From 1f6678cf423df93b475997f37ec65065a6cf1d25 Mon Sep 17 00:00:00 2001
From: amrbashir <github@amrbashir.me>
Date: Thu, 5 Mar 2026 04:17:17 +0200
Subject: [PATCH 1/3] refactor(macos-sign): use base64 crate instead of Command

---
 crates/tauri-macos-sign/src/lib.rs | 43 +++++++++++-------------------
 1 file changed, 16 insertions(+), 27 deletions(-)

diff --git a/crates/tauri-macos-sign/src/lib.rs b/crates/tauri-macos-sign/src/lib.rs
index 87e30fdeea62..c6e93821a66e 100644
--- a/crates/tauri-macos-sign/src/lib.rs
+++ b/crates/tauri-macos-sign/src/lib.rs
@@ -64,6 +64,8 @@ pub enum Error {
   },
   #[error("failed to encode DER: {error}")]
   FailedToEncodeDER { error: std::io::Error },
+  #[error("failed to decode base64 certificate: {0}")]
+  Base64Decode(base64::DecodeError),
   #[error("certificate missing common name")]
   CertificateMissingCommonName,
   #[error("certificate missing organization unit for common name {common_name}")]
@@ -329,36 +331,23 @@ impl NotarytoolCmdExt for Command {
   }
 }
 
-fn decode_base64(base64: &OsStr, out_path: &Path) -> Result<()> {
-  let tmp_dir = tempfile::tempdir().map_err(Error::TempDir)?;
+fn decode_base64(base64_input: &OsStr, out_path: &Path) -> Result<()> {
+  use base64::Engine;
 
-  let src_path = tmp_dir.path().join("src");
-  let base64 = base64
+  let input = base64_input
     .to_str()
-    .expect("failed to convert base64 to string")
-    .as_bytes();
-
-  // as base64 contain whitespace decoding may be broken
-  // https://github.com/marshallpierce/rust-base64/issues/105
-  // we'll use builtin base64 command from the OS
-  std::fs::write(&src_path, base64).map_err(|error| Error::Fs {
-    context: "failed to write base64 to temp file",
-    path: src_path.clone(),
-    error,
-  })?;
+    .expect("failed to convert base64 to string");
 
-  assert_command(
-    std::process::Command::new("base64")
-      .arg("--decode")
-      .arg("-i")
-      .arg(&src_path)
-      .arg("-o")
-      .arg(out_path)
-      .piped(),
-    "failed to decode certificate",
-  )
-  .map_err(|error| Error::CommandFailed {
-    command: "base64 --decode".to_string(),
+  // strip whitespace before decoding
+  let cleaned: String = input.chars().filter(|c| !c.is_ascii_whitespace()).collect();
+
+  let decoded = base64::engine::general_purpose::STANDARD
+    .decode(&cleaned)
+    .map_err(Error::Base64Decode)?;
+
+  std::fs::write(out_path, &decoded).map_err(|error| Error::Fs {
+    context: "failed to write decoded certificate",
+    path: out_path.to_path_buf(),
     error,
   })?;
 

From f04302d563d570e3cc524873a353543bf89e540e Mon Sep 17 00:00:00 2001
From: amrbashir <github@amrbashir.me>
Date: Sat, 7 Mar 2026 03:51:40 +0200
Subject: [PATCH 2/3] add base64 crate as a dependency

---
 Cargo.lock                         | 1 +
 crates/tauri-macos-sign/Cargo.toml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index ffa7c32f7962..8b9b0da50813 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8712,6 +8712,7 @@ name = "tauri-macos-sign"
 version = "2.3.3"
 dependencies = [
  "apple-codesign",
+ "base64 0.22.1",
  "chrono",
  "dirs 6.0.0",
  "log",
diff --git a/crates/tauri-macos-sign/Cargo.toml b/crates/tauri-macos-sign/Cargo.toml
index af15c66fa8e5..fa4c429fd0f3 100644
--- a/crates/tauri-macos-sign/Cargo.toml
+++ b/crates/tauri-macos-sign/Cargo.toml
@@ -25,3 +25,4 @@ log = { version = "0.4.21", features = ["kv"] }
 apple-codesign = { version = "0.27", default-features = false }
 chrono = "0.4"
 p12 = "0.6"
+base64 = "0.22"

From 33fafa34b37c2e292f178546641ed9818813f5a3 Mon Sep 17 00:00:00 2001
From: Lucas Nogueira <lucas@tauri.app>
Date: Tue, 10 Mar 2026 09:09:01 -0300
Subject: [PATCH 3/3] add change file

---
 .changes/base64.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changes/base64.md

diff --git a/.changes/base64.md b/.changes/base64.md
new file mode 100644
index 000000000000..2fb599baba49
--- /dev/null
+++ b/.changes/base64.md
@@ -0,0 +1,5 @@
+---
+"tauri-macos-sign": patch:enhance
+---
+
+Do not rely on system base64 CLI to decode certificates.