From 97d0e333305d11b81d0cf1155fde91e1a84cfeb5 Mon Sep 17 00:00:00 2001
From: Steven Enamakel <enamakel@tinyhumans.ai>
Date: Thu, 26 Mar 2026 17:55:31 -0700
Subject: [PATCH] chore: update Tauri signing keys and enhance macOS release
 workflow

- Modified the Tauri signing key configuration in the GitHub Actions workflow to allow fallback to an updater private key if the primary key is not set.
- Added comments in the release workflow to clarify the handling of app binaries and feature-gated helper binaries for macOS codesigning.
- Updated the public key in the Tauri configuration for the updater plugin to a new value for improved security.
---
 .github/workflows/release.yml | 8 ++++++--
 src-tauri/tauri.conf.json     | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 79f638d1f..4ad6d7726 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -308,11 +308,15 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           BASE_URL: ${{ vars.BASE_URL }}
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY || secrets.UPDATER_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD || secrets.UPDATER_PRIVATE_KEY_PASSWORD }}
           WITH_UPDATER: 'true'
           MACOSX_DEPLOYMENT_TARGET: ${{ matrix.settings.platform == 'macos-latest' && '10.15' || '' }}
         with:
+          # Keep only the app binary in the .app bundle by default.
+          # Helper bins (openhuman-tools-discovery/openhuman-core/openhuman-cli)
+          # are feature-gated in Cargo.toml to prevent unsigned subcomponents
+          # from breaking macOS codesign during release packaging.
           args: -c ${{ steps.config-overrides.outputs.json }} ${{ matrix.settings.args }}
           includeDebug: false
           includeRelease: true
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index b8baead71..c0d728c2d 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -51,7 +51,7 @@
   },
   "plugins": {
     "updater": {
-      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEVBMjYzN0QxNjE4MjYzQzgKUldUSVk0SmgwVGNtNnJnNkFrZnloeDVUME1CczNDS3lMQ1hWVkxlVldCdjRCUFozYjFSekpVNWwK",
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDA1NkI1NEQzNjVDMjA0NDgKUldSSUJNSmwwMVJyQmJCTnQrQWxPSmhZQmVyWU1NMXdwRlRCSHR0ZEdlbkRncCtpQnhaZU5rUEQK",
       "endpoints": [
         "https://github.com/tinyhumansai/openhuman/releases/latest/download/latest.json"
       ]