fix(updater): make pubkey optional in tauri config, check if set at runtime (fixes #2438)

plugins/updater/src/config.rs

@@ -98,7 +98,7 @@ pub struct Config {
     /// Updater endpoints.
     pub endpoints: Vec<Url>,
     /// Signature public key.
-    pub pubkey: String,
+    pub pubkey: Option<String>,
     /// The Windows configuration for the updater.
     pub windows: Option<WindowsConfig>,
 }
@@ -119,7 +119,7 @@ impl<'de> Deserialize<'de> for Config {
             pub dangerous_accept_invalid_hostnames: bool,
             #[serde(default)]
             pub endpoints: Vec<Url>,
-            pub pubkey: String,
+            pub pubkey: Option<String>,
             pub windows: Option<WindowsConfig>,
         }
 

plugins/updater/src/error.rs

@@ -9,6 +9,8 @@ use thiserror::Error;
 #[derive(Debug, Error)]
 #[non_exhaustive]
 pub enum Error {
+    #[error("Updater pubkey was not found in tauri config nor set at runtime.")]
+    MissingPubKey,
     /// Endpoints are not sent.
     #[error("Updater does not have any endpoints set.")]
     EmptyEndpoints,

plugins/updater/src/lib.rs

@@ -215,9 +215,18 @@ impl Builder {
         PluginBuilder::<R, Config>::new("updater")
             .setup(move |app, api| {
                 let mut config = api.config().clone();
-                if let Some(pubkey) = pubkey {
+
+                if config.pubkey.is_none() && pubkey.is_none() {
+                    return Err(Box::new(Error::MissingPubKey));
+                } else if pubkey.is_some() {
+                    if config.pubkey.is_some() {
+                        log::warn!(
+                            "Updater pubkey set at runtime will overwrite the config pubkey."
+                        );
+                    };
                     config.pubkey = pubkey;
-                }
+                };
+
                 if let Some(windows) = &mut config.windows {
                     windows.installer_args.extend(installer_args);
                 }

plugins/updater/src/updater.rs

@@ -243,7 +243,7 @@ impl UpdaterBuilder {
     }
 
     pub fn pubkey<S: Into<String>>(mut self, pubkey: S) -> Self {
-        self.config.pubkey = pubkey.into();
+        self.config.pubkey = Some(pubkey.into());
         self
     }
 
@@ -685,7 +685,11 @@ impl Update {
         }
         on_download_finish();
 
-        verify_signature(&buffer, &self.signature, &self.config.pubkey)?;
+        let pubkey = match &self.config.pubkey {
+            Some(pk) => pk,
+            None => return Err(Error::MissingPubKey),
+        };
+        verify_signature(&buffer, &self.signature, pubkey)?;
 
         Ok(buffer)
     }