# Publish a Tauri app for Linux

This guide adds Linux (`linux-x86_64`) to a Tauri 2 app that publishes to Mocco. Set up the app, the updater key, `tauri.conf.json` and the CI key first, as in [Publish a Tauri app](https://www.mocco.club/docs/en/articles/2pegvw-publish-tauri); everything there applies to Linux too.

## Pick a bundle

Use **AppImage**. It runs on most distributions, and the updater replaces it in place without an administrator:

| Bundle     | `tauri build --bundles` | Files in `src-tauri/target/release/bundle/` |
| ---------- | ----------------------- | ------------------------------------------- |
| AppImage   | `appimage`              | `appimage/App_0.2.0_amd64.AppImage` and `appimage/App_0.2.0_amd64.AppImage.sig` |
| deb        | `deb`                   | `deb/App_0.2.0_amd64.deb` and, with an updater plugin that installs packages, `deb/App_0.2.0_amd64.deb.sig` |
| rpm        | `rpm`                   | `rpm/App-0.2.0-1.x86_64.rpm` and, likewise, `rpm/App-0.2.0-1.x86_64.rpm.sig` |

With `createUpdaterArtifacts: true`, Tauri signs the AppImage itself for the updater, so the same file is both what people download and what the app installs. (With `"v1Compatible"`, the update bundle is a separate `.AppImage.tar.gz` with its own `.sig`; upload that as the update bundle instead.) Updating a `.deb` or `.rpm` install needs an updater plugin version that supports it, and asks for an administrator's password; check your plugin's release notes before you ship one.

A release has one installer and one update bundle per platform, so pick one bundle for `linux-x86_64`. Build on the oldest distribution you support (`ubuntu-22.04`, for example): an AppImage built on a newer one may not start on older systems.

Linux has no counterpart of Authenticode or notarization that Mocco checks. The updater signature is what protects installed apps: they verify every update against the public key compiled into them.

## The release step

On a Linux runner, after the build:

```yaml
- name: Publish to Mocco
  uses: fi-workers/mocco/actions/desktop-publish@<commit sha>
  with:
    app-id: <app id>
    version: ${{ steps.version.outputs.version }}
    notes-file: RELEASE_NOTES.md
    artifacts: |
      linux-x86_64 installer src-tauri/target/release/bundle/appimage/App_${{ steps.version.outputs.version }}_amd64.AppImage
      linux-x86_64 updater   src-tauri/target/release/bundle/appimage/App_${{ steps.version.outputs.version }}_amd64.AppImage
    channel: stable
  env:
    MOCCO_API_KEY: ${{ secrets.MOCCO_API_KEY }}
```

The same file is listed twice, once per kind; the `.sig` next to it is read for the `updater` line. For deb, use the two `deb/…_amd64.deb` lines instead (and `rpm/…` for rpm).

Mocco serves the update under `linux-x86_64` and under the key newer updater plugins look up first: `linux-x86_64-appimage`, or `linux-x86_64-deb` / `linux-x86_64-rpm` when the update bundle's name ends in `.deb` / `.rpm`. Nothing changes in `tauri.conf.json`: the endpoint's `{{target}}/{{arch}}` is already `linux/x86_64`.

## Publish with the other platforms

To ship macOS, Windows and Linux as one release, build each on its own runner and publish every file from one job: see [Build every platform, publish one release](https://www.mocco.club/docs/en/articles/bxpv24-publish-tauri-windows#build-every-platform-publish-one-release).

## Next

- [Publish a Tauri app for Windows](https://www.mocco.club/docs/en/articles/bxpv24-publish-tauri-windows): NSIS or MSI, and Authenticode.
- [Publish with curl](https://www.mocco.club/docs/en/articles/by2fx3-publish-with-curl): the same upload from any CI. Use the content type `application/octet-stream` for an AppImage or an rpm, and `application/vnd.debian.binary-package` for a deb.