Add Windows ARM64 release packaging

Author: misrasaurabh1

.github/workflows/release-windows.yml

@@ -97,8 +97,8 @@ jobs:
         run: npm run build
         working-directory: apps/desktop
 
-  windows-x64:
-    name: Build and publish Windows x64
+  windows:
+    name: Build and publish Windows x64 and ARM64
     needs: release-preflight
     runs-on: windows-latest
     env:
@@ -158,6 +158,9 @@ jobs:
       - name: Select stable Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - name: Install Windows ARM64 Rust target
+        run: rustup target add aarch64-pc-windows-msvc
+
       - name: Cache Rust build
         uses: Swatinem/rust-cache@v2
 
@@ -228,13 +231,13 @@ jobs:
           tenant-id: ${{ env.AZURE_TENANT_ID }}
           subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
 
-      - name: Prepare unsigned Windows sidecars
+      - name: Prepare unsigned Windows x64 sidecars
         shell: pwsh
         env:
           LOCALITY_WINDOWS_EXTERNAL_CODESIGN: ""
         run: ./apps/desktop/scripts/prepare-windows-bundle.ps1
 
-      - name: Sign Windows sidecars
+      - name: Sign Windows x64 sidecars
         if: steps.windows-signing.outputs.enabled == 'true'
         uses: azure/artifact-signing-action@v2
         with:
@@ -246,7 +249,7 @@ jobs:
           timestamp-rfc3161: http://timestamp.acs.microsoft.com
           timestamp-digest: SHA256
 
-      - name: Validate signed Windows sidecars
+      - name: Validate signed Windows x64 sidecars
         if: steps.windows-signing.outputs.enabled == 'true'
         shell: pwsh
         run: |
@@ -255,13 +258,49 @@ jobs:
             Assert-LocalityWindowsSigned -Path (Join-Path "apps/desktop/src-tauri/windows" $name)
           }
 
-      - name: Build, sign, and validate Windows installer
+      - name: Build, sign, and validate Windows x64 installer
         shell: pwsh
         env:
           LOCALITY_WINDOWS_BUNDLE_PREPARED: "1"
           PUBLISH_ALLOW_DIRTY: "1"
         run: ./scripts/publish-windows.ps1
 
+      - name: Prepare unsigned Windows ARM64 sidecars
+        shell: pwsh
+        env:
+          LOCALITY_WINDOWS_EXTERNAL_CODESIGN: ""
+          LOCALITY_WINDOWS_TARGET: aarch64-pc-windows-msvc
+        run: ./apps/desktop/scripts/prepare-windows-bundle.ps1
+
+      - name: Sign Windows ARM64 sidecars
+        if: steps.windows-signing.outputs.enabled == 'true'
+        uses: azure/artifact-signing-action@v2
+        with:
+          endpoint: ${{ env.AZURE_ARTIFACT_SIGNING_ENDPOINT }}
+          signing-account-name: ${{ env.AZURE_ARTIFACT_SIGNING_ACCOUNT }}
+          certificate-profile-name: ${{ env.AZURE_ARTIFACT_SIGNING_CERTIFICATE_PROFILE }}
+          files-folder: ${{ github.workspace }}\apps\desktop\src-tauri\windows
+          files-folder-filter: exe
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
+      - name: Validate signed Windows ARM64 sidecars
+        if: steps.windows-signing.outputs.enabled == 'true'
+        shell: pwsh
+        run: |
+          . ./scripts/windows-codesign.ps1
+          foreach ($name in @("loc.exe", "localityd.exe", "locality-cloud-files.exe")) {
+            Assert-LocalityWindowsSigned -Path (Join-Path "apps/desktop/src-tauri/windows" $name)
+          }
+
+      - name: Build, sign, and validate Windows ARM64 installer
+        shell: pwsh
+        env:
+          LOCALITY_WINDOWS_BUNDLE_PREPARED: "1"
+          LOCALITY_WINDOWS_TARGET: aarch64-pc-windows-msvc
+          PUBLISH_ALLOW_DIRTY: "1"
+        run: ./scripts/publish-windows.ps1
+
       - name: Sign Windows installers
         if: steps.windows-signing.outputs.enabled == 'true'
         uses: azure/artifact-signing-action@v2
@@ -299,32 +338,46 @@ jobs:
       - name: Create standard GitHub asset names
         shell: pwsh
         run: |
-          $source = "target/release/bundle/windows/Locality-release-windows-x86_64-setup.exe"
-          $destination = "target/release/bundle/windows/Locality_Windows_v$env:APP_VERSION.exe"
-          $latestDestination = "target/release/bundle/windows/Locality_Windows.exe"
-          if (-not (Test-Path -LiteralPath $source)) {
-            Write-Error "Could not find Windows installer $source."
-            exit 1
-          }
-          if (-not (Test-Path -LiteralPath "$source.sig")) {
-            Write-Error "Could not find Windows updater signature $source.sig."
-            exit 1
-          }
-          Copy-Item -LiteralPath $source -Destination $destination -Force
-          Copy-Item -LiteralPath "$source.sig" -Destination "$destination.sig" -Force
-          Copy-Item -LiteralPath $source -Destination $latestDestination -Force
-          Copy-Item -LiteralPath "$source.sig" -Destination "$latestDestination.sig" -Force
-          foreach ($path in @($destination, $latestDestination)) {
-            $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath $path).Hash.ToLowerInvariant()
-            "$hash  $(Split-Path -Leaf $path)" | Set-Content -Encoding ascii -LiteralPath "$path.sha256"
+          function Copy-InstallerAsset {
+            param(
+              [string] $Source,
+              [string] $VersionedDestination,
+              [string] $LatestDestination
+            )
+            if (-not (Test-Path -LiteralPath $Source)) {
+              Write-Error "Could not find Windows installer $Source."
+              exit 1
+            }
+            if (-not (Test-Path -LiteralPath "$Source.sig")) {
+              Write-Error "Could not find Windows updater signature $Source.sig."
+              exit 1
+            }
+            Copy-Item -LiteralPath $Source -Destination $VersionedDestination -Force
+            Copy-Item -LiteralPath "$Source.sig" -Destination "$VersionedDestination.sig" -Force
+            Copy-Item -LiteralPath $Source -Destination $LatestDestination -Force
+            Copy-Item -LiteralPath "$Source.sig" -Destination "$LatestDestination.sig" -Force
+            foreach ($path in @($VersionedDestination, $LatestDestination)) {
+              $hash = (Get-FileHash -Algorithm SHA256 -LiteralPath $path).Hash.ToLowerInvariant()
+              "$hash  $(Split-Path -Leaf $path)" | Set-Content -Encoding ascii -LiteralPath "$path.sha256"
+            }
           }
 
+          Copy-InstallerAsset `
+            -Source "target/release/bundle/windows/Locality-release-windows-x86_64-setup.exe" `
+            -VersionedDestination "target/release/bundle/windows/Locality_Windows_v$env:APP_VERSION.exe" `
+            -LatestDestination "target/release/bundle/windows/Locality_Windows.exe"
+          Copy-InstallerAsset `
+            -Source "target/release/bundle/windows/Locality-release-windows-aarch64-setup.exe" `
+            -VersionedDestination "target/release/bundle/windows/Locality_Windows_ARM64_v$env:APP_VERSION.exe" `
+            -LatestDestination "target/release/bundle/windows/Locality_Windows_ARM64.exe"
+
       - name: Render Windows updater manifest
         shell: bash
         env:
           GITHUB_RELEASE_TAG: ${{ env.RELEASE_TAG }}
           UPDATER_MANIFEST_OUTPUT: target/release/bundle/updater/latest-windows.json
           UPDATER_WINDOWS_X86_64_ARTIFACT: target/release/bundle/windows/Locality_Windows_v${{ env.APP_VERSION }}.exe
+          UPDATER_WINDOWS_AARCH64_ARTIFACT: target/release/bundle/windows/Locality_Windows_ARM64_v${{ env.APP_VERSION }}.exe
           UPDATER_NOTES: Locality ${{ env.APP_VERSION }} Windows update.
         run: scripts/render-tauri-updater-manifest.sh
 
@@ -333,7 +386,9 @@ jobs:
         run: |
           New-Item -ItemType Directory -Force -Path target/release/github-assets | Out-Null
           Copy-Item "target/release/bundle/windows/Locality_Windows_v$env:APP_VERSION.exe*" target/release/github-assets/
+          Copy-Item "target/release/bundle/windows/Locality_Windows_ARM64_v$env:APP_VERSION.exe*" target/release/github-assets/
           Copy-Item target/release/bundle/windows/Locality_Windows.exe* target/release/github-assets/
+          Copy-Item target/release/bundle/windows/Locality_Windows_ARM64.exe* target/release/github-assets/
           Copy-Item target/release/bundle/updater/latest-windows.json target/release/github-assets/
           Get-ChildItem target/release/github-assets -File |
             Sort-Object Name |

Makefile

@@ -107,10 +107,18 @@ publish-linux: setup ## Build and validate Linux .deb and .rpm packages.
 publish-windows: setup ## Build, sign, and validate a Windows NSIS package.
 	pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/publish-windows.ps1
 
+.PHONY: publish-windows-arm64
+publish-windows-arm64: setup ## Build, sign, and validate a Windows ARM64 NSIS package.
+	LOCALITY_WINDOWS_TARGET=aarch64-pc-windows-msvc pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/publish-windows.ps1
+
 .PHONY: build-tauri-windows
 build-tauri-windows: setup ## Build the Windows Tauri installer.
 	$(DESKTOP_NPM) run build:windows
 
+.PHONY: build-tauri-windows-arm64
+build-tauri-windows-arm64: setup ## Build the Windows ARM64 Tauri installer.
+	LOCALITY_WINDOWS_TARGET=aarch64-pc-windows-msvc $(DESKTOP_NPM) run build:windows-arm64
+
 .PHONY: render-homebrew-cask
 render-homebrew-cask: ## Render a Homebrew cask from published macOS DMG artifacts.
 	scripts/render-homebrew-cask.sh

apps/desktop/README.md

@@ -68,6 +68,13 @@ Build a local NSIS installer from the repo root on Windows:
 make build-tauri-windows
 ```
 
+For a Windows on Arm installer:
+
+```sh
+rustup target add aarch64-pc-windows-msvc
+make build-tauri-windows-arm64
+```
+
 The build stages `loc.exe`, `localityd.exe`, and `locality-cloud-files.exe` under
 `src-tauri/windows` before Tauri bundles the app. The installer copies those
 sidecars next to the desktop executable so the app can start the packaged

apps/desktop/package.json

@@ -13,6 +13,7 @@
     "build:mas": "VITE_LOCALITY_DISTRIBUTION_CHANNEL=mas LOCALITY_DISTRIBUTION_CHANNEL=mas tauri build --bundles app",
     "build:linux": "tauri build --bundles deb,rpm",
     "build:windows": "tauri build --bundles nsis",
+    "build:windows-arm64": "tauri build --bundles nsis --target aarch64-pc-windows-msvc",
     "preview": "vite preview --host 127.0.0.1 --port 1421",
     "tauri": "tauri"
   },

apps/desktop/scripts/prepare-windows-bundle.ps1

@@ -6,6 +6,30 @@ $Out = Join-Path $Root "apps\desktop\src-tauri\windows"
 $MountLogoSource = Join-Path $Root "apps\desktop\src-tauri\icons\locality-mount-logo.ico"
 $MountLogoOut = Join-Path $Out "locality-mount-logo.ico"
 . (Join-Path $Root "scripts\windows-codesign.ps1")
+
+function Get-WindowsBuildTarget {
+    if (-not [string]::IsNullOrWhiteSpace($env:LOCALITY_WINDOWS_TARGET)) {
+        return $env:LOCALITY_WINDOWS_TARGET
+    }
+    if (-not [string]::IsNullOrWhiteSpace($env:PUBLISH_WINDOWS_TARGET)) {
+        return $env:PUBLISH_WINDOWS_TARGET
+    }
+    if (-not [string]::IsNullOrWhiteSpace($env:TAURI_ENV_TARGET_TRIPLE)) {
+        return $env:TAURI_ENV_TARGET_TRIPLE
+    }
+    if ($env:TAURI_ENV_ARCH -match "^(aarch64|arm64)$") {
+        return "aarch64-pc-windows-msvc"
+    }
+    return ""
+}
+
+$TargetTriple = Get-WindowsBuildTarget
+$ReleaseDir = if ([string]::IsNullOrWhiteSpace($TargetTriple)) {
+    Join-Path $Root "target\release"
+} else {
+    Join-Path $Root "target\$TargetTriple\release"
+}
+
 New-Item -ItemType Directory -Force -Path $Out | Out-Null
 $Sidecars = @(
     (Join-Path $Out "loc.exe"),
@@ -33,14 +57,18 @@ if ($env:LOCALITY_WINDOWS_BUNDLE_PREPARED -ne "1") {
 
     Push-Location $Root
     try {
-        & $Cargo build -p loc-cli -p localityd -p locality-cloud-files --release
+        $cargoArgs = @("build", "-p", "loc-cli", "-p", "localityd", "-p", "locality-cloud-files", "--release")
+        if (-not [string]::IsNullOrWhiteSpace($TargetTriple)) {
+            $cargoArgs += @("--target", $TargetTriple)
+        }
+        & $Cargo @cargoArgs
     } finally {
         Pop-Location
     }
 
-    Copy-Item -LiteralPath (Join-Path $Root "target\release\loc.exe") -Destination (Join-Path $Out "loc.exe") -Force
-    Copy-Item -LiteralPath (Join-Path $Root "target\release\localityd.exe") -Destination (Join-Path $Out "localityd.exe") -Force
-    Copy-Item -LiteralPath (Join-Path $Root "target\release\locality-cloud-files.exe") -Destination (Join-Path $Out "locality-cloud-files.exe") -Force
+    Copy-Item -LiteralPath (Join-Path $ReleaseDir "loc.exe") -Destination (Join-Path $Out "loc.exe") -Force
+    Copy-Item -LiteralPath (Join-Path $ReleaseDir "localityd.exe") -Destination (Join-Path $Out "localityd.exe") -Force
+    Copy-Item -LiteralPath (Join-Path $ReleaseDir "locality-cloud-files.exe") -Destination (Join-Path $Out "locality-cloud-files.exe") -Force
     Copy-Item -LiteralPath $MountLogoSource -Destination $MountLogoOut -Force
 } else {
     foreach ($Sidecar in $Sidecars) {
@@ -60,6 +88,9 @@ if (Test-LocalityWindowsCodeSigningRequested) {
     }
 }
 
+if (-not [string]::IsNullOrWhiteSpace($TargetTriple)) {
+    Write-Host "Prepared Windows target $TargetTriple"
+}
 Write-Host "Prepared Windows CLI in $(Join-Path $Out 'loc.exe')"
 Write-Host "Prepared Windows daemon in $(Join-Path $Out 'localityd.exe')"
 Write-Host "Prepared Windows Cloud Files helper in $(Join-Path $Out 'locality-cloud-files.exe')"

docs/windows-distribution.md

@@ -12,12 +12,27 @@ Build a local NSIS installer from the repo root on Windows:
 make build-tauri-windows
 ```
 
+Build the Windows on Arm installer from a Windows host with the Rust target
+installed:
+
+```powershell
+rustup target add aarch64-pc-windows-msvc
+make build-tauri-windows-arm64
+```
+
 For release-like local packaging, use:
 
 ```powershell
 pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/publish-windows.ps1
 ```
 
+For Windows on Arm release-like packaging, run:
+
+```powershell
+rustup target add aarch64-pc-windows-msvc
+make publish-windows-arm64
+```
+
 The Tauri pre-bundle hook runs:
 
 ```powershell
@@ -26,14 +41,19 @@ apps/desktop/scripts/prepare-windows-bundle.ps1
 
 That script builds `loc-cli`, `localityd`, and `locality-cloud-files` in release mode,
 stages the three sidecars under `apps/desktop/src-tauri/windows/`, and lets the
-NSIS hook copy them next to the installed desktop executable.
+NSIS hook copy them next to the installed desktop executable. Set
+`LOCALITY_WINDOWS_TARGET=aarch64-pc-windows-msvc` or use the ARM64 make targets
+to build and stage Windows on Arm sidecars from
+`target\aarch64-pc-windows-msvc\release`.
 
 Expected local artifacts:
 
 ```text
 target/release/bundle/nsis/*.exe
 target/release/bundle/windows/Locality-beta-windows-x86_64-setup.exe
 target/release/bundle/windows/Locality-beta-windows-x86_64-setup.exe.sha256
+target/release/bundle/windows/Locality-beta-windows-aarch64-setup.exe
+target/release/bundle/windows/Locality-beta-windows-aarch64-setup.exe.sha256
 ```
 
 The publish script requires a clean git working tree by default because the
@@ -174,6 +194,7 @@ Render the Windows updater manifest with:
 ```powershell
 $env:UPDATER_MANIFEST_OUTPUT = "target/release/bundle/updater/latest-windows.json"
 $env:UPDATER_WINDOWS_X86_64_ARTIFACT = "target/release/bundle/windows/Locality-release-windows-x86_64-setup.exe"
+$env:UPDATER_WINDOWS_AARCH64_ARTIFACT = "target/release/bundle/windows/Locality-release-windows-aarch64-setup.exe"
 bash scripts/render-tauri-updater-manifest.sh
 ```
 
@@ -193,6 +214,12 @@ Locality_Windows_v0.1.0.exe.sig
 Locality_Windows.exe
 Locality_Windows.exe.sha256
 Locality_Windows.exe.sig
+Locality_Windows_ARM64_v0.1.0.exe
+Locality_Windows_ARM64_v0.1.0.exe.sha256
+Locality_Windows_ARM64_v0.1.0.exe.sig
+Locality_Windows_ARM64.exe
+Locality_Windows_ARM64.exe.sha256
+Locality_Windows_ARM64.exe.sig
 latest-windows.json
 SHA256SUMS-windows
 ```

scripts/finalize-github-release.sh

@@ -92,6 +92,12 @@ required_assets=(
   "Locality_Windows.exe"
   "Locality_Windows.exe.sha256"
   "Locality_Windows.exe.sig"
+  "Locality_Windows_ARM64_v${APP_VERSION}.exe"
+  "Locality_Windows_ARM64_v${APP_VERSION}.exe.sha256"
+  "Locality_Windows_ARM64_v${APP_VERSION}.exe.sig"
+  "Locality_Windows_ARM64.exe"
+  "Locality_Windows_ARM64.exe.sha256"
+  "Locality_Windows_ARM64.exe.sig"
   "latest-windows.json"
   "SHA256SUMS-windows"
 )