For AI agents: fetch the complete documentation index at /llms.txt, the full documentation corpus at /llms-full.txt, the agent skill at /skill.md, or this page as Markdown at /docs/desktop/updates.md (or send Accept: text/markdown).

Auto-updates and release channels

Signed update feeds, the stable/beta channel, and the shipped release workflow.

Ask about this guide

Generate the updater keypair once

The updater verifies minisign signatures on downloaded artifacts. Generate a keypair with the Tauri signer and keep the private key as TAURI_SIGNING_PRIVATE_KEY with its password in TAURI_SIGNING_PRIVATE_KEY_PASSWORD, both in your secret store — never in the repo. Builds that create updater artifacts emit a .sig sidecar next to each installer; the public key goes to clients, the private key stays in CI.

corepack pnpm --filter @supastack/desktop exec tauri signer generate -w ~/.tauri/product.key

Configure the updater at build time

tauri.conf.json ships a sentinel updater block with empty endpoints and pubkey — keep it, because the updater plugin cannot initialize without the keys present. Real values are deep-merged at build time through a --config JSON overlay or the TAURI_CONFIG environment variable; check:release-config prints the exact overlay to paste when SUPASTACK_UPDATER_ENDPOINT and SUPASTACK_UPDATER_PUBKEY are set.

Set both or neither: an endpoints-only overlay leaves the pubkey empty, so checks appear to work while every install fails signature verification. The endpoint URL carries {{target}}, {{arch}}, and {{current_version}} placeholders — the version slot is required — plus an optional {{channel}} path segment that enables release channels.

# check:release-config prints this overlay for tauri build --config:
# {"plugins":{"updater":{"endpoints":["https://releases.example.com/{{channel}}/{{target}}/{{arch}}/{{current_version}}"],"pubkey":"<base64 public key>"}}}
# SUPASTACK_UPDATER_ENDPOINT=
# SUPASTACK_UPDATER_PUBKEY=

Publish the latest.json feed

Each endpoint answers a latest.json manifest — version, notes, pub_date, and a platforms map covering darwin-aarch64, darwin-x86_64, windows-x86_64, windows-aarch64, linux-x86_64, and linux-aarch64 — where every entry pairs the installer URL with its signature.

Build it with the release:manifest script: it scans a bundle directory for .app.tar.gz, -setup.exe (preferred over .msi), and .AppImage artifacts — each must have its .sig neighbour — and writes or merges the manifest. Flags cover --version, --base-url, --bundle-dir with --platform, --merge to accumulate platforms across runs, --notes, --pub-date, and --out.

corepack pnpm --filter @supastack/desktop release:manifest -- \
  --version 1.2.0 \
  --base-url https://releases.example.com/stable \
  --bundle-dir src-tauri/target/release/bundle \
  --platform windows-x86_64 \
  --merge latest.json

Stable and beta channels

When an endpoint contains the {{channel}} placeholder, the app menu enables a Beta Updates checkbox that switches the feed between stable and beta. The choice persists in an update-channel file next to the app config; SUPASTACK_UPDATE_CHANNEL overrides it per run — anything unrecognized is ignored with a warning — and stable is the default. Without the placeholder the toggle stays disabled and only the stable feed is checked.

When updates are checked

One silent background check runs at startup and only shows a dialog when an update exists; the Check for Updates… menu item reports every outcome. Checks serialize — a second concurrent request is dropped. An available update offers Install and Restart, which downloads, installs, and restarts the app; unconfigured builds answer that updates are not configured, and failures surface as dialogs rather than retries.

The shipped release workflow

.github/workflows/desktop-release.yml builds the matrix — macOS on both architectures, Windows, and Ubuntu — on desktop-v* tags or a manual dispatch with a version and channel. It stamps the manifest version from the tag (a release that skips this offers itself as an update forever), merges the per-platform manifests, and creates a draft GitHub release carrying latest.json plus every installer and signature — marked prerelease for beta channels.

It needs SUPASTACK_APP_URL and SUPASTACK_UPDATER_ENDPOINT as repository variables and SUPASTACK_UPDATER_PUBKEY plus the signing private key and its password as secrets; Apple signing credentials are optional add-ons. The full runbook lives in docs/desktop-updates.md in the repository.

Verification and troubleshooting

Install a build, publish a newer manifest to a test feed, and confirm the update dialog arrives on the next check and the app restarts into the new version. Then switch to beta and confirm the channel feed answer changes.