rockclaver Desktop Packaging
Get a working Electron or Tauri app into users' hands on all three platforms. Full signing commands and config are in REFERENCE.md.
Tooling Choice
- Electron Forge: integrated, recommended for new Electron projects.
- electron-builder: more config surface, flexible target formats.
- Tauri:
tauri build; ~5–10 MB vs Electron's ~120 MB; requires Rust toolchain. - Prefer Tauri for bundle size; Electron when an existing Node codebase makes migration expensive.
Signing & Notarization
- macOS:
codesign→xcrun notarytool submit→xcrun stapler staple; hardened runtime required; 10.15+ blocks unsigned apps. - Windows:
signtoolwith an RFC 3161 timestamp; EV cert avoids SmartScreen, OV builds reputation over ~30 days. - Linux: AppImage (widest reach), deb, RPM, Flatpak (Flathub, sandboxed).
- Config keys and full commands: see REFERENCE.md.
Auto-Update
- Electron (electron-updater): release server or S3 with
latest.yml; delta updates reduce size. - Tauri:
updater.endpointsintauri.conf.json; sign bundles with a separate Ed25519 key. - Serve over HTTPS; validate signatures before applying.
OAuth Deep Links
Register myapp:// so the OS routes OAuth callbacks to the app:
- macOS:
CFBundleURLTypesinInfo.plist. - Windows: registry key
HKEY_CLASSES_ROOT\myapp. - Linux:
.desktopfile withMimeType=x-scheme-handler/myapp. - Electron:
app.setAsDefaultProtocolClient('myapp'). Tauri:allowlist.protocol.open = true.
CI Pipeline
push to main → unsigned build + smoke test
tag vX.Y.Z → sign + package per platform + upload artifacts
GitHub Release → attach artifacts; updater server detects new version
Use matrix builds: macOS, Windows, and Ubuntu runners.
Guardrails
- Never commit signing certificates or PFX files — use CI secret managers.
- Always test the packaged binary (not dev mode) on a clean OS before releasing.
- Pin the Electron version; patch upgrades can change Chromium APIs.
- Audit bundle size before each release (
webpack-bundle-analyzer,rollup-plugin-visualizer).