julian
a1f3103a76
The updater endpoint pointed at mca/parking_solution's own Gitea "latest release" redirect, but that repo is private and field appliances have no Gitea credentials — every update check was silently failing. release.yml now mirrors signed installers to mca/public_releases (public, installers only) under a fixed desktop-latest tag; tauri.conf.json points there. Rejected embedding a read token in the app instead, given the booth-operator threat model. Also: make the appliance-provisioning root_directory gotcha impossible to skim past (boxed callout + explicit next-step pointers), after it caused a second missed step on the park-2 install.
52 lines
2.3 KiB
JSON
52 lines
2.3 KiB
JSON
{
|
|
"$schema": "https://schema.tauri.app/config/2",
|
|
"productName": "Parking System",
|
|
"version": "0.0.0",
|
|
"identifier": "com.parking.desktop",
|
|
"build": {
|
|
"devUrl": "http://localhost:5173",
|
|
"frontendDist": "../../web/dist",
|
|
"beforeDevCommand": "pnpm --filter @parking/web dev",
|
|
"beforeBuildCommand": "pnpm --filter @parking/web build"
|
|
},
|
|
"app": {
|
|
"windows": [
|
|
{
|
|
"label": "main",
|
|
"title": "Parking System",
|
|
"width": 1280,
|
|
"height": 800,
|
|
"minWidth": 1024,
|
|
"minHeight": 640,
|
|
"resizable": true,
|
|
"maximized": true,
|
|
"fullscreen": false
|
|
}
|
|
],
|
|
"security": {
|
|
"csp": "default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; connect-src 'self' http://127.0.0.1:3000 http://localhost:3000 ws://127.0.0.1:3000 ws://localhost:3000"
|
|
}
|
|
},
|
|
"bundle": {
|
|
"active": true,
|
|
"targets": "all",
|
|
"createUpdaterArtifacts": true,
|
|
"icon": [
|
|
"icons/32x32.png",
|
|
"icons/128x128.png",
|
|
"icons/128x128@2x.png",
|
|
"icons/icon.icns",
|
|
"icons/icon.ico"
|
|
]
|
|
},
|
|
"plugins": {
|
|
"updater": {
|
|
"//": "Points at mca/public_releases, NOT this (private, source) repo — the updater runs on offline-first field appliances with no Gitea credentials, so the endpoint must be reachable unauthenticated. That repo is public and holds only compiled installers (no source), mirrored here by .gitea/workflows/release.yml. NOT the 'latest release' redirect: public_releases is shared across apps in the org, so 'latest' there could be someone else's release. This URL names our own most-recent tag directly (desktop-vX.Y.Z, bumped by the release workflow each publish) so a newer unrelated app release never shadows ours. The updater GETs this, gets the manifest (platforms.linux-x86_64.{signature,url}), and compares versions. The release is reachable to the appliance only when it's brought online (phone hotspot); offline-first means a failed check is a no-op.",
|
|
"endpoints": [
|
|
"https://git.infra.msai.al/mca/public_releases/releases/download/desktop-latest/latest.json"
|
|
],
|
|
"pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDgxNzg5RUQ1QkM0Q0FDRjYKUldUMnJFeTgxWjU0Z1RlNmhneDVZQlVVTVZZdGhJTkUxTGdDeGYwQSttZmNKVVp5WEdVMWlBb1YK"
|
|
}
|
|
}
|
|
}
|