# Desktop Packaging

> Package and sign Electron or Tauri apps — macOS notarization, Windows code signing, Linux bundles, auto-update, and OAuth deep links. Use when shipping a desktop app, setting up installers, or configuring auto-update.

- Skill: `rockclaver/desktop-packaging` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add rockclaver/desktop-packaging`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rockclaver/desktop-packaging/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: rockclaver (https://skillmd.com/u/rockclaver)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rockclaver/desktop-packaging

---

# Desktop Packaging

Get a working Electron or Tauri app into users' hands on all three platforms. Full signing commands and config are in [REFERENCE.md](REFERENCE.md).

## Tooling Choice

- **Electron Forge**: integrated, recommended for new Electron projects.
- **electron-builder**: more config surface, flexible target formats.
- **Tauri**: `tauri build`; ~5–10 MB vs Electron's ~120 MB; requires Rust toolchain.
- Prefer Tauri for bundle size; Electron when an existing Node codebase makes migration expensive.

## Signing & Notarization

- **macOS**: `codesign` → `xcrun notarytool submit` → `xcrun stapler staple`; hardened runtime required; 10.15+ blocks unsigned apps.
- **Windows**: `signtool` with an RFC 3161 timestamp; EV cert avoids SmartScreen, OV builds reputation over ~30 days.
- **Linux**: AppImage (widest reach), deb, RPM, Flatpak (Flathub, sandboxed).
- Config keys and full commands: see REFERENCE.md.

## Auto-Update

- **Electron (electron-updater)**: release server or S3 with `latest.yml`; delta updates reduce size.
- **Tauri**: `updater.endpoints` in `tauri.conf.json`; sign bundles with a separate Ed25519 key.
- Serve over HTTPS; validate signatures before applying.

## OAuth Deep Links

Register `myapp://` so the OS routes OAuth callbacks to the app:
- macOS: `CFBundleURLTypes` in `Info.plist`.
- Windows: registry key `HKEY_CLASSES_ROOT\myapp`.
- Linux: `.desktop` file with `MimeType=x-scheme-handler/myapp`.
- Electron: `app.setAsDefaultProtocolClient('myapp')`. Tauri: `allowlist.protocol.open = true`.

## CI Pipeline

```
push to main   →  unsigned build + smoke test
tag vX.Y.Z     →  sign + package per platform + upload artifacts
GitHub Release →  attach artifacts; updater server detects new version
```

Use matrix builds: macOS, Windows, and Ubuntu runners.

## Guardrails

- Never commit signing certificates or PFX files — use CI secret managers.
- Always test the packaged binary (not dev mode) on a clean OS before releasing.
- Pin the Electron version; patch upgrades can change Chromium APIs.
- Audit bundle size before each release (`webpack-bundle-analyzer`, `rollup-plugin-visualizer`).