MrSphay/Modrinth-plus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Align Windows signing with MrTrust contract
Some checks failed
Codex Template Compliance / template-compliance (push) Successful in 8s
Details
Build / build-windows (push) Failing after 8m43s
Details

Browse Source
This commit is contained in:
MrSphay
2026-05-16 04:34:34 +02:00
parent e66aa3d128
commit 6e9c53db2d
5 changed files with 84 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
docs/self-updates.md
View File

@@ -4,13 +4,15 @@ Modrinth Plus uses the existing Tauri updater flow from the upstream Modrinth Ap
The updater requires signing. Tauri does not allow unsigned updater installs, so the Gitea repository must provide these Actions secrets:
- `MRTRUST_CODE_SIGNING_PFX_BASE64`: base64-encoded `MrSphay-CodeSigning.pfx` from MrTrust.
- `MRTRUST_PFX_PASSWORD`: password for the MrTrust code-signing PFX.
- `MRTRUST_CODESIGN_PFX_BASE64`: base64-encoded `MrSphay-CodeSigning.pfx` from MrTrust.
- `MRTRUST_CODESIGN_PFX_PASSWORD`: password for the MrTrust code-signing PFX.
- `TAURI_SIGNING_PRIVATE_KEY`: private key generated by `tauri signer generate`.
- `TAURI_SIGNING_PRIVATE_KEY_PASSWORD`: optional key password.
- `TAURI_SIGNING_PUBLIC_KEY`: public key generated next to the private key.
- `REGISTRY_TOKEN`: Gitea token with package write access.
MrTrust signing and Tauri updater signing are separate. If only the two `MRTRUST_*` secrets are set, the workflow still builds and publishes a MrTrust-signed Windows installer, but it does not publish `latest.json` for in-app reload updates.
Generate a keypair with the Tauri CLI:
```powershell
@@ -19,7 +21,7 @@ pnpm --filter @modrinth/app exec tauri signer generate -- -w "$env:USERPROFILE\.
Use the `.key` file content as `TAURI_SIGNING_PRIVATE_KEY` and the `.key.pub` file content as `TAURI_SIGNING_PUBLIC_KEY`.
Encode the MrTrust PFX for the `MRTRUST_CODE_SIGNING_PFX_BASE64` secret:
Encode the MrTrust PFX for the `MRTRUST_CODESIGN_PFX_BASE64` secret:
```powershell
[Convert]::ToBase64String([IO.File]::ReadAllBytes(".\private\MrSphay-CodeSigning.pfx"))
@@ -32,3 +34,11 @@ https://git.wilkensxl.de/api/packages/MrSphay/generic/modrinth-plus/latest/lates
```
The Windows installer and bundled executables are Authenticode-signed with the MrTrust code-signing certificate. Users who installed MrTrust before installing Modrinth Plus should see the artifacts as signed by the trusted MrSphay certificate chain. MrTrust does not disable Defender, SmartScreen, UAC, or enterprise policy.
MrTrust itself is intentionally separate from Modrinth Plus. Download the current `MrTrust-<version>.zip` from:
```text
https://git.wilkensxl.de/MrSphay/MrTrust/releases
```
Run `MrTrust.exe` once to install trust for MrSphay-signed apps. Open it again and choose `Remove trust` to reverse that trust.