1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
// Copyright 2019-2023 Tauri Programme within The Commons Conservancy
// SPDX-License-Identifier: Apache-2.0
// SPDX-License-Identifier: MIT
use std::{ffi::OsString, fmt::Display};
use serde::{Deserialize, Deserializer};
use url::Url;
/// Install modes for the Windows update.
#[derive(Debug, PartialEq, Eq, Clone, Deserialize)]
#[serde(rename_all = "camelCase")]
#[derive(Default)]
pub enum WindowsUpdateInstallMode {
/// Specifies there's a basic UI during the installation process, including a final dialog box at the end.
BasicUi,
/// The quiet mode means there's no user interaction required.
/// Requires admin privileges if the installer does.
Quiet,
/// Specifies unattended mode, which means the installation only shows a progress bar.
#[default]
Passive,
}
impl WindowsUpdateInstallMode {
/// Returns the associated `msiexec.exe` arguments.
pub fn msiexec_args(&self) -> &'static [&'static str] {
match self {
Self::BasicUi => &["/qb+"],
Self::Quiet => &["/quiet"],
Self::Passive => &["/passive"],
}
}
#[cfg(windows)]
pub(crate) fn msi_restart_after_install_args(&self) -> &'static [&'static str] {
&["AUTOLAUNCHAPP=True"]
}
/// Returns the associated nsis arguments.
pub fn nsis_args(&self) -> &'static [&'static str] {
// `/P`: Passive
// `/S`: Silent
// `/R`: Restart
match self {
Self::Passive => &["/P"],
Self::Quiet => &["/S"],
_ => &[],
}
}
#[cfg(windows)]
pub(crate) fn nsis_restart_after_install_args(&self) -> &'static [&'static str] {
match self {
Self::BasicUi => &[],
_ => &["/R"],
}
}
}
impl Display for WindowsUpdateInstallMode {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
write!(
f,
"{}",
match self {
Self::BasicUi => "basicUi",
Self::Quiet => "quiet",
Self::Passive => "passive",
}
)
}
}
#[derive(Debug, Clone, Deserialize, Default)]
#[serde(rename_all = "camelCase")]
pub struct WindowsConfig {
/// Additional arguments given to the NSIS or WiX installer.
///
/// Note: this applies to both WiX and NSIS installers
#[serde(
default,
alias = "installer-args",
deserialize_with = "deserialize_os_string"
)]
pub installer_args: Vec<OsString>,
/// Updating mode, defaults to `passive` mode.
///
/// See [`WindowsUpdateInstallMode`] for more info.
#[serde(default, alias = "install-mode")]
pub install_mode: WindowsUpdateInstallMode,
}
fn deserialize_os_string<'de, D>(deserializer: D) -> Result<Vec<OsString>, D::Error>
where
D: Deserializer<'de>,
{
Ok(Vec::<String>::deserialize(deserializer)?
.into_iter()
.map(OsString::from)
.collect::<Vec<_>>())
}
/// Updater configuration.
#[derive(Debug, Clone, Default)]
pub struct Config {
/// Dangerously allow using insecure transport protocols for update endpoints.
pub dangerous_insecure_transport_protocol: bool,
/// Dangerously accept invalid TLS certificates for update requests.
pub dangerous_accept_invalid_certs: bool,
/// Dangerously accept invalid hostnames for TLS certificates for update requests.
pub dangerous_accept_invalid_hostnames: bool,
/// Updater endpoints.
pub endpoints: Vec<Url>,
/// Signature public key.
pub pubkey: String,
/// Require the update signature to carry the version it was signed for, and reject the
/// update when that version differs from the one announced by the update endpoint.
///
/// The endpoint response is fetched over TLS but is not itself signed, and the signature
/// only covers the downloaded artifact. Without this flag, anyone able to serve a crafted
/// response can pair an inflated `version` field with the `url` and `signature` of an
/// older release and force a downgrade to a genuine but outdated build, since that older
/// artifact carries a valid signature.
///
/// The signed version is read from the signature's trusted comment, which is covered by
/// the signature. Releases signed before the Tauri CLI started recording it carry no
/// version, so enabling this rejects them. Re-sign and re-publish every release your users
/// can still update from before turning this on.
///
/// This is checked independently of the version comparison: it constrains which artifact a
/// given version number may resolve to, not whether that version is newer.
///
/// The default value of this flag is `false`.
pub require_signed_version: bool,
/// Allow the updater to install a release whose version is not newer than the
/// currently running one, changing the version check from "must be newer" to
/// "must be different".
///
/// Note that the updater only verifies the signature of the downloaded artifact,
/// not the version advertised by the update endpoint, so enabling this removes the
/// only guard against installing a previously released (and validly signed) version.
///
/// Ignored when the application sets a custom
/// [`Builder::default_version_comparator`](crate::Builder::default_version_comparator).
///
/// The default value of this flag is `false`.
pub allow_downgrades: bool,
/// The Windows configuration for the updater.
pub windows: Option<WindowsConfig>,
}
impl<'de> Deserialize<'de> for Config {
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
where
D: Deserializer<'de>,
{
#[derive(Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct Config {
#[serde(default, alias = "dangerous-insecure-transport-protocol")]
pub dangerous_insecure_transport_protocol: bool,
#[serde(default, alias = "dangerous-accept-invalid-certs")]
pub dangerous_accept_invalid_certs: bool,
#[serde(default, alias = "dangerous-accept-invalid-hostnames")]
pub dangerous_accept_invalid_hostnames: bool,
#[serde(default)]
pub endpoints: Vec<Url>,
pub pubkey: String,
#[serde(default, alias = "require-signed-version")]
pub require_signed_version: bool,
#[serde(default, alias = "allow-downgrades")]
pub allow_downgrades: bool,
pub windows: Option<WindowsConfig>,
}
let config = Config::deserialize(deserializer)?;
validate_endpoints(
&config.endpoints,
config.dangerous_insecure_transport_protocol,
)
.map_err(serde::de::Error::custom)?;
Ok(Self {
dangerous_insecure_transport_protocol: config.dangerous_insecure_transport_protocol,
dangerous_accept_invalid_certs: config.dangerous_accept_invalid_certs,
dangerous_accept_invalid_hostnames: config.dangerous_accept_invalid_hostnames,
endpoints: config.endpoints,
pubkey: config.pubkey,
require_signed_version: config.require_signed_version,
allow_downgrades: config.allow_downgrades,
windows: config.windows,
})
}
}
pub(crate) fn validate_endpoints(
endpoints: &[Url],
dangerous_insecure_transport_protocol: bool,
) -> crate::Result<()> {
if !dangerous_insecure_transport_protocol {
for url in endpoints {
if url.scheme() != "https" {
#[cfg(debug_assertions)]
{
eprintln!("[\x1b[33mWARNING\x1b[0m] The updater endpoint \"{url}\" doesn't use `https` protocol. This is allowed in development but will fail in release builds.");
eprintln!("[\x1b[33mWARNING\x1b[0m] if this is a desired behavior, you can enable `dangerousInsecureTransportProtocol` in the plugin configuration");
}
#[cfg(not(debug_assertions))]
return Err(crate::Error::InsecureTransportProtocol);
}
}
}
Ok(())
}