Repository: tauri-apps/tauri
File: tooling/cli/src/build.rs (Rust)

Code before:

    let updater_bundles: Vec<&Bundle> = bundles
      .iter()
      .filter(|bundle| bundle.package_type == PackageType::Updater)
      .collect();
    // If updater is active and we bundled it
    if config_.tauri.bundle.updater.active && !updater_bundles.is_empty() {
      // if no password provided we use an empty string
      let password = var_os("TAURI_SIGNINING_PRIVATE_KEY_PASSWORD")
        .map(|v| v.to_str().unwrap().to_string())
        .or_else(|| if ci { Some("".into()) } else { None });
      // get the private key
      let secret_key = if let Some(mut private_key) =
        var_os("TAURI_SIGNINING_PRIVATE_KEY").map(|v| v.to_str().unwrap().to_string())
      {
        // check if env var points to a file..
        let pk_dir = Path::new(&private_key);
        // Check if user provided a path or a key
        // We validate if the path exist or not.
        if pk_dir.exists() {
          // read file content and use it as private key
          private_key = read_key_from_file(pk_dir)?;
        }
        updater_secret_key(private_key, password)
      } else {
        Err(anyhow::anyhow!("A public key has been found, but no private key. Make sure to set `TAURI_SIGNINING_PRIVATE_KEY` environment variable."))
      }?;

      let pubkey =
        base64::engine::general_purpose::STANDARD.decode(&config_.tauri.bundle.updater.pubkey)?;
      let pub_key_decoded = String::from_utf8_lossy(&pubkey);
      let public_key = minisign::PublicKeyBox::from_string(&pub_key_decoded)?.into_public_key()?;

      // make sure we have our package built
      let mut signed_paths = Vec::new();
      for elem in updater_bundles {
        // we expect to have only one path in the vec but we iter if we add
        // another type of updater package who require multiple file signature
        for path in elem.bundle_paths.iter() {
          // sign our path from environment variables
          let (signature_path, signature) = sign_file(&secret_key, path)?;
          if signature.keynum() != public_key.keynum() {
            return Err(anyhow::anyhow!(
              "The updater secret key from `TAURI_SIGNINING_PRIVATE_KEY` does not match the public key defined in `tauri.conf.json > tauri > updater > pubkey`."
            ));
          }
          signed_paths.append(&mut vec![signature_path]);
        }
      }

      print_signed_updater_archive(&signed_paths)?;

Review comment (suggestion):
```suggestion
        Err(anyhow::anyhow!("A public key has been found, but no private key. Make sure to set `TAURI_SIGNING_PRIVATE_KEY` environment variable."))
```

Code after:
    let bundles = bundle_project(settings)
      .map_err(|e| anyhow::anyhow!("{:#}", e))
      .with_context(|| "failed to bundle project")?;

    let updater_bundles: Vec<&Bundle> = bundles
      .iter()
      .filter(|bundle| bundle.package_type == PackageType::Updater)
      .collect();
    // If updater is active and we bundled it
    if config_.tauri.bundle.updater.active && !updater_bundles.is_empty() {
      // if no password provided we use an empty string
      let password = var_os("TAURI_SIGNING_PRIVATE_KEY_PASSWORD")
        .map(|v| v.to_str().unwrap().to_string())
        .or_else(|| if ci { Some("".into()) } else { None });
      // get the private key
      let secret_key = if let Some(mut private_key) =
        var_os("TAURI_SIGNING_PRIVATE_KEY").map(|v| v.to_str().unwrap().to_string())
      {
        // check if env var points to a file..
        let pk_dir = Path::new(&private_key);
        // Check if user provided a path or a key
        // We validate if the path exist or not.
        if pk_dir.exists() {
          // read file content and use it as private key
          private_key = read_key_from_file(pk_dir)?;
        }
        updater_secret_key(private_key, password)
      } else {
        Err(anyhow::anyhow!("A public key has been found, but no private key. Make sure to set `TAURI_SIGNING_PRIVATE_KEY` environment variable."))
      }?;

      let pubkey =
        base64::engine::general_purpose::STANDARD.decode(&config_.tauri.bundle.updater.pubkey)?;
      let pub_key_decoded = String::from_utf8_lossy(&pubkey);
      let public_key = minisign::PublicKeyBox::from_string(&pub_key_decoded)?.into_public_key()?;

      // make sure we have our package built
      let mut signed_paths = Vec::new();
      for elem in updater_bundles {
        // we expect to have only one path in the vec but we iter if we add
        // another type of updater package who require multiple file signature
        for path in elem.bundle_paths.iter() {
          // sign our path from environment variables
          let (signature_path, signature) = sign_file(&secret_key, path)?;
          if signature.keynum() != public_key.keynum() {
            return Err(anyhow::anyhow!(
              "The updater secret key from `TAURI_SIGNING_PRIVATE_KEY` does not match the public key defined in `tauri.conf.json > tauri > updater > pubkey`."
            ));
          }
          signed_paths.append(&mut vec![signature_path]);
        }