T-7270-polish-tauri-code-signing
Status: closed/obsoleted · Impact: medium · Complexity: medium
The polish desktop bundle (com.sksizer.vaultpolish) must be code-signed
(and, on macOS, notarized) to be distributable without OS security warnings.
The monorepo has no signing configuration or secrets for it. Establish the
signing identity and wire it into the release build.
| Location | Role today |
|---|---|
apps/legacy-polish/src-tauri/tauri.conf.json | identifier: com.sksizer.vaultpolish; macOS entitlements set; no signing/notarization config |
| release pipeline | no polish signing identity or secrets configured |
Proposed
Section titled “Proposed”Release builds produce signed (and notarized) bundles; signing identity and secrets are stored securely and referenced by the release job.
Approach
Section titled “Approach”- Obtain the signing identity (owner-provided: Apple Developer ID cert + notarization credentials for macOS; equivalents for other targets).
- Add signing config to
tauri.conf.json/ the release environment. - Store secrets securely (release-secret store) and reference them from the release job.
Requires owner-provided credentials — cannot be completed by an agent alone.
Files to touch
Section titled “Files to touch”| Location | Kind | Change |
|---|---|---|
apps/legacy-polish/src-tauri/tauri.conf.json | modify | bundle signing / notarization config |
.github/workflows/ | modify | signing secrets wired into the release job |
Acceptance criteria
Section titled “Acceptance criteria”- AC-1: a release build emits a signed bundle (verifiable via
codesign/spctlon macOS or the platform equivalent). - AC-2: signing secrets are stored securely, not committed.
Out of scope
Section titled “Out of scope”- The release/versioning scheme itself (tracked in
T-LH85).
Dependencies
Section titled “Dependencies”T-LH85— signing plugs into the release path.- Owner-provided signing credentials.
Discovery context
Section titled “Discovery context”apps/legacy-polish/MIGRATION.md“Owner-gated remainder” item 5 (Tauri signing / bundle identifiers) — deferred at import.