Repository navigation
feat(update): 增加应用内更新与各平台一键安装脚本 - #9
Merged
Merged
Conversation
- 核心新增 Updater port 与更新状态机：检查、下载进度、验签、安装后重启；自动检查默认关闭 - 外壳用 tauri-plugin-updater 实现，只有从安装包运行的副本可用；开启 requireSignedVersion 防止降级 - 发布时签名每个安装包，latest.json 按安装方式给出平台键（deb、rpm、AppImage、nsis、msi、app） - scripts/install.sh 与 install.ps1：Linux、macOS、Windows 一键安装并校验 SHA256SUMS，附离线测试与真实 runner 工作流 - deny.toml 只允许经 tauri-plugin-updater 引入 HTTP 与 TLS；文档中“从不联网”的说法改为准确表述
- 匿名 API 按 IP 限流，macOS runner 上返回 403；共用出口 IP 的网络同样会遇到 - 改为下载 releases/latest/download/SHA256SUMS，从安装包文件名中读出版本号
Merged
sunerpy
pushed a commit
that referenced
this pull request
Oct 1, 2026
- Features: 增加应用内更新与各平台一键安装脚本 (#9)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
参考 Voltip，给 Lockra 加上应用内更新和各平台的一键安装脚本。
应用内更新
lockra-core（Updaterport，暂停时钟 + fake 测试）；外壳用tauri-plugin-updater =2.12.0实现，网络请求全部在 Rust 侧，webview 没有插件权限，CSP 不变。.app里），源码构建的副本会说明无法更新，不会替换自身。tauri.conf.json，私钥与密码已设为仓库 secret）；requireSignedVersion要求签名里的版本等于清单宣布的版本，拒绝“旧包冒充新版本”的降级。安装前先写入防抖中的自动备份。发布侧
latest.json除了每个目标的{os}-{arch}，还为每个已签名的包写{os}-{arch}-{安装方式}键。插件先按安装方式查找：只写{os}-{arch}时，用.deb安装的副本会下载 AppImage 并以InvalidUpdaterFormat失败（v0.1.1 的 deb 里实测含__TAURI_BUNDLE_TYPE_VAR_DEB）。这个修复做在 github-project-scaffold 模板里，tauri-release.py与模板保持一致。make linux-x64/windows-x64在没有私钥时不签名（--config关掉 updater 产物）。一键安装
scripts/install.sh（Linux x64/ARM64：有 apt 用 deb，有 dnf/zypper/yum 用 rpm，否则 AppImage；macOS：对应芯片的 dmg，Rosetta 下也选 Apple 芯片）与scripts/install.ps1（Windows x64/ARM64，按用户静默安装），都先校验SHA256SUMS，不符则不安装。scripts/test-install.sh（假 GitHub、假包管理器，14 种情况）与scripts/test-install.ps1（pwsh，替换联网与注册表 cmdlet），两者都做过变异检查；接进 CI 的 Repository gates 与make check。install-scripts.yml在真实 runner 上对最新正式版运行：Ubuntu x64/ARM64（apt 与 AppImage）、Fedora（dnf）、macOS、Windows x64/ARM64（irm | iex方式）。非必需检查。依赖与文档
deny.toml原本禁止任何 HTTP/TLS crate；现在只允许经tauri-plugin-updater引入（wrappers），其他 crate 引入仍会失败。docs/security.md、docs/release.md、docs/architecture.md：所有“从不联网”改为“只在检查更新时连接 GitHub”，写明检查发送什么、信任链和残余风险；新增docs/acceptance/updates.md。验证
make check全部通过（crates 行覆盖率 97.96%，update.rs100%；web 三个包 ≥98%）；cargo deny check licenses bans sources advisories通过。make smoke-update：两个 release AppImage（9.0.0 → 9.0.1，临时密钥）在 Xvfb 下真实升级，磁盘上的 AppImage 被替换为 9.0.1，Lockra 从新文件重启。docs/acceptance/updates.md列出手动步骤）。0.1.x 没有更新器，0.2.0 起才能应用内升级。🤖 Generated with Claude Code