Automatic Desktop Updates with Signed Installers
A Tauri app that checks for, verifies and installs its own updates from an internal release feed.
- Runs out of the box: yes
- Tests: no
- CI: yes
- Docs: yes
- Used in production: no
Learning demo, not turnkey. This example is experimental: it shows an idea that works on the bench, but it has not been reviewed for production use. Expect rough edges and check with the owner before reusing it.
Purpose#
A deliberately tiny desktop application built to find out what automatic updates really involve before a product team commits to them. It polls a static release feed, downloads the installer, verifies a detached signature and relaunches into the new version.
The pipeline signs every installer and publishes the feed entry only after the signature verifies, so a half-finished release can never be offered to a running client.
What you will learn#
- Publish a static update feed from CI and consume it from a desktop client
- Verify a detached signature before running a downloaded installer
Technologies & features#
- Technologies
- RustTauriGitHub ActionsCargo
- Features
- Automatic UpdateCode SigningContinuous Delivery
- Topics
- Update DeliveryprimarySoftware Integrity
Lessons learned#
- Worked
Generating the feed entry as the last pipeline step meant clients never saw a release whose installer or signature was missing.
- Didn’t work
Our first internal certificate was not trusted on locked-down machines, so installers were blocked silently. Distributing the signing root through device management fixed it.
- Decision
The client only ever moves forward. A downgrade requires a new, higher version number carrying the older code.
- Limitation
Updates cannot be applied while the app runs elevated by another user; those clients must be updated manually.
Try it#
git clone https://git.example.internal/developer-experience/auto-update-spike.git
cd auto-update-spike
cargo tauri dev
# in another terminal, serve a newer build as the feed:
./tools/serve-feed.sh --version 0.2.0Commands come from the owner’s README. Credentials are never stored here.
