chore(release): v1.34.22 — fix truncated updater pubkey

A character was lost when the base64-encoded minisign public key was
transcribed into tauri.conf.json, producing a 41-byte decoded key
instead of the required 42 bytes. Every release built against that key
(v1.34.15 through v1.34.21) rejects any update manifest signature with
"Invalid encoding in minisign data". Replaced with the correct pubkey
read directly from ~/.tauri/psysonic-updater.key.pub.

v1.34.19 installed manually for testing cannot receive auto-updates
because the broken pubkey is baked into its binary; a fresh v1.34.22
install is required as the base for the updater test.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -83,8 +83,10 @@ jobs:
             args: '--target aarch64-apple-darwin'
           - platform: 'macos-latest'
             args: '--target x86_64-apple-darwin'
-          - platform: 'windows-latest'
-            args: '--bundles nsis'
+          # TEMPORARILY DISABLED during macOS updater testing — faster turnaround.
+          # Re-add before the next public release.
+          # - platform: 'windows-latest'
+          #   args: '--bundles nsis'
     runs-on: ${{ matrix.settings.platform }}
     steps:
       - uses: actions/checkout@v5
@@ -128,25 +130,38 @@ jobs:
         with:
           releaseId: ${{ needs.create-release.outputs.release_id }}
           args: ${{ matrix.settings.args }}
-      - name: upload updater signature (macOS only)
+      - name: re-sign updater bundle + upload .sig (macOS only)
+        # tauri-action re-packs the .app into .app.tar.gz after tauri CLI is
+        # done, which invalidates the .sig tauri CLI created (different hash).
+        # We can't stop the repack (it's tied to includeUpdaterJson), so we
+        # sign the final repacked .tar.gz ourselves and upload the fresh .sig.
         if: runner.os == 'macOS'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
+          set -e
           VERSION=${{ needs.create-release.outputs.package_version }}
-          SIG=$(find src-tauri/target -path '*/release/bundle/macos/*.app.tar.gz.sig' | head -1)
-          if [ -z "$SIG" ]; then
-            echo "::error::No .sig file found under src-tauri/target/*/release/bundle/macos/"
+          TARGET_ARG='${{ matrix.settings.args }}'
+          if echo "$TARGET_ARG" | grep -q 'aarch64'; then
+            TARGET="aarch64-apple-darwin"
+            ARCH="aarch64"
+          else
+            TARGET="x86_64-apple-darwin"
+            ARCH="x64"
+          fi
+          TARBALL="src-tauri/target/${TARGET}/release/bundle/macos/Psysonic.app.tar.gz"
+          if [ ! -f "$TARBALL" ]; then
+            echo "::error::Expected tarball missing: $TARBALL"
+            ls -la "$(dirname "$TARBALL")" || true
             exit 1
           fi
-          echo "Found signature: $SIG"
-          if echo "$SIG" | grep -q 'aarch64-apple-darwin'; then
-            DST="Psysonic_aarch64.app.tar.gz.sig"
-          else
-            DST="Psysonic_x64.app.tar.gz.sig"
-          fi
-          cp "$SIG" "$DST"
-          gh release upload "app-v${VERSION}" "$DST" --clobber
+          npx @tauri-apps/cli signer sign "$TARBALL"
+          cp "${TARBALL}.sig" "Psysonic_${ARCH}.app.tar.gz.sig"
+          gh release upload "app-v${VERSION}" \
+            "Psysonic_${ARCH}.app.tar.gz.sig" \
+            --clobber
 
   generate-manifest:
     needs: [create-release, build-macos-windows]
@@ -168,6 +183,9 @@ jobs:
           gh release upload "app-v${VERSION}" latest.json --clobber
 
   build-linux:
+    # TEMPORARILY DISABLED during macOS updater testing — faster turnaround.
+    # Re-enable by removing `if: false` before the next public release.
+    if: false
     needs: create-release
     permissions:
       contents: write
@@ -223,6 +241,11 @@ jobs:
   #
   # The refreshed lock/hash files are committed back to `main` when they change.
   verify-nix:
+    # TEMPORARILY DISABLED during the v1.34.x testing iteration (signing +
+    # updater stabilisation). Remove `if: false` to re-enable — it auto-commits
+    # flake.lock / npmDepsHash refreshes to main on every release, which causes
+    # rebase friction while we're iterating fast on the release pipeline.
+    if: false
     needs: create-release
     runs-on: ubuntu-24.04
     permissions:

CHANGELOG.md

@@ -9,6 +9,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 >
 > **🎉 macOS users:** Starting with **v1.34.15**, Psysonic can **update itself silently**. No more DMG downloading and dragging to Applications — the updater fetches the signed `.app` bundle, verifies the signature, replaces the app in place, and relaunches. Just click "Update" when the toast appears.
 
+## [1.34.22] - 2026-04-18
+
+> ### ⚠️ PLEASE IGNORE — TEST BUILD ONLY
+>
+> Corrects the minisign public key in the bundle. The earlier releases had a character lost in transmission, which made the embedded pubkey one byte short and therefore invalid — any auto-update attempt failed with "Invalid encoding in minisign data". This rebuild has the correct key. Test builds will be deleted soon.
+
+## [1.34.21] - 2026-04-18
+
+> ### ⚠️ PLEASE IGNORE THIS RELEASE — TEST BUILD ONLY
+>
+> **This is a throwaway test build used to verify the macOS auto-updater pipeline end-to-end. There are no new features, no bug fixes, no changes of any kind that affect how Psysonic behaves for end users — only the version number, plus a small UI polish in the update notification on macOS.**
+>
+> **This release will be deleted within a day or two.** Do not download it, do not rely on it, do not link to it. Stay on whatever version you currently have installed; normal releases will resume shortly under the regular versioning scheme.
+>
+> Thanks for your patience while we stabilise the updater infrastructure.
+
+## [1.34.20] - 2026-04-18
+
+> ### ⚠️ PLEASE IGNORE THIS RELEASE — TEST BUILD ONLY
+>
+> **This is a throwaway test build used to verify the macOS auto-updater pipeline end-to-end. There are no new features, no bug fixes, no changes of any kind that affect how Psysonic behaves — only the version number is different.**
+>
+> **This release will be deleted within a day or two.** Do not download it, do not rely on it, do not link to it. Stay on whatever version you currently have installed; normal releases will resume shortly under the regular versioning scheme.
+>
+> Thanks for your patience while we stabilise the updater infrastructure.
+
 ## [1.34.16] - 2026-04-18
 
 ### Fixed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "psysonic",
-  "version": "1.34.16",
+  "version": "1.34.22",
   "private": true,
   "scripts": {
     "dev": "vite",

src-tauri/Cargo.lock

@@ -3653,7 +3653,7 @@ dependencies = [
 
 [[package]]
 name = "psysonic"
-version = "1.34.16"
+version = "1.34.22"
 dependencies = [
  "biquad",
  "discord-rich-presence",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "psysonic"
-version = "1.34.16"
+version = "1.34.22"
 description = "Psysonic Desktop Music Player"
 authors = []
 license = ""

src-tauri/patches/cpal-0.15.3/src/host/coreaudio/macos/mod.rs

@@ -33,7 +33,6 @@ use std::fmt;
 use std::mem;
 use std::os::raw::c_char;
 use std::ptr::null;
-use std::rc::Rc;
 use std::slice;
 use std::sync::mpsc::{channel, RecvTimeoutError};
 use std::sync::{Arc, Mutex};

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Psysonic",
-  "version": "1.34.16",
+  "version": "1.34.22",
   "identifier": "dev.psysonic.player",
   "build": {
     "beforeDevCommand": "npm run dev",
@@ -33,7 +33,7 @@
   },
   "plugins": {
     "updater": {
-      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDhCNzk5MUNCRDQ4N0UwODgKUldTSTRJZlV5NUY1aThucWM3RTh4ZmpwblR1amh4R2lER3NjZDgrQTQwVGNFaWFtVStsUWFjOQo=",
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDhCNzk5MUNCRDQ4N0UwODgKUldTSTRJZlV5NUY1aThucWM3RTh4ZmpwblR1amh4R2lER3NjZDgrQTQwVGNFaWFtVStsUVBhYzkK",
       "endpoints": [
         "https://github.com/Psychotoxical/psysonic/releases/latest/download/latest.json"
       ],

src/components/AppUpdater.tsx

@@ -159,6 +159,10 @@ export default function AppUpdater() {
 
   const asset = pickAsset(release.assets);
   const showAurHint = IS_LINUX && isArch;
+  // On macOS the Tauri Updater handles architecture, signature verification
+  // and in-place install — we don't need (and should not show) a DMG asset.
+  const useTauriUpdater = IS_MACOS;
+  const showInstallBtn = !showAurHint && (useTauriUpdater || !!asset);
 
   const handleSkip = () => {
     localStorage.setItem(SKIP_KEY, release.version);
@@ -309,6 +313,40 @@ export default function AppUpdater() {
               <code className="update-modal-aur-cmd">yay -S psysonic-bin</code>
               <code className="update-modal-aur-cmd update-modal-aur-alt">sudo pacman -Syu psysonic-bin</code>
             </div>
+          ) : useTauriUpdater ? (
+            <>
+              {dlState === 'idle' && (
+                <div className="update-modal-asset">
+                  <span className="update-modal-asset-name">
+                    {t('common.updaterMacReady', {
+                      defaultValue: 'Downloads, verifies and installs automatically. The app will restart when done.',
+                    })}
+                  </span>
+                </div>
+              )}
+              {dlState === 'downloading' && (
+                <div className="update-modal-progress">
+                  <div className="app-updater-progress-bar">
+                    <div className="app-updater-progress-fill" style={{ width: `${pct}%` }} />
+                  </div>
+                  <span className="app-updater-pct">{pct}%</span>
+                  <span className="update-modal-dl-bytes">
+                    {fmtBytes(dlProgress.bytes)}
+                    {dlProgress.total > 0 && ` / ${fmtBytes(dlProgress.total)}`}
+                  </span>
+                </div>
+              )}
+              {dlState === 'done' && (
+                <div className="update-modal-done">
+                  <div className="update-modal-done-title">
+                    {t('common.updaterMacDone', { defaultValue: 'Installed. Restarting…' })}
+                  </div>
+                </div>
+              )}
+              {dlState === 'error' && (
+                <div className="app-updater-error">{dlError || t('common.updaterErrorMsg')}</div>
+              )}
+            </>
           ) : asset ? (
             <>
               {dlState === 'idle' && (
@@ -365,10 +403,12 @@ export default function AppUpdater() {
           <button className="btn btn-surface" onClick={() => setDismissed(true)}>
             {t('common.updaterRemindBtn')}
           </button>
-          {!showAurHint && asset && dlState === 'idle' && (
+          {showInstallBtn && dlState === 'idle' && (
             <button className="btn btn-primary" onClick={handleDownload}>
               <Download size={14} />
-              {t('common.updaterDownloadBtn')}
+              {useTauriUpdater
+                ? t('common.updaterInstallNow', { defaultValue: 'Install now' })
+                : t('common.updaterDownloadBtn')}
             </button>
           )}
           {dlState === 'error' && (