Deployment

This chapter covers producing a release build, packaging it into installers for each operating system, and adding code signing and automatic updates.

Building for release

Before shipping, check version, identifier and the icons in tauri.conf.json. A single command then builds the frontend (beforeBuildCommand), compiles the Rust core with optimizations and creates the installers.

npm run tauri build

# Only produce specific bundle formats
npm run tauri build -- --bundles deb,appimage

# Just the executable, no installers (handy for tests)
npm run tauri build -- --no-bundle

# Bundle a debug build to investigate problems
npm run tauri build -- --debug

Output lands in per-format folders under src-tauri/target/release/bundle/. Web assets are embedded in the executable, so there are no extra files to ship.

Installers per platform

Choose formats with bundle.targets. Cross-compilation is limited, so you normally build on each OS. On GitHub Actions, the official tauri-action builds for all three desktop platforms and uploads the results to a release.

name: release
on:
  push:
    tags: ["v*"]
jobs:
  build:
    strategy:
      matrix:
        platform: [windows-latest, macos-latest, ubuntu-22.04]
    runs-on: ${{ matrix.platform }}
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable
      - name: Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
      - name: Install
        run: npm install
      - name: Build and release
        uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: "App ${{ github.ref_name }}"
          releaseDraft: true

Code signing

Unsigned apps trigger warnings or blocks from Windows SmartScreen and macOS Gatekeeper. On Windows, install a code signing certificate and set certificateThumbprint, digestAlgorithm and timestampUrl under bundle.windows, or call an external tool such as Azure-based signing through signCommand. On macOS, sign with a Developer ID certificate from an Apple Developer account and notarize the app. Set these environment variables and Tauri handles both during the build.

export APPLE_SIGNING_IDENTITY="Developer ID Application: Example Inc (TEAMID)"
export APPLE_API_ISSUER="issuer-id"
export APPLE_API_KEY="key-id"
export APPLE_API_KEY_PATH="/path/to/AuthKey.p8"
npm run tauri build

Automatic updates with the updater plugin

Add the plugin with npm run tauri add updater and generate a signing key pair. Update artifacts are signed with the private key, and the app only installs updates that verify against the public key. Keep the private key safe: if you lose it, you can no longer ship updates to existing users.

npm run tauri signer generate -- -w ~/.tauri/myapp.key
export TAURI_SIGNING_PRIVATE_KEY="$HOME/.tauri/myapp.key"
export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="your-key-password"

{
  "bundle": { "createUpdaterArtifacts": true },
  "plugins": {
    "updater": {
      "pubkey": "CONTENTS OF THE PUBLIC KEY",
      "endpoints": ["https://releases.example.com/{{target}}/{{arch}}/{{current_version}}"]
    }
  }
}

Add updater:default and process:default to your capability, then check for and install updates from the app.

import { check } from "@tauri-apps/plugin-updater";
import { relaunch } from "@tauri-apps/plugin-process";

const update = await check();
if (update) {
  await update.downloadAndInstall();
  await relaunch();
}

The endpoint can be a static JSON file. tauri-action uploads a latest.json to your GitHub release, so you can point the updater straight at it. The updater is desktop-only; mobile apps ship through the App Store and Google Play.

Summary

• npm run tauri build produces an executable with embedded web assets plus installers.
• Windows gets MSI and NSIS, macOS .app and .dmg, Linux .deb, .rpm and .AppImage; build on each OS.
• Code signing avoids install warnings, and macOS also requires notarization.
• The updater plugin only installs updates signed with your key.

Official documentation:

• Distribute
• Updater
• macOS Code Signing
• Windows Code Signing
• tauri-action