打包与代码签名

tauri build 基础

# 构建当前平台的安装包
npm run tauri build

# 指定安装包格式
npm run tauri build -- --bundles nsis     # Windows NSIS 安装向导
npm run tauri build -- --bundles msi      # Windows MSI
npm run tauri build -- --bundles dmg      # macOS DMG
npm run tauri build -- --bundles appimage # Linux AppImage
npm run tauri build -- --bundles deb      # Debian/Ubuntu .deb

# 调试构建（不启用优化，保留符号）
npm run tauri build -- --debug

# 构建产出目录
# src-tauri/target/release/bundle/
# ├── macos/    → .app, .dmg
# ├── nsis/     → *-setup.exe
# ├── msi/      → *.msi
# └── appimage/ → *.AppImage

tauri.conf.json 打包配置

{
  "bundle": {
    "active": true,
    "targets": "all",
    "identifier": "com.mycompany.myapp",
    "publisher": "My Company",
    "copyright": "Copyright © 2024 My Company",
    "category": "DeveloperTool",
    "shortDescription": "My awesome desktop app",
    "longDescription": "A longer description for app stores",
    "icon": [
      "icons/32x32.png",
      "icons/128x128.png",
      "icons/128x128@2x.png",
      "icons/icon.icns",
      "icons/icon.ico"
    ],
    "windows": {
      "wix": { "language": "zh-CN" },
      "nsis": {
        "languages": ["SimpChinese", "English"],
        "installMode": "currentUser"
      }
    },
    "macOS": {
      "signingIdentity": "Developer ID Application: My Company (XXXXXXXXXX)",
      "entitlements": "entitlements.plist",
      "minimumSystemVersion": "10.15"
    },
    "linux": {
      "deb": {
        "depends": ["libwebkit2gtk-4.1-0", "libayatana-appindicator3-1"]
      }
    }
  }
}

macOS 代码签名与公证

# 本地 macOS 签名所需环境变量
export APPLE_CERTIFICATE="base64编码的p12证书"
export APPLE_CERTIFICATE_PASSWORD="证书密码"
export APPLE_SIGNING_IDENTITY="Developer ID Application: My Company (XXXXXXXXXX)"

# 公证所需（使用 App Store Connect API Key）
export APPLE_API_ISSUER="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
export APPLE_API_KEY="XXXXXXXXXX"
export APPLE_API_KEY_PATH="/path/to/AuthKey_XXXXXXXXXX.p8"

# tauri build 会自动读取这些环境变量完成签名+公证
npm run tauri build

Windows 代码签名

# Windows 签名所需环境变量
# 方式1：使用 .pfx 证书文件
export TAURI_SIGNING_PRIVATE_KEY="base64编码的pfx"
export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="证书密码"

# 方式2：使用 Azure Trusted Signing（推荐，无需本地存储证书）
# 在 tauri.conf.json 中配置 signtool 选项

GitHub Actions 跨平台矩阵构建

# .github/workflows/release.yml
name: Release

on:
  push:
    tags: ['v*']

jobs:
  release:
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: macos-latest
            args: '--target aarch64-apple-darwin'  # Apple Silicon
          - platform: macos-latest
            args: '--target x86_64-apple-darwin'    # Intel Mac
          - platform: ubuntu-22.04
            args: ''
          - platform: windows-latest
            args: ''

    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev \
            build-essential curl wget file \
            libxdo-dev libssl-dev \
            libayatana-appindicator3-dev librsvg2-dev

      - uses: actions/setup-node@v4
        with:
          node-version: lts/*
          cache: npm

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: 'src-tauri -> target'

      - run: npm install

      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # macOS 签名
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_PATH: ${{ secrets.APPLE_API_KEY_PATH }}
        with:
          tagName: ${{ github.ref_name }}
          releaseName: 'v__VERSION__'
          releaseBody: 'See CHANGELOG.md for release notes.'
          releaseDraft: true
          prerelease: false
          args: ${{ matrix.args }}

代码签名的技术原理

为什么需要代码签名？

代码签名不只是"为了绕过系统警告"，而是现代操作系统安全体系的重要组成部分：

GitHub Actions 签名的安全实践

签名 Secrets 的安全管理：

绝不要：
  ✗ 把证书文件（.p12, .pfx）提交到 git 仓库
  ✗ 在 Actions 日志中打印证书密码
  ✗ 把私钥存储在公开 Secrets（用 repository secrets，非 environment secrets）

推荐做法：
  ✓ 证书用 base64 编码后存储到 GitHub Secrets
    base64 -i certificate.p12 | pbcopy  (macOS)
  ✓ 限制 Actions workflow 只能在特定分支（main/release/*）触发
  ✓ 为 Release 构建单独创建 GitHub Environment（production），
    限制只有特定 reviewers 能审批才会使用签名 Secrets
  ✓ 使用 GitHub OIDC + Apple Notary Tool（避免存储 Apple ID 密码）

苹果公证的新方式（推荐）：
  旧方式（altool）：需要存储 Apple ID + app-specific password
  新方式（notarytool + API Key）：只需要存储 API Key（可以随时吊销）
  格式：APPLE_API_KEY_ID + APPLE_API_ISSUER + APPLE_API_KEY（私钥文件）

构建缓存优化

Tauri 的 CI 构建主要耗时在 Rust 编译上，合理配置缓存可以将构建时间从 20 分钟缩短到 3-5 分钟：

# GitHub Actions 缓存配置
- name: Cache Rust dependencies
  uses: Swatinem/rust-cache@v2
  with:
    workspaces: 'src-tauri -> target'
    # 仅缓存 release profile 的依赖
    cache-on-failure: true

- name: Cache Node modules
  uses: actions/cache@v4
  with:
    path: node_modules
    key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-node-

Linux 包格式选择

本章小结