Stage and require verified extraction helper in Windows release packages

apps/desktop/src-tauri/build.rs

@@ -1,3 +1,46 @@
 fn main() {
+    let target = std::env::var("CARGO_CFG_TARGET_OS").expect("target OS");
+    let name = if target == "windows" {
+        "searchi-extract-worker.exe"
+    } else {
+        "searchi-extract-worker"
+    };
+    let helper = std::path::Path::new("resources").join(name);
+    println!("cargo:rerun-if-changed={}", helper.display());
+    println!("cargo:rerun-if-changed=resources/extraction-worker.json");
+    println!("cargo:rerun-if-changed=../../../tools/stage_extraction_worker.py");
+    println!("cargo:rerun-if-changed=../../../crates/searchi-core/src");
+    println!("cargo:rerun-if-changed=../../../crates/searchi-media/src");
+    println!("cargo:rerun-if-changed=../../../crates/searchi-extract-worker/src");
+    println!("cargo:rerun-if-changed=../../../Cargo.lock");
+    println!("cargo:rerun-if-changed=../../../Cargo.toml");
+    if std::env::var("PROFILE").as_deref() == Ok("release") {
+        let metadata = std::fs::symlink_metadata(&helper).unwrap_or_else(|_| {
+            panic!("Missing packaged document helper. Run tools/stage_extraction_worker.py before building a release.")
+        });
+        assert!(
+            metadata.file_type().is_file()
+                && metadata.len() > 0
+                && metadata.len() <= 64 * 1024 * 1024,
+            "Packaged document helper must be a regular, nonempty file under 64 MiB"
+        );
+    }
+    if std::env::var("PROFILE").as_deref() == Ok("release")
+        && matches!(target.as_str(), "windows" | "linux")
+    {
+        let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../..");
+        let status = std::process::Command::new("python")
+            .arg(root.join("tools/stage_extraction_worker.py"))
+            .args(["--verify-only", "--platform", &target, "--architecture"])
+            .arg(std::env::var("CARGO_CFG_TARGET_ARCH").expect("target architecture"))
+            .arg("--destination")
+            .arg(std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("resources"))
+            .status()
+            .expect("Python is required to verify packaged extraction worker provenance");
+        assert!(
+            status.success(),
+            "Packaged extraction worker verification failed; rebuild and stage it"
+        );
+    }
     tauri_build::build()
 }