Windows updates come from the Kestrove website; version 1.2.1

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/gitea-release.sh

@@ -1,17 +1,11 @@
 #!/bin/sh
-# Creates (or reuses) the Gitea release for this version, uploads the desktop bundles to it, and writes
-# updater/latest.json, which the Windows app checks for updates (src-tauri/src/updates.rs).
+# Creates (or reuses) the Gitea release for this version and uploads the desktop bundles to it. The website's
+# downloads and the Windows app's updates come from scripts/publish-update.sh instead.
 #
-#   GITEA_TOKEN=… TAURI_SIGNING_PRIVATE_KEY_PATH=… scripts/gitea-release.sh [dir-with-files]   (default ../release/desktop)
+#   GITEA_TOKEN=… scripts/gitea-release.sh [dir-with-files]   (default ../release/desktop)
 #
 # GITEA_TOKEN: a Gitea access token with the write:repository scope (Settings → Applications). The tag
 # v<version> must already be pushed. Files: *.AppImage, *.deb, *.rpm, *-setup.exe, kestrove-nmh-*, SHA256SUMS.
-#
-# Updates: the Windows installer needs an updater signature (<installer>.sig) from the Kestrove updater key, whose
-# public half is in src-tauri/tauri.conf.json. Sign after Authenticode signing: the signature covers the final
-# file. With TAURI_SIGNING_PRIVATE_KEY_PATH set, a missing .sig is made here (the key's password is asked for, or
-# read from TAURI_SIGNING_PRIVATE_KEY_PASSWORD). Optional NOTES: the text shown with the update.
-# Users get the update only once updater/latest.json is committed and pushed to main (printed at the end).
 set -eu
 cd "$(dirname "$0")/.."
 : "${GITEA_TOKEN:?set GITEA_TOKEN (Gitea → Settings → Applications → token with write:repository)}"
@@ -21,15 +15,6 @@ DIR=${1:-../release/desktop}
 V=$(node -p 'require("./package.json").version')
 TAG="v$V"
 AUTH="Authorization: token $GITEA_TOKEN"
-SETUP="$DIR/Kestrove_${V}_x64-setup.exe"
-
-if [ -f "$SETUP" ] && [ ! -f "$SETUP.sig" ]; then
-  : "${TAURI_SIGNING_PRIVATE_KEY_PATH:?$SETUP.sig is missing: set TAURI_SIGNING_PRIVATE_KEY_PATH to the updater key to sign it}"
-  # --app-version binds the signature to this version (the app requires it), so an older signed installer can't
-  # be offered again under a newer version number.
-  npx tauri signer sign -f "$TAURI_SIGNING_PRIVATE_KEY_PATH" ${TAURI_SIGNING_PRIVATE_KEY_PASSWORD+-p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD"} \
-    --app-version "$V" "$SETUP"
-fi
 
 (cd "$DIR" && rm -f SHA256SUMS && for f in *.AppImage *.deb *.rpm *-setup.exe kestrove-nmh-*; do if [ -f "$f" ]; then shasum -a 256 -- "$f"; fi; done > SHA256SUMS; cat SHA256SUMS)
 
@@ -45,16 +30,3 @@ for f in "$DIR"/*.AppImage "$DIR"/*.deb "$DIR"/*.rpm "$DIR"/*-setup.exe "$DIR"/*
 done
 echo "Release: ${API%/api/v1}/$REPO/releases/tag/$TAG"
 
-# The update manifest, written only after the installer it points to is uploaded.
-if [ -f "$SETUP.sig" ]; then
-  mkdir -p updater
-  node -e '
-    const [v, url, sigFile, notes] = process.argv.slice(1);
-    const signature = require("fs").readFileSync(sigFile, "utf8").trim();
-    const doc = { version: v, notes, pub_date: new Date().toISOString().replace(/\.\d+Z$/, "Z"),
-      platforms: { "windows-x86_64": { signature, url } } };
-    require("fs").writeFileSync("updater/latest.json", JSON.stringify(doc, null, 2) + "\n");
-  ' "$V" "${API%/api/v1}/$REPO/releases/download/$TAG/$(basename "$SETUP")" "$SETUP.sig" "${NOTES:-Kestrove $V}"
-  echo "Wrote updater/latest.json. To offer the update, commit it and push to main:"
-  echo "  git add updater/latest.json && git commit -m \"Offer $V as an update\" && git push origin main"
-fi

scripts/publish-update.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+# Puts the Windows installer on the Kestrove website and offers it as an update: signs it with the updater key if
+# needed, copies it to the website's downloads/, and writes the website's updates/latest.json, which the app checks
+# (src-tauri/src/updates.rs).
+#
+#   TAURI_SIGNING_PRIVATE_KEY_PATH=… scripts/publish-update.sh [dir-with-installer]   (default ../release/desktop)
+#
+# Sign after Authenticode signing: the updater signature covers the final file. The key's password is asked for,
+# or read from TAURI_SIGNING_PRIVATE_KEY_PASSWORD. Optional NOTES: the text shown with the update. Optional
+# WEBSITE_DIR: the website folder (default ../kestrove-website). Users get the update once the website is deployed.
+set -eu
+cd "$(dirname "$0")/.."
+DIR=${1:-../release/desktop}
+SITE=${WEBSITE_DIR:-../kestrove-website}
+V=$(node -p 'require("./package.json").version')
+NAME="Kestrove_${V}_x64-setup.exe"
+SETUP="$DIR/$NAME"
+[ -f "$SETUP" ] || { echo "$SETUP not found" >&2; exit 1; }
+
+if [ ! -f "$SETUP.sig" ]; then
+  : "${TAURI_SIGNING_PRIVATE_KEY_PATH:?$SETUP.sig is missing: set TAURI_SIGNING_PRIVATE_KEY_PATH to the updater key to sign it}"
+  # --app-version binds the signature to this version (the app requires it), so an older signed installer can't
+  # be offered again under a newer version number.
+  npx tauri signer sign -f "$TAURI_SIGNING_PRIVATE_KEY_PATH" ${TAURI_SIGNING_PRIVATE_KEY_PASSWORD+-p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD"} \
+    --app-version "$V" "$SETUP"
+fi
+
+mkdir -p "$SITE/downloads" "$SITE/updates"
+cp "$SETUP" "$SITE/downloads/$NAME"
+node -e '
+  const [out, v, url, sigFile, notes] = process.argv.slice(1);
+  const signature = require("fs").readFileSync(sigFile, "utf8").trim();
+  const doc = { version: v, notes, pub_date: new Date().toISOString().replace(/\.\d+Z$/, "Z"),
+    platforms: { "windows-x86_64": { signature, url } } };
+  require("fs").writeFileSync(out, JSON.stringify(doc, null, 2) + "\n");
+' "$SITE/updates/latest.json" "$V" "https://kestrove.samialabri.com/downloads/$NAME" "$SETUP.sig" "${NOTES:-Kestrove $V}"
+echo "Copied $NAME to $SITE/downloads and wrote $SITE/updates/latest.json. Deploy the website to offer the update."