CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

docs: build-and-sign Mac App Store Tauri section, pitfall 114, changelog

Browse source
This commit is contained in:
CRTkafa 2026-10-24 12:16:19 +08:00
parent f588f4e1aa
commit 33a7f73ab9
3 changed files with 54 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
skills/build-and-sign/SKILL.md
View file

@ -85,6 +85,32 @@ when the owner said so for this run). The MCP server offers only `apple_signing_
6. **Next.** `storebound apple encryption --build N`, `storebound apple testflight distribute --build N --group Team
--dry` (`testflight` skill), `storebound apple listing --version x.y.z --build N` (`appstore-first-release`).
## Mac App Store: a Tauri app (.pkg)
`storebound apple build --platform macos --tauri apps/desktop/src-tauri --path-free --dry` prints the plan; without
`--dry` it runs in the Mac's logged-in GUI session (not over SSH: write a .command file and `open -a Terminal` it):
1. Version from `--version` or tauri.conf.json, build number from `--build-number` or the next free one on App Store
Connect for macOS (CFBundleVersion must increase). `tauri.conf.json` `identifier` must equal `apple.bundleId`.
2. Identities from the login keychain: "Apple Distribution" (or "3rd Party Mac Developer Application") and "Mac
Installer Distribution" (or "3rd Party Mac Developer Installer"). The installer one is its own certificate type
(`apple.signing.certificateType: 'MAC_INSTALLER_DISTRIBUTION'`, `apple signing ensure`).
3. Provisioning profile: `--profile`, else an installed one, else the active `MAC_APP_STORE` profile from the API
(`apple.signing.profileType: 'MAC_APP_STORE'`).
4. `tauri build --bundles app --target universal-apple-darwin --config <overlay>`: the overlay sets the signing identity,
the generated entitlements (app sandbox, application / team identifier, your own keys kept), the embedded profile,
hardened runtime and `bundleVersion`. Set `bundle.category` and `bundle.macOS.minimumSystemVersion` in
tauri.conf.json (the build stops without LSApplicationCategoryType / LSMinimumSystemVersion).
5. Checks of the .app (sandbox, no get-task-allow, profile inside, version / build), `codesign --verify`, then
`productbuild --component <app> /Applications --sign <installer identity>` and `pkgutil --check-signature`.
6. `--path-free`: rustc remaps the checkout, CARGO_HOME, RUSTUP_HOME and the home folder, no debug info, symbols stripped;
the build fails when the home folder or user name is still in the app. `--unsigned` runs the pipeline without
identities (not uploadable). Result: `<out>/export/<version>-<build>/<Product>.pkg` (`--out`, default `build/macos`).
Then `storebound apple upload <pkg> --platform macos --dry` and without `--dry` (App Store Connect build upload,
platform MAC_OS, or `--via altool`). The .pkg is checked first (installer signature); the build shows up in the macOS
version's build list once processed. Details and fixes: `store-pitfalls` 119.
## Android
1. **Upload key.** Generate once (`keytool -genkeypair -v -storetype PKCS12 -keystore upload.p12 -alias upload