Signing and Trust
Signing does two different jobs:
- It proves an artifact came from the expected publisher or key holder.
- It lets the platform decide whether to install, update, warn, or block.
Do not treat signing as a last-minute build flag. It is identity infrastructure.
Identity Types
| Identity | Where it matters | What you protect | What happens if it breaks |
|---|---|---|---|
| Android app signing key | Installed APK identity | Usually held by Play App Signing for Play releases | Users cannot update if the signing lineage is wrong |
| Android upload key | AAB upload to Play | Your upload keystore or CI secret | You must reset it through Play Console before uploading again |
| Microsoft Store package identity | Store/MSIX app | Partner Center app reservation and package metadata | Uploads or certification fail |
| Windows code-signing certificate | Direct EXE/MSI/MSIX downloads | OV/EV certificate or signing service credentials | SmartScreen/Defender warnings increase; users distrust downloads |
| Apple signing identity and provisioning | iOS/macOS builds | Apple Developer account credentials and certificates | Builds cannot be submitted or installed through normal channels |
| Tauri updater key | Tauri update metadata and artifacts | Updater private key | Installed users cannot trust future updater artifacts |
| Electron updater metadata/signing | Electron desktop updates | Platform signing secrets and publish provider credentials | Update checks or installs fail, or signature verification weakens |
Android Play Signing
For new Google Play apps, publish Android App Bundles. You sign the AAB with an upload key, upload it to Play, and Play App Signing signs the generated APKs that users install.
This gives you two operational keys:
- App signing key: the install/update identity. Play stores and protects it for Play distribution.
- Upload key: the key your release process uses to authenticate uploaded bundles.
Gotcha: Do not commit keystores or signing passwords. A leaked upload key can be reset, but a leaked signing process still creates release risk and cleanup work.
Windows Store and SmartScreen
Microsoft Store distribution and direct Windows downloads are different trust models.
| Path | Trust model | Practical result |
|---|---|---|
| Microsoft Store/MSIX | Store certification and Microsoft signing during publishing | Users install through Store trust and Store-managed updates |
| Signed direct download | Your publisher certificate plus file/app reputation | Users may still see SmartScreen warnings until reputation exists |
| Unsigned direct download | No publisher identity | Expect scary warnings and low user trust |
SmartScreen is reputation-based. It evaluates URLs, downloads, apps, files, and signatures. A valid signature helps, but a new publisher or new binary can still warn. EV certificates can improve initial reputation, but they cost more and usually require stronger identity validation.
Gotcha: “Signed” does not mean “no warning.” For direct downloads, plan for clean-machine testing, download-path testing, and a Microsoft file submission path if Defender or SmartScreen flags a release.
Apple Basics
Apple releases use App Store Connect, bundle IDs, signing/provisioning, privacy details, screenshots, review, and release options. macOS direct distribution also has notarization and Gatekeeper concerns. Do not assume Apple is ready until the Apple Developer Program account, bundle ID, certificates, and App Store Connect app record exist.
Updater Keys Are Separate Trust
Desktop auto-updaters do not become safe just because the installer is signed.
Tauri’s updater uses a separate public/private key pair. The public key goes into app configuration, and the private key signs updater artifacts. Tauri’s updater signature verification is mandatory.
Electron Builder depends on target choice:
- AppX/MSIX is a Store-oriented path and uses Store updates.
- NSIS works with
electron-updater. - MSI is not supported by
electron-updateraccording to the Electron Builder documentation surfaced through Context7.
Warning: Losing a Tauri updater private key is worse than losing a normal release note. Already-installed clients trust that key. Without it, you may need a manual reinstall path.