Bugfix: How to fix TAURI_SIGNING_PRIVATE_KEY 'Missing encoded key in...

Documentation for Sessions

🐛 Bugfix: How to fix TAURI_SIGNING_PRIVATE_KEY 'Missing encoded key in...

Date: 2026-02-25
Time: 21:35:18 UTC
Session: gspace1-142.2
Agent: orchestrator
Confidence: 98%
Status: ✅ Documented

📋 Decision Context

Question:

How to fix TAURI_SIGNING_PRIVATE_KEY 'Missing encoded key in secret key' error on macOS CI builds?

Task: Fix Vitto Desktop CI/CD release workflow

🎯 Decision Made

Chosen:

Set the GitHub Secret to the RAW content of ~/.tauri/vitto.key (which is already base64-encoded internally), NOT double-base64-encoded via base64 -i. Used gh secret set at repo level to bypass clipboard issues.

Options Considered:

  1. base64 -i ~/.tauri/vitto.key (double-encode — WRONG)
  2. cat ~/.tauri/vitto.key (raw content — CORRECT)
  3. Store key file path instead of content
  4. Use GitHub CLI gh secret set to bypass clipboard

💭 Reasoning

The ~/.tauri/vitto.key file generated by cargo tauri signer generate stores its content as a SINGLE base64 string (encoding 'untrusted comment: rsign encrypted secret key\n'). Running base64 -i ~/.tauri/vitto.key DOUBLE-encodes it, producing invalid data when Tauri decodes. The correct value for TAURI_SIGNING_PRIVATE_KEY is cat ~/.tauri/vitto.key | tr -d '\n'. Additionally, clipboard copy-paste introduced errors — using gh secret set --body programmatically is more reliable. Set at repo level since org-level required admin:org scope.

📁 Files Involved

🔗 Related

Auto-generated by MCP Smart Consolidation