[feat] Allow for custom URLs for NSIS. WiX, Webview source

[mauromartins-ntx]

Describe the problem

I'm currently behind a corporate firewall that inhibits downloading from Github as such, all calls to github.com for downloading files are impeded.
As such, I'm unable to correctly finish compilation of a Tauri app as I cannot download the NSIS binaries.

Describe the solution you'd like

Allow for alternative URLs to be specified in the configuration files, so that I can specify an internal URL for an artifactory repository that would contain these files.

Alternatives considered

Usage of a custom proxy to proxy to the archive storage as I'm aware of #7985
However, this is too cumbersome for a resilient deployment pipeline and adds another moving part.

Additional context

No response

[FabianLars]

Does #10866 or #11096 work for you?

[mauromartins-ntx]

Does #10866 or #11096 work for you?

Hello, thank you first of all for your swift reply!

Yes, this worked for me, it allowed me to change the URL appropriately, however, I'm getting a TLS issue:

    Info Verifying NSIS package
    Downloading https://jfrog/binary-releases/releases/download/nsis-3/nsis-3.zip
failed to bundle project: `https://jfrog/tauri-apps/binary-releases/releases/download/nsis-3/nsis-3.zip: Connection Failed: tls connection init failed: invalid peer certificate: UnknownIssuer`
    Error failed to bundle project: `https://jfrog/tauri-apps/binary-releases/releases/download/nsis-3/nsis-3.zip: Connection Failed: tls connection init failed: invalid peer certificate: UnknownIssuer

The certificate for jfrog (url redacted) has been correctly installed system wide, however to no avail, I'm assuming this is something on the Jenkins side.

I've seen #7338 and #3770 however from what I've gathered for the Tauri V2 release I must put it in the local app data repository, which doesn't appear to be viable given the aforementioned Jenkins configuration.

So succinctly, my question is, is there a --insecure flag or something similar I can pass to disable TLS verification?

[FabianLars]

So succinctly, my question is, is there a --insecure flag or something similar I can pass to disable TLS verification?

Not yet but i think it we can add it for use cases like these.

Since you added the cert to the system, it may be enough to enable system certs in ureq. Can you try this maybe?

cargo install tauri-cli --debug --features ureq/native-certs
cargo tauri build

and if that doesn't work

cargo install tauri-cli --debug --git https://github.com/tauri-apps/tauri --features ureq/platform-verifier
cargo tauri build

(uses a better rust crate for the system deps)

[mauromartins-ntx]

So succinctly, my question is, is there a --insecure flag or something similar I can pass to disable TLS verification?

Not yet but i think it we can add it for use cases like these.

Since you added the cert to the system, it may be enough to enable system certs in ureq. Can you try this maybe?

cargo install tauri-cli --debug --features ureq/native-certs
cargo tauri build

and if that doesn't work

cargo install tauri-cli --debug --git https://github.com/tauri-apps/tauri --features ureq/platform-verifier
cargo tauri build

(uses a better rust crate for the system deps)

Hello,

Thank you again for your reply, I'm currently using @tauri-apps/cli via pnpm, my section in package.json is as follows:

  "scripts": {
    "start": "npm run app-dev",
    "app-build": "tauri build",
    "app-dev": "tauri dev --no-watch --config ./src-tauri/tauri-dev.conf.json",
    "build": "npm run --workspaces --if-present build",
    "bootstrap": "run-p bootstrap:* && npm run --workspaces --if-present bootstrap",
    "bootstrap:vendor-node": "node scripts/vendor-node.cjs",
    "bootstrap:vendor-plugins": "node scripts/vendor-plugins.cjs",
    "bootstrap:vendor-protoc": "node scripts/vendor-protoc.cjs",
    "lint": "npm run --workspaces --if-present lint",
    "replace-version": "node scripts/replace-version.cjs",
    "tauri": "tauri",
    "tauri-before-build": "npm run bootstrap && npm run --workspaces --if-present build",
    "tauri-before-dev": "npm run --workspaces --if-present dev"
  },

My current build step is just calling npm app-build, I'm using the TS wrapper, are the flags passable to the TS wrapper too?

I cannot really do a cargo install as crates.io is blocked and cargo install doesn't respect the local config.toml (as per rust-lang/cargo#11660)

Could you recommend a work-around? Circling back, is there a flag to specify trusted certificates directories, etc?

[FabianLars]

My current build step is just calling npm app-build, I'm using the TS wrapper, are the flags passable to the TS wrapper too?

Not really. It's a build time thing so we have to rebuild the cli here. While technically possible with the js cli as well, it's not a good fit for CI imo. ref https://v1.tauri.app/v1/guides/faq#how-can-i-use-unpublished-tauri-changes (not ported to v2 docs yet - the instructions are wrong for the cli)

Circling back, is there a flag to specify trusted certificates directories, etc?

This is basically what i'm trying to make you try here. The http client in the cli currently can only use built-in certificates so for any user defined ones we need changes in the cli to try it. Also, system wide installed certs would be much easier to enable than a custom folder so i'd like to start with that and wait to see if the custom folder is really required.

[mauromartins-ntx]

My current build step is just calling npm app-build, I'm using the TS wrapper, are the flags passable to the TS wrapper too?

Not really. It's a build time thing so we have to rebuild the cli here. While technically possible with the js cli as well, it's not a good fit for CI imo. ref https://v1.tauri.app/v1/guides/faq#how-can-i-use-unpublished-tauri-changes (not ported to v2 docs yet - the instructions are wrong for the cli)

Circling back, is there a flag to specify trusted certificates directories, etc?

This is basically what i'm trying to make you try here. The http client in the cli currently can only use built-in certificates so for any user defined ones we need changes in the cli to try it. Also, system wide installed certs would be much easier to enable than a custom folder so i'd like to start with that and wait to see if the custom folder is really required.

Helllo,

So the first solution appears to work, but simultaneously does not.
I am unable to try the second due to the aforementioned corporate firewall which inhibits access to Github

It doesn't show any progress downloading the actual file, per say, nor does it show the URL again, it simply complains it cannot find nsis

     Compiling urlencoding v2.1.3
   Compiling hex_color v3.0.0

    Finished `release` profile [optimized] target(s) in 6m 27s
warning: the following packages contain code that will be rejected by a future version of Rust: iso8601 v0.3.0, nom v4.2.3
note: to see what the problems were, use the option `--future-incompat-report`, or run `cargo report future-incompatibilities --id 1`
    Built [tauri_cli::build] application at: C:\jenkinsdir\src-tauri\target\release\app.exe
    Info [tauri_bundler::bundle::windows::nsis] Target: x6    
    [...]
    Debug [handlebars::render] Rendering value: Path(Relative(([], "this")))
    Running [tauri_bundler::bundle::windows::nsis] makensis.exe to produce C:\jenkinsdirsrc-tauri\target\release\bundle\nsis\app.0.0_x64-setup.exe
    Running [tauri_bundler::utils] Command `C:\WINDOWS\system32\config\systemprofile\AppData\Local\tauri\NSIS\makensis.exe  -INPUTCHARSET UTF8 -OUTPUTCHARSET UTF8 -V3 C:\jenkinsdir\src-tauri\target\release\nsis\x64\installer.nsi`
Unable to start child process, error 0x2
    Error [tauri_cli] failed to bundle project:
    - `The system cannot find the file specified. (os error 2)`

The directory specified does exist and does have makensis.exe in it

The other directory does exist

I have attempted to vendor a version of makensis and adding to PATH, to no avail (obiviously, as this is now NSIS is called)

The situation here is mainly due to how the production machines are configured, they don't allow anything to be run from anything but C:\jenkinsdir\ (I cannot manually start anything from outside that directory)

Is there a variable I can specify the PATH of the NSIS installation to?

Or is there a way to just get Tauri to generate the .nsh file and stop there, so I can then run NSIS myself?

[FabianLars]

I am unable to try the second due to the aforementioned corporate firewall which inhibits access to Github

ah yes, ofcourse... 😅

The situation here is mainly due to how the production machines are configured, they don't allow anything to be run from anything but C:\jenkinsdir\ (I cannot manually start anything from outside that directory)

If i see it right and your target dir is in that path too you can use this config https://v2.tauri.app/reference/config/#uselocaltoolsdir

[mauromartins-ntx]

If i see it right and your target dir is in that path too you can use this config https://v2.tauri.app/reference/config/#uselocaltoolsdir

    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3m 41s
   Replacing C:\WINDOWS\system32\config\systemprofile\.cargo\bin\cargo-tauri.exe
error: failed to move `C:\WINDOWS\system32\config\systemprofile\.cargo\bin\cargo-install7yDeI1\cargo-tauri.exe` to `C:\WINDOWS\system32\config\systemprofile\.cargo\bin\cargo-tauri.exe`

Caused by:
  Access is denied. (os error 5)

This feature doesn't appear to be working as intended, it's still going to systemprofile for some weird reason? My target directory is within that "safe" one correct.

[FabianLars]

That config will change where the NSIS tools will be downloaded to, so it will only be applied when building your app, not the cli.

[mauromartins-ntx]

That config will change where the NSIS tools will be downloaded to, so it will only be applied when building your app, not the cli.

That would be my intention yes, did I put it in the wrong place maybe? 😅

I put in tauri.conf.json > bundle should it be under windows?

[FabianLars]

No you did at it correctly probably but in your message the error happens before the tauri build step (this is cargo install tauri-cli failing)

[mauromartins-ntx]

No you did at it correctly probably but in your message the error happens before the tauri build step (this is cargo install tauri-cli failing)

Oh I see, this is weird because cargo install worked perfectly before this config change 😅

I'll look in to the matter see if I didn't change anything else, but I don't think so

[mauromartins-ntx]

All resolved, thank you for your help @FabianLars.