feat(record-release): forward the Tauri updater signature as asset metadata (#105)

Part of the multipass-desktop in-app auto-update feature. Design:
ductone/multipass#553; app: ductone/multipass#554.

`record-release` reads `manifest.json` and POSTs a RecordRelease request
to the registry ingest endpoint; this forwards the updater bundle's
minisign signature so it reaches the registry as per-asset metadata.

## Changes
- `proto/artifacts/v1/manifest.proto`: `string updater_signature = 10;`
on `Asset` (JSON `updaterSignature`). Regenerated bindings.
- `cmd/record-release/main.go`: map `updaterSignature` → the request's
`assets[].metadata["updater.signature"]` (only for the asset that
carries it).
- Tests added. Also confirmed `cmd/merge-manifests` round-trips assets
through the proto with `DiscardUnknown`, so the proto field is what
preserves the signature through the merge → record-release chain (no
change needed there).

## Codegen
`buf generate proto` with the plugin version referenced in the proto
header (protocolbuffers/go v1.36.10); reverted an unrelated `buf format`
reordering to keep the diff minimal.

## Verified
`go build`/`vet`/`test ./...` all pass.

The registry ingest maps JSON `assets[].metadata` →
`registry.v1.Asset.metadata` server-side (the paired `metadata` field in
ductone/connector-registry-api). Pairs with generate-dist-manifest
(multipass-workflows) and the mirror allowlist.

---------

Co-authored-by: Giancarlo Silvestrin <giancarlo.silvestrin@conductorone.com>
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

cmd/record-release/main.go

@@ -50,8 +50,18 @@ type ReleaseAsset struct {
 	CertificateURL string                `json:"certificateUrl,omitempty"`
 	SbomURL        string                `json:"sbomUrl,omitempty"`
 	Attestations   []*ReleaseAttestation `json:"attestations,omitempty"`
+	// Metadata carries free-form, per-asset key/value pairs that the registry
+	// stores on registry.v1.Asset.metadata. Currently used to forward the Tauri
+	// updater bundle's minisign signature under updaterSignatureMetadataKey.
+	// Left nil (and omitted from JSON) for assets without any metadata.
+	Metadata map[string]string `json:"metadata,omitempty"`
 }
 
+// updaterSignatureMetadataKey is the well-known registry metadata key under
+// which a Tauri auto-update bundle's base64 minisign signature is stored
+// (registry.v1.Asset.metadata["updater.signature"]).
+const updaterSignatureMetadataKey = "updater.signature"
+
 // ReleaseImage is the transformed image for the registry API.
 type ReleaseImage struct {
 	Ref          string                `json:"ref"`
@@ -316,7 +326,7 @@ func main() {
 func transformAssets(manifest *pb.Manifest) map[string]*ReleaseAsset {
 	assets := make(map[string]*ReleaseAsset)
 	for platform, asset := range manifest.GetAssets() {
-		assets[platform] = &ReleaseAsset{
+		ra := &ReleaseAsset{
 			Platform:       platform,
 			Filename:       asset.GetFilename(),
 			MediaType:      asset.GetMediaType(),
@@ -328,6 +338,13 @@ func transformAssets(manifest *pb.Manifest) map[string]*ReleaseAsset {
 			SbomURL:        asset.GetSbomHref(),
 			Attestations:   transformAttestations(asset.GetAttestations()),
 		}
+		// The Tauri updater bundle carries a base64 minisign signature that must
+		// reach the registry as per-asset metadata. Only the updater asset sets
+		// updaterSignature; every other asset leaves Metadata nil/omitted.
+		if sig := asset.GetUpdaterSignature(); sig != "" {
+			ra.Metadata = map[string]string{updaterSignatureMetadataKey: sig}
+		}
+		assets[platform] = ra
 	}
 
 	return assets

cmd/record-release/main_test.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"reflect"
+	"strings"
 	"testing"
 
 	pb "github.com/ConductorOne/github-workflows/pb/artifacts/v1"
@@ -43,6 +44,54 @@ func TestTransformAssetsPreservesAssetAttestations(t *testing.T) {
 	}
 }
 
+func TestTransformAssetsMapsUpdaterSignatureToMetadata(t *testing.T) {
+	manifest := pb.Manifest_builder{
+		Assets: map[string]*pb.Asset{
+			// The macOS updater bundle carries the minisign signature.
+			"darwin-universal-updater": pb.Asset_builder{
+				Filename:         strPtr("baton-example-v1.2.3-darwin-universal.app.tar.gz"),
+				MediaType:        strPtr("application/gzip"),
+				Href:             strPtr("https://dist.example.com/updater.app.tar.gz"),
+				UpdaterSignature: strPtr("dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduCg=="),
+			}.Build(),
+			// A regular asset must not gain any metadata.
+			"linux-amd64": pb.Asset_builder{
+				Filename:  strPtr("baton-example-v1.2.3-linux-amd64.tar.gz"),
+				MediaType: strPtr("application/gzip"),
+				Href:      strPtr("https://dist.example.com/asset.tar.gz"),
+			}.Build(),
+		},
+	}.Build()
+
+	assets := transformAssets(manifest)
+
+	updater := assets["darwin-universal-updater"]
+	wantMeta := map[string]string{"updater.signature": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduCg=="}
+	if !reflect.DeepEqual(updater.Metadata, wantMeta) {
+		t.Fatalf("updater metadata = %#v, want %#v", updater.Metadata, wantMeta)
+	}
+
+	if plain := assets["linux-amd64"]; plain.Metadata != nil {
+		t.Fatalf("non-updater asset metadata = %#v, want nil", plain.Metadata)
+	}
+
+	// Metadata is omitted from JSON when nil, present when set.
+	plainBody, err := json.Marshal(assets["linux-amd64"])
+	if err != nil {
+		t.Fatalf("marshal plain asset: %v", err)
+	}
+	if strings.Contains(string(plainBody), "\"metadata\"") {
+		t.Fatalf("plain asset JSON unexpectedly contains metadata: %s", plainBody)
+	}
+	updaterBody, err := json.Marshal(updater)
+	if err != nil {
+		t.Fatalf("marshal updater asset: %v", err)
+	}
+	if !strings.Contains(string(updaterBody), "\"updater.signature\"") {
+		t.Fatalf("updater asset JSON missing metadata signature: %s", updaterBody)
+	}
+}
+
 func TestTransformAttestationsSkipsIncompleteAssetEntries(t *testing.T) {
 	got := transformAttestations([]*pb.AttestationDescriptor{
 		attestation(slsaProvenance, "https://dist.example.com/provenance.sigstore.json"),

pb/artifacts/v1/manifest.pb.go

@@ -87,6 +87,14 @@ message Asset {
   // For your customer flow (verify one OS artifact at a time), this is the recommended place to link
   // per-artifact provenance and/or SBOM attestations stored in S3.
   repeated AttestationDescriptor attestations = 9;
+
+  // updater_signature is the base64-encoded minisign signature for a Tauri
+  // in-app auto-update bundle. Only set on updater-bundle assets
+  // ({platform}-updater); empty for all other assets. The value is forwarded to
+  // the connector registry as per-asset metadata under the well-known key
+  // "updater.signature".
+  // JSON key: "updaterSignature".
+  string updater_signature = 10;
 }
 
 // Image represents metadata for a container image (digest-first).