kandev/docs/plans/desktop-tauri-app/task-05-signing-and-release-trust.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
05-signing-and-release-trust	Signing and release trust	done	3	04-release-desktop-artifacts	plan.md	../../specs/desktop-tauri-app/spec.md

Task 05: Signing and Release Trust

Acceptance

• macOS desktop release builds support Developer ID signing and notarization through GitHub Actions secrets.
• Windows desktop release builds support code signing through the selected signing mechanism.
• Missing signing inputs produce unsigned desktop artifacts with a release-notes warning.

Verification

rtk bash -lc 'cd apps && pnpm --filter kandev test -- release-config'
rtk git diff --check

Manual verification for maintainers:

rtk gh workflow run release.yml -f dry_run=true -f bump=patch

Files Likely Touched

• .github/workflows/release.yml
• apps/desktop/src-tauri/tauri.conf.json
• docs/desktop-tauri-signing.md
• apps/cli/src/release-config.test.ts

Dependencies

• Task 04.

Inputs

• Spec sections: What; Permissions; Failure modes; Scenarios.
• Plan sections: Release Pipeline > Signing.
• Tauri signing docs for macOS, Windows, Linux, and updater signing constraints.

Output Contract

When complete, update this file's status to done, update the Wave 3 checkbox in plan.md, and report changed files, tests run, blockers, and residual risks.