fix(bundler): sign DLLs by thewh1teagle · Pull Request #11676 · tauri-apps/tauri

thewh1teagle · 2024-11-13T13:39:39Z

Now it's signed after bundling:

Log:

Details

..\..\tauri\target\debug\cargo-tauri.exe bundle
    Signing D:\vibe\target\release\vibe.exe
    Signing D:\vibe\target\release\vibe.exe with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: D:\\vibe\\target\\release\\vibe.exe\r\r\n"
    Warn NSIS directory contains mis-hashed files. Redownloading them.
    Downloading https://github.com/tauri-apps/nsis-tauri-utils/releases/download/nsis_tauri_utils-v0.4.1/nsis_tauri_utils.dll
    Info validating hash
    Info Target: x64
    Info Signing NSIS plugins
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\NSISdl.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\NSISdl.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-ansi\\NSISdl.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\StartMenu.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\StartMenu.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-ansi\\StartMenu.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\System.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\System.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-ansi\\System.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\nsDialogs.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\nsDialogs.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-ansi\\nsDialogs.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\NSISdl.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\NSISdl.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\NSISdl.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\StartMenu.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\StartMenu.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\StartMenu.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\System.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\System.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\System.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\nsDialogs.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\nsDialogs.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\nsDialogs.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\nsis_tauri_utils.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\nsis_tauri_utils.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\nsis_tauri_utils.dll\r\r\n"
    Running makensis.exe to produce D:\vibe\target\release\bundle\nsis\vibe_2.6.6_x64-setup.exe
Done Adding Additional Store
Successfully signed: C:\Users\User\AppData\Local\Temp\nst3640.tmp
    Signing D:\vibe\target\release\bundle\nsis\vibe_2.6.6_x64-setup.exe
    Signing D:\vibe\target\release\bundle\nsis\vibe_2.6.6_x64-setup.exe with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: D:\\vibe\\target\\release\\bundle/nsis/vibe_2.6.6_x64-setup.exe\r\r\n"
    Finished 1 bundle at:
        D:\vibe\target\release\bundle\nsis\vibe_2.6.6_x64-setup.exe

This can potentially fix some issues with #2486
Btw I recommend to everyone always sign the exe even with self signed certificate instead of publishing unsigned binaries that usually flagged immediately as a virus by Windows AVs

github-actions · 2024-11-13T13:53:55Z

Package Changes Through `c3c091b`

There are 8 changes which include @tauri-apps/api with minor, tauri with minor, tauri-cli with minor, @tauri-apps/cli with minor, tauri-utils with minor, tauri-bundler with minor, tauri-runtime with minor, tauri-runtime-wry with minor

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
@tauri-apps/api	2.4.1	2.5.0
tauri-utils	2.3.1	2.4.0
tauri-bundler	2.3.1	2.4.0
tauri-runtime	2.5.1	2.6.0
tauri-runtime-wry	2.5.1	2.6.0
tauri-codegen	2.1.1	2.1.2
tauri-macros	2.1.1	2.1.2
tauri-plugin	2.1.1	2.1.2
tauri-build	2.1.1	2.1.2
tauri	2.4.1	2.5.0
@tauri-apps/cli	2.4.1	2.5.0
tauri-cli	2.4.1	2.5.0

Add another change file through the GitHub UI by following this link.

Read about change files or the docs at github.com/jbolda/covector

amrbashir

Could you also add a change file in .changes directory?

thewh1teagle · 2024-11-14T19:28:22Z

Updated

thewh1teagle · 2024-12-02T18:39:17Z

Just a reminder. I still get many false positive detections and I believe that should fix most of them. Hope you can merge it soon.

Update: that's what I do meanwhile:

# Import certificate
[IO.File]::WriteAllBytes('cert.pfx', [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE))
Import-PfxCertificate -Exportable -FilePath "cert.pfx" -CertStoreLocation 'cert:\CurrentUser\My' -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)

# Sign resources
$signtoolPath = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\" -Filter "signtool.exe" -Recurse | Where-Object FullName -like "*\x64\signtool.exe" | Select-Object -First 1).FullName
&$signtoolPath sign /f cert.pfx /p $env:WINDOWS_CERTIFICATE_PASSWORD /tr http://timestamp.digicert.com /td sha256 /fd sha256 desktop\src-tauri\ffmpeg\bin\x64\*
# Sign nsis plugin DLLs
Get-ChildItem -Path "$env:LOCALAPPDATA\tauri\NSIS\Plugins" -Filter '*.dll' -Recurse | ForEach-Object { 
    &$signtoolPath sign /f cert.pfx /p $env:WINDOWS_CERTIFICATE_PASSWORD /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName
}

thewh1teagle · 2024-12-05T20:09:25Z

I noticed now that caching won't work if we sign the plugin files

https://github.com/tauri-apps/tauri/blob/dev/crates/tauri-bundler/src/bundle/windows/nsis/mod.rs#L88

It will redownlod them each time we bundle.
maybe we should cache them in directory derived from the URL

amrbashir · 2024-12-08T22:53:26Z

@thewh1teagle then we should copy them next to the generated installer.nsi and sign these copies instead.

lucasfernog

thank you!

linguofeng · 2025-05-17T09:22:50Z

#13341

linguofeng · 2025-05-17T09:24:56Z

    added_resources.push(resource_path.clone());

+    if settings.can_sign() {
+      try_sign(&resource_path, settings)?;


you already identified the code so are you open to creating a PR as well?

thewh1teagle requested a review from a team as a code owner November 13, 2024 13:39

thewh1teagle force-pushed the fix/nsis-sign-plugins branch 2 times, most recently from 2821708 to 07f64cf Compare November 13, 2024 14:07

amrbashir requested changes Nov 14, 2024

View reviewed changes

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs Outdated

amrbashir requested changes Nov 14, 2024

View reviewed changes

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs Outdated

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs Outdated

thewh1teagle force-pushed the fix/nsis-sign-plugins branch from 2fabf5d to b051f75 Compare November 14, 2024 19:27

amrbashir requested changes Nov 14, 2024

View reviewed changes

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs Outdated

fix: sign nsis plugin DLLs

9e3ac6e

thewh1teagle force-pushed the fix/nsis-sign-plugins branch from f564491 to 9e3ac6e Compare November 15, 2024 00:22

amrbashir mentioned this pull request Dec 8, 2024

refactor(bundler/nsis): replace nsis_process.dll usage with nsProcess.dll #11041

Closed

lucasfernog added 2 commits April 13, 2025 09:24

Merge branch 'dev' into fix/nsis-sign-plugins

f3ce45a

also sign DLLs on unix

fecf91a

lucasfernog changed the title ~~fix: sign nsis plugin DLLs~~ fix(bundler): sign DLLs Apr 13, 2025

github-project-automation bot added this to Roadmap Apr 13, 2025

github-project-automation bot moved this to 📬Proposal in Roadmap Apr 13, 2025

lucasfernog added 10 commits April 13, 2025 14:36

fix build

abeb34c

create copy of nsis dir

41aa9e7

always make a copy of nsis (so linux works, permission error otherwise)

37b4ca1

fix windows build

ab1d91b

fix

39b259b

to_path_buf

a651401

also create wix copy

f973a77

remove unused toolset change

88336f8

fix unused var

855ac68

fmt

06b2209

lucasfernog added 5 commits April 13, 2025 17:53

fix wix build

1d6d939

fix build

7f05af7

fix plugin copy

415af22

fix conflict

1f8dd28

fix file download

c3c091b

lucasfernog approved these changes Apr 13, 2025

View reviewed changes

lucasfernog merged commit 8d994f6 into tauri-apps:dev Apr 13, 2025
14 checks passed

github-project-automation bot moved this from 📬Proposal to 🔎 In audit in Roadmap Apr 13, 2025

github-actions bot mentioned this pull request Apr 13, 2025

Apply Version Updates From Current Changes #13123

Merged

linguofeng reviewed May 17, 2025

View reviewed changes

This was referenced Jul 30, 2025

[bug] should not sign everthing defined by bundle.resources in tauri.conf.json #13917

Closed

[feat] Add configuration to control the signing behavior of resources files #13922

Open

Uh oh!

Conversation

thewh1teagle commented Nov 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Package Changes Through c3c091b

Uh oh!

Uh oh!

Uh oh!

amrbashir left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

thewh1teagle commented Nov 14, 2024

Uh oh!

Uh oh!

thewh1teagle commented Dec 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thewh1teagle commented Dec 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

amrbashir commented Dec 8, 2024

Uh oh!

lucasfernog left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

linguofeng commented May 17, 2025

Uh oh!

linguofeng May 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

FabianLars May 17, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

thewh1teagle commented Nov 13, 2024 •

edited

Loading

github-actions bot commented Nov 13, 2024 •

edited

Loading

Package Changes Through `c3c091b`

amrbashir left a comment •

edited

Loading

thewh1teagle commented Dec 2, 2024 •

edited

Loading

thewh1teagle commented Dec 5, 2024 •

edited

Loading

linguofeng May 17, 2025 •

edited

Loading