fix(bundler): sign DLLs by thewh1teagle · Pull Request #11676 · tauri-apps/tauri

thewh1teagle · 2024-11-13T13:39:39Z

Now it's signed after bundling:

Log:

Details

..\..\tauri\target\debug\cargo-tauri.exe bundle
    Signing D:\vibe\target\release\vibe.exe
    Signing D:\vibe\target\release\vibe.exe with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: D:\\vibe\\target\\release\\vibe.exe\r\r\n"
    Warn NSIS directory contains mis-hashed files. Redownloading them.
    Downloading https://github.com/tauri-apps/nsis-tauri-utils/releases/download/nsis_tauri_utils-v0.4.1/nsis_tauri_utils.dll
    Info validating hash
    Info Target: x64
    Info Signing NSIS plugins
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\NSISdl.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\NSISdl.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-ansi\\NSISdl.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\StartMenu.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\StartMenu.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-ansi\\StartMenu.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\System.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\System.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-ansi\\System.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\nsDialogs.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-ansi\nsDialogs.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-ansi\\nsDialogs.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\NSISdl.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\NSISdl.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\NSISdl.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\StartMenu.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\StartMenu.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\StartMenu.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\System.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\System.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\System.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\nsDialogs.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\nsDialogs.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\nsDialogs.dll\r\r\n"
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\nsis_tauri_utils.dll
    Signing C:\Users\User\AppData\Local\tauri\NSIS\Plugins\x86-unicode\nsis_tauri_utils.dll with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: C:\\Users\\User\\AppData\\Local\\tauri\\NSIS\\Plugins\\x86-unicode\\nsis_tauri_utils.dll\r\r\n"
    Running makensis.exe to produce D:\vibe\target\release\bundle\nsis\vibe_2.6.6_x64-setup.exe
Done Adding Additional Store
Successfully signed: C:\Users\User\AppData\Local\Temp\nst3640.tmp
    Signing D:\vibe\target\release\bundle\nsis\vibe_2.6.6_x64-setup.exe
    Signing D:\vibe\target\release\bundle\nsis\vibe_2.6.6_x64-setup.exe with identity "45DCFF335BB538C58489BD03BF167D29DDA53110"
    Info "Done Adding Additional Store\r\nSuccessfully signed: D:\\vibe\\target\\release\\bundle/nsis/vibe_2.6.6_x64-setup.exe\r\r\n"
    Finished 1 bundle at:
        D:\vibe\target\release\bundle\nsis\vibe_2.6.6_x64-setup.exe

This can potentially fix some issues with #2486
Btw I recommend to everyone always sign the exe even with self signed certificate instead of publishing unsigned binaries that usually flagged immediately as a virus by Windows AVs

github-actions · 2024-11-13T13:53:55Z

Package Changes Through `c3c091b`

There are 8 changes which include @tauri-apps/api with minor, tauri with minor, tauri-cli with minor, @tauri-apps/cli with minor, tauri-utils with minor, tauri-bundler with minor, tauri-runtime with minor, tauri-runtime-wry with minor

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
@tauri-apps/api	2.4.1	2.5.0
tauri-utils	2.3.1	2.4.0
tauri-bundler	2.3.1	2.4.0
tauri-runtime	2.5.1	2.6.0
tauri-runtime-wry	2.5.1	2.6.0
tauri-codegen	2.1.1	2.1.2
tauri-macros	2.1.1	2.1.2
tauri-plugin	2.1.1	2.1.2
tauri-build	2.1.1	2.1.2
tauri	2.4.1	2.5.0
@tauri-apps/cli	2.4.1	2.5.0
tauri-cli	2.4.1	2.5.0

Add another change file through the GitHub UI by following this link.

Read about change files or the docs at github.com/jbolda/covector

amrbashir

Could you also add a change file in .changes directory?

thewh1teagle · 2024-11-14T19:28:22Z

Updated

thewh1teagle · 2024-12-02T18:39:17Z

Just a reminder. I still get many false positive detections and I believe that should fix most of them. Hope you can merge it soon.

Update: that's what I do meanwhile:

# Import certificate
[IO.File]::WriteAllBytes('cert.pfx', [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE))
Import-PfxCertificate -Exportable -FilePath "cert.pfx" -CertStoreLocation 'cert:\CurrentUser\My' -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)

# Sign resources
$signtoolPath = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\" -Filter "signtool.exe" -Recurse | Where-Object FullName -like "*\x64\signtool.exe" | Select-Object -First 1).FullName
&$signtoolPath sign /f cert.pfx /p $env:WINDOWS_CERTIFICATE_PASSWORD /tr http://timestamp.digicert.com /td sha256 /fd sha256 desktop\src-tauri\ffmpeg\bin\x64\*
# Sign nsis plugin DLLs
Get-ChildItem -Path "$env:LOCALAPPDATA\tauri\NSIS\Plugins" -Filter '*.dll' -Recurse | ForEach-Object { 
    &$signtoolPath sign /f cert.pfx /p $env:WINDOWS_CERTIFICATE_PASSWORD /tr http://timestamp.digicert.com /td sha256 /fd sha256 $_.FullName
}

thewh1teagle · 2024-12-05T20:09:25Z

I noticed now that caching won't work if we sign the plugin files

https://github.com/tauri-apps/tauri/blob/dev/crates/tauri-bundler/src/bundle/windows/nsis/mod.rs#L88

It will redownlod them each time we bundle.
maybe we should cache them in directory derived from the URL

amrbashir · 2024-12-08T22:53:26Z

@thewh1teagle then we should copy them next to the generated installer.nsi and sign these copies instead.

lucasfernog

thank you!

linguofeng · 2025-05-17T09:22:50Z

#13341

linguofeng · 2025-05-17T09:24:56Z

    added_resources.push(resource_path.clone());

+    if settings.can_sign() {
+      try_sign(&resource_path, settings)?;


you already identified the code so are you open to creating a PR as well?

thewh1teagle requested a review from a team as a code owner November 13, 2024 13:39

thewh1teagle force-pushed the fix/nsis-sign-plugins branch 2 times, most recently from 2821708 to 07f64cf Compare November 13, 2024 14:07

amrbashir requested changes Nov 14, 2024

View reviewed changes

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs Outdated

amrbashir requested changes Nov 14, 2024

View reviewed changes

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs Outdated

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs Outdated

thewh1teagle force-pushed the fix/nsis-sign-plugins branch from 2fabf5d to b051f75 Compare November 14, 2024 19:27

amrbashir requested changes Nov 14, 2024

View reviewed changes

Comment thread crates/tauri-bundler/src/bundle/windows/nsis/mod.rs Outdated

fix: sign nsis plugin DLLs

9e3ac6e

thewh1teagle force-pushed the fix/nsis-sign-plugins branch from f564491 to 9e3ac6e Compare November 15, 2024 00:22

amrbashir mentioned this pull request Dec 8, 2024

refactor(bundler/nsis): replace nsis_process.dll usage with nsProcess.dll #11041

Closed

lucasfernog added 2 commits April 13, 2025 09:24

Merge branch 'dev' into fix/nsis-sign-plugins

f3ce45a

also sign DLLs on unix

fecf91a

lucasfernog changed the title ~~fix: sign nsis plugin DLLs~~ fix(bundler): sign DLLs Apr 13, 2025

lucasfernog added 12 commits April 13, 2025 14:36

fix build

abeb34c

create copy of nsis dir

41aa9e7

always make a copy of nsis (so linux works, permission error otherwise)

37b4ca1

fix windows build

ab1d91b

fix

39b259b

to_path_buf

a651401

also create wix copy

f973a77

remove unused toolset change

88336f8

fix unused var

855ac68

fmt

06b2209

fix wix build

1d6d939

fix build

7f05af7

lucasfernog added 3 commits April 13, 2025 18:03

fix plugin copy

415af22

fix conflict

1f8dd28

fix file download

c3c091b

lucasfernog approved these changes Apr 13, 2025

View reviewed changes

lucasfernog merged commit 8d994f6 into tauri-apps:dev Apr 13, 2025

github-actions Bot mentioned this pull request Apr 13, 2025

Apply Version Updates From Current Changes #13123

Merged

linguofeng reviewed May 17, 2025

View reviewed changes

This was referenced Jul 30, 2025

[bug] should not sign everthing defined by bundle.resources in tauri.conf.json #13917

Closed

[feat] Add configuration to control the signing behavior of resources files #13922

Open

Navigation Menu

Uh oh!

Uh oh!

fix(bundler): sign DLLs - #11676

fix(bundler): sign DLLs#11676
lucasfernog merged 18 commits into
tauri-apps:devfrom
thewh1teagle:fix/nsis-sign-plugins

thewh1teagle commented Nov 13, 2024 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 13, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

amrbashir left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

thewh1teagle commented Nov 14, 2024

Uh oh!

Uh oh!

thewh1teagle commented Dec 2, 2024 •

edited

Loading

Uh oh!

thewh1teagle commented Dec 5, 2024 •

edited

Loading

Uh oh!

amrbashir commented Dec 8, 2024

Uh oh!

lucasfernog left a comment

Uh oh!

linguofeng commented May 17, 2025

Uh oh!

linguofeng May 17, 2025 •

edited

Loading

Uh oh!

FabianLars May 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Uh oh!

Conversation

thewh1teagle commented Nov 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Package Changes Through c3c091b

Uh oh!

Uh oh!

Uh oh!

amrbashir left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

thewh1teagle commented Nov 14, 2024

Uh oh!

Uh oh!

thewh1teagle commented Dec 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thewh1teagle commented Dec 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

amrbashir commented Dec 8, 2024

Uh oh!

lucasfernog left a comment

Choose a reason for hiding this comment

Uh oh!

linguofeng commented May 17, 2025

Uh oh!

linguofeng May 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

FabianLars May 17, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

thewh1teagle commented Nov 13, 2024 •

edited

Loading

github-actions Bot commented Nov 13, 2024 •

edited

Loading

Package Changes Through `c3c091b`

amrbashir left a comment •

edited

Loading

thewh1teagle commented Dec 2, 2024 •

edited

Loading

thewh1teagle commented Dec 5, 2024 •

edited

Loading

linguofeng May 17, 2025 •

edited

Loading