tauri-plugin-hdiff-update

Tauri 2 plugin for signed and transactional installed-file updates.

The default permission exposes only:

• prepare_file_update
• launch_file_update
• prepare_full_update
• launch_full_update

Preparation verifies the installed source tree, downloads and verifies a directory patch, applies it to staging, and verifies every target file. Launch starts a non-elevated supervisor; after the application exits it invokes the same signed application binary as a constrained elevated worker. The worker commits managed paths with a journal and rollback backup.

Both directory patches and the official Tauri full installer are prepared in an application-owned disk cache. A verified prepared update is reused instead of downloaded again. When the application starts with a pending update, the bootstrap applies it before the normal UI starts. Full installers are resolved from the official Tauri update manifest and verified with the compiled Minisign public key before they become launchable.

Persistent full-installer updates are intentionally limited to per-machine Windows installations under Program Files. The UAC bootstrap runs from the installed, non-user-writable executable and stages the verified installer in a locked-down ProgramData transaction before launch.

The consuming application must call maybe_run_file_update_helper before Tauri startup and pass the same compile-time configuration to init(config). Register the single-instance plugin first. At the start of the primary application's setup hook, call apply_prepared_update_on_startup; only after it returns false may normal services and windows start. Call confirm_file_update_startup after setup succeeds. The trusted public-key ring, application id, current version, updater public key, main executable, managed paths, and bundled hpatchz path never come from frontend arguments.

See the repository README and commercial directory update specification for the complete integration contract.