Repository: tauri-apps/tauri
File: tooling/cli/src/build.rs (Rust)

Code before:
        // We validate if the path exist or not.
        if pk_dir.exists() {
          // read file content and use it as private key
          private_key = read_key_from_file(pk_dir)?;
        }
        updater_secret_key(private_key, password)
      } else {
        Err(anyhow::anyhow!("A public key has been found, but no private key. Make sure to set `TAURI_SIGNINING_PRIVATE_KEY` environment variable."))
      }?;

      let pubkey =
        base64::engine::general_purpose::STANDARD.decode(&config_.tauri.bundle.updater.pubkey)?;
      let pub_key_decoded = String::from_utf8_lossy(&pubkey);
      let public_key = minisign::PublicKeyBox::from_string(&pub_key_decoded)?.into_public_key()?;

      // make sure we have our package built
      let mut signed_paths = Vec::new();
      for elem in updater_bundles {
        // we expect to have only one path in the vec but we iter if we add
        // another type of updater package who require multiple file signature
        for path in elem.bundle_paths.iter() {
          // sign our path from environment variables
          let (signature_path, signature) = sign_file(&secret_key, path)?;
          if signature.keynum() != public_key.keynum() {
            return Err(anyhow::anyhow!(
              "The updater secret key from `TAURI_SIGNINING_PRIVATE_KEY` does not match the public key defined in `tauri.conf.json > tauri > updater > pubkey`."
            ));
          }
          signed_paths.append(&mut vec![signature_path]);
        }
      }

      print_signed_updater_archive(&signed_paths)?;
    }
  }

  Ok(())
}

pub fn setup(target: Target, options: &mut Options, mobile: bool) -> Result<AppInterface> {
  let (merge_config, merge_config_path) = resolve_merge_config(&options.config)?;
  options.config = merge_config;

  let config = get_config(target, options.config.as_deref())?;

  let tauri_path = tauri_dir();
  set_current_dir(tauri_path).with_context(|| "failed to change current working directory")?;

  let config_guard = config.lock().unwrap();
  let config_ = config_guard.as_ref().unwrap();


Review comment (security):
```suggestion
              "The updater secret key from `TAURI_SIGNING_PRIVATE_KEY` does not match the public key defined in `tauri.conf.json > tauri > updater > pubkey`."
```

Code after:
        // check if env var points to a file..
        let pk_dir = Path::new(&private_key);
        // Check if user provided a path or a key
        // We validate if the path exist or not.
        if pk_dir.exists() {
          // read file content and use it as private key
          private_key = read_key_from_file(pk_dir)?;
        }
        updater_secret_key(private_key, password)
      } else {
        Err(anyhow::anyhow!("A public key has been found, but no private key. Make sure to set `TAURI_SIGNING_PRIVATE_KEY` environment variable."))
      }?;

      let pubkey =
        base64::engine::general_purpose::STANDARD.decode(&config_.tauri.bundle.updater.pubkey)?;
      let pub_key_decoded = String::from_utf8_lossy(&pubkey);
      let public_key = minisign::PublicKeyBox::from_string(&pub_key_decoded)?.into_public_key()?;

      // make sure we have our package built
      let mut signed_paths = Vec::new();
      for elem in updater_bundles {
        // we expect to have only one path in the vec but we iter if we add
        // another type of updater package who require multiple file signature
        for path in elem.bundle_paths.iter() {
          // sign our path from environment variables
          let (signature_path, signature) = sign_file(&secret_key, path)?;
          if signature.keynum() != public_key.keynum() {
            return Err(anyhow::anyhow!(
              "The updater secret key from `TAURI_SIGNING_PRIVATE_KEY` does not match the public key defined in `tauri.conf.json > tauri > updater > pubkey`."
            ));
          }
          signed_paths.append(&mut vec![signature_path]);
        }
      }

      print_signed_updater_archive(&signed_paths)?;
    }
  }

  Ok(())
}

pub fn setup(target: Target, options: &mut Options, mobile: bool) -> Result<AppInterface> {
  let (merge_config, merge_config_path) = resolve_merge_config(&options.config)?;
  options.config = merge_config;

  let config = get_config(target, options.config.as_deref())?;

  let tauri_path = tauri_dir();
  set_current_dir(tauri_path).with_context(|| "failed to change current working directory")?;