tauri-apps/tauri · error · tauri_cli::error::Error

Key generation aborted: Unable to find the private key

Error message

Key generation aborted: Unable to find the private key

What it means

`tauri signer sign` needs your updater private key. It reads `--private-key-path` (or env TAURI_SIGNING_PRIVATE_KEY_PATH), else takes `--private-key` (env TAURI_SIGNING_PRIVATE_KEY; legacy TAURI_PRIVATE_KEY/TAURI_PRIVATE_KEY_PATH still honored). If after all of that no key is present, it aborts before signing.

Source

Thrown at crates/tauri-cli/src/signer/sign.rs:84

      "TAURI_PRIVATE_KEY_PASSWORD",
      "TAURI_SIGNING_PRIVATE_KEY_PASSWORD",
    )
  });
  options
}

pub fn command(mut options: Options) -> Result<()> {
  options = backward_env_vars(options);

  options.private_key = if let Some(private_key) = options.private_key_path {
    Some(std::fs::read_to_string(Path::new(&private_key)).expect("Unable to extract private key"))
  } else {
    options.private_key
  };
  let private_key = if let Some(pk) = options.private_key {
    pk
  } else {
    crate::error::bail!("Key generation aborted: Unable to find the private key");
  };

  if options.password.is_none() {
    println!("Signing without password.");
  }

  let (manifest_dir, signature) =
    sign_file(&secret_key(private_key, options.password)?, options.file)
      .with_context(|| "failed to sign file")?;

  println!(
           "\nYour file was signed successfully, You can find the signature here:\n{}\n\nPublic signature:\n{}\n\nMake sure to include this into the signature field of your update server.",
           display_path(manifest_dir),
           base64::engine::general_purpose::STANDARD.encode(signature.to_string())
         );

  Ok(())
}

View on GitHub (pinned to 52e4b6e71d)

Solutions

1. Pass the key explicitly: `tauri signer sign -f ~/.tauri/myapp.key <file>`.
2. Or export the env var: `export TAURI_SIGNING_PRIVATE_KEY=$(cat ~/.tauri/myapp.key)` (or TAURI_SIGNING_PRIVATE_KEY_PATH pointing at the file).
3. If you have no key yet, generate one: `tauri signer generate -w ~/.tauri/myapp.key`.
4. Print env presence (never the value) to debug CI: `[ -n "$TAURI_SIGNING_PRIVATE_KEY" ] && echo set`.

Example fix

# before
tauri signer sign ./target/release/bundle/macos/MyApp.app.tar.gz
# error: Key generation aborted: Unable to find the private key

# after
tauri signer sign \
  -f ~/.tauri/myapp.key \
  -p "$TAURI_SIGNING_PRIVATE_KEY_PASSWORD" \
  ./target/release/bundle/macos/MyApp.app.tar.gz

#!/usr/bin/env bash
# Fail fast with a clear message before invoking the signer
: "${TAURI_SIGNING_PRIVATE_KEY:?set TAURI_SIGNING_PRIVATE_KEY or pass -k/-f}"
tauri signer sign "$@"

When it happens

Trigger: Invoking `tauri signer sign <file>` with neither -k/-f flags nor any of the TAURI_*_PRIVATE_KEY(_PATH) environment variables set; or setting the password var but forgetting the key var; or a typo'd env var name in CI.

Common situations: CI jobs where secrets were not injected; local terminal missing the exported env vars from .zshrc; migrating from deprecated TAURI_PRIVATE_KEY vars and dropping them before adding the new ones.

Related errors

• system clock is incorrect
• Failed to generate key
• Unable to write keypair
• Android SDK not found. Make sure the SDK and NDK are install
• invalid permission {p}

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/8e95a9cd552adfbd. Report an issue: GitHub.