# NetDesk — Windows Packaging

Build scripts that turn the Rust `netdesk-viewer` binary into the two Windows
distributions **NetDesk by Akronlogic** ships:

| Edition       | Artifact                        | Install? |
|---------------|---------------------------------|----------|
| **Portable**  | `NetDesk-Portable-win64.zip`    | No — unzip and run |
| **Installer** | `NetDesk-Setup-win64.exe`       | Yes — Start Menu + Desktop shortcuts, uninstaller |

Everything in this folder is self-contained; nothing here touches the Rust
sources. All outputs land in **`packaging\dist\`**.

```
packaging/
├── build-portable.ps1    builds + stages the portable folder, zips it
├── build-installer.ps1   stages, runs makensis, signs both artifacts
├── netdesk.nsi           NSIS (Modern UI 2) installer definition
├── README.md             this file
└── dist/                 (generated)
    ├── NetDesk-Portable/            staging folder (also fed to the installer)
    │   ├── NetDesk.exe              = target/release/netdesk-viewer.exe, renamed
    │   ├── libstdc++-6.dll          MinGW C++ runtime (required at runtime)
    │   ├── libgcc_s_seh-1.dll       MinGW GCC runtime
    │   ├── libwinpthread-1.dll      MinGW threading runtime
    │   └── README.txt
    ├── NetDesk-Portable-win64.zip   ← portable artifact
    └── NetDesk-Setup-win64.exe      ← installer artifact (needs makensis)
```

## Prerequisites

- **Rust (windows-GNU toolchain)** + the MinGW-w64 toolchain at
  `C:\mingw-netdesk\mingw64\bin`. The scripts prepend this and `~\.cargo\bin`
  to `PATH` before calling cargo, matching the project's manual build step:

  ```sh
  export PATH="/c/mingw-netdesk/mingw64/bin:$HOME/.cargo/bin:$PATH"
  ```

- **NSIS** (for the installer only). If `makensis` is missing,
  `build-installer.ps1` still produces the staging folder and prints the
  install command:

  ```powershell
  winget install --id NSIS.NSIS -e
  # or download: https://nsis.sourceforge.io/Download
  ```

## Produce the PORTABLE zip

```powershell
powershell -ExecutionPolicy Bypass -File packaging\build-portable.ps1
```

Builds `cargo build --release -p netdesk-viewer`, assembles
`dist\NetDesk-Portable\` (NetDesk.exe + the 3 DLLs + README.txt) and writes
`dist\NetDesk-Portable-win64.zip`. Add `-SkipBuild` to reuse an existing
`target\release\netdesk-viewer.exe`.

## Produce the INSTALLER exe

```powershell
powershell -ExecutionPolicy Bypass -File packaging\build-installer.ps1
```

Runs the portable staging, then compiles `netdesk.nsi` with `makensis` into
`dist\NetDesk-Setup-win64.exe`, and signs both `NetDesk.exe` and the setup exe.
Useful flags: `-SkipBuild`, `-NoSign`, `-Thumbprint <THUMB>`.

Compile the installer by hand (after staging) with:

```powershell
makensis /DSTAGEDIR=packaging\dist\NetDesk-Portable /DOUTFILE=packaging\dist\NetDesk-Setup-win64.exe packaging\netdesk.nsi
```

The installer installs into `%ProgramFiles%\NetDesk`, creates Start Menu and
Desktop shortcuts, registers an uninstaller in Add/Remove Programs, and offers
an **optional, off-by-default** per-user autostart (HKCU `...\Run`).

## Code signing

Signing is handled by the project helper `..\certs\sign-release.ps1`
(Akronlogic cert, thumbprint `YOUR_CODE_SIGNING_CERT_THUMBPRINT`,
Sectigo timestamp). `build-installer.ps1`:

1. invokes `sign-release.ps1` against the release tree, then
2. signs the staged `NetDesk.exe` (a renamed copy) and the finished
   `NetDesk-Setup-win64.exe` with the **same** certificate + timestamp
   mechanism (that helper is hardcoded to the `target\release` paths, so the
   staged/setup files are signed with the identical cert here).

> **Public trust note:** the bundled Akronlogic certificate is self-issued, so
> signatures are only trusted on machines that ran `certs\trust-akronlogic.cmd`.
> For signatures trusted on **every** Windows PC with no action by the user, a
> **CA-issued code-signing certificate** (Sectigo/DigiCert, chaining to a root
> in the Microsoft Trusted Root Program) is required — pass it to the helper
> with `-Thumbprint <cert-in-store>` or `-PfxPath cert.pfx -PfxPassword ...`.
> Self-signed certificates never qualify for public trust.

Skip signing entirely with `-NoSign` (e.g. for a local test build).

## Notes

- The portable and installer editions ship the **same** `NetDesk.exe` plus the
  same three MinGW runtime DLLs. The viewer imports `libstdc++-6.dll` at
  runtime, so the DLLs must always sit beside the exe.
- Deleting the portable folder fully removes it. The installer edition is
  removed from Add/Remove Programs (or `uninstall.exe`).

## iOS (macOS only)

`build-ios.sh` (+ the `ios/` CocoaPods templates) builds the signed iOS app on a
Mac: it adds the Rust iOS targets, compiles `netdesk-core` for device +
simulator, assembles `NetDeskCore.xcframework`, wires it into the Flutter
`ui/ios/` project, and runs `flutter build ipa`. It cannot run on Windows (Xcode
is required). One command on the Mac:

```bash
packaging/build-ios.sh --team <APPLE_TEAM_ID>
```

Full walkthrough — Apple Developer Program, signing, the VideoToolbox decode
path, every command — is in [`../docs/build-ios.md`](../docs/build-ios.md).

```
packaging/ios/
├── netdesk_core.podspec   vendors NetDeskCore.xcframework + the VideoToolbox frameworks
└── Podfile                Flutter iOS Podfile template with the netdesk_core pod
```