Tauri 2.0 Windows Build Creating .exe and .msi Installers

// tauri.conf.json - NSIS configuration
{
  "bundle": {
    "active": true,
    "targets": ["nsis"],
    "identifier": "com.mycompany.myapp",
    "icon": ["icons/icon.ico"],
    
    "windows": {
      "certificateThumbprint": null,
      "digestAlgorithm": "sha256",
      "timestampUrl": "",
      
      "nsis": {
        // Installer configuration
        "installerIcon": "icons/installer.ico",
        "headerImage": "installer/header.bmp",
        "sidebarImage": "installer/sidebar.bmp",
        
        // Installation options
        "installMode": "perMachine",  // or "currentUser"
        "allowDowngrades": true,
        "perMachineUpgrade": true,
        
        // Shortcuts
        "createDesktopShortcut": "always",  // "always", "never", "prompt"
        "createStartMenuShortcut": true,
        
        // Custom languages
        "languages": ["English", "Spanish", "French", "German"],
        
        // License file
        "license": "LICENSE.rtf",
        
        // Custom NSIS script
        "template": null,
        
        // Display language selector
        "displayLanguageSelector": false
      }
    }
  }
}

// Build NSIS installer
npm run tauri build -- --target nsis

// Output location:
// src-tauri/target/release/bundle/nsis/MyApp_1.0.0_x64-setup.exe

// Custom NSIS script (advanced)
// Create custom-installer.nsi
!include "MUI2.nsh"

Name "MyApp"
OutFile "MyApp-Setup.exe"
InstallDir "$PROGRAMFILES64\MyApp"

# Modern UI settings
!define MUI_ABORTWARNING
!define MUI_ICON "icons\installer.ico"
!define MUI_UNICON "icons\uninstaller.ico"
!define MUI_HEADERIMAGE
!define MUI_HEADERIMAGE_BITMAP "installer\header.bmp"
!define MUI_WELCOMEFINISHPAGE_BITMAP "installer\sidebar.bmp"

# Pages
!insertmacro MUI_PAGE_WELCOME
!insertmacro MUI_PAGE_LICENSE "LICENSE.txt"
!insertmacro MUI_PAGE_COMPONENTS
!insertmacro MUI_PAGE_DIRECTORY
!insertmacro MUI_PAGE_INSTFILES
!insertmacro MUI_PAGE_FINISH

!insertmacro MUI_UNPAGE_WELCOME
!insertmacro MUI_UNPAGE_CONFIRM
!insertmacro MUI_UNPAGE_INSTFILES
!insertmacro MUI_UNPAGE_FINISH

# Languages
!insertmacro MUI_LANGUAGE "English"

# Installation section
Section "MyApp" SecMain
  SetOutPath "$INSTDIR"
  
  # Copy files
  File /r "release\*.*"
  
  # Create shortcuts
  CreateDirectory "$SMPROGRAMS\MyApp"
  CreateShortcut "$SMPROGRAMS\MyApp\MyApp.lnk" "$INSTDIR\MyApp.exe"
  CreateShortcut "$DESKTOP\MyApp.lnk" "$INSTDIR\MyApp.exe"
  
  # Registry keys
  WriteRegStr HKLM "Software\MyApp" "InstallPath" "$INSTDIR"
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\MyApp" \
    "DisplayName" "MyApp"
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\MyApp" \
    "UninstallString" "$INSTDIR\Uninstall.exe"
  
  # Create uninstaller
  WriteUninstaller "$INSTDIR\Uninstall.exe"
SectionEnd

# Uninstaller section
Section "Uninstall"
  # Remove files
  RMDir /r "$INSTDIR"
  
  # Remove shortcuts
  Delete "$SMPROGRAMS\MyApp\MyApp.lnk"
  Delete "$DESKTOP\MyApp.lnk"
  RMDir "$SMPROGRAMS\MyApp"
  
  # Remove registry keys
  DeleteRegKey HKLM "Software\MyApp"
  DeleteRegKey HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\MyApp"
SectionEnd

// Silent installation
MyApp-Setup.exe /S

// Custom install directory
MyApp-Setup.exe /D=C:\CustomPath\MyApp

// tauri.conf.json - WiX MSI configuration
{
  "bundle": {
    "targets": ["msi"],
    "windows": {
      "wix": {
        // WiX configuration
        "language": ["en-US"],
        "dialogImagePath": "installer/dialog.bmp",
        "bannerPath": "installer/banner.bmp",
        
        // Custom WiX source
        "template": null,
        
        // Component group refs
        "componentRefs": [],
        
        // Feature refs
        "featureRefs": [],
        
        // Merge modules
        "mergeRefs": [],
        
        // Skip webview install
        "skipWebviewInstall": false,
        
        // License
        "license": "LICENSE.rtf",
        
        // Enable elevated update
        "enableElevatedUpdateRuntime": false
      }
    }
  }
}

// Build MSI package
npm run tauri build -- --target msi

// Custom WiX template (advanced)
// Create custom.wxs
<?xml version="1.0" encoding="UTF-8"?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
  <Product
    Id="*"
    Name="MyApp"
    Language="1033"
    Version="1.0.0"
    Manufacturer="MyCompany"
    UpgradeCode="{YOUR-GUID-HERE}">
    
    <Package
      InstallerVersion="500"
      Compressed="yes"
      InstallScope="perMachine"
      Description="MyApp Installer"
      Comments="MyApp - A powerful desktop application" />
    
    <!-- Media -->
    <Media Id="1" Cabinet="myapp.cab" EmbedCab="yes" />
    
    <!-- Upgrade handling -->
    <MajorUpgrade
      DowngradeErrorMessage="A newer version is already installed."
      AllowSameVersionUpgrades="yes" />
    
    <!-- Installation directory -->
    <Directory Id="TARGETDIR" Name="SourceDir">
      <Directory Id="ProgramFiles64Folder">
        <Directory Id="INSTALLDIR" Name="MyApp">
          <!-- Application files -->
          <Component Id="MainExecutable" Guid="{GUID}">
            <File
              Id="MyAppExe"
              Source="MyApp.exe"
              KeyPath="yes"
              Checksum="yes" />
            
            <!-- Start Menu shortcut -->
            <Shortcut
              Id="StartMenuShortcut"
              Directory="ProgramMenuFolder"
              Name="MyApp"
              WorkingDirectory="INSTALLDIR"
              Icon="AppIcon.exe"
              IconIndex="0"
              Advertise="yes" />
            
            <!-- Desktop shortcut -->
            <Shortcut
              Id="DesktopShortcut"
              Directory="DesktopFolder"
              Name="MyApp"
              WorkingDirectory="INSTALLDIR"
              Icon="AppIcon.exe"
              IconIndex="0"
              Advertise="yes" />
            
            <!-- Registry keys -->
            <RegistryValue
              Root="HKCU"
              Key="Software\MyCompany\MyApp"
              Name="InstallPath"
              Type="string"
              Value="[INSTALLDIR]"
              KeyPath="no" />
          </Component>
        </Directory>
      </Directory>
      
      <!-- Program Menu folder -->
      <Directory Id="ProgramMenuFolder" />
      
      <!-- Desktop folder -->
      <Directory Id="DesktopFolder" Name="Desktop" />
    </Directory>
    
    <!-- Features -->
    <Feature Id="Complete" Level="1">
      <ComponentRef Id="MainExecutable" />
    </Feature>
    
    <!-- UI -->
    <UIRef Id="WixUI_InstallDir" />
    <Property Id="WIXUI_INSTALLDIR" Value="INSTALLDIR" />
    
    <!-- Icon -->
    <Icon Id="AppIcon.exe" SourceFile="MyApp.exe" />
    <Property Id="ARPPRODUCTICON" Value="AppIcon.exe" />
    
    <!-- Add/Remove Programs -->
    <Property Id="ARPHELPLINK" Value="https://myapp.com/support" />
    <Property Id="ARPURLINFOABOUT" Value="https://myapp.com" />
  </Product>
</Wix>

// Build custom WiX installer
candle.exe custom.wxs
light.exe custom.wixobj -out MyApp.msi

// Silent MSI installation
msiexec /i MyApp.msi /qn

// MSI with logging
msiexec /i MyApp.msi /l*v install.log

// Uninstall MSI
msiexec /x MyApp.msi /qn

// 1. Obtain code signing certificate
// Options:
// - DigiCert, Sectigo, GlobalSign ($200-400/year)
// - SSL.com ($200/year)
// - Certum ($70/year)

// 2. Export certificate with private key (.pfx)

// 3. Configure Tauri for signing
// tauri.conf.json
{
  "bundle": {
    "windows": {
      "certificateThumbprint": "YOUR_CERT_THUMBPRINT",
      "digestAlgorithm": "sha256",
      "timestampUrl": "http://timestamp.digicert.com"
    }
  }
}

// Get certificate thumbprint (PowerShell)
Get-ChildItem -Path Cert:\CurrentUser\My

// Or from .pfx file
certutil -dump certificate.pfx

// Manual signing with signtool
// Install Windows SDK for signtool.exe

// Sign executable
signtool sign /f certificate.pfx /p password /fd SHA256 \
  /tr http://timestamp.digicert.com /td SHA256 \
  /d "MyApp" /du "https://myapp.com" \
  MyApp.exe

// Verify signature
signtool verify /pa /v MyApp.exe

// Environment variables for CI/CD
// GitHub Actions
env:
  WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
  WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
  TAURI_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
  TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}

// Decode and import certificate in CI
- name: Import Certificate
  run: |
    $pfxPath = "$env:TEMP\certificate.pfx"
    $pfxBytes = [System.Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
    [IO.File]::WriteAllBytes($pfxPath, $pfxBytes)
    Import-PfxCertificate -FilePath $pfxPath \
      -CertStoreLocation Cert:\CurrentUser\My \
      -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
  shell: powershell

// Sign after build
- name: Sign Installer
  run: |
    $installers = Get-ChildItem -Path "src-tauri/target/release/bundle" -Filter "*.exe" -Recurse
    foreach ($installer in $installers) {
      & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" sign `
        /f "$env:TEMP\certificate.pfx" `
        /p "$env:WINDOWS_CERTIFICATE_PASSWORD" `
        /fd SHA256 `
        /tr http://timestamp.digicert.com `
        /td SHA256 `
        /d "MyApp" `
        $installer.FullName
    }
  shell: powershell

// SmartScreen reputation
// - New certificates trigger warnings
// - Build reputation through:
//   1. Extended Validation (EV) certificate (instant trust)
//   2. Standard certificate + downloads over time
//   3. Submit to Microsoft SmartScreen for review