feat: add signed Tauri desktop auto-updates

.github/workflows/macos-check.yml

@@ -42,7 +42,7 @@ jobs:
         run: |
           bun run typecheck
           bun run desktop:build:web
-          bun test scripts/install-macos.test.ts
+          bun test scripts/install-macos.test.ts scripts/generate-tauri-update-manifest.test.ts
           bash -n scripts/install-macos.sh
 
       - name: Test native applications
@@ -54,6 +54,8 @@ jobs:
     if: github.event_name == 'workflow_dispatch'
     needs: macos-check
     runs-on: macos-14
+    env:
+      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
     steps:
       - uses: actions/checkout@v5
         with:
@@ -76,12 +78,12 @@ jobs:
 
       - name: Build Apple Silicon desktop and qd
         run: |
-          bun tauri build --ci --target aarch64-apple-darwin --bundles dmg
+          bun tauri build --ci --target aarch64-apple-darwin --bundles app,dmg
           cargo build --release --target aarch64-apple-darwin --manifest-path cli/Cargo.toml
 
       - name: Build Intel desktop and qd
         run: |
-          bun tauri build --ci --target x86_64-apple-darwin --bundles dmg
+          bun tauri build --ci --target x86_64-apple-darwin --bundles app,dmg
           cargo build --release --target x86_64-apple-darwin --manifest-path cli/Cargo.toml
 
       - name: Validate release packaging and checksums

.github/workflows/release.yml

@@ -18,10 +18,12 @@ jobs:
     runs-on: windows-latest
     env:
       RELEASE_TAG: ${{ github.event.inputs.tag || github.ref_name }}
+      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
     steps:
       - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
+          persist-credentials: false
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -51,6 +53,7 @@ jobs:
           name: windows-release
           path: |
             src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/QuickDrop_*_x64-setup.exe
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/QuickDrop_*_x64-setup.exe.sig
             cli/target/release/qd_*_x86_64-windows.exe
             cli/target/release/qd_*_x86_64-windows.exe.sha256
           if-no-files-found: error
@@ -65,6 +68,7 @@ jobs:
           $installer = Get-ChildItem "src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/QuickDrop_*_x64-setup.exe" | Select-Object -First 1 -ExpandProperty FullName
           gh release upload $env:RELEASE_TAG `
             $installer `
+            "${installer}.sig" `
             "cli/target/release/qd_${version}_x86_64-windows.exe" `
             "cli/target/release/qd_${version}_x86_64-windows.exe.sha256" `
             --clobber
@@ -73,10 +77,12 @@ jobs:
     runs-on: macos-14
     env:
       RELEASE_TAG: ${{ github.event.inputs.tag || github.ref_name }}
+      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
     steps:
       - uses: actions/checkout@v5
         with:
           ref: ${{ env.RELEASE_TAG }}
+          persist-credentials: false
 
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -95,9 +101,9 @@ jobs:
 
       - name: Build macOS desktop and qd for Apple Silicon and Intel
         run: |
-          bun tauri build --ci --target aarch64-apple-darwin --bundles dmg
+          bun tauri build --ci --target aarch64-apple-darwin --bundles app,dmg
           cargo build --release --target aarch64-apple-darwin --manifest-path cli/Cargo.toml
-          bun tauri build --ci --target x86_64-apple-darwin --bundles dmg
+          bun tauri build --ci --target x86_64-apple-darwin --bundles app,dmg
           cargo build --release --target x86_64-apple-darwin --manifest-path cli/Cargo.toml
 
       - name: Package macOS release assets
@@ -111,8 +117,12 @@ jobs:
             cli/target/release/qd_*-macos.sha256
             src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/QuickDrop_*_aarch64.dmg
             src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/QuickDrop_*_aarch64.dmg.sha256
+            src-tauri/target/aarch64-apple-darwin/release/bundle/macos/QuickDrop_*_aarch64.app.tar.gz
+            src-tauri/target/aarch64-apple-darwin/release/bundle/macos/QuickDrop_*_aarch64.app.tar.gz.sig
             src-tauri/target/x86_64-apple-darwin/release/bundle/dmg/QuickDrop_*_x64.dmg
             src-tauri/target/x86_64-apple-darwin/release/bundle/dmg/QuickDrop_*_x64.dmg.sha256
+            src-tauri/target/x86_64-apple-darwin/release/bundle/macos/QuickDrop_*_x64.app.tar.gz
+            src-tauri/target/x86_64-apple-darwin/release/bundle/macos/QuickDrop_*_x64.app.tar.gz.sig
           if-no-files-found: error
 
       - name: Upload macOS assets to release
@@ -128,6 +138,36 @@ jobs:
             "cli/target/release/qd_${version}_x86_64-macos.sha256" \
             "src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/QuickDrop_${version}_aarch64.dmg" \
             "src-tauri/target/aarch64-apple-darwin/release/bundle/dmg/QuickDrop_${version}_aarch64.dmg.sha256" \
+            "src-tauri/target/aarch64-apple-darwin/release/bundle/macos/QuickDrop_${version}_aarch64.app.tar.gz" \
+            "src-tauri/target/aarch64-apple-darwin/release/bundle/macos/QuickDrop_${version}_aarch64.app.tar.gz.sig" \
             "src-tauri/target/x86_64-apple-darwin/release/bundle/dmg/QuickDrop_${version}_x64.dmg" \
             "src-tauri/target/x86_64-apple-darwin/release/bundle/dmg/QuickDrop_${version}_x64.dmg.sha256" \
+            "src-tauri/target/x86_64-apple-darwin/release/bundle/macos/QuickDrop_${version}_x64.app.tar.gz" \
+            "src-tauri/target/x86_64-apple-darwin/release/bundle/macos/QuickDrop_${version}_x64.app.tar.gz.sig" \
             --clobber
+
+  updater-manifest:
+    if: github.event_name != 'pull_request'
+    needs: [windows, macos]
+    runs-on: ubuntu-latest
+    env:
+      RELEASE_TAG: ${{ github.event.inputs.tag || github.ref_name }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ env.RELEASE_TAG }}
+          persist-credentials: false
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Download updater signatures
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release download "$RELEASE_TAG" --pattern "*.sig" --dir updater-signatures
+
+      - name: Generate and upload updater manifest
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          bun run scripts/generate-tauri-update-manifest.ts
+          gh release upload "$RELEASE_TAG" latest.json --clobber

AGENTS.md

@@ -7,7 +7,8 @@
 - Pull-request commits MUST NOT trigger release builds. Wait for review approval and merge first; only the release tag or an explicit manual rebuild may start the Windows Actions job.
 - After a user-facing change is validated, approved, and merged into `main`, agents MUST complete the work by starting the appropriate release with the official release command. A successful merge is not the delivery endpoint unless the user explicitly defers the release.
 - Linux desktop and `qd` binaries MUST be built locally and uploaded by `scripts/release.ts`; do not add a Linux GitHub Actions build.
+- Desktop updater bundles MUST be signed with the persistent Tauri updater key. The release host keeps it at `~/.config/quickdrop-release/updater.key`; GitHub Actions uses the `TAURI_SIGNING_PRIVATE_KEY` repository secret. Never generate a replacement key while existing updater-enabled builds are public.
 - Windows desktop installer and `qd.exe` MUST be built by `.github/workflows/release.yml` on `windows-latest`; do not attempt to cross-compile or publish them locally.
 - Apple Silicon and Intel macOS desktop DMGs and `qd` binaries MUST be built by `.github/workflows/release.yml` on a macOS runner; do not attempt to publish them from the Linux release host.
-- A release is complete only after the Linux assets are public, the Windows and macOS workflow jobs succeed, and every public download endpoint returns the matching release assets.
+- A release is complete only after the Linux assets are public, the Windows and macOS workflow jobs succeed, `latest.json` references all four signed desktop updater bundles, and every public download endpoint returns the matching release assets.
 - `bun run release:check` is the non-publishing validation command.

README.md

@@ -266,7 +266,7 @@ bun run release patch
 # or: bun run release 1.0.0
 ```
 
-The command keeps the desktop and CLI manifests aligned, validates them, builds and packages all Linux assets locally, commits the version, and atomically pushes `main` with its annotated tag. It immediately creates the GitHub release with the Linux desktop and CLI/TUI binaries plus checksum. The tag starts the platform Actions workflow, which adds the Windows installer and CLI/TUI assets plus the Apple Silicon and Intel macOS menu bar app and CLI/TUI assets. The command waits for that workflow and verifies every public download before succeeding. Linux is intentionally never built in Actions; use `bun run release:check` for a non-publishing manifest check.
+The command keeps the desktop and CLI manifests aligned, validates them, builds and packages all Linux assets locally, commits the version, and atomically pushes `main` with its annotated tag. It immediately creates the GitHub release with the Linux desktop and CLI/TUI binaries plus checksums and updater signature. The tag starts the platform Actions workflow, which adds the Windows installer and CLI/TUI assets, the Apple Silicon and Intel macOS menu bar app and CLI/TUI assets, signed desktop updater bundles, and `latest.json`. The command waits for that workflow and verifies every public download before succeeding. Linux is intentionally never built in Actions; use `bun run release:check` for a non-publishing manifest check.
 
 ### End-user installation
 
@@ -301,6 +301,8 @@ curl -fsSL https://quickdrop.eaedave.xyz/install.sh | bash
 
 The installer is idempotent and always installs or updates the complete Linux experience: the desktop/tray client, the `qd` CLI/TUI binary, the launcher, and the detected OmarchyBar or Waybar integration. It stores the selected backend in `~/.config/quickdrop/config.env`; rerun the same command to update every component.
 
+The Tauri desktop checks for updates shortly after launch on Linux, Windows, and macOS. When a signed update is available, QuickDrop asks before installing and restarting. Windows and macOS also expose **Verificar atualizações…** in the tray/menu bar. Update bundles are authenticated with the QuickDrop updater key on every platform. The macOS build uses an ad-hoc Apple signature rather than Developer ID notarization, so Gatekeeper may still require **Abrir Mesmo Assim** after installation or an update.
+
 ## Local backend with Docker
 
 Start the optional backend service together with PostgreSQL: