mirror of
https://github.com/BigBodyCobain/Shadowbroker.git
synced 2026-09-19 07:32:22 +02:00
139 lines
4.9 KiB
Markdown
139 lines
4.9 KiB
Markdown
# Desktop Release Guide
|
|
|
|
This directory now has a repeatable desktop release path with branded bundle
|
|
icons, checksum output, Tauri updater artifacts, and a local updater signing
|
|
key path, but **not** full Windows/macOS distribution signing/notarization.
|
|
|
|
## Entry points
|
|
|
|
Use any of these:
|
|
|
|
```bash
|
|
# POSIX shell
|
|
./build.sh
|
|
|
|
# Windows PowerShell
|
|
./build.ps1
|
|
|
|
# Cross-platform npm wrapper
|
|
npm --prefix desktop-shell run build:desktop
|
|
```
|
|
|
|
Use `--clean` when you want to wipe the previous static export, companion
|
|
bundle, managed backend bundle, generated icons, and old installer outputs
|
|
before rebuilding.
|
|
|
|
Prerequisites:
|
|
|
|
- Rust toolchain
|
|
- `cargo tauri` available via `cargo install tauri-cli@^2`
|
|
- Node.js / npm with the frontend dependencies already installed
|
|
- On Windows, an x64 Python 3.11 backend venv with the production dependencies
|
|
installed. The venv is used only as a package source and is never shipped.
|
|
|
|
## CI / GitHub Actions
|
|
|
|
The repo also has a desktop matrix workflow at:
|
|
|
|
```text
|
|
.github/workflows/desktop-release.yml
|
|
```
|
|
|
|
What it does today:
|
|
|
|
- builds unsigned desktop artifacts on Windows, macOS, and Linux
|
|
- uploads bundle artifacts for PRs and branch builds
|
|
- on `v*.*.*` tags, attaches release assets to the GitHub release
|
|
- forwards Apple signing/notarization secrets to the macOS build **if** they
|
|
exist, but does not require them
|
|
|
|
See [RELEASE_INPUTS.md](./RELEASE_INPUTS.md) for the plain-language answer to
|
|
"what would I need later?".
|
|
|
|
## What the build does
|
|
|
|
1. Generates the desktop icon set in `src-tauri/icons/`
|
|
2. Stages a desktop-only frontend export tree that omits Next server-only
|
|
routes/proxy (`src/app/api`, `src/proxy.ts`)
|
|
3. Stages a managed backend runtime bundle into `src-tauri/backend-runtime/`.
|
|
Windows builds use the checksum-pinned official Python 3.11.9 embeddable
|
|
distribution plus the backend venv's installed packages; they never copy
|
|
`pyvenv.cfg` or a host-bound venv launcher.
|
|
4. Builds the frontend export with `NEXT_OUTPUT=export`
|
|
5. Copies `frontend/out` into `src-tauri/companion-www/`
|
|
6. Runs `cargo tauri build`
|
|
7. Writes:
|
|
- `src-tauri/target/release/bundle/SHA256SUMS.txt`
|
|
- `src-tauri/target/release/bundle/release-manifest.json`
|
|
- `src-tauri/target/release/bundle/latest.json` when signed updater
|
|
artifacts are present
|
|
|
|
For CI/release builds, the backend release-gate attestation is also staged into
|
|
the managed backend bundle at `backend-runtime/data/release_attestation.json`,
|
|
and the managed-backend updater refreshes that file on version sync without
|
|
overwriting the rest of the runtime `data/` directory.
|
|
|
|
The Windows staging step fails the build if virtualenv metadata or an absolute
|
|
build-machine Python path reaches the bundle. It also renames the completed
|
|
runtime and launches the embedded interpreter from the relocated path before
|
|
Tauri packaging begins. Set `SHADOWBROKER_PYTHON_EMBED_ZIP` to an offline copy
|
|
of `python-3.11.9-embed-amd64.zip`; the pinned SHA-256 is still enforced. Set
|
|
`SHADOWBROKER_BACKEND_PYTHON` only when the production backend interpreter is
|
|
outside the normal `backend/venv` location.
|
|
|
|
When an installed runtime layout changes, the desktop updater removes legacy
|
|
virtualenv directories and their marker after copying the new bundle. The
|
|
operator's `.env`, `data/`, and unrelated runtime files remain preserved.
|
|
|
|
## Release artifacts
|
|
|
|
Artifacts are emitted under:
|
|
|
|
```text
|
|
desktop-shell/tauri-skeleton/src-tauri/target/release/bundle/
|
|
```
|
|
|
|
Expected bundle types vary by platform:
|
|
|
|
- Windows: `.msi`, `.exe`
|
|
- macOS: `.dmg`, `.app`-related archives
|
|
- Linux: `.deb`, `.AppImage`
|
|
|
|
## What is still manual
|
|
|
|
- Windows code signing
|
|
- macOS notarization/signing credentials
|
|
- Publishing `latest.json` plus the signed updater installer assets to the
|
|
GitHub release
|
|
- Final splash/installer copy polish
|
|
|
|
## Tauri updater notes
|
|
|
|
The updater public key is baked into `src-tauri/tauri.conf.json`. Keep the
|
|
private key in `release-secrets/shadowbroker-updater.key` and its local
|
|
password file in `release-secrets/shadowbroker-updater.key.pass`, or provide
|
|
the same values through `TAURI_SIGNING_PRIVATE_KEY` and
|
|
`TAURI_SIGNING_PRIVATE_KEY_PASSWORD` at build time. The local
|
|
`release-secrets/` folder is gitignored.
|
|
|
|
The production updater endpoint is:
|
|
|
|
```text
|
|
https://github.com/BigBodyCobain/Shadowbroker/releases/latest/download/latest.json
|
|
```
|
|
|
|
For GitHub releases, upload `latest.json`, the installer (`.msi` / `.exe`), and
|
|
the matching `.sig` files generated under `src-tauri/target/release/bundle/`.
|
|
Tauri updater signing verifies update packages only; it does not remove Windows
|
|
SmartScreen warnings. Windows public trust still requires a real code-signing
|
|
certificate later.
|
|
|
|
## Trust model reminder
|
|
|
|
The packaged build still uses:
|
|
|
|
- a bundled local backend runtime that the desktop app owns by default
|
|
- Rust-authoritative policy enforcement for privileged local control
|
|
- the packaged loopback app server for same-origin non-privileged `/api/*`
|
|
- reduced-trust browser companion mode with no native bridge injection
|