fix: retry Gitea publish through slow mainland link

.github/workflows/release.yml

@@ -130,7 +130,6 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          DSH_DESKTOP_UPDATER_PUBKEY: ${{ secrets.DSH_DESKTOP_UPDATER_PUBKEY }}
         with:
           projectPath: .
           tagName: v__VERSION__

Cargo.lock

@@ -949,7 +949,7 @@ dependencies = [
 
 [[package]]
 name = "dsh-core"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "base64 0.22.1",
  "dirs",
@@ -966,7 +966,7 @@ dependencies = [
 
 [[package]]
 name = "dsh-desktop"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "arboard",
  "dsh-core",

Cargo.toml

@@ -3,7 +3,7 @@ members = ["crates/dsh-core", "src-tauri"]
 resolver = "2"
 
 [workspace.package]
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 license = "MIT"
 authors = ["TommyFang2077"]

data/metainfo/io.github.tommyfang.DshDesktop.metainfo.xml

@@ -41,6 +41,11 @@
   <content_rating type="oars-1.1" />
 
   <releases>
+    <release version="0.1.1" date="2026-08-16">
+      <description>
+        <p>Signed in-app updater from the mainland mirror; HTTPS Gitea distribution; Market install warnings for GitHub-only sources.</p>
+      </description>
+    </release>
     <release version="0.1.0" date="2026-08-15">
       <description>
         <p>Tauri shell with an Apple-style title bar, bundled dsh, and on-launch updates.</p>

scripts/publish-gitea-release.sh

@@ -14,18 +14,41 @@ API="${GITEA_BASE_URL%/}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}"
 PACKAGE_BASE="${GITEA_BASE_URL%/}/api/packages/${GITEA_OWNER}/generic/dsh-easy-desktop-updater"
 AUTH="Authorization: token ${GITEA_TOKEN}"
 
-# The Gitea repository is a pull mirror. Sync the GitHub tag before creating
-# the matching Gitea release, then wait until the tag is queryable.
-curl --fail --silent --show-error -X POST -H "$AUTH" "$API/mirror-sync" >/dev/null
-for _ in $(seq 1 30); do
+# Retry transient gateway errors (504) coming from the front proxy while the
+# NAS reaches github.com over a mainland link: requests can stall past the
+# proxy read timeout. 404s are NOT retried here (release/package state).
+curl_retry() {
+  local attempts=0
+  while ! "$@"; do
+    attempts=$((attempts + 1))
+    if (( attempts >= 4 )); then
+      echo "curl failed after 4 attempts: $*" >&2
+      return 1
+    fi
+    echo "curl transient failure (attempt ${attempts}/3), retrying: $*" >&2
+    sleep 10
+  done
+}
+
+# The Gitea repository is a pull mirror. Kick a background sync; the trigger
+# response itself is irrelevant (it can 504 while the sync runs on Gitea).
+# The tag poll below is the actual gate.
+curl --silent --show-error -X POST -H "$AUTH" "$API/mirror-sync" >/dev/null || true
+
+# Wait (up to 10 min) until the tag has synced; then fail loudly if it never did.
+for _ in $(seq 1 60); do
   if curl --fail --silent --show-error -H "$AUTH" "$API/tags/$RELEASE_TAG" >/dev/null 2>&1; then
+    synced=1
     break
   fi
   sleep 10
 done
-curl --fail --silent --show-error -H "$AUTH" "$API/tags/$RELEASE_TAG" >/dev/null
+[[ "${synced:-0}" == 1 ]] || {
+  echo "tag $RELEASE_TAG did not appear on the Gitea mirror after 10 minutes" >&2
+  exit 1
+}
 
-release_json=$(curl --silent --show-error -H "$AUTH" "$API/releases/tags/$RELEASE_TAG")
+release_json=$(curl_retry curl --fail --silent --show-error -H "$AUTH" "$API/releases/tags/$RELEASE_TAG")
 release_id=$(printf '%s' "$release_json" | jq -r '.id // empty')
 if [[ -z "$release_id" ]]; then
   release_payload=$(jq -n \
@@ -33,7 +56,7 @@ if [[ -z "$release_id" ]]; then
     --arg name "DeepSeek Harness Desktop $RELEASE_TAG" \
     --arg body "大陆镜像安装包；文件与 GitHub Release 同源。应用内更新包由 Tauri 签名校验。" \
     '{tag_name:$tag,target_commitish:$tag,name:$name,body:$body,draft:false,prerelease:false}')
-  release_json=$(curl --fail --silent --show-error \
+  release_json=$(curl_retry curl --fail --silent --show-error \
     -X POST -H "$AUTH" -H 'Content-Type: application/json' \
     --data "$release_payload" "$API/releases")
   release_id=$(printf '%s' "$release_json" | jq -r '.id')
@@ -44,17 +67,17 @@ curl --silent --show-error -X DELETE -H "$AUTH" \
   "$PACKAGE_BASE/$RELEASE_VERSION" >/dev/null || true
 for file in "$STAGING_DIR"/*; do
   [[ -f "$file" && "$(basename "$file")" != "latest.json" ]] || continue
-  curl --fail --silent --show-error -H "$AUTH" --upload-file "$file" \
+  curl_retry curl --fail --silent --show-error -H "$AUTH" --upload-file "$file" \
     "$PACKAGE_BASE/$RELEASE_VERSION/$(basename "$file")" >/dev/null
 done
 
 # Stable updater endpoint. Gitea generic packages are immutable, so replace
 # the synthetic "latest" version on each completed release.
 curl --silent --show-error -X DELETE -H "$AUTH" "$PACKAGE_BASE/latest" >/dev/null || true
-curl --fail --silent --show-error -H "$AUTH" --upload-file "$STAGING_DIR/latest.json" \
+curl_retry curl --fail --silent --show-error -H "$AUTH" --upload-file "$STAGING_DIR/latest.json" \
   "$PACKAGE_BASE/latest/latest.json" >/dev/null
 
-assets=$(curl --fail --silent --show-error -H "$AUTH" "$API/releases/$release_id/assets")
+assets=$(curl_retry curl --fail --silent --show-error -H "$AUTH" "$API/releases/$release_id/assets")
 for file in "$STAGING_DIR"/*; do
   [[ -f "$file" ]] || continue
   name=$(basename "$file")
@@ -64,9 +87,9 @@ for file in "$STAGING_DIR"/*; do
   esac
   old_id=$(printf '%s' "$assets" | jq -r --arg name "$name" '[.[] | select(.name == $name) | .id][0] // empty')
   if [[ -n "$old_id" ]]; then
-    curl --fail --silent --show-error -X DELETE -H "$AUTH" \
+    curl_retry curl --fail --silent --show-error -X DELETE -H "$AUTH" \
       "$API/releases/$release_id/assets/$old_id" >/dev/null
   fi
-  curl --fail --silent --show-error -H "$AUTH" \
+  curl_retry curl --fail --silent --show-error -H "$AUTH" \
     -F "attachment=@$file" "$API/releases/$release_id/assets?name=$name" >/dev/null
-done
+done

scripts/setup-gitea-release.sh

@@ -76,7 +76,14 @@ gh auth status >/dev/null
 confirm '现在写入 GITEA_TOKEN 与 Tauri 签名 secrets 吗？' || exit 1
 printf '%s' "$GITEA_TOKEN" | gh secret set GITEA_TOKEN
 cat "$PRIVATE_KEY_PATH" | gh secret set TAURI_SIGNING_PRIVATE_KEY
-cat "$PUBLIC_KEY_PATH" | gh secret set DSH_DESKTOP_UPDATER_PUBKEY
+python3 - "$PUBLIC_KEY_PATH" <<'PY'
+import json, pathlib, sys
+conf = pathlib.Path("src-tauri/tauri.conf.json")
+data = json.loads(conf.read_text(encoding="utf-8"))
+data["plugins"]["updater"]["pubkey"] = pathlib.Path(sys.argv[1]).read_text(encoding="utf-8").strip()
+conf.write_text(json.dumps(data, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+PY
+echo "公钥已写入 src-tauri/tauri.conf.json（随仓库提交）"
 if [[ -n "$SIGNING_PASSWORD" ]]; then
   printf '%s' "$SIGNING_PASSWORD" | gh secret set TAURI_SIGNING_PRIVATE_KEY_PASSWORD
 fi

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "DeepSeek Harness",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "identifier": "io.github.tommyfang.DshDesktop",
   "build": {
     "frontendDist": "../ui"
@@ -17,7 +17,7 @@
   },
   "plugins": {
     "updater": {
-      "pubkey": ""
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDM1OEI5NkQwMjJCNkFDODMKUldTRHJMWWkwSmFMTlcza3Vkd1UxclQydm0xOW9MTVNxU1JIckkreWRwc1dMTm1HOVVaMHI1SysK"
     }
   },
   "bundle": {