fix: issues when patching binary files #14521

kandrelczyk · 2025-11-22T23:29:52Z

This addresses #14186

Alternative patch method based on string value change. Since this is now common for all platforms I removed the no longer necessary code. Also clean up error that is no longer needed. Tested this on Linux with stripped binary and using updater plugin unit tests.

github-actions · 2025-11-23T03:46:53Z

Package Changes Through `7595a70`

There are 7 changes which include @tauri-apps/api with patch, tauri with patch, tauri-cli with patch, tauri-bundler with patch, @tauri-apps/cli with patch, tauri-macos-sign with patch, tauri-utils with patch

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
@tauri-apps/api	2.9.0	2.9.1
tauri-utils	2.8.0	2.8.1
tauri-macos-sign	2.3.0	2.3.1
tauri-bundler	2.7.3	2.7.4
tauri-runtime	2.9.1	2.9.2
tauri-runtime-wry	2.9.1	2.9.2
tauri-codegen	2.5.1	2.5.2
tauri-macros	2.5.1	2.5.2
tauri-plugin	2.5.1	2.5.2
tauri-build	2.5.2	2.5.3
tauri	2.9.3	2.9.4
@tauri-apps/cli	2.9.4	2.9.5
tauri-cli	2.9.4	2.9.5

Add another change file through the GitHub UI by following this link.

Read about change files or the docs at github.com/jbolda/covector

Legend-Master · 2025-11-23T12:32:25Z

crates/tauri-bundler/src/bundle.rs

-  }
+  let mut file_data = std::fs::read(binary).expect("Could not read binary file.");
+
+  if let Some(bundle_var_index) = kmp::index_of(BUNDLE_VAR_TOKEN, &file_data) {


Didn't look at it closely yet, but I think this would fail when patching the binary for the second bundle type right? (e.g .msi first and __TAURI_BUNDLE_TYPE becomes __TAURI_BUNDLE_TYPE_VAR_MSI already that when we do it for the NSIS bundle, we can no longer find __TAURI_BUNDLE_TYPE_VAR_UNK)

There was an issue with double signing the binaries or patching already signed binary (I don't remember exactly) and the fix was to copy the original binary before each bundle so this should be fine. I tested on linux with standard deb,rpm and appImage and didn't get any errors.

do you remember if after the bundling is all done the binary in target/release/ will be a fresh one or the one from the last patch?

I've double checked and something is not right. I will fix it so that we always patch and bundle a copy of the binary and at the end we're left with the original, unpatched one.

I am still a bit concerned about this approach, like if we stopped at one of these steps (user pressed ctrl-c or we had an error somewhere), there's no way to recover/bundle again other than rebuilding the app's binary through cargo, and since we're matching any string in the binary, although unlikely, we risk replacing the wrong things

In my opinion, this method should not be used for the binary patching/main detection method

if we make sure to never touch the binary in target/release/ and always work on the copy somewhere else then you can just re-run tauri bundle but not sure if that's what you mean

Ah, didn't think of that, that should probably fix this problem, it might leave files in the temp folder but I guess if that's somewhere inside target, the next cargo clean removes it anyways

True but this is so unlikely i wouldn't even count this as an argument

Fair, I just don't really like that chance to be honest 😂

well, any ideas left for the patching idea?

I messed up the words when moving them, I was thinking it shouldn't be the 'main binary patching/detection' method (e.g. use the current one and adding this for a backup)

I messed up the words when moving them, I was thinking it shouldn't be the 'main binary patching/detection' method (e.g. use the current one and adding this for a backup)

ah my bad. I mean honestly fair enough! we can keep both 🤷

// When packaging multiple binary types, we make a copy of the unsigned main_binary so that we can // restore it after each package_type step. This avoids two issues: // - modifying a signed binary without updating its PE checksum can break signature verification // - codesigning tools should handle calculating+updating this, we just need to ensure // (re)signing is performed after every `patch_binary()` operation // - signing an already-signed binary can result in multiple signatures, causing verification errors let main_binary_reset_required = matches!(target_os, TargetPlatform::Windows) && settings.windows().can_sign() && package_types.len() > 1;

So I remembered correctly we do this but it's just for Windows right now. I'm assuming simply extending this approach to Linux will be enough, right? It's basically boils down to the same issue. I will work on this later today.

in the future we should look into the "work on temp copy only" approach but that's not urgent

So just to be clear, are we going to use this method for binary patching exclusively or do we want to use this as a fallback? (e.g. the find link section thing -> find the string and replace)

crates/tauri-bundler/src/bundle.rs

Legend-Master · 2025-11-26T03:29:50Z

crates/tauri-bundler/src/error.rs

  /// Package type is not supported by target platform
-  #[error("Wrong package type {0} for platform {1}")]
-  InvalidPackageType(String, String),
+  #[error("Wrong package type {0}")]


Not sure if we could make breaking changes here

@FabianLars any thoughts?

This was only used by the binary patching code. I don't think any external code will use this error as it's very specific.

we have downstream bundler users so ideally we don't break here. also not sure if we wanted to keep the old logic around or not @Legend-Master ?

I think we keep InvalidPackageType the same and mark the other variants deprecated?

yeah yeah - my ping was a bit offtopic here. Just deprecate it, change the comment to say that it's unused and move on.

Legend-Master · 2025-11-26T03:32:54Z

crates/tauri-bundler/src/bundle.rs

-  }
+  let mut file_data = std::fs::read(binary).expect("Could not read binary file.");
+
+  if let Some(bundle_var_index) = kmp::index_of(BUNDLE_VAR_TOKEN, &file_data) {


So just to be clear, are we going to use this method for binary patching exclusively or do we want to use this as a fallback? (e.g. the find link section thing -> find the string and replace)

Co-authored-by: Tony <[email protected]>

kandrelczyk · 2025-11-26T07:49:50Z

I've change this to be the only method. I don't see any benefits in using the old method over this.

FabianLars · 2025-11-26T09:22:19Z

since the old method didn't work well i agree but i really don't mind either so i'm fine with what tony decides lol - i do like how this here has a seemingly way simpler impl

Legend-Master · 2025-11-26T10:12:49Z

Let's just roll with this one exclusively

…/tauri into patch_by_string_substitution

Legend-Master

Generally looking good, seems to work on Windows from testing, thanks again for the help on this
Just some nitpicks

.changes/fix-binary-patching.md

crates/tauri-bundler/src/error.rs

Legend-Master · 2025-11-27T12:56:43Z

crates/tauri-bundler/src/error.rs

  /// Package type is not supported by target platform
+  #[deprecated(note = "User WrongPackageType instead")]
  #[error("Wrong package type {0} for platform {1}")]
  InvalidPackageType(String, String),


Any reason we change this to WrongPackageType and removed the platform info?

I merged both Linux and Windows cases in one function so I thought the platform validation doesn't apply anymore but after thinking about it I split it again

#[cfg(target_os = "linux")] let bundle_type = match package_type { crate::PackageType::Deb => b"__TAURI_BUNDLE_TYPE_VAR_DEB", crate::PackageType::Rpm => b"__TAURI_BUNDLE_TYPE_VAR_RPM", crate::PackageType::AppImage => b"__TAURI_BUNDLE_TYPE_VAR_APP", _ => { return Err(crate::Error::InvalidPackageType( package_type.short_name().to_owned(), "Linux".to_owned(), )) } }; #[cfg(target_os = "windows")] let bundle_type = match package_type { crate::PackageType::Nsis => b"__TAURI_BUNDLE_TYPE_VAR_NSS", crate::PackageType::WindowsMsi => b"__TAURI_BUNDLE_TYPE_VAR_MSI", _ => { return Err(crate::Error::InvalidPackageType( package_type.short_name().to_owned(), "Windows".to_owned(), )) } }; ''' So I've restored this error.

Co-authored-by: Tony <[email protected]>

…/tauri into patch_by_string_substitution

kandrelczyk · 2025-11-27T23:03:11Z

Totally forgot about Mac. I disabled patching on Mac since we already handle it in pub fn bundle_type() in platform.rs. Or do we prefer to patch it and change this method?

match __TAURI_BUNDLE_TYPE {
      "__TAURI_BUNDLE_TYPE_VAR_DEB" => Some(BundleType::Deb),
      "__TAURI_BUNDLE_TYPE_VAR_RPM" => Some(BundleType::Rpm),
      "__TAURI_BUNDLE_TYPE_VAR_APP" => Some(BundleType::AppImage),
      "__TAURI_BUNDLE_TYPE_VAR_MSI" => Some(BundleType::Msi),
      "__TAURI_BUNDLE_TYPE_VAR_NSS" => Some(BundleType::Nsis),
      _ => {
        if cfg!(target_os = "macos") {
          Some(BundleType::App)
        } else {
          None
        }
      }

would be

match __TAURI_BUNDLE_TYPE {
      "__TAURI_BUNDLE_TYPE_VAR_DEB" => Some(BundleType::Deb),
      "__TAURI_BUNDLE_TYPE_VAR_RPM" => Some(BundleType::Rpm),
      "__TAURI_BUNDLE_TYPE_VAR_APP" => Some(BundleType::AppImage),
      "__TAURI_BUNDLE_TYPE_VAR_MSI" => Some(BundleType::Msi),
      "__TAURI_BUNDLE_TYPE_VAR_NSS" => Some(BundleType::Nsis),
      "__TAURI_BUNDLE_TYPE_VAR_MAC" => Some(BundleType::App),
      _ => None
      }

Legend-Master · 2025-11-28T03:01:36Z

I think we could change that later if we actually add another bundler for mac

Also, we probably want to fix those warnings 🙃

https://github.com/tauri-apps/tauri/actions/runs/19749488088/job/56598652144?pr=14521

kandrelczyk · 2025-11-28T19:01:43Z

Fixed 👍

Legend-Master · 2025-11-29T03:03:28Z

.changes/fix-binary-patching.md

@@ -0,0 +1,8 @@
+---
+"tauri": patch:changes


@FabianLars do we want to delay this to next minor? since this isn't compatible with our current tauri and cli minor versions combo

sounds reasonable

kandrelczyk added 2 commits November 23, 2025 00:18

alternative patch method

8bf7d51

change file

dad191c

kandrelczyk requested a review from a team as a code owner November 22, 2025 23:29

github-project-automation bot added this to Roadmap Nov 22, 2025

github-project-automation bot moved this to 📬Proposal in Roadmap Nov 22, 2025

FabianLars requested review from FabianLars, Legend-Master and lucasfernog November 23, 2025 07:28

kandrelczyk added 2 commits November 23, 2025 09:03

clippy

ec35668

license header

66b64b1

Legend-Master reviewed Nov 23, 2025

View reviewed changes

copy and restore binary

88d8064

Legend-Master reviewed Nov 26, 2025

View reviewed changes

Update crates/tauri-bundler/src/bundle.rs

2d32f71

Co-authored-by: Tony <[email protected]>

kandrelczyk added 2 commits November 26, 2025 18:38

deprecate error

662a1ba

Merge branch 'patch_by_string_substitution' of github.com:kandrelczyk…

7c786b3

…/tauri into patch_by_string_substitution

Legend-Master reviewed Nov 27, 2025

View reviewed changes

kandrelczyk and others added 4 commits November 27, 2025 22:37

Update .changes/fix-binary-patching.md

3799c5b

Co-authored-by: Tony <[email protected]>

deprecate error and revernt package type validation

ff5ab53

Merge branch 'patch_by_string_substitution' of github.com:kandrelczyk…

6adcbcc

…/tauri into patch_by_string_substitution

fix mac

4035869

fix warning

ad7335b

Legend-Master approved these changes Nov 29, 2025

View reviewed changes

Merge branch 'dev' into patch_by_string_substitution

7595a70

Legend-Master added this to the 2.10 milestone Nov 29, 2025

Uh oh!

fix: issues when patching binary files #14521

Are you sure you want to change the base?

fix: issues when patching binary files #14521

Conversation

kandrelczyk commented Nov 22, 2025

Uh oh!

github-actions bot commented Nov 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Package Changes Through 7595a70

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kandrelczyk commented Nov 26, 2025

Uh oh!

FabianLars commented Nov 26, 2025

Uh oh!

Legend-Master commented Nov 26, 2025

Uh oh!

Legend-Master left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kandrelczyk commented Nov 27, 2025

Uh oh!

Legend-Master commented Nov 28, 2025

Uh oh!

kandrelczyk commented Nov 28, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Nov 23, 2025 •

edited

Loading

Package Changes Through `7595a70`