Private updates with Github Releases

[khrykin]

Hey, looking for some help regarding the self-updater. I've found some older discussions but not sure how relevant they are still.

Is it currently possible to use a private repo's Github Releases for self-updates? We don't want to expose the app binaries to the public. There's a way to pass a header to the updater e.g. Authorization, but as GitHub API doesn't provide an endpoint for one of the latest release's assets (We need latest.json), one needs to perform two requests - first fetch the latest release endpoint; find the asset id, and then fetch the asset endpoint using that id. And as I understand, currently you can only provide a list of endpoints that directly respond with latest.json in tauri.conf.json. Moreover, if using tauri-action, latest.json mentions only browser download links for the assets, and you can't authenticate those with an access token.

From the docs, it seems that the only option here is to spin up a proxy server that would implement obtaining latest.json with a single request - but we'd like to avoid it if possible. Am I missing something here?

Thanks!

[CalvinWilkinson]

I am running into this same issue as well.

I understand that we can have a proxy/middleware server that we can have the Tauri updater endpoint point to, but that server still returns a URL that is consumed by the updater, and that URL cannot be authenticated.

Everybody out there is saying that we can add the binaries as assets to a public repo release. But I have mentioned that this does not solve the problem. The repo is public and the assets are as well, so this doesn't solve anything.

I am not getting any straight answers from anybody either. My client requires that these build assets and binaries NOT be public and I do not blame them.

@khrykin Have you been able to solve this?

[EFeru]

@khrykin @CalvinWilkinson any progress on this? Indeed the tauri expects to use the links in the latest.json. However the download links cannot be authenticated for private repos. We need to use api requests, and GET the assets by id... All in all I see a lot of workarounds in tauri backend.
I really hope that the tauri team will find providing updates from private repos as important as providing updates from public repos.

[khrykin]

We ended up having a proxy server to authenticate requests with a GitHub access token and checking for updates manually 🤷🏻‍♂️ I haven't checked if things have changed since v2.

[CalvinWilkinson]

I have done the same. I made my own proxy server using deno and deno deploy, and it works great. More work but we have control.

[EFeru]

@CalvinWilkinson @khrykin I am happy to hear you found a solution. Do you mind sharing some information with me? Mainly I am interested on:

• How did you set it up? Tauri first needs a file latest.json, inside there are download links. How did you manage the requests Tauri <-> Deno <-> Github communication including authentification?
• And where do you run Deno? Do you have something like a Raspberry pi or something more involved?

I would really appreciation some details since is the first time I hear about Deno.

[CalvinWilkinson]

Sure!!

I have the "proxy server" running in deno deploy.

As for how it works, the proxy server has 2 endpoints. One of them is for the actual download that is used by Tauri
to download the asset.

The other endpoint is just for getting the meta-data expected by Tauri so it can make the decision
if there is an update available or not. Based on the response requirements of Tauri, I return the different
build targets. For example, my response back to the app is for Windows, macOS silicon, and macOS x64.

I use the GitHub API to be able to get information about the release for version and asset information.
To be honest, I use my own deno library called kd_clients
which I use all over the place for CICD, and more for my client. Of course, that is up to your needs and
requirements.

Using the latest.json is one way to do it. But instead I just used the other response method from the Tauri
docs so I could get more control. The method that I am using is directly for dynamic update servers which is
what I built.

All the info is in the docs, it is just about putting it all together.

Tauri will reach out to the server via settings in the tauri.conf.json.

"plugins": {
    "updater": {
        "pubkey": "E3cE5kT2VVTUVFWG8K",
        "endpoints": [
            "https://my-dynamic-update-server/latest-release-meta-data"
        ]
    }
}

I also run the update manually instead of using automatic. The setup section gives more info about this.

I would share source code with you to get you up and running, but I cannot do that due to the client.

I hope this helps!!

Also, definitly check out deno, you will not be disappointed. Very very good runtime and I use it for everything now.

[EFeru]

Hi @CalvinWilkinson ,

Thanks to your response, I decided to dig further and manage to get Tauri V2 Updater working with Deno proxy. Here are the full instructions:
https://github.com/EFeru/tauri-deno-updater/

Deno project code:
https://github.com/EFeru/tauri-deno-updater/blob/main/server.ts

[CalvinWilkinson]

Awesome!! Glad you got something working.