sync dev with upstream/dev

.changes/acl-identifier-error-context.md

@@ -0,0 +1,9 @@
+---
+"tauri-utils": "patch:enhance"
+---
+
+Improve diagnostics for invalid plugin and permission identifiers.
+
+The `Identifier` deserializer now wraps the inner error with the offending identifier string so the message reads `invalid plugin or permission identifier '<value>': ...`, surfacing the bad entry without requiring a grep through the file.
+
+The previous parse failure (`failed to parse JSON: identifiers can only include lowercase ASCII, hyphens which are not leading or trailing, and a single colon if using a prefix at line 16 column 23`) now reads `failed to parse JSON: invalid plugin or permission identifier 'sqlite_proxy:allow-foo': identifiers can only include lowercase ASCII, hyphens which are not leading or trailing, and a single colon if using a prefix at line 16 column 23`.

.changes/nsis-config-path-context.md

@@ -0,0 +1,5 @@
+---
+"tauri-bundler": "patch:enhance"
+---
+
+Improve NSIS configuration path errors so missing installer icons and images include the related config key and path.

.changes/nsis-stock-plugins-embed-signed.md

@@ -0,0 +1,5 @@
+---
+"tauri-bundler": "patch:bug"
+---
+
+Fix NSIS stock plugins (`NSISdl.dll`, `StartMenu.dll`, `System.dll`, `nsDialogs.dll`) being embedded in the final installer as unsigned despite the signing step succeeding. The signed local copies under `<output>/Plugins/x86-unicode/` were not on makensis' plugin search path, so makensis fell back to the unsigned DLLs from the NSIS toolset directory. The fix adds `!addplugindir` for the signed plugin directory before any plugin command is parsed in the script.

crates/tauri-build/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## \[2.6.2]
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.9.2`
+- Upgraded to `tauri-codegen@2.6.2`
+
 ## \[2.6.1]
 
 ### Dependencies

crates/tauri-build/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tauri-build"
-version = "2.6.1"
+version = "2.6.2"
 description = "build time code to pair with https://crates.io/crates/tauri"
 exclude = ["CHANGELOG.md", "/target"]
 readme = "README.md"
@@ -26,8 +26,8 @@ targets = [
 [dependencies]
 anyhow = "1"
 quote = { version = "1", optional = true }
-tauri-codegen = { version = "2.6.1", path = "../tauri-codegen", optional = true }
-tauri-utils = { version = "2.9.1", path = "../tauri-utils", features = [
+tauri-codegen = { version = "2.6.2", path = "../tauri-codegen", optional = true }
+tauri-utils = { version = "2.9.2", path = "../tauri-utils", features = [
   "build-2",
   "resources",
 ] }

crates/tauri-bundler/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## \[2.9.2]
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.9.2`
+
 ## \[2.9.1]
 
 ### Dependencies

crates/tauri-bundler/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tauri-bundler"
-version = "2.9.1"
+version = "2.9.2"
 authors = [
   "George Burton <burtonageo@gmail.com>",
   "Tauri Programme within The Commons Conservancy",
@@ -15,7 +15,7 @@ rust-version = "1.77.2"
 exclude = ["CHANGELOG.md", "/target", "rustfmt.toml"]
 
 [dependencies]
-tauri-utils = { version = "2.9.1", path = "../tauri-utils", features = [
+tauri-utils = { version = "2.9.2", path = "../tauri-utils", features = [
   "resources",
 ] }
 image = "0.25"

crates/tauri-bundler/src/bundle/windows/nsis/installer.nsi

@@ -13,6 +13,12 @@ ManifestDPIAwareness PerMonitorV2
   SetCompressor /SOLID "{{compression}}"
 !endif
 
+; Keep above !include to stay ahead of any plugin command
+; see https://github.com/tauri-apps/tauri/pull/15422#discussion_r3289239624
+{{#if signed_plugins_path}}
+!addplugindir "{{signed_plugins_path}}"
+{{/if}}
+
 !include MUI2.nsh
 !include FileFunc.nsh
 !include x64.nsh

crates/tauri-bundler/src/bundle/windows/nsis/mod.rs

@@ -13,7 +13,7 @@ use crate::{
       },
     },
   },
-  error::ErrorExt,
+  error::{bail, ErrorExt},
   utils::{
     http_utils::{download_and_verify, verify_file_hash, HashAlgorithm},
     CommandExt,
@@ -282,6 +282,13 @@ fn build_nsis_app_installer(
     to_json(&additional_plugins_path),
   );
 
+  if let Some(plugin_copy_path) = &maybe_plugin_copy_path {
+    data.insert(
+      "signed_plugins_path",
+      to_json(plugin_copy_path.join("x86-unicode")),
+    );
+  }
+
   data.insert("arch", to_json(arch));
   data.insert("bundle_id", to_json(bundle_id));
   data.insert("manufacturer", to_json(manufacturer));
@@ -319,7 +326,8 @@ fn build_nsis_app_installer(
   );
 
   if let Some(license_file) = settings.license_file() {
-    let license_file = dunce::canonicalize(license_file)?;
+    let license_file = dunce::canonicalize(&license_file)
+      .fs_context("failed to resolve `bundle > licenseFile`", license_file)?;
     let license_file_with_bom = output_path.join("license_file");
     let content = std::fs::read(license_file)?;
     write_utf8_with_bom(&license_file_with_bom, content)?;
@@ -339,37 +347,58 @@ fn build_nsis_app_installer(
     if let Some(installer_icon) = &nsis.installer_icon {
       data.insert(
         "installer_icon",
-        to_json(dunce::canonicalize(installer_icon)?),
+        to_json(dunce::canonicalize(installer_icon).fs_context(
+          "failed to resolve `bundle > windows > nsis > installerIcon`",
+          installer_icon.to_owned(),
+        )?),
       );
     }
 
     if let Some(header_image) = &nsis.header_image {
-      data.insert("header_image", to_json(dunce::canonicalize(header_image)?));
+      data.insert(
+        "header_image",
+        to_json(dunce::canonicalize(header_image).fs_context(
+          "failed to resolve `bundle > windows > nsis > headerImage`",
+          header_image.to_owned(),
+        )?),
+      );
     }
 
     if let Some(sidebar_image) = &nsis.sidebar_image {
       data.insert(
         "sidebar_image",
-        to_json(dunce::canonicalize(sidebar_image)?),
+        to_json(dunce::canonicalize(sidebar_image).fs_context(
+          "failed to resolve `bundle > windows > nsis > sidebarImage`",
+          sidebar_image.to_owned(),
+        )?),
       );
     }
 
     if let Some(uninstaller_icon) = &nsis.uninstaller_icon {
       data.insert(
         "uninstaller_icon",
-        to_json(dunce::canonicalize(uninstaller_icon)?),
+        to_json(dunce::canonicalize(uninstaller_icon).fs_context(
+          "failed to resolve `bundle > windows > nsis > uninstallerIcon`",
+          uninstaller_icon.to_owned(),
+        )?),
       );
     }
 
     if let Some(uninstaller_header_image) = &nsis.uninstaller_header_image {
       data.insert(
         "uninstaller_header_image",
-        to_json(dunce::canonicalize(uninstaller_header_image)?),
+        to_json(dunce::canonicalize(uninstaller_header_image).fs_context(
+          "failed to resolve `bundle > windows > nsis > uninstallerHeaderImage`",
+          uninstaller_header_image.to_owned(),
+        )?),
       );
     }
 
     if let Some(installer_hooks) = &nsis.installer_hooks {
-      let installer_hooks = dunce::canonicalize(installer_hooks)?;
+      let installer_hooks = dunce::canonicalize(installer_hooks).fs_context(
+        "failed to resolve `bundle > windows > nsis > installerHooks`",
+        installer_hooks.to_owned(),
+      )?;
       data.insert("installer_hooks", to_json(installer_hooks));
     }
 
@@ -628,7 +657,7 @@ fn build_nsis_app_installer(
   );
 
   let nsis_output_path = output_path.join(out_file);
-  let nsis_installer_path = settings.project_out_directory().to_path_buf().join(format!(
+  let nsis_installer_path = settings.project_out_directory().join(format!(
     "bundle/{}/{}.exe",
     if updater {
       NSIS_UPDATER_OUTPUT_FOLDER_NAME
@@ -661,11 +690,7 @@ fn build_nsis_app_installer(
   #[cfg(not(target_os = "windows"))]
   let mut nsis_cmd = Command::new("makensis");
 
-  if let Some(plugins_path) = &maybe_plugin_copy_path {
-    nsis_cmd.env("NSISPLUGINS", plugins_path);
-  }
-
-  nsis_cmd
+  let status = nsis_cmd
     .args(["-INPUTCHARSET", "UTF8", "-OUTPUTCHARSET", "UTF8"])
     .arg(match settings.log_level() {
       log::Level::Error => "-V1",
@@ -682,6 +707,9 @@ fn build_nsis_app_installer(
       command: "makensis.exe".to_string(),
       error,
     })?;
+  if !status.success() {
+    bail!("Failed to bundle app with makensis");
+  }
 
   fs::rename(nsis_output_path, &nsis_installer_path)?;
 

crates/tauri-cli/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## \[2.11.2]
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.9.2`
+- Upgraded to `tauri-bundler@2.9.2`
+
 ## \[2.11.1]
 
 ### Dependencies

crates/tauri-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tauri-cli"
-version = "2.11.1"
+version = "2.11.2"
 authors = ["Tauri Programme within The Commons Conservancy"]
 edition = "2021"
 rust-version = "1.77.2"
@@ -47,7 +47,7 @@ sublime_fuzzy = "0.7"
 clap_complete = "4"
 clap = { version = "4", features = ["derive", "env"] }
 thiserror = "2"
-tauri-bundler = { version = "2.9.1", default-features = false, path = "../tauri-bundler" }
+tauri-bundler = { version = "2.9.2", default-features = false, path = "../tauri-bundler" }
 colored = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = { version = "1", features = ["preserve_order"] }
@@ -58,7 +58,7 @@ shared_child = "1"
 duct = "1.0"
 toml_edit = { version = "0.25", features = ["serde"] }
 json-patch = "3"
-tauri-utils = { version = "2.9.1", path = "../tauri-utils", features = [
+tauri-utils = { version = "2.9.2", path = "../tauri-utils", features = [
   "isolation",
   "schema",
   "config-json5",

crates/tauri-cli/config.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://schema.tauri.app/config/2.11.1",
+  "$id": "https://schema.tauri.app/config/2.11.2",
   "title": "Config",
   "description": "The Tauri configuration object.\n It is read from a file where you can define your frontend assets,\n configure the bundler and define a tray icon.\n\n The configuration file is generated by the\n [`tauri init`](https://v2.tauri.app/reference/cli/#init) command that lives in\n your Tauri application source directory (src-tauri).\n\n Once generated, you may modify it at will to customize your Tauri application.\n\n ## File Formats\n\n By default, the configuration is defined as a JSON file named `tauri.conf.json`.\n\n Tauri also supports JSON5 and TOML files via the `config-json5` and `config-toml` Cargo features, respectively.\n The JSON5 file name must be either `tauri.conf.json` or `tauri.conf.json5`.\n The TOML file name is `Tauri.toml`.\n\n ## Platform-Specific Configuration\n\n In addition to the default configuration file, Tauri can\n read a platform-specific configuration from `tauri.linux.conf.json`,\n `tauri.windows.conf.json`, `tauri.macos.conf.json`, `tauri.android.conf.json` and `tauri.ios.conf.json`\n (or `Tauri.linux.toml`, `Tauri.windows.toml`, `Tauri.macos.toml`, `Tauri.android.toml` and `Tauri.ios.toml` if the `Tauri.toml` format is used),\n which gets merged with the main configuration object.\n\n ## Configuration Structure\n\n The configuration is composed of the following objects:\n\n - [`app`](#appconfig): The Tauri configuration\n - [`build`](#buildconfig): The build configuration\n - [`bundle`](#bundleconfig): The bundle configurations\n - [`plugins`](#pluginconfig): The plugins configuration\n\n Example tauri.config.json file:\n\n ```json\n {\n   \"productName\": \"tauri-app\",\n   \"version\": \"0.1.0\",\n   \"build\": {\n     \"beforeBuildCommand\": \"\",\n     \"beforeDevCommand\": \"\",\n     \"devUrl\": \"http://localhost:3000\",\n     \"frontendDist\": \"../dist\"\n   },\n   \"app\": {\n     \"security\": {\n       \"csp\": null\n     },\n     \"windows\": [\n       {\n         \"fullscreen\": false,\n         \"height\": 600,\n         \"resizable\": true,\n         \"title\": \"Tauri App\",\n         \"width\": 800\n       }\n     ]\n   },\n   \"bundle\": {},\n   \"plugins\": {}\n }\n ```",
   "type": "object",