feat(bundler/cli): Add feature flag to use system certificates - #11
Conversation
📝 WalkthroughWalkthroughThis PR introduces platform certificate support for tauri-bundler and tauri-cli, enabling these tools to utilize the system's native TLS certificate store when downloading and verifying tools and versions. A new Changes
Sequence Diagram(s)sequenceDiagram
participant CLI as tauri-cli/bundler
participant Agent as HTTP Agent<br/>(ureq)
participant TLS as TLS Verifier
participant API as External API<br/>(crates.io, CDN)
Note over CLI,API: With platform-certs feature enabled
CLI->>Agent: Create base_ureq_agent()
Agent->>TLS: Configure platform-root-certs
TLS->>TLS: Load system certificate store
CLI->>Agent: Make HTTP request
Agent->>TLS: Validate certificate
TLS->>API: Connection verified
API-->>Agent: Response
Agent-->>CLI: Data/File content
Note over CLI,API: Without platform-certs feature
CLI->>Agent: Create base_ureq_agent()
Agent->>TLS: Use default proxy config
CLI->>Agent: Make HTTP request
Agent->>API: Standard TLS validation
API-->>Agent: Response
Agent-->>CLI: Data/File content
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
1 similar comment
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
crates/tauri-bundler/src/utils/http_utils.rs (1)
33-39:⚠️ Potential issue | 🟠 Major
generate_github_mirror_url_from_basedrops the asset path, breaking mirror downloads.The function ignores its
github_urlparameter and returns only the base mirror URL (e.g.,https://mirror.example.com/) without the asset path. When the template method is unavailable and this fallback is used, the download URL becomes incorrect. Attach the original GitHub URL's path and query to the mirror base.🛠️ Proposed fix (preserve path/query)
fn generate_github_mirror_url_from_base(github_url: &str) -> Option<String> { + let github = Url::parse(github_url).ok()?; std::env::var("TAURI_BUNDLER_TOOLS_GITHUB_MIRROR") .ok() .and_then(|cdn| Url::parse(&cdn).ok()) - .map(|cdn| { - cdn.to_string() - }) + .map(|mut cdn| { + cdn.set_path(github.path()); + cdn.set_query(github.query()); + cdn.to_string() + }) }crates/tauri-bundler/src/bundle/windows/util.rs (1)
54-69:⚠️ Potential issue | 🟠 MajorUse
base_ureq_agent()for WebView2 offline installer download.
Line 65 usesureq::get(url)directly, which skips proxy and platform certificate configuration. This breaks downloads in corporate environments with proxies or custom CAs. Usebase_ureq_agent()instead, consistent withwebview2_guid_path()anddownload_webview2_bootstrapper()in this file.Fix
- let response = ureq::get(url).call().map_err(Box::new)?; + let response = base_ureq_agent().get(url).call().map_err(Box::new)?; let mut bytes = Vec::new();
🤖 Fix all issues with AI agents
In `@crates/tauri-bundler/src/utils/http_utils.rs`:
- Around line 52-72: The mirror-download path in generate_github_alternative_url
is creating its own agent with ureq::agent(), bypassing the proxy/TLS config;
change that to call base_ureq_agent() so mirror downloads reuse the same TLS
root-certs and proxy settings as regular downloads. Locate the
generate_github_alternative_url function and replace the ureq::agent()
construction with a call to base_ureq_agent(), ensuring the returned
(ureq::Agent, String) tuple uses that agent for the alternative URL path. Verify
no other code paths construct a plain ureq::agent() where base_ureq_agent()
should be used.
| fn create_agent_and_url(url: &str) -> (ureq::Agent, String) { | ||
| generate_github_alternative_url(url).unwrap_or(( | ||
| ureq::Agent::config_builder() | ||
| .proxy(ureq::Proxy::try_from_env()) | ||
| .build() | ||
| .into(), | ||
| url.to_owned(), | ||
| )) | ||
| generate_github_alternative_url(url).unwrap_or((base_ureq_agent(), url.to_owned())) | ||
| } | ||
|
|
||
| pub(crate) fn base_ureq_agent() -> ureq::Agent { | ||
| #[cfg(feature = "platform-certs")] | ||
| let agent: ureq::Agent = ureq::Agent::config_builder() | ||
| .tls_config( | ||
| ureq::tls::TlsConfig::builder() | ||
| .root_certs(ureq::tls::RootCerts::PlatformVerifier) | ||
| .build(), | ||
| ) | ||
| .proxy(ureq::Proxy::try_from_env()) | ||
| .build() | ||
| .into(); | ||
| #[cfg(not(feature = "platform-certs"))] | ||
| let agent: ureq::Agent = ureq::Agent::config_builder() | ||
| .proxy(ureq::Proxy::try_from_env()) | ||
| .build() | ||
| .into(); | ||
| return agent; |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n crates/tauri-bundler/src/utils/http_utils.rsRepository: agentic-review-benchmarks/tauri-combined-coderabbit
Length of output: 8184
Mirror downloads should reuse base_ureq_agent for TLS/proxy parity.
Line 49 in generate_github_alternative_url uses ureq::agent() instead of base_ureq_agent(), causing mirror downloads to bypass platform certificate verification and proxy configuration that apply to regular downloads. Change line 49 to use base_ureq_agent() to maintain consistent behavior across both code paths.
🔁 Proposed fix
- .map(|alt_url| (ureq::agent(), alt_url))
+ .map(|alt_url| (base_ureq_agent(), alt_url))🤖 Prompt for AI Agents
In `@crates/tauri-bundler/src/utils/http_utils.rs` around lines 52 - 72, The
mirror-download path in generate_github_alternative_url is creating its own
agent with ureq::agent(), bypassing the proxy/TLS config; change that to call
base_ureq_agent() so mirror downloads reuse the same TLS root-certs and proxy
settings as regular downloads. Locate the generate_github_alternative_url
function and replace the ureq::agent() construction with a call to
base_ureq_agent(), ensuring the returned (ureq::Agent, String) tuple uses that
agent for the alternative URL path. Verify no other code paths construct a plain
ureq::agent() where base_ureq_agent() should be used.
1 participant
Benchmark PR from agentic-review-benchmarks#11
Summary by CodeRabbit