Code signing

Beginner walkthrough

Prerequisites: Finish Desktop local setup, including Rust and the operating-system build tools. Stop the Tauri development process before building an installer; leave the Web backend running. Run each check below from the repository root and wait for it to finish before running the next. The filtered package commands work in Desktop-only and All Platforms checkouts.

Quick terms: a workspace is one team's separate users, data, and settings. The server is the trusted backend; keep provider keys out of browser and phone code. A migration is a versioned database change that creates or updates tables. An AI model is the engine that answers; the model catalog is the server's list of available model IDs and prices. A provider is an outside service such as an AI, email, or billing service. An entitlement is a grant that lets a workspace use a feature. A webhook is a message one service sends to another service's URL.

1. In a local branch, ask your coding agent to inspect apps/desktop/src-tauri/tauri.conf.json and set the product identifier, app name, icons, and backend URL to values you own. Use a public HTTPS backend URL for release builds.

2. From the repository root, run the Desktop package checks below. Before check:release-config, set SUPASTACK_APP_URL in this terminal using the operating-system command in Desktop local setup; the public HTTPS backend must be running, and the app identifier must be your own.

3. A successful build does not sign, notarize, or publish an installer; if Rust or a system library is missing, finish Desktop local setup.

For custom code, start with the supplied prompts/README.md and copy the closest prompt: prompts/new-app-screen.md for an app screen or prompts/new-landing-page.md for a public page. For server, database, or provider work, give your coding agent this guide's task and ask it to read AGENTS.md, .ai/PROJECT_CONTEXT.md, and matching .ai/ mirrors; inspect the exact source files named here; list files and checks before editing; preserve workspace ownership and server-only secrets; and show you the diff. Tell it the behavior you want, input and output fields, allowed roles, expected success and errors, and the test account, provider, or device. Use sample values; never paste a real secret.

• Before you start
• Terminal basics
• Desktop local setup
• Agent prompts & project memory

corepack pnpm --filter @supastack/desktop typecheck
corepack pnpm --filter @supastack/desktop test
corepack pnpm --filter @supastack/desktop check:release-config
corepack pnpm --filter @supastack/desktop build

Configure the product shell

Review src-tauri/tauri.conf.json, Cargo metadata, capabilities and platform identifiers. Replace app icons through the shared asset process and set the intended backend URL at build/runtime. The hosted web app must already be deployed and reachable.

Run the native build gate

These package commands run Rust typecheck and tests, validate release settings, and build the Tauri installer. Signing and distribution configuration depend on the target platform and your account/certificates; do not store signing material in source.

corepack pnpm --filter @supastack/desktop typecheck
corepack pnpm --filter @supastack/desktop test
corepack pnpm --filter @supastack/desktop check:release-config
corepack pnpm --filter @supastack/desktop build

Verify the installer on the target OS

Check clean install, launch, backend reachability, auth, menus/tray, hotkey registration, second instance, deep links, offline retry and uninstall. Verify each supported OS separately. A local build does not prove signed or notarized commercial distribution; signing configuration, an updater feed, and release automation are not included.

• Native acceptance checklist
• Deploy the shared backend

Setup and configuration

1. Unsigned installers install fine on your own machine but trigger Gatekeeper and SmartScreen warnings for everyone else — sign before you ship.

2. On macOS, enroll in the Apple Developer Program for a Developer ID certificate, then add the signing and notarization config under the bundle section of src-tauri/tauri.conf.json and feed Tauri its documented signing env (APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY, plus the APPLE_API_KEY / APPLE_API_ISSUER notarization credentials) from your CI secret store.

3. On Windows, configure the bundle's Windows signing — a certificate thumbprint or a custom signtool command — with the certificate delivered through your runner's secret store as well.

# tauri.conf.json ships unsigned today:
#   "bundle": { "active": true, "targets": "all", "icon": [...] }
# Add signing under bundle > macOS / bundle > windows
# and keep every certificate and password in your secret store,
# never in the repo.
# Auto-updater & release channels (stable / beta via {{channel}}):
# SUPASTACK_UPDATER_ENDPOINT=https://releases.example.com/{{channel}}/{{target}}/{{arch}}/{{current_version}}
# SUPASTACK_UPDATER_PUBKEY=…
# SUPASTACK_UPDATE_CHANNEL=stable

Implementation workflow

Provision certificates through your own secret store and inject them as environment variables at build time — a certificate committed to the repo is a certificate to revoke.

Bake the production SUPASTACK_APP_URL into the same release build so installed shells point at the deployed app.

Verification and troubleshooting

Verify by installing the produced artifact on a machine that isn't yours: no Gatekeeper or SmartScreen warning, the app launches, and sign-in persists. A green tauri build without the signed install test is not release evidence.

Next: the Web tab's Deployment checklist covers the server-side launch gates.