From 7d1ac57213a075b6a6d4b95bf5127820e8f14eea Mon Sep 17 00:00:00 2001
From: Wes <wesb@block.xyz>
Date: Wed, 25 Mar 2026 15:57:40 -0700
Subject: [PATCH] Fix desktop release updater signing flow

---
 desktop/RELEASING.md                     | 9 +++++++--
 desktop/scripts/build-release-config.mjs | 6 +-----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/desktop/RELEASING.md b/desktop/RELEASING.md
index 0154f6b2b17..ce7037c550d 100644
--- a/desktop/RELEASING.md
+++ b/desktop/RELEASING.md
@@ -74,7 +74,7 @@ The `sprout-desktop-release.yml` workflow:
    `Cargo.toml` using `set-version-from-tag.mjs`.
 3. **Regenerates `Cargo.lock`** to match the patched `Cargo.toml`.
 4. **Validates** all required secrets are present.
-5. **Builds** the release config with signing and updater settings.
+5. **Builds** the release config with the updater public key and endpoint.
 6. **Builds** the Tauri app (unsigned).
 7. **Signs and notarizes** the macOS bundle via `block/apple-codesign-action`.
 8. **Re-packages** the signed app into a DMG and updater archive.
@@ -89,7 +89,7 @@ The `sprout-desktop-release.yml` workflow:
 
 Local builds will not be codesigned or notarized — that only happens in CI
 via `block/apple-codesign-action`. Local builds are useful for testing the
-updater config and DMG packaging.
+updater runtime config and DMG packaging.
 
 ```bash
 # Set updater env vars
@@ -167,3 +167,8 @@ tag drives the version.
 - **Build failures**: If versions are wrong, check that the tag follows the
   format `desktop/v<semver>` (e.g. `desktop/v0.3.0`). CI extracts the version
   from the tag automatically.
+
+- **"A public key has been found, but no private key"**: The Tauri build should
+  not require `TAURI_SIGNING_PRIVATE_KEY`. If you see this, the build is trying
+  to generate updater artifacts before the signed app bundle exists. The updater
+  archive is supposed to be created and signed later from the notarized app.
diff --git a/desktop/scripts/build-release-config.mjs b/desktop/scripts/build-release-config.mjs
index 2a15673f0dc..0ffd7a6b870 100644
--- a/desktop/scripts/build-release-config.mjs
+++ b/desktop/scripts/build-release-config.mjs
@@ -13,17 +13,13 @@ const baseConfig = JSON.parse(readFileSync(baseConfigPath, "utf-8"));
 
 const releaseConfig = { ...baseConfig };
 
-releaseConfig.bundle = {
-  ...(releaseConfig.bundle ?? baseConfig.bundle ?? {}),
-  createUpdaterArtifacts: "v1Compatible",
-};
-
 releaseConfig.bundle.macOS = {
   ...(releaseConfig.bundle?.macOS ?? baseConfig.bundle?.macOS ?? {}),
   minimumSystemVersion: "10.15",
 };
 
 if (publicKey && endpoint) {
+  // Build-time updater artifacts are created later from the signed app bundle.
   releaseConfig.plugins = {
     ...(baseConfig.plugins ?? {}),
     updater: {