Desktop Release
A desktop app people download from the internet has to be signed so the OS opens it: Gatekeeper refuses an unsigned or un-notarized macOS app, and SmartScreen warns on an unsigned Windows program.
akan build-desktop signs with --sign and notarizes with --notarize, using the identity the environment names; the environment alone signs nothing. It packs the file people download with --installer true, and picks a Windows or Linux app's CPU with --arch; a macOS app is Apple silicon only.Terminal
A desktop app is built on its own OS: a Mac builds the macOS app, a Windows PC the Windows one. The CI recipe below runs one job per OS instead of cross-compiling.
Signing
macOS
With
--sign, a Developer ID Application certificate signs every Mach-O file inside out — the server's native addons and bin included — with the hardened runtime and a secure timestamp. The executable gets Bun's JIT entitlements, and the camera's or microphone's when a usage text asks for them; native.desktop.entitlements adds the app's own. --notarize then submits the app, staples the ticket and checks it with spctl.AKAN_NATIVE_MACOS_IDENTITY— A keychain identity by name (“Developer ID Application: Name (TEAMID)”) or SHA-1. A Mac that already holds the certificate needs only this.AKAN_NATIVE_MACOS_CERTIFICATE + _PASSWORD— A .p12 file and its password. The build imports it into a keychain of its own and deletes it afterwards: the CI way.AKAN_NATIVE_MACOS_NOTARY_KEY + _KEY_ID + _ISSUER— An App Store Connect API key (the AuthKey_XXXX.p8 file, its key id, the issuer id): the credentials--notarizesubmits and staples with.AKAN_NATIVE_MACOS_NOTARY_PROFILE— Instead of the key: a profilexcrun notarytool store-credentialssaved in the keychain.
Windows
With
--sign, Authenticode signs every PE file of the app — the executable, its DLL, the server's addons and bin — SHA-256 with an RFC 3161 timestamp, and verifies them. signtool comes from the Windows SDK (AKAN_NATIVE_SIGNTOOL names another).AKAN_NATIVE_WINDOWS_CERTIFICATE + _PASSWORD— A .pfx file and its password.AKAN_NATIVE_WINDOWS_THUMBPRINT— A certificate in the Windows store by its SHA-1 thumbprint: a USB token's or an HSM's.AKAN_NATIVE_WINDOWS_SIGN_COMMAND— Any other signer as a JSON array, run once per file with {file} replaced, e.g. signtool with Azure Trusted Signing: ["signtool","sign","/fd","SHA256","/tr","http://timestamp.acs.microsoft.com","/td","SHA256","/dlib","Azure.CodeSigning.Dlib.dll","/dmdf","metadata.json","{file}"].AKAN_NATIVE_WINDOWS_TIMESTAMP_URL— The RFC 3161 timestamp server. Default http://timestamp.digicert.com.
An update release must be signed the same way: the updater checks the installed app's signature, so a signed installed app accepts only a release
akan publish-update --sign signed with the same identity.Installers And CPU
- macOS ·
<fileName>-<version>-<arch>.dmg— The app beside an Applications link, opening on a drag-to-Applications window with the app's icon on the disk.native.desktop.dmgreplaces the background (background,background2x) and moves the window and icons. Signed, notarized and stapled like the app. - Windows ·
<fileName>-<version>-<arch>-setup.exe— A per-user NSIS setup (/Sinstalls silently). The setup and the uninstaller it writes are signed too. - Linux ·
<fileName>-<version>-<arch>.AppImage— One executable file for any distribution with WebKitGTK 4.1 and GTK 3. The build needsmksquashfs(squashfs-tools). An AppImage cannot update itself.
--arch arm64 or --arch x64 builds a Windows or Linux app for that CPU of the OS: the Rust library, Bun's executable, the server's bun install --cpu and each bin file follow it. A macOS app is Apple silicon (arm64) only; Intel Macs are not a target.Native Addons
A server package with a
.node addon needs a binary for the target OS and CPU that links nothing outside the system, such as a ROS install under /opt or Homebrew. One that compiles itself at install goes in trustedDependencies, since Bun runs no install script of an untrusted package. The build lists any addon that would fail on a user's computer and stops.CI Recipe
One job per OS on GitHub Actions: install, build, sign, pack and upload. Store the certificate and the notary key base64-encoded in repository secrets; each is written to the runner's temp folder and named by its variable, and no password reaches a file.
.github/workflows/desktop-release.yml
Replace myapp with the app's name and give the env its server configuration as the image's deployment does. macOS runners carry codesign and notarytool, Windows runners the Windows SDK's signtool and NSIS.