Skip to content

feat(bundler/cli): Add feature flag to use system certificates #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tomerqodo wants to merge 2 commits into
base: coderabbit_full_base_featbundler_cli_add_feature_flag_to_use_system_certificates_pr11
Choose a base branch
from
Open

feat(bundler/cli): Add feature flag to use system certificates #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7a6d250
Apply PR changes (squashed due to cherry-pick conflicts)
tomerqodo Jan 25, 2026
8f50d71
update pr
tomerqodo Jan 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .changes/feat-bundler-platform-certs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
---
"tauri-bundler": "minor:enhance"
"tauri-cli": "minor:enhance"
"@tauri-apps/cli": "minor:enhance"
---

The bundler and cli will now read TLS Certificates installed on the system when downloading tools and checking versions.
53 changes: 48 additions & 5 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion crates/tauri-bundler/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,8 @@ name = "tauri_bundler"
path = "src/lib.rs"

[features]
default = ["rustls"]
default = ["rustls", "platform-certs"]
native-tls = ["ureq/native-tls"]
native-tls-vendored = ["native-tls", "native-tls/vendored"]
rustls = ["ureq/rustls"]
platform-certs = ["ureq/platform-verifier"]
13 changes: 7 additions & 6 deletions crates/tauri-bundler/src/bundle/windows/util.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,12 @@

use std::{
fs::create_dir_all,
io::Read,
path::{Path, PathBuf},
};
use ureq::ResponseExt;

use crate::utils::http_utils::download;
use crate::utils::http_utils::{base_ureq_agent, download};

pub const WEBVIEW2_BOOTSTRAPPER_URL: &str = "https://go.microsoft.com/fwlink/p/?LinkId=2124703";
pub const WEBVIEW2_OFFLINE_INSTALLER_X86_URL: &str =
Expand All @@ -23,10 +24,7 @@ pub const WIX_OUTPUT_FOLDER_NAME: &str = "msi";
pub const WIX_UPDATER_OUTPUT_FOLDER_NAME: &str = "msi-updater";

pub fn webview2_guid_path(url: &str) -> crate::Result<(String, String)> {
let agent: ureq::Agent = ureq::Agent::config_builder()
.proxy(ureq::Proxy::try_from_env())
.build()
.into();
let agent = base_ureq_agent();
let response = agent.head(url).call().map_err(Box::new)?;
let final_url = response.get_uri().to_string();
let remaining_url = final_url.strip_prefix(WEBVIEW2_URL_PREFIX).ok_or_else(|| {
Expand Down Expand Up @@ -64,7 +62,10 @@ pub fn download_webview2_offline_installer(base_path: &Path, arch: &str) -> crat
let file_path = dir_path.join(filename);
if !file_path.exists() {
create_dir_all(dir_path)?;
std::fs::write(&file_path, download(url)?)?;
let response = ureq::get(url).call().map_err(Box::new)?;
let mut bytes = Vec::new();
response.into_body().into_reader().read_to_end(&mut bytes)?;
std::fs::write(&file_path, bytes)?;
}
Ok(file_path)
}
Expand Down
30 changes: 21 additions & 9 deletions crates/tauri-bundler/src/utils/http_utils.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,7 @@ fn generate_github_mirror_url_from_base(github_url: &str) -> Option<String> {
std::env::var("TAURI_BUNDLER_TOOLS_GITHUB_MIRROR")
.ok()
.and_then(|cdn| Url::parse(&cdn).ok())
.map(|mut cdn| {
cdn.set_path(github_url);
.map(|cdn| {
cdn.to_string()
})
}
Expand All @@ -51,13 +50,26 @@ fn generate_github_alternative_url(url: &str) -> Option<(ureq::Agent, String)> {
}

fn create_agent_and_url(url: &str) -> (ureq::Agent, String) {
generate_github_alternative_url(url).unwrap_or((
ureq::Agent::config_builder()
.proxy(ureq::Proxy::try_from_env())
.build()
.into(),
url.to_owned(),
))
generate_github_alternative_url(url).unwrap_or((base_ureq_agent(), url.to_owned()))
}

pub(crate) fn base_ureq_agent() -> ureq::Agent {
#[cfg(feature = "platform-certs")]
let agent: ureq::Agent = ureq::Agent::config_builder()
.tls_config(
ureq::tls::TlsConfig::builder()
.root_certs(ureq::tls::RootCerts::PlatformVerifier)
.build(),
)
.proxy(ureq::Proxy::try_from_env())
.build()
.into();
#[cfg(not(feature = "platform-certs"))]
let agent: ureq::Agent = ureq::Agent::config_builder()
.proxy(ureq::Proxy::try_from_env())
.build()
.into();
return agent;
Comment on lines 52 to +72

@coderabbitai coderabbitai Bot Feb 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n crates/tauri-bundler/src/utils/http_utils.rs

Repository: agentic-review-benchmarks/tauri-combined-coderabbit

Length of output: 8184

Mirror downloads should reuse base_ureq_agent for TLS/proxy parity.

Line 49 in generate_github_alternative_url uses ureq::agent() instead of base_ureq_agent(), causing mirror downloads to bypass platform certificate verification and proxy configuration that apply to regular downloads. Change line 49 to use base_ureq_agent() to maintain consistent behavior across both code paths.

🔁 Proposed fix 
-    .map(|alt_url| (ureq::agent(), alt_url))
+    .map(|alt_url| (base_ureq_agent(), alt_url))
🤖 Prompt for AI Agents 
In `@crates/tauri-bundler/src/utils/http_utils.rs` around lines 52 - 72, The
mirror-download path in generate_github_alternative_url is creating its own
agent with ureq::agent(), bypassing the proxy/TLS config; change that to call
base_ureq_agent() so mirror downloads reuse the same TLS root-certs and proxy
settings as regular downloads. Locate the generate_github_alternative_url
function and replace the ureq::agent() construction with a call to
base_ureq_agent(), ensuring the returned (ureq::Agent, String) tuple uses that
agent for the alternative URL path. Verify no other code paths construct a plain
ureq::agent() where base_ureq_agent() should be used.

}

#[allow(dead_code)]
Expand Down
3 changes: 2 additions & 1 deletion crates/tauri-cli/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,11 +138,12 @@ object = { version = "0.36", default-features = false, features = [
ar = "0.9"

[features]
default = ["rustls"]
default = ["rustls", "platform-certs"]
native-tls = [
"tauri-bundler/native-tls",
"cargo-mobile2/native-tls",
"ureq/native-tls",
]
native-tls-vendored = ["native-tls", "tauri-bundler/native-tls-vendored"]
rustls = ["tauri-bundler/rustls", "cargo-mobile2/rustls", "ureq/rustls"]
platform-certs = ["tauri-bundler/platform-certs", "ureq/platform-verifier"]
15 changes: 14 additions & 1 deletion crates/tauri-cli/src/helpers/cargo_manifest.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,19 @@ struct CrateIoGetResponse {
pub fn crate_latest_version(name: &str) -> Option<String> {
// Reference: https://github.com/rust-lang/crates.io/blob/98c83c8231cbcd15d6b8f06d80a00ad462f71585/src/controllers/krate/metadata.rs#L88
let url = format!("https://crates.io/api/v1/crates/{name}?include");
#[cfg(feature = "platform-certs")]
let mut response = {
let agent = ureq::Agent::config_builder()
.tls_config(
ureq::tls::TlsConfig::builder()
.root_certs(ureq::tls::RootCerts::PlatformVerifier)
.build(),
)
.build()
.new_agent();
agent.get(&url).call().ok()?
};
#[cfg(not(feature = "platform-certs"))]
let mut response = ureq::get(&url).call().ok()?;
let metadata: CrateIoGetResponse =
serde_json::from_reader(response.body_mut().as_reader()).unwrap();
Expand Down Expand Up @@ -178,7 +191,7 @@ pub fn crate_version(
}
}

if lock.is_some() && crate_lock_packages.is_empty() {
if lock.is_some() && !crate_lock_packages.is_empty() {
let lock_version = crate_lock_packages
.iter()
.map(|p| p.version.clone())
Expand Down