feat(cli): add `--no-binary-patching` flag to build and bundle by tenderdeve · Pull Request #15619 · tauri-apps/tauri

tenderdeve · 2026-06-30T12:37:00Z

Tauri patches the main executable with bundle type information (Patching app.exe with bundle type information: nsis) so the updater plugin can pick the matching installer format when several bundle types target the same platform. This rewrites the binary after it is built, invalidating an existing code signature on it — which makes bundling an already-signed binary inside e.g. the NSIS bundler impossible.

Change

Add a bundle > disableBinaryPatching config option (default false, so patching stays on). When set to true, bundle_project skips the patch_binary call and the post-patch re-sign, leaving the main binary untouched.

I gated the re-sign together with the patch because that re-sign exists only to repair the signature the patch invalidates (the main binary is intentionally skipped by sign_binaries_if_needed). So with patching disabled the executable is left exactly as built, preserving any existing signature — which is the point of the flag.

As @Legend-Master noted in the issue, the patching is only needed when shipping multiple installer types per platform that should each update with their own format, so disabling it is safe otherwise.

Files

tauri-utils: new disableBinaryPatching field on BundleConfig (+ ToTokens, regenerated config.schema.json)
tauri-bundler: disable_binary_patching on BundleSettings + Settings::disable_binary_patching(); guard in bundle_project
tauri-cli: map the config field into BundleSettings

Open question

I went with a config value (matches the rest of bundle). Happy to also add a --no-sign-style --disable-binary-patching CLI flag on tauri build/tauri bundle if you would prefer that too.

Legend-Master · 2026-07-02T03:25:17Z

let's go with --no-binary-patching

tenderdeve · 2026-07-02T06:42:24Z

@Legend-Master switched to --no-binary-patching as agreed — dropped the bundle > disableBinaryPatching config option and the tauri-utils change entirely. It's now a CLI flag on both tauri build and tauri bundle, wired through Settings::set_no_binary_patching exactly like --no-sign. When set, the bundler skips the patch_binary call and the post-patch re-sign, leaving an already-signed binary untouched.

Pushed in 8d3139d. Rebuilt fmt/clippy clean on tauri-bundler + tauri-cli (the one remaining clippy warning is pre-existing in pbxproj.rs, unrelated).

github-actions · 2026-07-02T11:23:26Z

Package Changes Through `3553abb`

There are 14 changes which include tauri with minor, tauri-cli with minor, @tauri-apps/cli with minor, tauri-runtime with minor, tauri-runtime-wry with minor, tauri-utils with minor, tauri-bundler with minor, tauri-build with minor, tauri-macos-sign with minor, tauri-codegen with minor, tauri-macros with minor, tauri-plugin with minor, tauri-driver with minor, @tauri-apps/api with minor

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
@tauri-apps/api	2.11.1	2.12.0
tauri-utils	2.9.3	2.10.0
tauri-macos-sign	2.3.4	2.4.0
tauri-bundler	2.9.4	2.10.0
tauri-runtime	2.11.3	2.12.0
tauri-runtime-wry	2.11.4	2.12.0
tauri-codegen	2.6.3	2.7.0
tauri-macros	2.6.3	2.7.0
tauri-plugin	2.6.3	2.7.0
tauri-build	2.6.3	2.7.0
tauri	2.11.5	2.12.0
@tauri-apps/cli	2.11.4	2.12.0
tauri-cli	2.11.4	2.12.0
tauri-driver	2.0.6	2.1.0

Add another change file through the GitHub UI by following this link.

Read about change files or the docs at github.com/jbolda/covector

Legend-Master

Looks good, just some small nitpicks

Also you'll need to sign your commits for me to merge this

https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits

Legend-Master · 2026-07-06T07:21:18Z

@@ -0,0 +1,6 @@
+---
+"tauri-bundler": "minor:feat"
+"tauri-cli": "minor:feat"


Suggested change

"tauri-cli": "minor:feat"

"tauri-cli": "minor:feat"

"@tauri-apps/cli": "minor:feat"

Applied — the changefile now lists all three (tauri-bundler, tauri-cli, @tauri-apps/cli) as minor:feat.

Legend-Master · 2026-07-06T07:23:33Z


+  /// Sets whether to disable patching the main binary with bundle type information.
+  #[must_use]
+  pub fn no_binary_patching(mut self, no_binary_patching: bool) -> Self {


I know we had no_sign above, but generally speaking, we should use positive flags (e.g. binary_pacthing and true by default)

Done — flipped to a positive binary_patching flag defaulting to true (the CLI flag stays --no-binary-patching, which just sets it to false).

tenderdeve · 2026-07-09T07:55:37Z

@Legend-Master addressed both:

Settings now stores a positive binary_patching: bool defaulting to true (getter/setter/builder renamed to match). The --no-binary-patching CLI flag stays as agreed and just flips it off at the boundary via set_binary_patching(!options.no_binary_patching).
Added @tauri-apps/cli to the changefile.

Also signed all commits (Verified now). cargo check + fmt clean.

Legend-Master · 2026-07-09T11:04:04Z

-    Default::default()
+    Self {
+      binary_patching: true,
+      ..Default::default()


Let's manually implement the default instead

Done in a0e9f93fb — dropped #[derive(Default)] and hand-wrote impl Default for SettingsBuilder with binary_patching: true; new() is now just Self::default().

Legend-Master · 2026-07-09T11:04:46Z

+    // Patching rewrites the main binary in place, invalidating any existing code signature.
+    // When disabled, leave the binary untouched and skip the post-patch re-sign (whose only
+    // purpose is to repair that invalidated signature), preserving an already-signed binary.


Suggested change

// Patching rewrites the main binary in place, invalidating any existing code signature.

// When disabled, leave the binary untouched and skip the post-patch re-sign (whose only

// purpose is to repair that invalidated signature), preserving an already-signed binary.

Remove this

Legend-Master · 2026-07-09T11:05:51Z

+      if matches!(target_os, TargetPlatform::Windows) && settings.windows().can_sign() {
+        windows::sign::try_sign(&main_binary_path, settings)?;
+      }
    }


Let's add a notice like we did for --no-sign

Added — logs Skipping binary patching due to --no-binary-patching flag. Put it once before the loop rather than in a per-package_type else so it does not repeat for each bundle; mirrors the single --no-sign notice.

Tauri patches the main executable with bundle type information so the updater plugin can pick the matching installer format when multiple bundle types target the same platform. This rewrites the binary after it is built, invalidating an existing code signature on it, which breaks bundling an already-signed binary (e.g. inside the NSIS bundler). Add a `bundle > disableBinaryPatching` config option (default false). When set, the bundler skips patching the main binary and the subsequent re-sign, leaving the executable untouched. closes tauri-apps#15591

Switch the disable-binary-patching control from the proposed `bundle > disableBinaryPatching` config option to a `--no-binary-patching` CLI flag on `tauri build` and `tauri bundle`, mirroring the `--no-sign` precedent. When set, the bundler skips patching the main executable with bundle type information (and the subsequent re-sign), preserving an already-signed binary. Patching only matters when shipping multiple bundle types per platform.

- Implement Default for SettingsBuilder manually so binary_patching defaults to true, instead of overriding it on top of a derived default. - Log a notice when --no-binary-patching skips patching, mirroring the --no-sign notice, and drop the now-redundant inline comment.

tenderdeve · 2026-07-20T11:01:31Z

@Legend-Master addressed all nitpicks in a0e9f93fb, and signed the whole branch — all five commits now show as Verified. Thanks for the review.

Legend-Master

Thanks

tenderdeve requested a review from a team as a code owner June 30, 2026 12:37

Legend-Master added this to the 2.12 milestone Jul 2, 2026

tenderdeve changed the title ~~feat(bundler): add bundle > disableBinaryPatching option~~ feat(cli): add --no-binary-patching flag to build and bundle Jul 2, 2026

Legend-Master reviewed Jul 6, 2026

View reviewed changes

tenderdeve force-pushed the feat/15591-disable-binary-patching branch from 8d3139d to a22ac40 Compare July 9, 2026 07:29

Legend-Master reviewed Jul 9, 2026

View reviewed changes

Legend-Master added the status: waiting Waiting on author label Jul 16, 2026

tenderdeve added 5 commits July 20, 2026 16:29

chore: add @tauri-apps/cli to changefile

36b9db3

refactor(bundler): use positive binary_patching flag defaulting to true

daefac8

tenderdeve force-pushed the feat/15591-disable-binary-patching branch from 54f7e3d to a0e9f93 Compare July 20, 2026 11:00

Legend-Master removed the status: waiting Waiting on author label Jul 21, 2026

Legend-Master and others added 2 commits July 21, 2026 11:57

Merge branch 'dev' into feat/15591-disable-binary-patching

59aaa19

Always sign and warn with path data

3553abb

Legend-Master approved these changes Jul 21, 2026

View reviewed changes

Legend-Master merged commit af465ea into tauri-apps:dev Jul 21, 2026
20 checks passed

github-actions Bot mentioned this pull request Jul 21, 2026

Apply Version Updates From Current Changes #15634

Draft

	"tauri-cli": "minor:feat"
	"tauri-cli": "minor:feat"
	"@tauri-apps/cli": "minor:feat"

	// Patching rewrites the main binary in place, invalidating any existing code signature.
	// When disabled, leave the binary untouched and skip the post-patch re-sign (whose only
	// purpose is to repair that invalidated signature), preserving an already-signed binary.

Uh oh!

Uh oh!

Conversation

tenderdeve commented Jun 30, 2026

Change

Files

Open question

Uh oh!

Legend-Master commented Jul 2, 2026

Uh oh!

tenderdeve commented Jul 2, 2026

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Package Changes Through 3553abb

Uh oh!

Legend-Master left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tenderdeve commented Jul 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tenderdeve commented Jul 20, 2026

Uh oh!

Legend-Master left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jul 2, 2026 •

edited

Loading

Package Changes Through `3553abb`