setup: the installer is our own window — the alpha key is the gate, the release comes down with it and is verified before the silent install, and the in-app tour asks for the key too

setup/src-tauri/build.rs

@@ -0,0 +1,19 @@
+//! The setup app trusts exactly what the app's updater trusts: the public
+//! key in the app's tauri.conf.json. Read at build time so there is one
+//! copy of it in the repository.
+use std::path::{Path, PathBuf};
+
+fn main() {
+    let manifest = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
+    let conf = manifest.join("../../src-tauri/tauri.conf.json");
+    println!("cargo:rerun-if-changed={}", conf.display());
+    let text = std::fs::read_to_string(&conf).expect("read src-tauri/tauri.conf.json");
+    let json: serde_json::Value = serde_json::from_str(&text).expect("parse tauri.conf.json");
+    let pubkey = json["plugins"]["updater"]["pubkey"]
+        .as_str()
+        .filter(|s| !s.is_empty())
+        .expect("plugins.updater.pubkey in src-tauri/tauri.conf.json");
+    let out = Path::new(&std::env::var("OUT_DIR").unwrap()).join("pubkey.rs");
+    std::fs::write(&out, format!("pub const PUBKEY: &str = {pubkey:?};\n")).expect("write pubkey.rs");
+    tauri_build::build();
+}