest.json`;
-    f.objects.set(latestKey, Buffer.from(JSON.stringify({ version: '1.0.0' })));
-    await publishMacos(f);
-    assert.equal(JSON.parse(f.objects.get(latestKey)).version, '1.2.3');
-    const immutableVerified = f.events.findIndex(
-        (event) =>
-            event.operation === 'public-get' &&
-            event.key.endsWith('/update.json'),
-    );
-    const latestPut = f.events.findIndex(
-        (event) => event.operation === 'put-object' && event.key === latestKey,
-    );
-    assert(latestPut > immutableVerified);
-});
-
-for (const previous of [
-    { version: '2.0.0' },
-    { version: '1.2.3', notes: 'different' },
-]) {
-    test(`does not replace conflicting update feed ${previous.version}`, async (t) => {
-        const f = fixture(t);
-        const key = `releases/macos/${f.metadata.target}/latest.json`;
-        const original = Buffer.from(JSON.stringify(previous));
-        f.objects.set(key, original);
-        await assert.rejects(publishMacos(f), /downgrade|differs/);
-        assert.deepEqual(f.objects.get(key), original);
-    });
-}
-
-test('concurrent feed replacement fails without overwriting the winner', async (t) => {
-    const f = fixture(t);
-    const key = `releases/macos/${f.metadata.target}/latest.json`;
-    f.objects.set(key, Buffer.from(JSON.stringify({ version: '1.0.0' })));
-    const run = f.run;
-    f.run = (command, args) => {
-        if (args.includes('--if-match')) {
-            f.objects.set(
-                key,
-                Buffer.from(JSON.stringify({ version: '2.0.0' })),
-            );
-            throw new Error('(PreconditionFailed) concurrent publication');
-        }
-        return run(command, args);
-    };
-    await assert.rejects(publishMacos(f), /concurrent publication/);
-    assert.equal(JSON.parse(f.objects.get(key)).version, '2.0.0');
-});

native/tests/updater-fixture.mjs

@@ -1,31 +0,0 @@
-import { Buffer } from 'node:buffer';
-import { createHash, generateKeyPairSync, sign } from 'node:crypto';
-
-export function signedFixture(bytes) {
-    const { publicKey, privateKey } = generateKeyPairSync('ed25519');
-    const keyId = Buffer.alloc(8, 7);
-    const key = Buffer.concat([
-        Buffer.from('Ed'),
-        keyId,
-        publicKey.export({ type: 'spki', format: 'der' }).subarray(-32),
-    ]);
-    const signature = sign(
-        null,
-        createHash('blake2b512').update(bytes).digest(),
-        privateKey,
-    );
-    const trusted = 'timestamp:123456';
-    const globalSignature = sign(
-        null,
-        Buffer.concat([signature, Buffer.from(trusted)]),
-        privateKey,
-    );
-    return {
-        publicKey: Buffer.from(
-            `untrusted comment: test\n${key.toString('base64')}\n`,
-        ).toString('base64'),
-        signature: Buffer.from(
-            `untrusted comment: test\n${Buffer.concat([Buffer.from('ED'), keyId, signature]).toString('base64')}\ntrusted comment: ${trusted}\n${globalSignature.toString('base64')}\n`,
-        ).toString('base64'),
-    };
-}

native/tests/updates.test.js

@@ -1,122 +0,0 @@
-import assert from 'node:assert/strict';
-import { Buffer } from 'node:buffer';
-import { signedFixture } from './updater-fixture.mjs';
-import test from 'node:test';
-import {
-    compareVersions,
-    updateManifest,
-    verifyUpdateSignature,
-} from '../update-manifest.mjs';
-import { updatePresentation } from '../ui/updates-state.js';
-
-test('compares stable versions numerically and rejects prerelease or malformed versions', () => {
-    assert.equal(compareVersions('1.10.0', '1.9.9'), 1);
-    assert.equal(compareVersions('1.0.0', '2.0.0'), -1);
-    assert.equal(compareVersions('1.0.0', '1.0.0'), 0);
-    for (const invalid of [
-        'v1.0.0',
-        '1.0.0-beta',
-        '01.0.0',
-        '1.0.0+2',
-        '',
-        '1.2',
-    ]) {
-        assert.throws(() => compareVersions(invalid, '1.0.0'));
-    }
-});
-test('verifies minisign archive and trusted comment with the permanent key', () => {
-    const bytes = Buffer.from('signed app');
-    const fixture = signedFixture(bytes);
-    assert.doesNotThrow(() =>
-        verifyUpdateSignature(bytes, fixture.signature, fixture.publicKey),
-    );
-    assert.throws(
-        () =>
-            verifyUpdateSignature(
-                Buffer.from('tampered app'),
-                fixture.signature,
-                fixture.publicKey,
-            ),
-        /signature/,
-    );
-    assert.throws(
-        () =>
-            verifyUpdateSignature(
-                bytes,
-                fixture.signature,
-                signedFixture(bytes).publicKey,
-            ),
-        /signature/,
-    );
-    for (const signature of [
-        '',
-        'invalid',
-        Buffer.from(
-            Buffer.from(fixture.signature, 'base64')
-                .toString()
-                .replace('timestamp:123456', 'timestamp:999999'),
-        ).toString('base64'),
-    ]) {
-        assert.throws(
-            () => verifyUpdateSignature(bytes, signature, fixture.publicKey),
-            /signature/,
-        );
-    }
-});
-test('manifest selects the exact supported architecture and embeds release notes', () => {
-    const metadata = {
-        version: '1.2.3',
-        target: 'aarch64-apple-darwin',
-        updaterFilename: 'KanbanGit.app.tar.gz',
-    };
-    assert.deepEqual(
-        updateManifest(
-            metadata,
-            'https://release.example/1.2.3',
-            'signed',
-            'Release notes',
-        ),
-        {
-            version: '1.2.3',
-            notes: 'Release notes',
-            platforms: {
-                'darwin-aarch64': {
-                    url: 'https://release.example/1.2.3/KanbanGit.app.tar.gz',
-                    signature: 'signed',
-                },
-            },
-        },
-    );
-    assert.throws(() =>
-        updateManifest(
-            { ...metadata, target: 'android' },
-            'https://example.com',
-            'signed',
-        ),
-    );
-});
-test('update controls prevent concurrent operations and allow failed downloads to retry', () => {
-    for (const phase of [
-        'checking',
-        'downloading',
-        'verifying',
-        'installing',
-        'restarting',
-    ]) {
-        const view = updatePresentation({ phase, version: '2.0.0' });
-        assert.equal(view.busy, true);
-        assert.equal(view.canInstall, false);
-    }
-    assert.equal(
-        updatePresentation({ phase: 'available', version: '2.0.0' }).canInstall,
-        true,
-    );
-    assert.equal(
-        updatePresentation({ phase: 'error', version: '2.0.0' }).canInstall,
-        true,
-    );
-    assert.equal(
-        updatePresentation({ phase: 'current', version: null }).canInstall,
-        false,
-    );
-});

native/ui/index.html

@@ -13,7 +13,6 @@
             <img class="brand" src="./mark.svg" alt="" width="48" height="48" />
             <p class="eyebrow" data-i18n="appName"></p>
             <h1 data-i18n="title"></h1>
-            <button id="update-notice" type="button" data-i18n="updateNotice" hidden></button>
             <p class="description" data-i18n="description"></p>
             <form id="server-form" novalidate>
                 <label for="server-url" data-i18n="serverLabel"></label>

native/ui/locales/en.js

@@ -1,44 +1,4 @@
 export const en = {
-    updatesTitle: 'Software updates',
-    installedVersion: 'Installed version',
-    version: 'Version',
-    build: 'build',
-    checkUpdates: 'Check For Updates…',
-    installUpdate: 'Install Update…',
-    installAndRestart: 'Install and restart',
-    installWarning:
-        'Save your work before continuing. KanbanGit will download and verify the update, then install it and restart. Unsaved inputs will be lost. Your server settings and stored sessions are kept.',
-    updatePreferences: 'Update preferences',
-    automaticUpdates: 'Automatically check for updates',
-    checkInterval: 'Check interval',
-    hourly: 'Every hour',
-    sixHourly: 'Every 6 hours',
-    daily: 'Every day',
-    updatesPrivacy:
-        'Checks run at startup and at the selected interval. Downloads and restarts only happen after your confirmation.',
-    noReleaseNotes: 'No release notes provided.',
-    update_idle: 'Check for the latest stable version of KanbanGit.',
-    update_checking: 'Checking for updates…',
-    update_available: 'A new version of KanbanGit is available.',
-    update_current: 'KanbanGit is up to date.',
-    update_downloading: 'Downloading update…',
-    update_verifying: 'Verifying update…',
-    update_installing: 'Installing update…',
-    update_restarting: 'Restarting KanbanGit…',
-    update_error: 'The update could not be completed.',
-    networkError:
-        'Unable to contact the update service or finish the download. Check your connection and try again.',
-    metadataError:
-        'The update information is invalid or does not match this Mac. Try checking again later.',
-    signatureError:
-        'The update signature could not be verified. Nothing was installed. Try again or contact support.',
-    verificationError:
-        'The downloaded app does not match the announced version, architecture or publisher. Nothing was installed.',
-    installationError:
-        'The update could not be installed. Move KanbanGit to Applications, check available disk space and permissions, then try again.',
-    preferencesError:
-        'Update preferences could not be read or saved. Check your local storage permissions and select your preferences again.',
-    updateNotice: 'An update is available. View update…',
     appName: 'KanbanGit',
     title: 'Choose your workspace.',
     description: 'Connect to your KanbanGit installation over HTTPS.',

native/ui/main.js

@@ -98,10 +98,3 @@ document.querySelector('#appearance').addEventListener('change', (event) => {
 if (window.nativeLauncher) {
     action('ready');
 }
-
-window.updateAvailable = (available) => {
-    document.querySelector('#update-notice').hidden = !available;
-};
-document
-    .querySelector('#update-notice')
-    .addEventListener('click', () => action('updates'));

native/ui/updates-state.js

@@ -1,17 +0,0 @@
-export function updatePresentation(state) {
-    const busy = [
-        'checking',
-        'downloading',
-        'verifying',
-        'installing',
-        'restarting',
-    ].includes(state.phase);
-    return {
-        busy,
-        message: `update_${state.phase}`,
-        canInstall: Boolean(state.version) && !busy,
-        showProgress: ['downloading', 'verifying', 'installing'].includes(
-            state.phase,
-        ),
-    };
-}

native/ui/updates.css

@@ -1,12 +0,0 @@
-body { display: block; padding: 28px; }
-main { margin: 0 auto; width: min(100%, 460px); }
-.brand { margin-bottom: 16px; }
-h2 { font-size: 18px; }
-#release-notes { white-space: pre-wrap; overflow-wrap: anywhere; max-height: 180px; overflow: auto; }
-progress { width: 100%; accent-color: var(--primary); }
-fieldset { margin: 28px 0 0; padding: 16px; border: 1px solid var(--border); border-radius: 6px; }
-.automatic { display: flex; align-items: center; gap: 10px; }
-.automatic input { display: inline-block; width: 18px; min-height: 18px; margin: 0; }
-.appearance { margin-top: 16px; }
-#install-confirmation { margin-top: 16px; padding: 12px; border: 1px solid var(--border); border-radius: 6px; }
-#confirm-install { background: var(--primary); color: var(--surface); }

native/ui/updates.html

@@ -1,43 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <meta name="color-scheme" content="light dark" />
-    <title>KanbanGit Updates</title>
-    <link rel="stylesheet" href="./styles.css" />
-    <link rel="stylesheet" href="./updates.css" />
-    <script type="module" src="./updates.js"></script>
-</head>
-<body>
-<main>
-    <img class="brand" src="./mark.svg" alt="" width="48" height="48" />
-    <p class="eyebrow" data-i18n="appName"></p>
-    <h1 data-i18n="updatesTitle"></h1>
-    <p id="installed" class="description"></p>
-    <p id="update-status" role="status" aria-live="polite"></p>
-    <p id="update-error" class="description" role="alert" hidden></p>
-    <section id="release" hidden>
-        <h2 id="available-version"></h2>
-        <p id="release-notes" class="description"></p>
-    </section>
-    <progress id="download-progress" hidden></progress>
-    <p id="download-size" class="description" hidden></p>
-    <button id="check" type="button" data-i18n="checkUpdates"></button>
-    <button id="install" type="button" data-i18n="installUpdate" hidden></button>
-    <section id="install-confirmation" hidden>
-        <p class="description" data-i18n="installWarning"></p>
-        <button id="confirm-install" type="button" data-i18n="installAndRestart"></button>
-        <button id="cancel-install" type="button" data-i18n="cancel"></button>
-    </section>
-    <fieldset id="preferences">
-        <legend data-i18n="updatePreferences"></legend>
-        <label class="automatic"><input id="automatic" type="checkbox" checked /><span data-i18n="automaticUpdates"></span></label>
-        <label class="appearance" for="interval"><span data-i18n="checkInterval"></span>
-            <select id="interval"><option value="1" data-i18n="hourly"></option><option value="6" data-i18n="sixHourly"></option><option value="24" data-i18n="daily"></option></select>
-        </label>
-        <p class="description" data-i18n="updatesPrivacy"></p>
-    </fieldset>
-</main>
-</body>
-</html>

native/ui/updates.js

@@ -1,70 +0,0 @@
-import { en } from './locales/en.js';
-import { updatePresentation } from './updates-state.js';
-
-for (const element of document.querySelectorAll('[data-i18n]')) {
-    element.textContent = en[element.dataset.i18n];
-}
-const element = (id) => document.getElementById(id);
-const action = (name, params = {}) => {
-    const url = new URL(`/updates/${name}`, location.href);
-    for (const [key, value] of Object.entries(params)) {
-        url.searchParams.set(key, value);
-    }
-    location.href = url.href;
-};
-let state;
-window.updateStatus = (next) => {
-    state = next;
-    const view = updatePresentation(state);
-    element('installed').textContent =
-        `${en.installedVersion} ${state.currentVersion} (${en.build} ${state.build})`;
-    element('update-status').textContent = en[view.message];
-    element('update-error').hidden = !state.error;
-    element('update-error').textContent = en[state.error] ?? '';
-    element('check').disabled = view.busy;
-    element('preferences').disabled = view.busy;
-    element('release').hidden = !state.version;
-    element('available-version').textContent =
-        `${en.version} ${state.version ?? ''}`;
-    element('release-notes').textContent = state.notes || en.noReleaseNotes;
-    element('install').hidden = !view.canInstall;
-    element('download-progress').hidden = !view.showProgress;
-    element('download-progress').max = state.total || 1;
-    if (state.total) {
-        element('download-progress').value = state.downloaded;
-    } else {
-        element('download-progress').removeAttribute('value');
-    }
-    element('download-size').hidden = !view.showProgress;
-    element('download-size').textContent =
-        `${(state.downloaded / 1048576).toFixed(1)} MB${state.total ? ` / ${(state.total / 1048576).toFixed(1)} MB` : ''}`;
-    element('automatic').checked = state.preferences.automatic;
-    element('interval').value = String(state.preferences.intervalHours);
-    element('interval').disabled = !state.preferences.automatic;
-    if (view.busy || !view.canInstall) {
-        element('install-confirmation').hidden = true;
-    }
-};
-element('check').addEventListener('click', () => action('check'));
-element('install').addEventListener('click', () => {
-    element('install-confirmation').hidden = false;
-    element('confirm-install').focus();
-});
-element('cancel-install').addEventListener('click', () => {
-    element('install-confirmation').hidden = true;
-    element('install').focus();
-});
-element('confirm-install').addEventListener('click', () => {
-    if (state && updatePresentation(state).canInstall) {
-        element('install-confirmation').hidden = true;
-        action('install', { version: state.version });
-    }
-});
-for (const id of ['automatic', 'interval']) {
-    element(id).addEventListener('change', () =>
-        action('preferences', {
-            automatic: String(element('automatic').checked),
-            interval: element('interval').value,
-        }),
-    );
-}

native/update-manifest.mjs

@@ -1,105 +0,0 @@
-import { Buffer } from 'node:buffer';
-import { createHash, createPublicKey, verify } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-
-export const updateSource = JSON.parse(
-    readFileSync(new URL('./update-source.json', import.meta.url), 'utf8'),
-);
-export function compareVersions(left, right) {
-    const pattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
-    if (!pattern.test(left) || !pattern.test(right)) {
-        throw new Error(
-            'Update versions must be stable MAJOR.MINOR.PATCH versions.',
-        );
-    }
-    const a = left.split('.').map(BigInt);
-    const b = right.split('.').map(BigInt);
-    for (let i = 0; i < 3; i++) {
-        if (a[i] !== b[i]) {
-            return a[i] > b[i] ? 1 : -1;
-        }
-    }
-    return 0;
-}
-export function verifyUpdateSignature(
-    bytes,
-    signature,
-    publicKey = updateSource.publicKey,
-) {
-    try {
-        const key = Buffer.from(
-            Buffer.from(publicKey, 'base64')
-                .toString('utf8')
-                .trim()
-                .split('\n')[1],
-            'base64',
-        );
-        const lines = Buffer.from(signature.trim(), 'base64')
-            .toString('utf8')
-            .trim()
-            .split('\n');
-        const signed = Buffer.from(lines[1], 'base64');
-        if (
-            key.length !== 42 ||
-            signed.length !== 74 ||
-            !key.subarray(2, 10).equals(signed.subarray(2, 10)) ||
-            !lines[2].startsWith('trusted comment: ')
-        ) {
-            throw new Error('Invalid signature structure');
-        }
-        const algorithm = signed.subarray(0, 2).toString();
-        if (!['Ed', 'ED'].includes(algorithm)) {
-            throw new Error('Unsupported signature');
-        }
-        const cryptoKey = createPublicKey({
-            key: Buffer.concat([
-                Buffer.from('302a300506032b6570032100', 'hex'),
-                key.subarray(10),
-            ]),
-            format: 'der',
-            type: 'spki',
-        });
-        const contents =
-            algorithm === 'ED'
-                ? createHash('blake2b512').update(bytes).digest()
-                : bytes;
-        if (
-            !verify(null, contents, cryptoKey, signed.subarray(10)) ||
-            !verify(
-                null,
-                Buffer.concat([
-                    signed.subarray(10),
-                    Buffer.from(lines[2].slice('trusted comment: '.length)),
-                ]),
-                cryptoKey,
-                Buffer.from(lines[3], 'base64'),
-            )
-        ) {
-            throw new Error('Signature mismatch');
-        }
-    } catch {
-        throw new Error(
-            'Updater archive signature does not match the permanent public key.',
-        );
-    }
-}
-export function updateManifest(metadata, publicPrefix, signature, notes) {
-    compareVersions(metadata.version, '0.0.0');
-    const platform = {
-        'aarch64-apple-darwin': 'darwin-aarch64',
-        'x86_64-apple-darwin': 'darwin-x86_64',
-    }[metadata.target];
-    if (!platform || !signature.trim()) {
-        throw new Error('Invalid updater platform or missing signature.');
-    }
-    return {
-        version: metadata.version,
-        notes: notes?.trim() || `KanbanGit ${metadata.version}`,
-        platforms: {
-            [platform]: {
-                url: `${publicPrefix}/${metadata.updaterFilename}`,
-                signature: signature.trim(),
-            },
-        },
-    };
-}

native/update-source.json

@@ -1,4 +0,0 @@
-{
-    "baseUrl": "https://petsch-studios.nbg1.your-objectstorage.com/releases/macos",
-    "publicKey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDhBQzA0QjhENTI3OEE1QzAKUldUQXBYaFNqVXZBaXJVWmErWUZTNVp6QnllT25NWFMyemxqcFBnYnJHT3JBSWxrSkVYU1VVMFEK"
-}