Package, Sign, And Update Desktop

Desktop release has three separate concerns: package format, OS code signing, and Tauri updater signing.

1. Choose Bundle Targets

Platform	Common targets	Notes
Windows	NSIS, MSI	MSI creation is Windows-bound; NSIS can be cross-compiled with caveats
macOS	app, dmg	Developer ID and notarization matter for outside-App-Store distribution
Linux	deb, rpm, AppImage	Distro dependencies and WebKitGTK versions affect behavior

2. Decide Windows WebView2 Mode

Mode	Use when	Tradeoff
Download bootstrapper	Public direct install with internet	Small installer, needs network
Embedded bootstrapper	Direct install where bootstrapper should be bundled	Larger installer, still uses Evergreen runtime
Offline installer	Microsoft Store EXE/MSI or offline environments	Larger artifact, works without live download
Fixed Version	Strict runtime pinning is required	Very large payload and you own runtime security updates
Skip	Controlled environment already guarantees runtime	App fails if runtime is missing

For public Windows distribution, do not skip WebView2 installation casually.

3. Separate Signing Types

Signing	What it proves	Key material
Windows/macOS code signing	OS and user trust for the app/installer	Certificate or platform signing identity
Tauri updater signing	Update artifact authenticity	Tauri updater private key and public key in config

You usually need both for a real direct-download app with auto-update.

4. Configure Updater Deliberately

Updater readiness requires:

updater plugin registered
public key configured
endpoints configured
artifact generation configured intentionally
private key stored outside git
static JSON or dynamic server tested
download, install, and relaunch tested

The updater private key is critical. If you lose it after users install the app, future updates signed by that key path fail.

5. Smoke The Artifact

Release smoke checklist:

artifact path recorded
target OS and architecture recorded
install succeeded
app launched without dev server
capability-dependent flows worked
sidecars started and stopped if present
logs were inspected
signature state recorded
updater check result recorded if enabled
uninstall or rollback path checked where applicable

6. Claim Carefully

Do not say “released” unless users can access the signed artifact through the intended distribution channel. A local unsigned bundle is a build artifact, not a release.