Skip to content

Code Review Bench PR #13824 - feat(bundler/cli): Add feature flag to use system certificates #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ketkarameya wants to merge 2 commits into from
Closed

Code Review Bench PR #13824 - feat(bundler/cli): Add feature flag to use system certificates #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7a6d250
Apply PR changes (squashed due to cherry-pick conflicts)
tomerqodo Jan 25, 2026
8f50d71
update pr
tomerqodo Jan 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .changes/feat-bundler-platform-certs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
---
"tauri-bundler": "minor:enhance"
"tauri-cli": "minor:enhance"
"@tauri-apps/cli": "minor:enhance"
---

The bundler and cli will now read TLS Certificates installed on the system when downloading tools and checking versions.
53 changes: 48 additions & 5 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion crates/tauri-bundler/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,8 @@ name = "tauri_bundler"
path = "src/lib.rs"

[features]
default = ["rustls"]
default = ["rustls", "platform-certs"]
native-tls = ["ureq/native-tls"]
native-tls-vendored = ["native-tls", "native-tls/vendored"]
rustls = ["ureq/rustls"]
platform-certs = ["ureq/platform-verifier"]
13 changes: 7 additions & 6 deletions crates/tauri-bundler/src/bundle/windows/util.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,12 @@

use std::{
fs::create_dir_all,
io::Read,
path::{Path, PathBuf},
};
use ureq::ResponseExt;

use crate::utils::http_utils::download;
use crate::utils::http_utils::{base_ureq_agent, download};

pub const WEBVIEW2_BOOTSTRAPPER_URL: &str = "https://go.microsoft.com/fwlink/p/?LinkId=2124703";
pub const WEBVIEW2_OFFLINE_INSTALLER_X86_URL: &str =
Expand All @@ -23,10 +24,7 @@ pub const WIX_OUTPUT_FOLDER_NAME: &str = "msi";
pub const WIX_UPDATER_OUTPUT_FOLDER_NAME: &str = "msi-updater";

pub fn webview2_guid_path(url: &str) -> crate::Result<(String, String)> {
let agent: ureq::Agent = ureq::Agent::config_builder()
.proxy(ureq::Proxy::try_from_env())
.build()
.into();
let agent = base_ureq_agent();
let response = agent.head(url).call().map_err(Box::new)?;
let final_url = response.get_uri().to_string();
let remaining_url = final_url.strip_prefix(WEBVIEW2_URL_PREFIX).ok_or_else(|| {
Expand Down Expand Up @@ -64,7 +62,10 @@ pub fn download_webview2_offline_installer(base_path: &Path, arch: &str) -> crat
let file_path = dir_path.join(filename);
if !file_path.exists() {
create_dir_all(dir_path)?;
std::fs::write(&file_path, download(url)?)?;
let response = ureq::get(url).call().map_err(Box::new)?;
Copy link
Copy Markdown

@gitar-bot-staging gitar-bot-staging bot Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: download_webview2_offline_installer bypasses base_ureq_agent()

The download_webview2_offline_installer function uses ureq::get(url) directly (line 65) which creates a default agent without platform certificate verification or proxy support. This defeats the purpose of this PR — the whole point is to route HTTP calls through base_ureq_agent() for platform-native TLS.

Note that webview2_guid_path (called just above on line 60) correctly uses base_ureq_agent(), so the HEAD request will use platform certs but the actual download GET request won't. This inconsistency could cause the download to fail in enterprise environments with custom CAs.

The existing download() helper in http_utils.rs already wraps base_ureq_agent() and does the same bytes-reading pattern — this function should use it instead of reimplementing the download inline.

Was this helpful? React with 👍 / 👎

Suggested change
let response = ureq::get(url).call().map_err(Box::new)?;
let response = base_ureq_agent().get(url).call().map_err(Box::new)?;
  • Apply suggested fix

let mut bytes = Vec::new();
response.into_body().into_reader().read_to_end(&mut bytes)?;
std::fs::write(&file_path, bytes)?;
}
Ok(file_path)
}
Expand Down
30 changes: 21 additions & 9 deletions crates/tauri-bundler/src/utils/http_utils.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,7 @@ fn generate_github_mirror_url_from_base(github_url: &str) -> Option<String> {
std::env::var("TAURI_BUNDLER_TOOLS_GITHUB_MIRROR")
.ok()
.and_then(|cdn| Url::parse(&cdn).ok())
.map(|mut cdn| {
cdn.set_path(github_url);
.map(|cdn| {
cdn.to_string()
})
}
Expand All @@ -51,13 +50,26 @@ fn generate_github_alternative_url(url: &str) -> Option<(ureq::Agent, String)> {
}

fn create_agent_and_url(url: &str) -> (ureq::Agent, String) {
generate_github_alternative_url(url).unwrap_or((
ureq::Agent::config_builder()
.proxy(ureq::Proxy::try_from_env())
.build()
.into(),
url.to_owned(),
))
generate_github_alternative_url(url).unwrap_or((base_ureq_agent(), url.to_owned()))
}

pub(crate) fn base_ureq_agent() -> ureq::Agent {
#[cfg(feature = "platform-certs")]
let agent: ureq::Agent = ureq::Agent::config_builder()
.tls_config(
ureq::tls::TlsConfig::builder()
.root_certs(ureq::tls::RootCerts::PlatformVerifier)
.build(),
)
.proxy(ureq::Proxy::try_from_env())
.build()
.into();
#[cfg(not(feature = "platform-certs"))]
let agent: ureq::Agent = ureq::Agent::config_builder()
.proxy(ureq::Proxy::try_from_env())
.build()
.into();
return agent;
}

#[allow(dead_code)]
Expand Down
3 changes: 2 additions & 1 deletion crates/tauri-cli/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,11 +138,12 @@ object = { version = "0.36", default-features = false, features = [
ar = "0.9"

[features]
default = ["rustls"]
default = ["rustls", "platform-certs"]
native-tls = [
"tauri-bundler/native-tls",
"cargo-mobile2/native-tls",
"ureq/native-tls",
]
native-tls-vendored = ["native-tls", "tauri-bundler/native-tls-vendored"]
rustls = ["tauri-bundler/rustls", "cargo-mobile2/rustls", "ureq/rustls"]
platform-certs = ["tauri-bundler/platform-certs", "ureq/platform-verifier"]
15 changes: 14 additions & 1 deletion crates/tauri-cli/src/helpers/cargo_manifest.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,19 @@ struct CrateIoGetResponse {
pub fn crate_latest_version(name: &str) -> Option<String> {
// Reference: https://github.com/rust-lang/crates.io/blob/98c83c8231cbcd15d6b8f06d80a00ad462f71585/src/controllers/krate/metadata.rs#L88
let url = format!("https://crates.io/api/v1/crates/{name}?include");
#[cfg(feature = "platform-certs")]
Copy link
Copy Markdown

@gitar-bot-staging gitar-bot-staging bot Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Bug: crate_latest_version duplicates TLS config and omits proxy

The crate_latest_version function in cargo_manifest.rs (lines 120-131) manually duplicates the TLS platform-verifier configuration instead of reusing a centralized helper. More critically, the #[cfg(feature = "platform-certs")] branch does not configure proxy support (.proxy(ureq::Proxy::try_from_env()) is missing), while the #[cfg(not(feature = "platform-certs"))] branch uses ureq::get() which also lacks proxy support.

This means crate_latest_version will fail in environments that require an HTTP proxy. The bundler has a centralized base_ureq_agent() function, but since this is in the CLI crate it can't directly reuse it. Consider either:

  1. Extracting the agent builder into a shared crate, or
  2. Creating a similar base_ureq_agent() helper in the CLI crate and reusing it here, ensuring proxy is always configured.

Was this helpful? React with 👍 / 👎

Suggested change
#[cfg(feature = "platform-certs")]
#[cfg(feature = "platform-certs")]
let mut response = {
let agent = ureq::Agent::config_builder()
.tls_config(
ureq::tls::TlsConfig::builder()
.root_certs(ureq::tls::RootCerts::PlatformVerifier)
.build(),
)
.proxy(ureq::Proxy::try_from_env())
.build()
.new_agent();
agent.get(&url).call().ok()?
};
  • Apply suggested fix

let mut response = {
let agent = ureq::Agent::config_builder()
.tls_config(
ureq::tls::TlsConfig::builder()
.root_certs(ureq::tls::RootCerts::PlatformVerifier)
.build(),
)
.build()
.new_agent();
agent.get(&url).call().ok()?
};
#[cfg(not(feature = "platform-certs"))]
let mut response = ureq::get(&url).call().ok()?;
let metadata: CrateIoGetResponse =
serde_json::from_reader(response.body_mut().as_reader()).unwrap();
Expand Down Expand Up @@ -178,7 +191,7 @@ pub fn crate_version(
}
}

if lock.is_some() && crate_lock_packages.is_empty() {
if lock.is_some() && !crate_lock_packages.is_empty() {
let lock_version = crate_lock_packages
.iter()
.map(|p| p.version.clone())
Expand Down