shield_lock
JinDaGe
← Back to skills
extension
Category: Development & EngineeringNo API key required

signing-tauri-apps

Guides the user through Tauri application code signing and notarization for Android, iOS, Linux, macOS, and Windows platforms including certificate setup and configuration.

personAuthor: jakexiaohubgithub
open_in_newRepositorydownloadDownload package

Tauri Code Signing Skill

This skill provides comprehensive guidance for code signing Tauri applications across all supported platforms.

Platform Overview

| Platform | Requirement | Certificate Type | |----------|-------------|------------------| | Android | Required for Play Store | Java Keystore (JKS) | | iOS | Required for distribution | Apple Developer Certificate | | Linux | Optional (enhances trust) | GPG Key | | macOS | Required for distribution | Developer ID / Apple Distribution | | Windows | Required (SmartScreen) | OV or EV Certificate |

Android Signing

Generate Keystore

macOS/Linux:

keytool -genkey -v -keystore ~/upload-keystore.jks -keyalg RSA -keysize 2048 -validity 10000 -alias upload

Windows:

keytool -genkey -v -keystore $env:USERPROFILE\upload-keystore.jks -storetype JKS -keyalg RSA -keysize 2048 -validity 10000 -alias upload

Configuration File

Create src-tauri/gen/android/keystore.properties:

password=<your-password>
keyAlias=upload
storeFile=/path/to/upload-keystore.jks

IMPORTANT: Never commit keystore.properties to version control.

Gradle Configuration

Modify src-tauri/gen/android/app/build.gradle.kts:

import java.io.FileInputStream

// Add before android { } block
val keystorePropertiesFile = rootProject.file("keystore.properties")
val keystoreProperties = java.util.Properties()
if (keystorePropertiesFile.exists()) {
    keystoreProperties.load(FileInputStream(keystorePropertiesFile))
}

android {
    // ... existing config ...

    signingConfigs {
        create("release") {
            keyAlias = keystoreProperties["keyAlias"] as String
            keyPassword = keystoreProperties["password"] as String
            storeFile = file(keystoreProperties["storeFile"] as String)
            storePassword = keystoreProperties["password"] as String
        }
    }

    buildTypes {
        release {
            signingConfig = signingConfigs.getByName("release")
            // ... other release config ...
        }
    }
}

CI/CD Environment Variables

| Variable | Description | |----------|-------------| | ANDROID_KEY_ALIAS | Key alias (e.g., upload) | | ANDROID_KEY_PASSWORD | Keystore password | | ANDROID_KEY_BASE64 | Base64-encoded keystore file |

GitHub Actions Example:

- name: Setup Android signing
  run: |
    cd src-tauri/gen/android
    echo "keyAlias=${{ secrets.ANDROID_KEY_ALIAS }}" > keystore.properties
    echo "password=${{ secrets.ANDROID_KEY_PASSWORD }}" >> keystore.properties
    base64 -d <<< "${{ secrets.ANDROID_KEY_BASE64 }}" > $RUNNER_TEMP/keystore.jks
    echo "storeFile=$RUNNER_TEMP/keystore.jks" >> keystore.properties

iOS Signing

Prerequisites

  • Apple Developer Program enrollment ($99/year)
  • Bundle identifier registered in App Store Connect
  • iOS code signing certificate
  • Mobile provisioning profile

Automatic Signing (Recommended)

For local development, authenticate through Xcode Settings > Accounts.

For CI/CD, create an App Store Connect API key and set:

| Variable | Description | |----------|-------------| | APPLE_API_ISSUER | Issuer ID from App Store Connect | | APPLE_API_KEY | Key ID from App Store Connect | | APPLE_API_KEY_PATH | Path to the .p8 private key file |

Manual Signing

| Variable | Description | |----------|-------------| | IOS_CERTIFICATE | Base64-encoded .p12 certificate | | IOS_CERTIFICATE_PASSWORD | Password used when exporting certificate | | IOS_MOBILE_PROVISION | Base64-encoded provisioning profile |

Certificate Types by Distribution Method

| Distribution | Certificate Type | |--------------|------------------| | Debugging | Apple Development or iOS App Development | | App Store | Apple Distribution or iOS Distribution | | Ad Hoc | Apple Distribution or iOS Distribution |

Export Certificate

  1. Open Keychain Access
  2. Find your certificate
  3. Right-click the private key
  4. Select "Export" and save as .p12
  5. Convert to base64: base64 -i certificate.p12

Create Provisioning Profile

  1. Register App ID with matching bundle identifier
  2. Create provisioning profile for your distribution method
  3. Link certificate to profile
  4. Download and convert: base64 -i profile.mobileprovision

Linux Signing (AppImage)

Generate GPG Key

gpg2 --full-gen-key

Back up the key securely.

Environment Variables

| Variable | Description | |----------|-------------| | SIGN | Set to 1 to enable signing | | SIGN_KEY | GPG Key ID (optional, uses default if not set) | | APPIMAGETOOL_SIGN_PASSPHRASE | Key password (required for CI/CD) | | APPIMAGETOOL_FORCE_SIGN | Set to 1 to fail build on signing error |

Build with Signing

SIGN=1 APPIMAGETOOL_SIGN_PASSPHRASE="your-passphrase" npm run tauri build

View Embedded Signature

./src-tauri/target/release/bundle/appimage/app_version_amd64.AppImage --appimage-signature

Validate Signature

Download the validate tool from AppImageUpdate releases:

chmod +x validate-x86_64.AppImage
./validate-x86_64.AppImage your-app.AppImage

Note: AppImage does not auto-validate signatures. Users must manually verify.

macOS Signing and Notarization

Prerequisites

  • Apple Developer Program enrollment ($99/year)
  • Mac computer for code signing
  • Free accounts cannot notarize applications

Certificate Types

| Certificate | Use Case | |-------------|----------| | Apple Distribution | App Store submissions | | Developer ID Application | Distribution outside App Store |

Create Certificate

  1. Generate Certificate Signing Request (CSR) from Keychain Access
  2. Upload CSR at Apple Developer > Certificates, IDs & Profiles
  3. Download and double-click .cer to install

Configuration

tauri.conf.json:

{
  "bundle": {
    "macOS": {
      "signingIdentity": "Developer ID Application: Your Name (TEAM_ID)"
    }
  }
}

Environment Variables for CI/CD

Certificate Variables:

| Variable | Description | |----------|-------------| | APPLE_CERTIFICATE | Base64-encoded .p12 certificate | | APPLE_CERTIFICATE_PASSWORD | Password for exported certificate | | APPLE_SIGNING_IDENTITY | Certificate name in keychain |

Notarization - Option 1: App Store Connect API (Recommended):

| Variable | Description | |----------|-------------| | APPLE_API_ISSUER | Issuer ID | | APPLE_API_KEY | Key ID | | APPLE_API_KEY_PATH | Path to .p8 private key |

Notarization - Option 2: Apple ID:

| Variable | Description | |----------|-------------| | APPLE_ID | Apple ID email | | APPLE_PASSWORD | App-specific password | | APPLE_TEAM_ID | Team identifier |

Export Certificate for CI/CD

# Export from Keychain as .p12, then:
base64 -i certificate.p12 | pbcopy

Ad-Hoc Signing (Testing Only)

For unsigned distribution or testing without Apple credentials:

{
  "bundle": {
    "macOS": {
      "signingIdentity": "-"
    }
  }
}

GitHub Actions Example

- name: Import certificate
  env:
    APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
    APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
  run: |
    echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12
    security create-keychain -p actions temp.keychain
    security import certificate.p12 -k temp.keychain -P $APPLE_CERTIFICATE_PASSWORD -T /usr/bin/codesign
    security list-keychains -s temp.keychain
    security unlock-keychain -p actions temp.keychain
    security set-key-partition-list -S apple-tool:,apple: -s -k actions temp.keychain

Windows Signing

Certificate Types

| Type | SmartScreen | Availability | |------|-------------|--------------| | OV (Organization Validated) | Builds reputation over time | Before June 1, 2023 | | EV (Extended Validation) | Immediate trust | Required after June 1, 2023 |

Note: Certificates obtained after June 1, 2023 require EV certificates for immediate SmartScreen trust.

Configuration

tauri.conf.json:

{
  "bundle": {
    "windows": {
      "certificateThumbprint": "A1B1A2B2A3B3A4B4A5B5A6B6A7B7A8B8A9B9A0B0",
      "digestAlgorithm": "sha256",
      "timestampUrl": "http://timestamp.sectigo.com"
    }
  }
}

Find Certificate Thumbprint

  1. Open certificate details
  2. Go to Details tab
  3. Find "Thumbprint" field
  4. Copy the hex string (remove spaces)

Common Timestamp URLs

  • http://timestamp.sectigo.com
  • http://timestamp.digicert.com
  • http://timestamp.globalsign.com

Convert Certificate to PFX

openssl pkcs12 -export -in cert.cer -inkey private-key.key -out certificate.pfx

Environment Variables for CI/CD

| Variable | Description | |----------|-------------| | WINDOWS_CERTIFICATE | Base64-encoded .pfx file | | WINDOWS_CERTIFICATE_PASSWORD | PFX export password |

GitHub Actions Example

- name: Import Windows certificate
  env:
    WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
    WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
  run: |
    echo "$WINDOWS_CERTIFICATE" | base64 --decode > certificate.pfx
    Import-PfxCertificate -FilePath certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
  shell: pwsh

Azure Key Vault Signing

For cloud-based signing with Azure Key Vault:

| Variable | Description | |----------|-------------| | AZURE_CLIENT_ID | Azure AD application client ID | | AZURE_CLIENT_SECRET | Azure AD application secret | | AZURE_TENANT_ID | Azure AD tenant ID |

Configure in tauri.conf.json:

{
  "bundle": {
    "windows": {
      "signCommand": "relic sign --key azurekeyvault --file %1"
    }
  }
}

Azure Trusted Signing

For Azure Code Signing service:

{
  "bundle": {
    "windows": {
      "signCommand": "trusted-signing-cli -e <endpoint> -a <account> -c <profile> %1"
    }
  }
}

Custom Sign Command

For other signing tools or cross-platform builds:

{
  "bundle": {
    "windows": {
      "signCommand": "your-signing-tool --sign %1"
    }
  }
}

The %1 placeholder is replaced with the executable path.

Quick Reference: All Environment Variables

Android

  • ANDROID_KEY_ALIAS
  • ANDROID_KEY_PASSWORD
  • ANDROID_KEY_BASE64

iOS (Manual)

  • IOS_CERTIFICATE
  • IOS_CERTIFICATE_PASSWORD
  • IOS_MOBILE_PROVISION

iOS/macOS (API Key)

  • APPLE_API_ISSUER
  • APPLE_API_KEY
  • APPLE_API_KEY_PATH

macOS (Certificate)

  • APPLE_CERTIFICATE
  • APPLE_CERTIFICATE_PASSWORD
  • APPLE_SIGNING_IDENTITY

macOS (Apple ID Notarization)

  • APPLE_ID
  • APPLE_PASSWORD
  • APPLE_TEAM_ID

Linux

  • SIGN
  • SIGN_KEY
  • APPIMAGETOOL_SIGN_PASSPHRASE
  • APPIMAGETOOL_FORCE_SIGN

Windows

  • WINDOWS_CERTIFICATE
  • WINDOWS_CERTIFICATE_PASSWORD

Azure (Windows)

  • AZURE_CLIENT_ID
  • AZURE_CLIENT_SECRET
  • AZURE_TENANT_ID