The publish job's last step fails during release finalization: packages/desktop/scripts/finalize-latest-json.ts signs desktop update artifacts with bunx @tauri-apps/cli signer sign, which reads the TAURI_SIGNING_PRIVATE_KEY / TAURI_SIGNING_PRIVATE_KEY_PASSWORD secrets. The fork's secret is not a valid minisign key, so signing dies with incorrect updater private key password: Missing comment in secret key and the whole release fails after npm and Docker already published (seen in run 30585007660 for v2.0.0).
Two parts:
- Short term: the updater feed should skip itself (like the other partial-release legs) instead of failing the release.
- Long term: generate a Bolt updater keypair (
bunx @tauri-apps/cli signer generate), set both secrets, and embed the new public key in the desktop updater config so auto-update signature verification works.
The publish job's last step fails during release finalization:
packages/desktop/scripts/finalize-latest-json.tssigns desktop update artifacts withbunx @tauri-apps/cli signer sign, which reads theTAURI_SIGNING_PRIVATE_KEY/TAURI_SIGNING_PRIVATE_KEY_PASSWORDsecrets. The fork's secret is not a valid minisign key, so signing dies withincorrect updater private key password: Missing comment in secret keyand the whole release fails after npm and Docker already published (seen in run 30585007660 for v2.0.0).Two parts:
bunx @tauri-apps/cli signer generate), set both secrets, and embed the new public key in the desktop updater config so auto-update signature verification works.