Auto-Updates with plugin-updater

"An update channel is a pipe straight into your users' machines. Sign what flows through it, or you've built an attacker's dream."

What the Updater Does

The updater plugin lets a shipped app check for, download, and install new versions itself — no trip to a store. The app periodically checks an endpoint you host, compares versions, and if there's a newer one, downloads and applies it. For directly-distributed desktop apps, this is how you push fixes without asking every user to re-download manually.

Signatures Are the Trust Anchor

Here's the part you must not get wrong. An update is a binary you're about to run on users' machines, so it has to be cryptographically signed. You generate a keypair with tauri signer generate: the public key goes into tauri.conf.json (baked into the app), and the private key signs each update bundle at release time. Before installing, the app verifies the bundle's signature against its built-in public key. This means even if an attacker takes over your update server, they can't push malware — they don't have your private key, so the signature check fails. The trust is in the signature, never in the URL.

The Manifest and the Flow

Your update endpoint serves a small JSON manifest describing the latest version, its download URLs per platform, and the signature. The plugin fetches it, decides if an update applies, and (with the right capability) downloads and installs. You decide the UX: silent background updates, or prompt-and-confirm. Either way, guard that private signing key like the keys to the kingdom — it is exactly that.

Code

Generating the update-signing keypair·bash

# Generate the updater keypair (do this once; keep the private key SAFE).
npm run tauri signer generate -- -w ~/.tauri/myapp.key
# Prints a public key → paste into tauri.conf.json updater.pubkey
# The private key (and its password) sign update bundles at release.

Checking for and applying a (verified) update·tsx

import { check } from "@tauri-apps/plugin-updater";
import { relaunch } from "@tauri-apps/plugin-process";

const update = await check();   // hits your manifest endpoint
if (update) {
  // Signature is verified by the plugin before this resolves.
  await update.downloadAndInstall();
  await relaunch();             // restart into the new version
}

Exercise

Describe the full update trust chain for your app in your own words: where the keypair comes from, which key goes in the app vs which signs releases, what the manifest contains, and the exact reason a compromised update server still can't push malware. Then state where you'd store the private key. You're proving you understand why signatures — not URLs — secure auto-updates.

Hint

tauri signer generate → public key in tauri.conf (shipped in app), private key signs bundles. Manifest lists version + per-platform URLs + signature. A hijacked server can't forge a signature without the private key, so the app rejects the bad bundle. Private key → protected CI secret + secure backup.