Make protoc writable before signing

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
           - platform: 'macos-latest' # for Intel-based Macs.
             args: '--target x86_64-apple-darwin'
             yaak_arch: 'x64'
-          - platform: 'ubuntu-22.04' # for Tauri v1, you could replace this with ubuntu-20.04.
+          - platform: 'ubuntu-22.04'
             args: ''
             yaak_arch: 'x64'
           - platform: 'windows-latest'
@@ -38,10 +38,6 @@ jobs:
         with:
           node-version: 22
 
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.22'
-
       - name: install Rust stable
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -56,7 +52,7 @@ jobs:
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
-            target/
+            src-tauri/target/
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-
 
@@ -66,6 +62,10 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
 
+      - name: install dependencies (windows only)
+        if: matrix.platform == 'windows-latest'
+        run: cargo install trusted-signing-cli
+
       - name: Install NPM Dependencies
         run: |
           npm ci
@@ -94,16 +94,24 @@ jobs:
         env:
           YAAK_PLUGINS_DIR: ${{ env.YAAK_PLUGINS_DIR }}
           YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }}
+
+          ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
-          ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+
+          # Apple signing stuff
+          APPLE_CERTIFICATE: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_ID: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_TEAM_ID: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_TEAM_ID }}
+
+          # Windows signing stuff
+          AZURE_CLIENT_ID: ${{ matrix.platform == 'windows-latest' && secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ matrix.platform == 'windows-latest' && secrets.AZURE_CLIENT_SECRET }}
+          AZURE_TENANT_ID: ${{ matrix.platform == 'windows-latest' && secrets.AZURE_TENANT_ID }}
         with:
           tagName: 'v__VERSION__'
           releaseName: 'Release __VERSION__'

package-lock.json

@@ -4929,10 +4929,9 @@
       "license": "MIT"
     },
     "node_modules/cross-spawn": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
-      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
-      "license": "MIT",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -9225,11 +9224,10 @@
       "license": "MIT"
     },
     "node_modules/npm-run-all/node_modules/cross-spawn": {
-      "version": "6.0.5",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.5.tgz",
-      "integrity": "sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==",
+      "version": "6.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.6.tgz",
+      "integrity": "sha512-VqCUuhcd1iB+dsv8gxPttb5iZh/D0iubSP21g36KXdEuf6I5JiioesUVjpCdHV9MZRUfVFlvwtIUyPfxo5trtw==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
         "nice-try": "^1.0.4",
         "path-key": "^2.0.1",
@@ -10489,11 +10487,10 @@
       }
     },
     "node_modules/react-devtools/node_modules/execa/node_modules/cross-spawn": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
-      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",

scripts/vendor-protoc.cjs

@@ -1,10 +1,10 @@
 const decompress = require('decompress');
 const Downloader = require('nodejs-file-downloader');
 const path = require('node:path');
-const { rmSync, mkdirSync, cpSync, existsSync } = require('node:fs');
+const { rmSync, mkdirSync, cpSync, existsSync, statSync, chmodSync } = require('node:fs');
 const { execSync } = require('node:child_process');
 
-const VERSION = '27.2';
+const VERSION = '28.3';
 
 // `${process.platform}_${process.arch}`
 const MAC_ARM = 'darwin_arm64';
@@ -67,6 +67,11 @@ mkdirSync(dstDir, { recursive: true });
   cpSync(includeSrc, includeDst, { recursive: true });
   rmSync(tmpDir, { recursive: true, force: true });
 
+  // Make binary writable, so we can sign it during release
+  const stat = statSync(binDst);
+  const newMode = stat.mode | 0o200;
+  chmodSync(binDst, newMode);
+
   console.log('Downloaded protoc to', binDst);
 })().catch((err) => console.log('Script failed:', err));
 

src-tauri/src/http_request.rs

@@ -243,7 +243,7 @@ pub async fn send_http_request<R: Runtime>(
 
     let request_body = rendered_request.body;
     if let Some(body_type) = &rendered_request.body_type {
-        if request_body.contains_key("query") && request_body.contains_key("variables") {
+        if body_type == "graphql" {
             let query = get_str_h(&request_body, "query");
             let variables = get_str_h(&request_body, "variables");
             let body = if variables.trim().is_empty() {
@@ -255,9 +255,6 @@ pub async fn send_http_request<R: Runtime>(
                 )
             };
             request_builder = request_builder.body(body.to_owned());
-        } else if request_body.contains_key("text") {
-            let body = get_str_h(&request_body, "text");
-            request_builder = request_builder.body(body.to_owned());
         } else if body_type == "application/x-www-form-urlencoded"
             && request_body.contains_key("form")
         {
@@ -359,6 +356,9 @@ pub async fn send_http_request<R: Runtime>(
             }
             headers.remove("Content-Type"); // reqwest will add this automatically
             request_builder = request_builder.multipart(multipart_form);
+        } else if request_body.contains_key("text") {
+            let body = get_str_h(&request_body, "text");
+            request_builder = request_builder.body(body.to_owned());
         } else {
             warn!("Unsupported body type: {}", body_type);
         }

src-tauri/tauri.conf.json

@@ -45,8 +45,8 @@
     "active": true,
     "category": "DeveloperTool",
     "externalBin": [
-      "vendored/protoc/yaakprotoc",
-      "vendored/node/yaaknode"
+      "vendored/node/yaaknode",
+      "vendored/protoc/yaakprotoc"
     ],
     "icon": [
       "icons/release/32x32.png",
@@ -79,8 +79,7 @@
       "frameworks": []
     },
     "windows": {
-      "digestAlgorithm": "sha256",
-      "timestampUrl": ""
+      "signCommand": "trusted-signing-cli -e https://eus.codesigning.azure.net/ -a Yaak -c yaakapp %1"
     }
   }
 }