From 4120b54f0886ac162859a6942aae23c9e47af2d8 Mon Sep 17 00:00:00 2001
From: thorsten <thorsten@PC>
Date: Mon, 31 Aug 2026 16:37:33 +0200
Subject: [PATCH] Give the updater a public key to check signatures against

The placeholder left when the updater was wired up. Without it a signed
installer would still ship an app that verifies nothing it downloads,
which is the whole point of signing one.

`.gitignore` gains the keys as well. The command the documentation gives
writes the private half into the working directory, this repository is
public, and one `git add -A` is the entire distance between those two
facts.
---
 .gitignore                | 5 +++++
 src-tauri/tauri.conf.json | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 2310ee0..2599e2e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,8 @@ dist/
 .vite/
 coverage/
 *.local
+
+# Signing keys. The documented `tauri signer generate -w` writes into the working directory, and
+# this repository is public — one `git add -A` is all it would take.
+*.key
+*.key.pub
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 249a313..134e771 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -47,7 +47,7 @@
 	},
 	"plugins": {
 		"updater": {
-			"pubkey": "",
+			"pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEY3NzE5Qjg2RjZCQ0U5NDMKUldSRDZiejJocHR4OTNSSkVXWWdheWNvQ1pjcG9HUlNTSGkvTXBZTFNuWThydjM0ZkpkZUxuZUgK",
 			"endpoints": [
 				"https://github.com/thorstenalpers/OpenEventViewer/releases/latest/download/latest.json"
 			]