feat(windows): NSIS uninstaller icon and header image support (#15201 )

* feat: NSIS uninstaller support. * chore: fix typo and update schema. * fix: comments and alias. * fix: add pages for uninst sidebar. * chore: fix typo in comments of fields. * fix: group HEADERIMAGE. * fix: remove welcome/finish of uninstaller. * fix: remove uninstaller_sidebar_image. * Update crates/tauri-utils/src/config.rs Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com> * chore: revert comments. * chore: update schema. * Update crates/tauri-utils/src/config.rs Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com> * Update crates/tauri-utils/src/config.rs Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com> * fix: typo of installer_icon. * chore: add change file. * fix: typo. * chore: update config.json. * Update .changes/feat-uninstaller-icon-image.md Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com> * fix: revert alias. * chore: update comments in settings.rs. * chore: update comments. * fix: installer.nsi * fix: installer.nsi --------- Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com>
feat: add Bring All to Front predefined menu item type (#14307 )
2026-04-11 10:43:31 +02:00 · 2026-04-08 16:10:55 +08:00 · 2026-04-07 23:34:01 +08:00 · 2026-04-07 12:52:05 +08:00 · 2026-04-01 12:14:20 +08:00 · 2026-03-31 12:44:38 +02:00
454 changed files with 28337 additions and 9841 deletions
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -6,4 +6,6 @@ ignore = [
  "RUSTSEC-2020-0095",
  # proc-macro-error is unmaintained
  "RUSTSEC-2024-0370",
+  # time crate can't be updated in the repo because of MSRV, users are unaffected
+  "RUSTSEC-2026-0009",
 ]
--- a/.changes/add-bring-all-to-front-predefined-menu-item-type.md
+++ b/.changes/add-bring-all-to-front-predefined-menu-item-type.md
@@ -0,0 +1,6 @@
+---
+'tauri': 'minor:feat'
+'@tauri-apps/api': 'minor:feat'
+---
+
+Add Bring All to Front predefined menu item type
--- a/.changes/base64.md
+++ b/.changes/base64.md
@@ -0,0 +1,5 @@
+---
+"tauri-macos-sign": patch:enhance
+---
+
+Do not rely on system base64 CLI to decode certificates.
--- a/.changes/change-pr-15117.md
+++ b/.changes/change-pr-15117.md
@@ -0,0 +1,6 @@
+---
+"tauri-build": patch:enhance
+"tauri": patch:enhance
+---
+
+Simplify async-sync code boundaries, no externally visible changes
--- a/.changes/channel-ctor-callback.md
+++ b/.changes/channel-ctor-callback.md
@@ -1,5 +0,0 @@
---
-"@tauri-apps/api": minor:feat
---
-
-Allow passing the callback as the parameter of constructor of `Channel` so you can use it like this `new Channel((message) => console.log(message))`
--- a/.changes/channel-never-cleaned-up.md
+++ b/.changes/channel-never-cleaned-up.md
@@ -1,6 +0,0 @@
---
-"tauri": minor:bug
-"@tauri-apps/api": minor:bug
---
-
-Fix `Channel`'s callback attached to `window` never cleaned up
--- a/.changes/channel-small-payload-perf.md
+++ b/.changes/channel-small-payload-perf.md
@@ -1,5 +0,0 @@
---
-"tauri": minor:perf
---
-
-Improve `Channel`'s performance when sending small amount of data (e.g. sending a number)
--- a/.changes/config.json
+++ b/.changes/config.json
@@ -27,12 +27,6 @@
          "dryRunCommand": true,
          "pipe": true
        },
-        {
-          "command": "cargo generate-lockfile",
-          "dryRunCommand": true,
-          "runFromRoot": true,
-          "pipe": true
-        },
        {
          "command": "cargo audit ${ process.env.CARGO_AUDIT_OPTIONS || '' }",
          "dryRunCommand": true,
--- a/.changes/data-tauri-drag-region-deep.md
+++ b/.changes/data-tauri-drag-region-deep.md
@@ -0,0 +1,5 @@
+---
+"tauri": minor:feat
+---
+
+Add `data-tauri-drag-region="deep"` so clicks on non-clickable children will drag as well. Can still opt out of drag on some regions using `data-tauri-drag-region="false"`
--- a/.changes/detect-package-manager-env.md
+++ b/.changes/detect-package-manager-env.md
@@ -1,6 +0,0 @@
---
-"tauri-cli": patch:enhance
-"@tauri-apps/cli": patch:enhance
---
-
-Detect package manager from environment variable `npm_config_user_agent` first
--- a/.changes/disable-input-accessory-view-ios.md
+++ b/.changes/disable-input-accessory-view-ios.md
@@ -1,7 +0,0 @@
---
-"@tauri-apps/api": minor:feat
-"tauri-utils": minor:feat
---
-
-Added `disableInputAccessoryView: bool` config for iOS.
-
--- a/.changes/escape-nsis-resource-sidecar.md
+++ b/.changes/escape-nsis-resource-sidecar.md
@@ -1,5 +0,0 @@
---
-tauri-bundler: patch:bug
---
-
-Fix NSIS bundler can't include resources and sidecars with `$` in the path
--- a/.changes/eval-take-into-string.md
+++ b/.changes/eval-take-into-string.md
@@ -1,5 +0,0 @@
---
-tauri: minor:enhance
---
-
-`Webview::eval` and `WebviewWindow::eval` now takes `impl Into<String>` instead of `&str` to allow passing the scripts more flexible and efficiently
--- a/.changes/eval-with-callback.md
+++ b/.changes/eval-with-callback.md
@@ -0,0 +1,7 @@
+---
+'tauri': 'minor:feat'
+'tauri-runtime': 'minor:feat'
+'tauri-runtime-wry': 'minor:feat'
+---
+
+Add `eval_with_callback` to the Tauri webview APIs and runtime dispatch layers.
--- a/.changes/feat-dock-visibility-on-macos.md
+++ b/.changes/feat-dock-visibility-on-macos.md
@@ -1,7 +0,0 @@
---
-tauri: patch:feat
-tauri-runtime: patch:feat
-tauri-runtime-wry: patch:feat
---
-
-MacOS: Add `set_dock_visibility` method to support setting the visibility of the application in the dock.
--- a/.changes/feat-uninstaller-icon-image.md
+++ b/.changes/feat-uninstaller-icon-image.md
@@ -0,0 +1,13 @@
+---
+"tauri-bundler": minor:feat
+"tauri-cli": minor:feat
+"@tauri-apps/cli": minor:feat
+"tauri-utils": minor:feat
+---
+
+Added uninstaller icon and uninstaller header image support for NSIS installer.
+
+Notes:
+
+- For `tauri-bundler` lib users, the `NsisSettings` now has 2 new fields `uninstaller_icon` and `uninstaller_header_image` which can be a breaking change
+- When bundling with NSIS, users can add `uninstallerIcon` and `uninstallerHeaderImage` under `bundle > windows > nsis` to configure them.
--- a/.changes/fix-build-bundles-arg.md
+++ b/.changes/fix-build-bundles-arg.md
@@ -0,0 +1,7 @@
+---
+"tauri-bundler": patch:bug
+"tauri-cli": patch:bug
+"@tauri-apps/cli": patch:bug
+---
+
+Fix `build --bundles` to allow `nsis` arg in linux+macOS
--- a/.changes/fix-ios-metal-toolchain.md
+++ b/.changes/fix-ios-metal-toolchain.md
@@ -0,0 +1,6 @@
+---
+"tauri-cli": patch:bug
+"@tauri-apps/cli": patch:bug
+---
+
+Fix iOS build failure when `Metal Toolchain` is installed by using explicit `$(DEVELOPER_DIR)/Toolchains/XcodeDefault.xctoolchain` path instead of `$(TOOLCHAIN_DIR)` for Swift library search paths.
--- a/.changes/fix-ios-xcode-16.3.md
+++ b/.changes/fix-ios-xcode-16.3.md
@@ -1,6 +0,0 @@
---
-"tauri-cli": patch:bug
-"@tauri-apps/cli": patch:bug
---
-
-Fixes iOS dev not working on Xcode 16.3 simulators. To apply the fix, either regenerate the Xcode project with `rm -r src-tauri/gen/apple && tauri ios init` or remove the `arm64-sim` architecture from the Xcode project.
--- a/.changes/fix-referencing-command.md
+++ b/.changes/fix-referencing-command.md
@@ -1,5 +0,0 @@
---
-tauri: patch:bug
---
-
-Fix missing `core:` in referenced commands in ACL error message
--- a/.changes/init-script-on-all-frames.md
+++ b/.changes/init-script-on-all-frames.md
@@ -1,9 +0,0 @@
---
-tauri: minor:feat
-tauri-runtime: minor:feat
---
-
- add API to run initialization scripts on all frames
-  - `WebviewBuilder::initialization_script_on_all_frames`
-  - `WebviewWindowBuilder::initialization_script_on_all_frames`
-  - `WebviewAttributes::initialization_script_on_all_frames`
--- a/.changes/input-accessory-view-builder-runtime.md
+++ b/.changes/input-accessory-view-builder-runtime.md
@@ -1,6 +0,0 @@
---
-"tauri-runtime": minor:feat
-"tauri-runtime-wry": minor:feat
---
-
-Added `WebviewAttributes::input_accessory_view_builder` on iOS.
--- a/.changes/input-accessory-view-builder.md
+++ b/.changes/input-accessory-view-builder.md
@@ -1,5 +0,0 @@
---
-"tauri": minor:feat
---
-
-Added `WebviewWindowBuilder::with_input_accessory_view_builder` and `WebviewBuilder::with_input_accessory_view_builder` on iOS.
--- a/.changes/invoke-system-take-as-ref-str.md
+++ b/.changes/invoke-system-take-as-ref-str.md
@@ -1,5 +0,0 @@
---
-tauri: minor:enhance
---
-
-`Builder::invoke_system` takes `AsRef<str>` now
--- a/.changes/ios-macos-bundleversion.md
+++ b/.changes/ios-macos-bundleversion.md
@@ -1,8 +0,0 @@
---
-"tauri-utils": minor:feat
-"@tauri-apps/cli": minor:feat
-"tauri-cli": minor:feat
-"tauri-bundler": minor:feat
---
-
-Added `bundleVersion` to iOS and macOS configuration to support specifying a `CFBundleVersion`.
--- a/.changes/isTauri-tests.md
+++ b/.changes/isTauri-tests.md
@@ -1,5 +0,0 @@
---
-"@tauri-apps/api": patch:enhance
---
-
-`core.isTauri` now leverages `globalThis` instead of `window` in order to be used in unit tests.
--- a/.changes/linux-deploy-link.md
+++ b/.changes/linux-deploy-link.md
@@ -0,0 +1,5 @@
+---
+"tauri-bundler": patch:bug
+---
+
+Correct GitHub Release URL path for Linux i686 tooling.
--- a/.changes/liquid-glass-icon.md
+++ b/.changes/liquid-glass-icon.md
@@ -0,0 +1,5 @@
+---
+"tauri-bundler": minor:feat
+---
+
+Added support to Liquid Glass icons.
--- a/.changes/macOS_allow_link_preview-api.md
+++ b/.changes/macOS_allow_link_preview-api.md
@@ -1,7 +0,0 @@
---
-"@tauri-apps/api": patch:feat
---
-
-macOS/iOS: add option to disable or enable link previews when building a webview (the webkit api has it enabled by default)
-  -  `WindowOptions::allowLinkPreview`
-  -  `WebviewOptions::allowLinkPreview`
--- a/.changes/macOS_allow_link_preview.md
+++ b/.changes/macOS_allow_link_preview.md
@@ -1,9 +0,0 @@
---
-"tauri": patch:feat
-"tauri-runtime": patch:feat
-"tauri-runtime-wry": patch:feat
---
-
-macOS/iOS: add option to disable or enable link previews when building a webview (the webkit api has it enabled by default)
-  -  `WebViewBuilder.allow_link_preview(allow_link_preview: bool)`
-  -  `WebviewWindowBuilder.allow_link_preview(allow_link_preview: bool)`
--- a/.changes/multi-window-mobile.md
+++ b/.changes/multi-window-mobile.md
@@ -0,0 +1,8 @@
+---
+"tauri": minor:feat
+"tauri-runtime-wry": minor:feat
+"tauri-runtime": minor:feat
+"tauri-utils": minor:feat
+---
+
+Support creating multiple windows on Android (activity embedding) and iOS (scenes).
--- a/.changes/new-window-main-thread.md
+++ b/.changes/new-window-main-thread.md
@@ -0,0 +1,6 @@
+---
+"tauri": minor:changes
+"tauri-runtime-wry": minor:changes
+---
+
+The new window handler passed to `on_new_window` no longer requires `Sync`, and runs on main thread on Windows, aligning with other platforms
--- a/.changes/prevent-window-overflow.md
+++ b/.changes/prevent-window-overflow.md
@@ -1,9 +0,0 @@
---
-"tauri": "patch:feat"
-"tauri-utils": "patch:feat"
-"tauri-runtime": "patch:feat"
-"tauri-runtime-wry": "patch:feat"
-"@tauri-apps/api": "patch:feat"
---
-
-Add `preventOverflow` config option to prevent the window from overflowing the monitor size on creation
--- a/.changes/prevent_overflow_api.md
+++ b/.changes/prevent_overflow_api.md
@@ -1,5 +0,0 @@
---
-"tauri": minor:feat
---
-
-Add `WindowBuilder::prevent_overflow`, `WebviewWindowBuilder::prevent_overflow`, `WindowBuilder::prevent_overflow_with_margin` and `WebviewWindowBuilder::prevent_overflow_with_margin` APIs to prevent the window from overflowing the monitor size on creation.
--- a/.changes/prompt-signing-key-password-context.md
+++ b/.changes/prompt-signing-key-password-context.md
@@ -0,0 +1,6 @@
+---
+"tauri-cli": patch:enhance
+"@tauri-apps/cli": patch:enhance
+---
+
+Show the context before prompting for updater signing key password
--- a/.changes/remove-webview-attribute-reexport.md
+++ b/.changes/remove-webview-attribute-reexport.md
@@ -1,5 +0,0 @@
---
-tauri: minor:breaking
---
-
-Removed re-exported `WebviewAttributes` from `tauri-runtime` which is exposed by accident in `tauri` and not used by any public facing APIs
--- a/.changes/run-return-restart.md
+++ b/.changes/run-return-restart.md
@@ -1,5 +0,0 @@
---
-tauri: patch:bug
---
-
-Fix `run_return` not responding to `restart` and `request_restart`
--- a/.changes/safepathbuf_into_pathbuf.md
+++ b/.changes/safepathbuf_into_pathbuf.md
@@ -0,0 +1,5 @@
+---
+"tauri": patch:enhance
+---
+
+Implement retrieving inner PathBuf from SafePathBuf to ease using APIs that require an owned PathBuf
--- a/.changes/setDockVisibility.md
+++ b/.changes/setDockVisibility.md
@@ -1,6 +0,0 @@
---
-"@tauri-apps/api": minor:feat
---
-
-Added `app.setDockVisibility` for macOS.
-
--- a/.changes/supersede-kuchikiki.md
+++ b/.changes/supersede-kuchikiki.md
@@ -0,0 +1,6 @@
+---
+"tauri-utils": minor:deps
+---
+
+Add new `html-manipulation-2` and `build-2` feature flags that use `dom_query` instead of `kuchikiki` for HTML parsing / manipulation.
+This allows downstream users to remove `kuchikiki` and its dependencies from their dependency tree.
--- a/.changes/tauri-dbus.md
+++ b/.changes/tauri-dbus.md
@@ -0,0 +1,5 @@
+---
+tauri: minor:feat
+---
+
+Added `dbus` feature flag (enabled by default) which is required for theme detection on Linux.
--- a/.changes/toml-ver.md
+++ b/.changes/toml-ver.md
@@ -0,0 +1,5 @@
+---
+tauri-utils: patch:deps
+---
+
+Changed `toml` crate version from `0.9` to `">=0.9, <=1"`
--- a/.changes/update-tao.md
+++ b/.changes/update-tao.md
@@ -1,5 +0,0 @@
---
-"tauri-runtime-wry": minor:deps
---
-
-Update tao to 0.33.
--- a/.changes/update-webview2.md
+++ b/.changes/update-webview2.md
@@ -1,6 +0,0 @@
---
-"tauri": minor:deps
-"tauri-runtime-wry": minor:deps
---
-
-Update webview2-com to 0.37.
--- a/.changes/update-windows.md
+++ b/.changes/update-windows.md
@@ -1,7 +0,0 @@
---
-"tauri": minor:deps
-"tauri-runtime": minor:deps
-"tauri-runtime-wry": minor:deps
---
-
-Update windows to 0.61.
--- a/.changes/update-wry.md
+++ b/.changes/update-wry.md
@@ -1,5 +0,0 @@
---
-"tauri-runtime-wry": minor:deps
---
-
-Update wry to 0.51.
--- a/.changes/wix-minimum-webview2-version.md
+++ b/.changes/wix-minimum-webview2-version.md
@@ -0,0 +1,12 @@
+---
+"tauri-bundler": minor:feat
+"tauri-cli": minor:feat
+"@tauri-apps/cli": minor:feat
+---
+
+Added support for `minimumWebview2Version` option support for the MSI (Wix) installer, the old `bundle > windows > nsis > minimumWebview2Version` is now deprecated in favor of `bundle > windows > minimumWebview2Version`
+
+Notes:
+
+- For anyone relying on the `WVRTINSTALLED` `Property` tag in `main.wxs`, it is now renamed to `INSTALLED_WEBVIEW2_VERSION`
+- For `tauri-bundler` lib users, the `WindowsSettings` now has a new field `minimum_webview2_version` which can be a breaking change
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -5,6 +5,7 @@ Hi! We, the maintainers, are really excited that you are interested in contribut
 - [Issue Reporting Guidelines](#issue-reporting-guidelines)
 - [Pull Request Guidelines](#pull-request-guidelines)
 - [Development Guide](#development-guide)
+- [AI Tool Policy](#ai-tool-policy)

 ## Issue Reporting Guidelines

@@ -33,11 +34,9 @@ Hi! We, the maintainers, are really excited that you are interested in contribut
 - It's OK to have multiple small commits as you work on the PR - we will let GitHub automatically squash it before merging.

 - If adding new feature:
-
  - Provide convincing reason to add this feature. Ideally you should open a suggestion issue first and have it greenlighted before working on it.

 - If fixing a bug:
-
  - If you are resolving a special issue, add `(fix: #xxxx[,#xxx])` (#xxxx is the issue id) in your PR title for a better release log, e.g. `fix: update entities encoding/decoding (fix #3899)`.
  - Provide detailed description of the bug in the PR, or link to an issue that does.

@@ -51,7 +50,10 @@ Hi! We, the maintainers, are really excited that you are interested in contribut

 First, [join our Discord server](https://discord.gg/SpmNs4S) and let us know that you want to contribute. This way we can point you in the right direction and help ensure your contribution will be as helpful as possible.

-To set up your machine for development, follow the [Tauri setup guide](https://v2.tauri.app/start/prerequisites/) to get all the tools you need to develop Tauri apps. The only additional tool you may need is [PNPM](https://pnpm.io/), it is only required if you are developing the Node CLI or API packages (`packages/cli` and `packages/api`). Next, fork and clone this repo. It is structured as a monorepo, which means that all the various Tauri packages are under the same repository. The development process varies depending on what part of Tauri you are contributing to, see the guides below for per-package instructions.
+To set up your machine for development, follow the [Tauri setup guide](https://v2.tauri.app/start/prerequisites/) to get all the tools you need to develop Tauri apps. The only additional tool you may need is [PNPM](https://pnpm.io/), it is only required if you are developing the Node CLI or API packages (`packages/cli` and `packages/api`).
+
+Next, [fork](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo) and clone [this repository](https://github.com/tauri-apps).
+The development process varies depending on what part of Tauri you are contributing to, see the guides below for per-package instructions.

 Some Tauri packages will be automatically built when running one of the examples. Others, however, will need to be built beforehand. To initialize, execute these commands in the repository root:

@@ -64,29 +66,54 @@ pnpm build

 See [Architecture](../ARCHITECTURE.md#major-components) for an overview of the packages in this repository.

+### Developing Tauri Core and Related Components (Rust API, Macros, Codegen, and Utils)
+
+The code for the Rust crates, including the Core, Macros, Utils, WRY runtime, and a few more are located in the [main Tauri repository](https://github.com/tauri-apps/tauri/tree/dev/crates).
+
+The easiest way to test your changes is to use the [helloworld](https://github.com/tauri-apps/tauri/tree/dev/examples/helloworld) example app. It automatically rebuilds and uses your local copy of the Tauri core packages. Just run `cargo run --example helloworld` after making changes to test them out.
+
+To test local changes against your own application simply point the Tauri create to your local repository. In `src-tauri/Cargo.toml` file change:
+
+`tauri = { version = "2.1.1" }`
+
+to:
+
+`tauri = { path = "path/to/local/tauri/crates/tauri" }`
+
+If any other crates depend on Tauri you will have to point them to the local repo as well.
+
 ### Developing Tauri Bundler and Rust CLI

-The code for the bundler is located in `[Tauri repo root]/crates/tauri-bundler`, and the code for the Rust CLI is located in `[Tauri repo root]/crates/tauri-cli`. If you are using your local copy of `@tauri-apps/cli` (see above), any changes you make to the bundler and CLI will be automatically built and applied when running the build or dev command. Otherwise, running `cargo install --path .` in the Rust CLI directory will allow you to run `cargo tauri build` and `cargo tauri dev` anywhere, using the updated copy of the bundler and cli. You will have to run this command each time you make a change in either package.
+The code for the bundler is located in [crates/tauri-bundler](https://github.com/tauri-apps/tauri/tree/dev/crates/tauri-bundler), and the code for the Rust CLI is located in [tauri-cli](https://github.com/tauri-apps/tauri/tree/dev/crates/tauri-cli).
+Running `cargo install --path .` in the Rust CLI directory will allow you to run `cargo tauri build` and `cargo tauri dev` anywhere, using the updated copy of the bundler and cli. You will have to run this command each time you make a change in either package.
+You can use `cargo install --path . --debug` to speed up test builds.

 ### Developing The Node.js CLI (`@tauri-apps/cli`)

-`@tauri-apps/cli` is a wrapper to `tauri-cli` so most changes should be written on the Rust CLI. The `[Tauri repo root]/crates/tauri-cli` folder contains only packaging scripts to properly publish the Rust CLI binaries to NPM.
-
-### Developing Tauri Core and Related Components (Rust API, Macros, Codegen, and Utils)
-
-The code for the Rust crates, including the Core, Macros, Utils, WRY runtime, and a few more are located in `[Tauri repo root]/crates/tauri-(macros/utils)`. The easiest way to test your changes is to use the `[Tauri repo root]/examples/helloworld` app. It automatically rebuilds and uses your local copy of the Tauri core packages. Just run `cargo run --example helloworld` after making changes to test them out.
+[`@tauri-apps/cli`](https://github.com/tauri-apps/tauri/tree/dev/packages/cli) is a small wrapper around `tauri-cli` so most changes should be happen in the Rust CLI (see above).

 #### Building the documentation locally

 You can build the Rust documentation locally running the following script:

 ```bash
-$ RUSTDOCFLAGS="--cfg docsrs" cargo +nightly doc --all-features --open
+$ cargo +nightly doc --all-features --open
 ```

 ### Developing the JS API

-The JS API provides bindings between the developer's JS in the Webview and the builtin Tauri APIs, written in Rust. Its code is located in `[Tauri repo root]/packages/api`. After making changes to the code, run `pnpm build` to build it. To test your changes, we recommend using the API example app, located in `[Tauri repo root]/examples/api`. It will automatically use your local copy of the JS API and provides a helpful UI to test the various commands.
+The JS API provides bindings between the developer's JS in the Webview and the built-in Tauri APIs, written in Rust. Its code is located in [/packages/api](https://github.com/tauri-apps/tauri/tree/dev/packages/api).
+After making changes to the code, run `pnpm build` to build it. To test your changes, we recommend using the API example app, located in [/examples/api](https://github.com/tauri-apps/tauri/tree/dev/examples/api). It will automatically use your local copy of the JS API and provides a helpful UI to test the various commands.
+
+## AI Tool Policy
+
+It takes a lot of time to review a Pull Request while it's very easy to make a nonsensical but plausible looking one using AI tools.
+It is unfair for other contributors and the reviewers to spend much of the time dealing with this, hence these rules:
+
+1. Review and test all LLM-generated content before submitting, you're the one responsible for it, not the AI.
+2. Don't use AI to respond to review comments (except for translations).
+
+We will close the Pull Request with a `ai-slop` tag if you failed to do so.

 ## Financial Contribution

--- a/.github/RELEASING.md
+++ b/.github/RELEASING.md
@@ -33,11 +33,6 @@ Releasing can be as easy as merging the version pull request but here is a check

 - [ ] Double check that every package is bumped correctly and there are no accidental major or minor being released unless that is indeed the intention.
 - [ ] Make sure that there are no pending or unfinished [covector-version-or-publish.yml](./workflows/covector-version-or-publish.yml) workflow runs.
- [ ] Sign the Version PR before merging as we require signed commits
-  - [ ] `git fetch --all`
-  - [ ] `git checkout release/version-updates`
-  - [ ] `git commit --amend -S`
-  - [ ] `git push --force`
 - [ ] Approve and merge the version pull request

 ## Publishing failed, what to do?
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -8,7 +8,16 @@ on:
  workflow_dispatch:
  schedule:
    - cron: '0 0 * * *'
+  pull_request:
+    paths:
+      - '.github/workflows/audit.yml'
+      - '**/Cargo.lock'
+      - '**/Cargo.toml'
+      - '**/package.json'
+      - '**/pnpm-lock.yaml'
  push:
+    branches:
+      - dev
    paths:
      - '.github/workflows/audit.yml'
      - '**/Cargo.lock'
@@ -26,7 +35,7 @@ jobs:
    steps:
      - uses: actions/checkout@v4
      - name: rust audit
-        uses: rustsec/audit-check@v1
+        uses: rustsec/audit-check@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

--- a/.github/workflows/check-generated-files.yml
+++ b/.github/workflows/check-generated-files.yml
@@ -8,6 +8,7 @@ on:
  pull_request:
    paths:
      - '.github/workflows/check-generated-files.yml'
+      - 'pnpm-lock.yaml'
      - 'packages/api/src/**'
      - 'crates/tauri/scripts/bundle.global.js'
      - 'crates/tauri-utils/src/config.rs'
@@ -31,6 +32,7 @@ jobs:
        with:
          filters: |
            api:
+              - 'pnpm-lock.yaml'
              - 'packages/api/src/**'
              - 'crates/tauri/scripts/bundle.global.js'
            schema:
--- a/.github/workflows/covector-version-or-publish.yml
+++ b/.github/workflows/covector-version-or-publish.yml
@@ -61,7 +61,7 @@ jobs:
      actions: write # required for workflow_dispatch
      contents: write # required to create new releases
      pull-requests: write # required to open version update pr
-      id-token: write # pnpm provenance
+      id-token: write # pnpm provenance / oidc token
    outputs:
      change: ${{ steps.covector.outputs.change }}
      commandRan: ${{ steps.covector.outputs.commandRan }}
@@ -74,11 +74,9 @@ jobs:
        with:
          fetch-depth: 0
      - run: npm i -g --force corepack
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
        with:
-          node-version: 20
-          registry-url: 'https://registry.npmjs.org'
-          cache: 'pnpm'
+          node-version: 24

      - name: cargo login
        run: cargo login ${{ secrets.ORG_CRATES_IO_TOKEN }}
@@ -96,7 +94,6 @@ jobs:
        uses: jbolda/covector/packages/action@covector-v0
        id: covector
        env:
-          NODE_AUTH_TOKEN: ${{ secrets.ORG_NPM_TOKEN }}
          CARGO_AUDIT_OPTIONS: ${{ secrets.CARGO_AUDIT_OPTIONS }}
          NPM_CONFIG_PROVENANCE: true
        with:
@@ -119,6 +116,7 @@ jobs:
          commit-message: 'apply version updates'
          labels: 'version updates'
          body: ${{ steps.covector.outputs.change }}
+          sign-commits: true

      - name: Trigger doc update
        if: |
--- a/.github/workflows/lint-rust.yml
+++ b/.github/workflows/lint-rust.yml
@@ -10,7 +10,7 @@ on:
      - dev
  pull_request:
    paths:
-      - '.github/workflows/lint-cli.yml'
+      - '.github/workflows/lint-rust.yml'
      - 'crates/**'

 env:
--- a/.github/workflows/publish-cli-js.yml
+++ b/.github/workflows/publish-cli-js.yml
@@ -20,6 +20,10 @@ defaults:
  run:
    working-directory: packages/cli/

+permissions:
+  contents: write # update release
+  id-token: write # oidc token
+
 jobs:
  build:
    strategy:
@@ -44,7 +48,7 @@ jobs:
            architecture: x64
            target: aarch64-pc-windows-msvc
            build: pnpm build --target aarch64-pc-windows-msvc
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
            target: x86_64-unknown-linux-gnu
            docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian
            build: |
@@ -52,7 +56,7 @@ jobs:
              cd packages/cli
              pnpm build --target x86_64-unknown-linux-gnu
              strip *.node
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
            target: x86_64-unknown-linux-musl
            docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
            build: |
@@ -64,7 +68,7 @@ jobs:
            build: |
              pnpm build --features native-tls-vendored --target=aarch64-apple-darwin
              strip -x *.node
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
            target: aarch64-unknown-linux-gnu
            docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian-aarch64
            build: |
@@ -72,7 +76,7 @@ jobs:
              cd packages/cli
              pnpm build --target aarch64-unknown-linux-gnu
              aarch64-unknown-linux-gnu-strip *.node
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
            architecture: x64
            target: armv7-unknown-linux-gnueabihf
            setup: |
@@ -81,7 +85,7 @@ jobs:
            build: |
              pnpm build --target=armv7-unknown-linux-gnueabihf
              arm-linux-gnueabihf-strip *.node
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
            architecture: x64
            target: aarch64-unknown-linux-musl
            docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
@@ -116,7 +120,7 @@ jobs:
        if: ${{ !matrix.settings.docker }}
        with:
          targets: ${{ matrix.settings.target }}
-      - uses: Swatinem/rust-cache@v1
+      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.settings.target }}
        if: ${{ matrix.settings.docker }}
@@ -319,7 +323,6 @@ jobs:
          - '20'
        image:
          - ghcr.io/napi-rs/napi-rs/nodejs:aarch64-16
-          - ghcr.io/napi-rs/napi-rs/nodejs:armhf-16
    runs-on: ubuntu-latest
    steps:
      - run: docker run --rm --privileged multiarch/qemu-user-static:register --reset
@@ -367,16 +370,13 @@ jobs:
      - test-linux-x64-gnu-binding
      - test-linux-x64-musl-binding
      #- test-linux-arm-bindings
-    permissions:
-      contents: write # update release
-      id-token: write # npm provenance
    steps:
      - uses: actions/checkout@v4
      - run: npm i -g --force corepack
      - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
-          node-version: 20
+          node-version: 24
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm i --frozen-lockfile --ignore-scripts
@@ -391,10 +391,8 @@ jobs:
        shell: bash
      - name: Publish
        run: |
-          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
          npm publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.ORG_NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ''
          RELEASE_ID: ${{ github.event.client_payload.releaseId || inputs.releaseId }}
-          NPM_CONFIG_PROVENANCE: true
--- a/.github/workflows/publish-cli-rs.yml
+++ b/.github/workflows/publish-cli-rs.yml
@@ -18,7 +18,7 @@ jobs:
      fail-fast: false
      matrix:
        config:
-          - os: ubuntu-20.04
+          - os: ubuntu-22.04
            rust_target: x86_64-unknown-linux-gnu
            ext: ''
            args: ''
@@ -38,35 +38,62 @@ jobs:
            rust_target: aarch64-pc-windows-msvc
            ext: '.exe'
            args: ''
+          - os: ubuntu-22.04
+            rust_target: riscv64gc-unknown-linux-gnu
+            ext: ''
+            args: ''
+            cross: true

    steps:
      - uses: actions/checkout@v4

      - name: 'Setup Rust'
+        if: ${{ !matrix.config.cross }}
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.config.rust_target }}

      - uses: Swatinem/rust-cache@v2
+        if: ${{ !matrix.config.cross }}
        with:
          key: ${{ matrix.config.rust_target }}

      - name: install Linux dependencies
-        if: matrix.config.os == 'ubuntu-latest'
+        if: ${{ !matrix.config.cross && startsWith(matrix.config.os, 'ubuntu') }}
        run: |
          sudo apt-get update
          sudo apt-get install -y libgtk-3-dev

+      - name: Install cross
+        if: ${{ matrix.config.cross }}
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cross@0.2.5
+
      - name: Build CLI
+        if: ${{ !matrix.config.cross }}
        run: cargo build --manifest-path ./crates/tauri-cli/Cargo.toml --profile release-size-optimized ${{ matrix.config.args }}

+      - name: Build CLI (cross)
+        if: ${{ matrix.config.cross }}
+        run: cross build --manifest-path ./crates/tauri-cli/Cargo.toml --target ${{ matrix.config.rust_target }} --profile release-size-optimized ${{ matrix.config.args }}
+
      - name: Upload CLI
+        if: ${{ !matrix.config.cross }}
        uses: actions/upload-artifact@v4
        with:
          name: cargo-tauri-${{ matrix.config.rust_target }}${{ matrix.config.ext }}
          path: target/release-size-optimized/cargo-tauri${{ matrix.config.ext }}
          if-no-files-found: error

+      - name: Upload CLI (cross)
+        if: ${{ matrix.config.cross }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-tauri-${{ matrix.config.rust_target }}${{ matrix.config.ext }}
+          path: target/${{ matrix.config.rust_target }}/release-size-optimized/cargo-tauri${{ matrix.config.ext }}
+          if-no-files-found: error
+
  upload:
    needs: build
    runs-on: ubuntu-latest
--- a/.github/workflows/test-core.yml
+++ b/.github/workflows/test-core.yml
@@ -90,15 +90,27 @@ jobs:

      - uses: Swatinem/rust-cache@v2
        with:
-          prefix-key: v2
+          key: ${{ matrix.platform.target }}
          save-if: ${{ matrix.features.key == 'all' }}

-      - name: test
+      - name: test tauri-utils
        if: ${{ !matrix.platform.cross }}
-        run: cargo ${{ matrix.platform.command }} --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --manifest-path crates/tauri/Cargo.toml
+        # Using --lib --bins --tests to skip doc tests
+        run: cargo ${{ matrix.platform.command }} --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --lib --bins --tests --manifest-path crates/tauri-utils/Cargo.toml

-      - name: test (using cross)
+      - name: test tauri-utils (using cross)
+        if: ${{ matrix.platform.cross }}
+        # Using --lib --bins --tests to skip doc tests
+        run: |
+          cargo install cross --git https://github.com/cross-rs/cross --rev 51f46f296253d8122c927c5bb933e3c4f27cc317 --locked
+          cross ${{ matrix.platform.command }} --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --lib --bins --tests --manifest-path crates/tauri-utils/Cargo.toml
+
+      - name: test tauri
+        if: ${{ !matrix.platform.cross }}
+        run: cargo ${{ matrix.features.key == 'no-default' && 'check' || matrix.platform.command }} --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --manifest-path crates/tauri/Cargo.toml
+
+      - name: test tauri (using cross)
        if: ${{ matrix.platform.cross }}
        run: |
-          cargo install cross --git https://github.com/cross-rs/cross --rev ac4c11cedc97cd7c27faed36e55377a90e6ed618 --locked
-          cross ${{ matrix.platform.command }} --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --manifest-path crates/tauri/Cargo.toml
+          cargo install cross --git https://github.com/cross-rs/cross --rev 51f46f296253d8122c927c5bb933e3c4f27cc317 --locked
+          cross ${{ matrix.features.key == 'no-default' && 'check' || matrix.platform.command }} --target ${{ matrix.platform.target }} ${{ matrix.features.args }} --manifest-path crates/tauri/Cargo.toml
--- a/.gitignore
+++ b/.gitignore
@@ -1,54 +1,55 @@
-# dependency directories
-node_modules/
-
-# Optional npm and yarn cache directory
-.npm/
-.yarn/
-
-# Output of 'npm pack'
-*.tgz
-
-# dotenv environment variables file
-.env
-
-# .vscode workspace settings file
-.vscode/settings.json
-.vscode/launch.json
-.vscode/tasks.json
-
-# npm, yarn and bun lock files
-package-lock.json
-yarn.lock
-bun.lockb
-
-# rust compiled folders
-target/
-
-# test video for streaming example
-streaming_example_test_video.mp4
-
-# examples /gen directory
-/examples/**/src-tauri/gen/
-/bench/**/src-tauri/gen/
-
-# logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-
-# runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# miscellaneous
-/.vs
-.DS_Store
-.Thumbs.db
-*.sublime*
-.idea
-debug.log
-TODO.md
+# dependency directories
+node_modules/
+
+# Optional npm and yarn cache directory
+.npm/
+.yarn/
+
+# Output of 'npm pack'
+*.tgz
+
+# dotenv environment variables file
+.env
+
+# .vscode workspace settings file
+.vscode/settings.json
+.vscode/launch.json
+.vscode/tasks.json
+
+# npm, yarn and bun lock files
+package-lock.json
+yarn.lock
+bun.lockb
+
+# rust compiled folders
+target/
+
+# test video for streaming example
+streaming_example_test_video.mp4
+
+# examples /gen directory
+/examples/**/src-tauri/gen/
+/bench/**/src-tauri/gen/
+
+# logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# miscellaneous
+/.vs
+.DS_Store
+.Thumbs.db
+*.sublime*
+.idea
+debug.log
+TODO.md
+.aider*
--- a/.scripts/ci/check-change-tags.js
+++ b/.scripts/ci/check-change-tags.js
@@ -57,7 +57,7 @@ function checkChangeFiles(changeFiles) {
    for (const [file, packages] of unknownTagsEntries) {
      for (const { package, tag } of packages) {
        console.error(
-          `Package \`${package}\` has an uknown change tag ${tag} in ${file} `
+          `Package \`${package}\` has an unknown change tag ${tag} in ${file} `
        )
      }
    }
--- a/.scripts/ci/check-license-header.js
+++ b/.scripts/ci/check-license-header.js
@@ -29,7 +29,7 @@ const ignore = [
 async function checkFile(file) {
  if (
    extensions.some((e) => file.endsWith(e))
-    && !ignore.some((i) => file.includes(`/${i}/`) || path.basename(file) == i)
+    && !ignore.some((i) => file.includes(`/${i}/`) || path.basename(file) === i)
  ) {
    const fileStream = fs.createReadStream(file)
    const rl = readline.createInterface({
--- a/.taurignore
+++ b/.taurignore
@@ -1,16 +0,0 @@
-.changes
-.devcontainer
-.docker
-.github
-.scripts
-.vscode
-audits
-bench
-packages/api
-packages/cli
-crates/tauri-cli
-crates/tauri-bundler
-crates/tauri-driver
-crates/tauri-macos-sign
-crates/tauri-schema-generator
-crates/tests
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -71,3 +71,4 @@ opt-level = "s"
 schemars_derive = { git = 'https://github.com/tauri-apps/schemars.git', branch = 'feat/preserve-description-newlines' }
 tauri = { path = "./crates/tauri" }
 tauri-plugin = { path = "./crates/tauri-plugin" }
+tauri-utils = { path = "./crates/tauri-utils" }
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 [![License](https://img.shields.io/badge/License-MIT%20or%20Apache%202-green.svg)](https://opencollective.com/tauri)
 [![test core](https://img.shields.io/github/actions/workflow/status/tauri-apps/tauri/test-core.yml?label=test%20core&logo=github)](https://github.com/tauri-apps/tauri/actions/workflows/test-core.yml)
 [![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Ftauri-apps%2Ftauri.svg?type=shield)](https://app.fossa.com/projects/git%2Bgithub.com%2Ftauri-apps%2Ftauri?ref=badge_shield)
-[![Chat Server](https://img.shields.io/badge/chat-discord-7289da.svg)](https://discord.gg/SpmNs4S)
+[![Chat Server](https://img.shields.io/badge/chat-discord-7289da.svg)](https://discord.com/invite/tauri)
 [![website](https://img.shields.io/badge/website-tauri.app-purple.svg)](https://tauri.app)
 [![https://good-labs.github.io/greater-good-affirmation/assets/images/badge.svg](https://good-labs.github.io/greater-good-affirmation/assets/images/badge.svg)](https://good-labs.github.io/greater-good-affirmation)
 [![support](https://img.shields.io/badge/sponsor-Open%20Collective-blue.svg)](https://opencollective.com/tauri)
@@ -81,7 +81,7 @@ For the complete list of sponsors please visit our [website](https://tauri.app#s

 ## Organization

-Tauri aims to be a sustainable collective based on principles that guide [sustainable free and open software communities](https://sfosc.org). To this end it has become a Programme within the [Commons Conservancy](https://commonsconservancy.org/), and you can contribute financially via [Open Collective](https://opencollective.com/tauri).
+Tauri aims to be a sustainable collective based on principles that guide sustainable free and open software communities. To this end it has become a Programme within the [Commons Conservancy](https://commonsconservancy.org/), and you can contribute financially via [Open Collective](https://opencollective.com/tauri).

 ## Licenses

--- a/bench/src/build_benchmark_jsons.rs
+++ b/bench/src/build_benchmark_jsons.rs
@@ -10,6 +10,8 @@
  html_logo_url = "https://github.com/tauri-apps/tauri/raw/dev/.github/icon.png",
  html_favicon_url = "https://github.com/tauri-apps/tauri/raw/dev/.github/icon.png"
 )]
+// file is used by multiple binaries
+#![allow(dead_code)]

 use std::{fs::File, io::BufReader};
 mod utils;
@@ -52,7 +54,7 @@ fn main() {
      .expect("Something wrong with tauri_data"),
    &serde_json::to_value(all_data).expect("Unable to build final json (all)"),
  )
-  .unwrap_or_else(|_| panic!("Unable to write {:?}", tauri_data));
+  .unwrap_or_else(|_| panic!("Unable to write {tauri_data:?}"));

  utils::write_json(
    tauri_recent
@@ -60,5 +62,5 @@ fn main() {
      .expect("Something wrong with tauri_recent"),
    &serde_json::to_value(recent).expect("Unable to build final json (recent)"),
  )
-  .unwrap_or_else(|_| panic!("Unable to write {:?}", tauri_recent));
+  .unwrap_or_else(|_| panic!("Unable to write {tauri_recent:?}"));
 }
--- a/bench/src/run_benchmark.rs
+++ b/bench/src/run_benchmark.rs
@@ -2,16 +2,17 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-License-Identifier: MIT

-//! This Rust binary runs on CI and provides internal metrics results of Tauri. To learn more see [benchmark_results](https://github.com/tauri-apps/benchmark_results) repository.
+//! This Rust binary runs on CI and provides internal metrics results of Tauri.
+//! To learn more see [benchmark_results](https://github.com/tauri-apps/benchmark_results) repository.
 //!
-//! ***_Internal use only_**
+//! ***_Internal use only_***

 #![doc(
  html_logo_url = "https://github.com/tauri-apps/tauri/raw/dev/.github/icon.png",
  html_favicon_url = "https://github.com/tauri-apps/tauri/raw/dev/.github/icon.png"
 )]

-use anyhow::Result;
+use anyhow::{Context, Result};
 use std::{
  collections::{HashMap, HashSet},
  env,
@@ -21,62 +22,66 @@ use std::{

 mod utils;

-/// The list of the examples of the benchmark name and binary relative path
-fn get_all_benchmarks() -> Vec<(String, String)> {
+/// The list of examples for benchmarks
+fn get_all_benchmarks(target: &str) -> Vec<(String, String)> {
  vec![
    (
      "tauri_hello_world".into(),
-      format!("../target/{}/release/bench_helloworld", utils::get_target()),
+      format!("../target/{target}/release/bench_helloworld"),
    ),
    (
      "tauri_cpu_intensive".into(),
-      format!(
-        "../target/{}/release/bench_cpu_intensive",
-        utils::get_target()
-      ),
+      format!("../target/{target}/release/bench_cpu_intensive"),
    ),
    (
      "tauri_3mb_transfer".into(),
-      format!(
-        "../target/{}/release/bench_files_transfer",
-        utils::get_target()
-      ),
+      format!("../target/{target}/release/bench_files_transfer"),
    ),
  ]
 }

-fn run_strace_benchmarks(new_data: &mut utils::BenchResult) -> Result<()> {
+fn run_strace_benchmarks(new_data: &mut utils::BenchResult, target: &str) -> Result<()> {
  use std::io::Read;

  let mut thread_count = HashMap::<String, u64>::new();
  let mut syscall_count = HashMap::<String, u64>::new();

-  for (name, example_exe) in get_all_benchmarks() {
-    let mut file = tempfile::NamedTempFile::new()?;
+  for (name, example_exe) in get_all_benchmarks(target) {
+    let mut file = tempfile::NamedTempFile::new()
+      .context("failed to create temporary file for strace output")?;
+
+    let exe_path = utils::bench_root_path().join(&example_exe);
+    let exe_path_str = exe_path
+      .to_str()
+      .context("executable path contains invalid UTF-8")?;
+    let temp_path_str = file
+      .path()
+      .to_str()
+      .context("temporary file path contains invalid UTF-8")?;

    Command::new("strace")
-      .args([
-        "-c",
-        "-f",
-        "-o",
-        file.path().to_str().unwrap(),
-        utils::bench_root_path().join(example_exe).to_str().unwrap(),
-      ])
+      .args(["-c", "-f", "-o", temp_path_str, exe_path_str])
      .stdout(Stdio::inherit())
-      .spawn()?
-      .wait()?;
+      .spawn()
+      .context("failed to spawn strace process")?
+      .wait()
+      .context("failed to wait for strace process")?;

    let mut output = String::new();
-    file.as_file_mut().read_to_string(&mut output)?;
+    file
+      .as_file_mut()
+      .read_to_string(&mut output)
+      .context("failed to read strace output")?;

    let strace_result = utils::parse_strace_output(&output);
-    // Note, we always have 1 thread. Use cloneX calls as counter for additional threads created.
-    let clone = 1
-      + strace_result.get("clone").map(|d| d.calls).unwrap_or(0)
+    // Count clone/clone3 syscalls as thread creation indicators
+    let clone_calls = strace_result.get("clone").map(|d| d.calls).unwrap_or(0)
      + strace_result.get("clone3").map(|d| d.calls).unwrap_or(0);
-    let total = strace_result.get("total").unwrap().calls;
-    thread_count.insert(name.to_string(), clone);
-    syscall_count.insert(name.to_string(), total);
+
+    if let Some(total) = strace_result.get("total") {
+      thread_count.insert(name.clone(), clone_calls);
+      syscall_count.insert(name, total.calls);
+    }
  }

  new_data.thread_count = thread_count;
@@ -85,70 +90,100 @@ fn run_strace_benchmarks(new_data: &mut utils::BenchResult) -> Result<()> {
  Ok(())
 }

-fn run_max_mem_benchmark() -> Result<HashMap<String, u64>> {
+fn run_max_mem_benchmark(target: &str) -> Result<HashMap<String, u64>> {
  let mut results = HashMap::<String, u64>::new();

-  for (name, example_exe) in get_all_benchmarks() {
-    let benchmark_file = utils::target_dir().join(format!("mprof{}_.dat", name));
-    let benchmark_file = benchmark_file.to_str().unwrap();
+  for (name, example_exe) in get_all_benchmarks(target) {
+    let benchmark_file = utils::target_dir().join(format!("mprof{name}_.dat"));
+    let benchmark_file_str = benchmark_file
+      .to_str()
+      .context("benchmark file path contains invalid UTF-8")?;
+
+    let exe_path = utils::bench_root_path().join(&example_exe);
+    let exe_path_str = exe_path
+      .to_str()
+      .context("executable path contains invalid UTF-8")?;

    let proc = Command::new("mprof")
-      .args([
-        "run",
-        "-C",
-        "-o",
-        benchmark_file,
-        utils::bench_root_path().join(example_exe).to_str().unwrap(),
-      ])
+      .args(["run", "-C", "-o", benchmark_file_str, exe_path_str])
      .stdout(Stdio::null())
      .stderr(Stdio::piped())
-      .spawn()?;
+      .spawn()
+      .with_context(|| format!("failed to spawn mprof for benchmark {name}"))?;

-    let proc_result = proc.wait_with_output()?;
-    println!("{:?}", proc_result);
-    results.insert(
-      name.to_string(),
-      utils::parse_max_mem(benchmark_file).unwrap(),
-    );
+    let proc_result = proc
+      .wait_with_output()
+      .with_context(|| format!("failed to wait for mprof {name}"))?;
+
+    if !proc_result.status.success() {
+      eprintln!(
+        "mprof failed for {name}: {}",
+        String::from_utf8_lossy(&proc_result.stderr)
+      );
+    }
+
+    if let Some(mem) = utils::parse_max_mem(benchmark_file_str)
+      .with_context(|| format!("failed to parse mprof data for {name}"))?
+    {
+      results.insert(name, mem);
+    }
+
+    // Clean up the temporary file
+    if let Err(e) = std::fs::remove_file(&benchmark_file) {
+      eprintln!("Warning: failed to remove temporary file {benchmark_file_str}: {e}");
+    }
  }

  Ok(results)
 }

-fn rlib_size(target_dir: &std::path::Path, prefix: &str) -> u64 {
+fn rlib_size(target_dir: &Path, prefix: &str) -> Result<u64> {
  let mut size = 0;
-  let mut seen = std::collections::HashSet::new();
+  let mut seen = HashSet::new();
+
+  let deps_dir = target_dir.join("deps");
+  for entry in std::fs::read_dir(&deps_dir).with_context(|| {
+    format!(
+      "failed to read target deps directory: {}",
+      deps_dir.display()
+    )
+  })? {
+    let entry = entry.context("failed to read directory entry")?;
+    let name = entry.file_name().to_string_lossy().to_string();

-  for entry in std::fs::read_dir(target_dir.join("deps")).unwrap() {
-    let entry = entry.unwrap();
-    let os_str = entry.file_name();
-    let name = os_str.to_str().unwrap();
    if name.starts_with(prefix) && name.ends_with(".rlib") {
-      let start = name.split('-').next().unwrap().to_string();
-      if seen.contains(&start) {
-        println!("skip {}", name);
-      } else {
-        seen.insert(start);
-        size += entry.metadata().unwrap().len();
-        println!("check size {} {}", name, size);
+      if let Some(start) = name.split('-').next() {
+        if seen.insert(start.to_string()) {
+          size += entry
+            .metadata()
+            .context("failed to read file metadata")?
+            .len();
+        }
      }
    }
  }
-  assert!(size > 0);
-  size
+
+  if size == 0 {
+    anyhow::bail!(
+      "no rlib files found for prefix {prefix} in {}",
+      deps_dir.display()
+    );
+  }
+
+  Ok(size)
 }

-fn get_binary_sizes(target_dir: &Path) -> Result<HashMap<String, u64>> {
+fn get_binary_sizes(target_dir: &Path, target: &str) -> Result<HashMap<String, u64>> {
  let mut sizes = HashMap::<String, u64>::new();

-  let wry_size = rlib_size(target_dir, "libwry");
-  println!("wry {} bytes", wry_size);
+  let wry_size = rlib_size(target_dir, "libwry")?;
  sizes.insert("wry_rlib".to_string(), wry_size);

-  // add size for all EXEC_TIME_BENCHMARKS
-  for (name, example_exe) in get_all_benchmarks() {
-    let meta = std::fs::metadata(example_exe).unwrap();
-    sizes.insert(name.to_string(), meta.len());
+  for (name, example_exe) in get_all_benchmarks(target) {
+    let exe_path = utils::bench_root_path().join(&example_exe);
+    let meta = std::fs::metadata(&exe_path)
+      .with_context(|| format!("failed to read metadata for {}", exe_path.display()))?;
+    sizes.insert(name, meta.len());
  }

  Ok(sizes)
@@ -188,14 +223,33 @@ fn cargo_deps() -> HashMap<String, usize> {
      cmd.args(["--target", target]);
      cmd.current_dir(utils::tauri_root_path());

-      let full_deps = cmd.output().expect("failed to run cargo tree").stdout;
-      let full_deps = String::from_utf8(full_deps).expect("cargo tree output not utf-8");
-      let count = full_deps.lines().collect::<HashSet<_>>().len() - 1; // output includes wry itself
+      match cmd.output() {
+        Ok(output) if output.status.success() => {
+          let full_deps = String::from_utf8_lossy(&output.stdout);
+          let count = full_deps
+            .lines()
+            .collect::<HashSet<_>>()
+            .len()
+            .saturating_sub(1); // output includes wry itself

-      // set the count to the highest count seen for this OS
-      let existing = results.entry(os.to_string()).or_default();
-      *existing = count.max(*existing);
-      assert!(count > 10); // sanity check
+          // set the count to the highest count seen for this OS
+          let existing = results.entry(os.to_string()).or_default();
+          *existing = count.max(*existing);
+
+          if count <= 10 {
+            eprintln!("Warning: dependency count for {target} seems low: {count}");
+          }
+        }
+        Ok(output) => {
+          eprintln!(
+            "cargo tree failed for {target}: {}",
+            String::from_utf8_lossy(&output.stderr)
+          );
+        }
+        Err(e) => {
+          eprintln!("Failed to run cargo tree for {target}: {e}");
+        }
+      }
    }
  }
  results
@@ -203,104 +257,127 @@ fn cargo_deps() -> HashMap<String, usize> {

 const RESULT_KEYS: &[&str] = &["mean", "stddev", "user", "system", "min", "max"];

-fn run_exec_time(target_dir: &Path) -> Result<HashMap<String, HashMap<String, f64>>> {
+fn run_exec_time(target: &str) -> Result<HashMap<String, HashMap<String, f64>>> {
+  let target_dir = utils::target_dir();
  let benchmark_file = target_dir.join("hyperfine_results.json");
-  let benchmark_file = benchmark_file.to_str().unwrap();
+  let benchmark_file_str = benchmark_file
+    .to_str()
+    .context("benchmark file path contains invalid UTF-8")?;

-  let mut command = [
+  let mut command = vec![
    "hyperfine",
    "--export-json",
-    benchmark_file,
+    benchmark_file_str,
    "--show-output",
    "--warmup",
    "3",
-  ]
-  .iter()
-  .map(|s| s.to_string())
-  .collect::<Vec<_>>();
+  ];

-  for (_, example_exe) in get_all_benchmarks() {
-    command.push(
-      utils::bench_root_path()
-        .join(example_exe)
-        .to_str()
-        .unwrap()
-        .to_string(),
-    );
+  let benchmarks = get_all_benchmarks(target);
+  let mut benchmark_paths = Vec::new();
+
+  for (_, example_exe) in &benchmarks {
+    let exe_path = utils::bench_root_path().join(example_exe);
+    let exe_path_str = exe_path
+      .to_str()
+      .context("executable path contains invalid UTF-8")?;
+    benchmark_paths.push(exe_path_str.to_string());
  }

-  utils::run(&command.iter().map(|s| s.as_ref()).collect::<Vec<_>>());
+  for path in &benchmark_paths {
+    command.push(path.as_str());
+  }
+
+  utils::run(&command)?;

  let mut results = HashMap::<String, HashMap<String, f64>>::new();
-  let hyperfine_results = utils::read_json(benchmark_file)?;
-  for ((name, _), data) in get_all_benchmarks().iter().zip(
-    hyperfine_results
-      .as_object()
-      .unwrap()
-      .get("results")
-      .unwrap()
-      .as_array()
-      .unwrap(),
-  ) {
-    let data = data.as_object().unwrap().clone();
-    results.insert(
-      name.to_string(),
-      data
-        .into_iter()
-        .filter(|(key, _)| RESULT_KEYS.contains(&key.as_str()))
-        .map(|(key, val)| (key, val.as_f64().unwrap()))
-        .collect(),
-    );
+  let hyperfine_results = utils::read_json(benchmark_file_str)?;
+
+  if let Some(results_array) = hyperfine_results
+    .as_object()
+    .and_then(|obj| obj.get("results"))
+    .and_then(|val| val.as_array())
+  {
+    for ((name, _), data) in benchmarks.iter().zip(results_array.iter()) {
+      if let Some(data_obj) = data.as_object() {
+        let filtered_data: HashMap<String, f64> = data_obj
+          .iter()
+          .filter(|(key, _)| RESULT_KEYS.contains(&key.as_str()))
+          .filter_map(|(key, val)| val.as_f64().map(|v| (key.clone(), v)))
+          .collect();
+
+        results.insert(name.clone(), filtered_data);
+      }
+    }
  }

  Ok(results)
 }

 fn main() -> Result<()> {
-  // download big files if not present
  let json_3mb = utils::home_path().join(".tauri_3mb.json");

  if !json_3mb.exists() {
+    println!("Downloading test data...");
    utils::download_file(
      "https://github.com/lemarier/tauri-test/releases/download/v2.0.0/json_3mb.json",
      json_3mb,
-    );
+    )
+    .context("failed to download test data")?;
  }

  println!("Starting tauri benchmark");

  let target_dir = utils::target_dir();
+  let target = utils::get_target();

-  env::set_current_dir(utils::bench_root_path())?;
+  env::set_current_dir(utils::bench_root_path())
+    .context("failed to set working directory to bench root")?;
+
+  let now = std::time::SystemTime::now()
+    .duration_since(std::time::UNIX_EPOCH)
+    .context("failed to get current time")?;
+  let timestamp = format!("{}", now.as_secs());
+
+  println!("Running execution time benchmarks...");
+  let exec_time = run_exec_time(target)?;
+
+  println!("Getting binary sizes...");
+  let binary_size = get_binary_sizes(&target_dir, target)?;
+
+  println!("Analyzing cargo dependencies...");
+  let cargo_deps = cargo_deps();

-  let format =
-    time::format_description::parse("[year]-[month]-[day]T[hour]:[minute]:[second]Z").unwrap();
-  let now = time::OffsetDateTime::now_utc();
  let mut new_data = utils::BenchResult {
-    created_at: now.format(&format).unwrap(),
-    sha1: utils::run_collect(&["git", "rev-parse", "HEAD"])
-      .0
-      .trim()
-      .to_string(),
-    exec_time: run_exec_time(&target_dir)?,
-    binary_size: get_binary_sizes(&target_dir)?,
-    cargo_deps: cargo_deps(),
+    created_at: timestamp,
+    sha1: {
+      let output = utils::run_collect(&["git", "rev-parse", "HEAD"])?;
+      output.0.trim().to_string()
+    },
+    exec_time,
+    binary_size,
+    cargo_deps,
    ..Default::default()
  };

  if cfg!(target_os = "linux") {
-    run_strace_benchmarks(&mut new_data)?;
-    new_data.max_memory = run_max_mem_benchmark()?;
+    println!("Running Linux-specific benchmarks...");
+    run_strace_benchmarks(&mut new_data, target)?;
+    new_data.max_memory = run_max_mem_benchmark(target)?;
  }

  println!("===== <BENCHMARK RESULTS>");
-  serde_json::to_writer_pretty(std::io::stdout(), &new_data)?;
+  serde_json::to_writer_pretty(std::io::stdout(), &new_data)
+    .context("failed to serialize benchmark results")?;
  println!("\n===== </BENCHMARK RESULTS>");

-  if let Some(filename) = target_dir.join("bench.json").to_str() {
-    utils::write_json(filename, &serde_json::to_value(&new_data)?)?;
+  let bench_file = target_dir.join("bench.json");
+  if let Some(filename) = bench_file.to_str() {
+    utils::write_json(filename, &serde_json::to_value(&new_data)?)
+      .context("failed to write benchmark results to file")?;
+    println!("Results written to: {filename}");
  } else {
-    eprintln!("Cannot write bench.json, path is invalid");
+    eprintln!("Cannot write bench.json, path contains invalid UTF-8");
  }

  Ok(())
--- a/bench/src/utils.rs
+++ b/bench/src/utils.rs
@@ -2,7 +2,16 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-License-Identifier: MIT

-use anyhow::Result;
+//! Utility functions for benchmarking tasks in the Tauri project.
+//!
+//! This module provides helpers for:
+//! - Paths to project directories and targets
+//! - Running and collecting process outputs
+//! - Parsing memory profiler (`mprof`) and syscall profiler (`strace`) outputs
+//! - JSON read/write utilities
+//! - File download utilities (via `curl` or file copy)
+
+use anyhow::{bail, Context, Result};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use std::{
@@ -13,6 +22,7 @@ use std::{
  process::{Command, Output, Stdio},
 };

+/// Holds the results of a benchmark run.
 #[derive(Default, Clone, Serialize, Deserialize, Debug)]
 pub struct BenchResult {
  pub created_at: String,
@@ -25,7 +35,7 @@ pub struct BenchResult {
  pub cargo_deps: HashMap<String, usize>,
 }

-#[allow(dead_code)]
+/// Represents a single line of parsed `strace` output.
 #[derive(Debug, Clone, Serialize)]
 pub struct StraceOutput {
  pub percent_time: f64,
@@ -35,6 +45,7 @@ pub struct StraceOutput {
  pub errors: u64,
 }

+/// Get the compilation target triple for the current platform.
 pub fn get_target() -> &'static str {
  #[cfg(target_os = "macos")]
  return if cfg!(target_arch = "aarch64") {
@@ -42,18 +53,22 @@ pub fn get_target() -> &'static str {
  } else {
    "x86_64-apple-darwin"
  };
+
  #[cfg(target_os = "ios")]
  return if cfg!(target_arch = "aarch64") {
    "aarch64-apple-ios"
  } else {
    "x86_64-apple-ios"
  };
+
  #[cfg(target_os = "linux")]
  return "x86_64-unknown-linux-gnu";
+
  #[cfg(target_os = "windows")]
-  unimplemented!();
+  unimplemented!("Windows target not implemented yet");
 }

+/// Get the `target/release` directory path for benchmarks.
 pub fn target_dir() -> PathBuf {
  bench_root_path()
    .join("..")
@@ -62,83 +77,90 @@ pub fn target_dir() -> PathBuf {
    .join("release")
 }

+/// Get the root path of the current benchmark crate.
 pub fn bench_root_path() -> PathBuf {
  PathBuf::from(env!("CARGO_MANIFEST_DIR"))
 }

-#[allow(dead_code)]
+/// Get the home directory of the current user.
 pub fn home_path() -> PathBuf {
  #[cfg(any(target_os = "macos", target_os = "ios", target_os = "linux"))]
-  return PathBuf::from(env!("HOME"));
+  {
+    PathBuf::from(std::env::var("HOME").unwrap_or_default())
+  }
+
  #[cfg(target_os = "windows")]
-  return PathBuf::from(env!("HOMEPATH"));
+  {
+    PathBuf::from(std::env::var("USERPROFILE").unwrap_or_default())
+  }
 }

-#[allow(dead_code)]
+/// Get the root path of the Tauri repository.
 pub fn tauri_root_path() -> PathBuf {
-  bench_root_path().parent().unwrap().to_path_buf()
+  bench_root_path().parent().map(|p| p.to_path_buf()).unwrap()
 }

-#[allow(dead_code)]
-pub fn run_collect(cmd: &[&str]) -> (String, String) {
-  let mut process_builder = Command::new(cmd[0]);
-  process_builder
+/// Run a command and collect its stdout and stderr as strings.
+/// Returns an error if the command fails or exits with a non-zero status.
+pub fn run_collect(cmd: &[&str]) -> Result<(String, String)> {
+  let output: Output = Command::new(cmd[0])
    .args(&cmd[1..])
    .stdin(Stdio::piped())
    .stdout(Stdio::piped())
-    .stderr(Stdio::piped());
-  let prog = process_builder.spawn().expect("failed to spawn script");
-  let Output {
-    stdout,
-    stderr,
-    status,
-  } = prog.wait_with_output().expect("failed to wait on child");
-  let stdout = String::from_utf8_lossy(&stdout).to_string();
-  let stderr = String::from_utf8_lossy(&stderr).to_string();
-  if !status.success() {
-    eprintln!("stdout: <<<{}>>>", stdout);
-    eprintln!("stderr: <<<{}>>>", stderr);
-    panic!("Unexpected exit code: {:?}", status.code());
+    .stderr(Stdio::piped())
+    .output()
+    .with_context(|| format!("failed to execute command: {cmd:?}"))?;
+
+  if !output.status.success() {
+    bail!(
+      "Command {:?} exited with {:?}\nstdout:\n{}\nstderr:\n{}",
+      cmd,
+      output.status.code(),
+      String::from_utf8_lossy(&output.stdout),
+      String::from_utf8_lossy(&output.stderr)
+    );
  }
-  (stdout, stderr)
+
+  Ok((
+    String::from_utf8_lossy(&output.stdout).to_string(),
+    String::from_utf8_lossy(&output.stderr).to_string(),
+  ))
 }

-#[allow(dead_code)]
-pub fn parse_max_mem(file_path: &str) -> Option<u64> {
-  let file = fs::File::open(file_path).unwrap();
+/// Parse a memory profiler (`mprof`) output file and return the maximum
+/// memory usage in bytes. Returns `None` if no values are found.
+pub fn parse_max_mem(file_path: &str) -> Result<Option<u64>> {
+  let file = fs::File::open(file_path)
+    .with_context(|| format!("failed to open mprof output file {file_path}"))?;
  let output = BufReader::new(file);
+
  let mut highest: u64 = 0;
-  // MEM 203.437500 1621617192.4123
+
  for line in output.lines().map_while(Result::ok) {
-    // split line by space
-    let split = line.split(' ').collect::<Vec<_>>();
+    let split: Vec<&str> = line.split(' ').collect();
    if split.len() == 3 {
-      // mprof generate result in MB
-      let current_bytes = str::parse::<f64>(split[1]).unwrap() as u64 * 1024 * 1024;
-      if current_bytes > highest {
-        highest = current_bytes;
+      if let Ok(mb) = split[1].parse::<f64>() {
+        let current_bytes = (mb * 1024.0 * 1024.0) as u64;
+        highest = highest.max(current_bytes);
      }
    }
  }

-  fs::remove_file(file_path).unwrap();
+  // Best-effort cleanup
+  let _ = fs::remove_file(file_path);

-  if highest > 0 {
-    return Some(highest);
-  }
-
-  None
+  Ok(if highest > 0 { Some(highest) } else { None })
 }

-#[allow(dead_code)]
+/// Parse the output of `strace -c` and return a summary of syscalls.
 pub fn parse_strace_output(output: &str) -> HashMap<String, StraceOutput> {
  let mut summary = HashMap::new();

  let mut lines = output
    .lines()
    .filter(|line| !line.is_empty() && !line.contains("detached ..."));
-  let count = lines.clone().count();

+  let count = lines.clone().count();
  if count < 4 {
    return summary;
  }
@@ -148,89 +170,91 @@ pub fn parse_strace_output(output: &str) -> HashMap<String, StraceOutput> {
  let data_lines = lines.skip(2);

  for line in data_lines {
-    let syscall_fields = line.split_whitespace().collect::<Vec<_>>();
+    let syscall_fields: Vec<&str> = line.split_whitespace().collect();
    let len = syscall_fields.len();
-    let syscall_name = syscall_fields.last().unwrap();

-    if (5..=6).contains(&len) {
-      summary.insert(
-        syscall_name.to_string(),
-        StraceOutput {
-          percent_time: str::parse::<f64>(syscall_fields[0]).unwrap(),
-          seconds: str::parse::<f64>(syscall_fields[1]).unwrap(),
-          usecs_per_call: Some(str::parse::<u64>(syscall_fields[2]).unwrap()),
-          calls: str::parse::<u64>(syscall_fields[3]).unwrap(),
-          errors: if syscall_fields.len() < 6 {
+    if let Some(&syscall_name) = syscall_fields.last() {
+      if (5..=6).contains(&len) {
+        let output = StraceOutput {
+          percent_time: syscall_fields[0].parse().unwrap_or(0.0),
+          seconds: syscall_fields[1].parse().unwrap_or(0.0),
+          usecs_per_call: syscall_fields[2].parse().ok(),
+          calls: syscall_fields[3].parse().unwrap_or(0),
+          errors: if len < 6 {
            0
          } else {
-            str::parse::<u64>(syscall_fields[4]).unwrap()
+            syscall_fields[4].parse().unwrap_or(0)
          },
-        },
-      );
+        };
+        summary.insert(syscall_name.to_string(), output);
+      }
    }
  }

-  let total_fields = total_line.split_whitespace().collect::<Vec<_>>();
-
-  summary.insert(
-    "total".to_string(),
-    match total_fields.len() {
-      // Old format, has no usecs/call
-      5 => StraceOutput {
-        percent_time: str::parse::<f64>(total_fields[0]).unwrap(),
-        seconds: str::parse::<f64>(total_fields[1]).unwrap(),
-        usecs_per_call: None,
-        calls: str::parse::<u64>(total_fields[2]).unwrap(),
-        errors: str::parse::<u64>(total_fields[3]).unwrap(),
-      },
-      6 => StraceOutput {
-        percent_time: str::parse::<f64>(total_fields[0]).unwrap(),
-        seconds: str::parse::<f64>(total_fields[1]).unwrap(),
-        usecs_per_call: Some(str::parse::<u64>(total_fields[2]).unwrap()),
-        calls: str::parse::<u64>(total_fields[3]).unwrap(),
-        errors: str::parse::<u64>(total_fields[4]).unwrap(),
-      },
-      _ => panic!("Unexpected total field count: {}", total_fields.len()),
+  let total_fields: Vec<&str> = total_line.split_whitespace().collect();
+  let total = match total_fields.len() {
+    5 => StraceOutput {
+      percent_time: total_fields[0].parse().unwrap_or(0.0),
+      seconds: total_fields[1].parse().unwrap_or(0.0),
+      usecs_per_call: None,
+      calls: total_fields[2].parse().unwrap_or(0),
+      errors: total_fields[3].parse().unwrap_or(0),
    },
-  );
+    6 => StraceOutput {
+      percent_time: total_fields[0].parse().unwrap_or(0.0),
+      seconds: total_fields[1].parse().unwrap_or(0.0),
+      usecs_per_call: total_fields[2].parse().ok(),
+      calls: total_fields[3].parse().unwrap_or(0),
+      errors: total_fields[4].parse().unwrap_or(0),
+    },
+    _ => {
+      panic!("Unexpected total field count: {}", total_fields.len());
+    }
+  };

+  summary.insert("total".to_string(), total);
  summary
 }

-#[allow(dead_code)]
-pub fn run(cmd: &[&str]) {
-  let mut process_builder = Command::new(cmd[0]);
-  process_builder.args(&cmd[1..]).stdin(Stdio::piped());
-  let mut prog = process_builder.spawn().expect("failed to spawn script");
-  let status = prog.wait().expect("failed to wait on child");
+/// Run a command and wait for completion.
+/// Returns an error if the command fails.
+pub fn run(cmd: &[&str]) -> Result<()> {
+  let status = Command::new(cmd[0])
+    .args(&cmd[1..])
+    .stdin(Stdio::piped())
+    .status()
+    .with_context(|| format!("failed to execute command: {cmd:?}"))?;
+
  if !status.success() {
-    panic!("Unexpected exit code: {:?}", status.code());
+    bail!("Command {:?} exited with {:?}", cmd, status.code());
  }
+  Ok(())
 }

-#[allow(dead_code)]
+/// Read a JSON file into a [`serde_json::Value`].
 pub fn read_json(filename: &str) -> Result<Value> {
-  let f = fs::File::open(filename)?;
+  let f =
+    fs::File::open(filename).with_context(|| format!("failed to open JSON file {filename}"))?;
  Ok(serde_json::from_reader(f)?)
 }

-#[allow(dead_code)]
+/// Write a [`serde_json::Value`] into a JSON file.
 pub fn write_json(filename: &str, value: &Value) -> Result<()> {
-  let f = fs::File::create(filename)?;
+  let f =
+    fs::File::create(filename).with_context(|| format!("failed to create JSON file {filename}"))?;
  serde_json::to_writer(f, value)?;
  Ok(())
 }

-#[allow(dead_code)]
-pub fn download_file(url: &str, filename: PathBuf) {
+/// Download a file from either a local path or an HTTP/HTTPS URL.
+/// Falls back to copying the file if the URL does not start with http/https.
+pub fn download_file(url: &str, filename: PathBuf) -> Result<()> {
  if !url.starts_with("http:") && !url.starts_with("https:") {
-    fs::copy(url, filename).unwrap();
-    return;
+    fs::copy(url, &filename).with_context(|| format!("failed to copy from {url}"))?;
+    return Ok(());
  }

-  // Downloading with curl this saves us from adding
-  // a Rust HTTP client dependency.
-  println!("Downloading {}", url);
+  println!("Downloading {url}");
  let status = Command::new("curl")
    .arg("-L")
    .arg("-s")
@@ -238,8 +262,14 @@ pub fn download_file(url: &str, filename: PathBuf) {
    .arg(&filename)
    .arg(url)
    .status()
-    .unwrap();
+    .with_context(|| format!("failed to execute curl for {url}"))?;

-  assert!(status.success());
-  assert!(filename.exists());
+  if !status.success() {
+    bail!("curl failed with exit code {:?}", status.code());
+  }
+  if !filename.exists() {
+    bail!("expected file {:?} to exist after download", filename);
+  }
+
+  Ok(())
 }
--- a/crates/tauri-build/CHANGELOG.md
+++ b/crates/tauri-build/CHANGELOG.md
@@ -1,5 +1,94 @@
 # Changelog

+## \[2.5.6]
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.8.3`
+- Upgraded to `tauri-codegen@2.5.5`
+
+## \[2.5.5]
+
+### Dependencies
+
+- Upgraded to `tauri-codegen@2.5.4`
+
+## \[2.5.4]
+
+### Enhancements
+
+- [`2d28e3143`](https://www.github.com/tauri-apps/tauri/commit/2d28e3143ee3d97d7570ea03877aa00a0d6e47d0) ([#14632](https://www.github.com/tauri-apps/tauri/pull/14632) by [@sftse](https://www.github.com/tauri-apps/tauri/../../sftse)) Small code refactors for improved code readability. No user facing changes.
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.8.2`
+- Upgraded to `tauri-codegen@2.5.3`
+
+## \[2.5.3]
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.8.1`
+- Upgraded to `tauri-codegen@2.5.2`
+
+## \[2.5.2]
+
+### Dependencies
+
+- Upgraded to `tauri-codegen@2.5.1`
+
+## \[2.5.1]
+
+### Bug Fixes
+
+- [`4b6b8690a`](https://www.github.com/tauri-apps/tauri/commit/4b6b8690ab886ebdf1307951cffbe03e31280baa) ([#14347](https://www.github.com/tauri-apps/tauri/pull/14347) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) Fixed an issue that caused docs.rs builds to fail. No user facing changes.
+
+## \[2.5.0]
+
+### New Features
+
+- [`3b4fac201`](https://www.github.com/tauri-apps/tauri/commit/3b4fac2017832d426dd07c5e24e26684eda57f7b) ([#14194](https://www.github.com/tauri-apps/tauri/pull/14194)) Add `tauri.conf.json > bundle > android > autoIncrementVersionCode` config option to automatically increment the Android version code.
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.8.0`
+- Upgraded to `tauri-codegen@2.5.0`
+
+## \[2.4.1]
+
+### Enhancements
+
+- [`c23bec62d`](https://www.github.com/tauri-apps/tauri/commit/c23bec62d6d5724798869681aa1534423aae28e2) ([#14083](https://www.github.com/tauri-apps/tauri/pull/14083) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) Tauri now ignores `macOS.minimumSystemVersion` in `tauri dev` to prevent forced rebuilds of macOS specific dependencies when using something like `rust-analyzer` at the same time as `tauri dev`.
+
+## \[2.4.0]
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.7.0`
+- Upgraded to `tauri-codegen@2.4.0`
+
+## \[2.3.1]
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.6.0`
+- Upgraded to `tauri-codegen@2.3.1`
+
+## \[2.2.1]
+
+### Dependencies
+
+- Upgraded to `tauri-codegen@2.3.0`
+- Upgraded to `tauri-utils@2.5.0`
+
+## \[2.2.0]
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.4.0`
+- Upgraded to `tauri-codegen@2.2.0`
+- [`48b12b440`](https://www.github.com/tauri-apps/tauri/commit/48b12b440478937c46fdfef9f9d95194be117020) Update to `tauri-utils@2.4.0`
+
 ## \[2.1.1]

 ### Dependencies
--- a/crates/tauri-build/Cargo.toml
+++ b/crates/tauri-build/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "tauri-build"
-version = "2.1.1"
+version = "2.5.6"
 description = "build time code to pair with https://crates.io/crates/tauri"
 exclude = ["CHANGELOG.md", "/target"]
 readme = "README.md"
@@ -22,15 +22,13 @@ targets = [
  "x86_64-linux-android",
  "x86_64-apple-ios",
 ]
-rustc-args = ["--cfg", "docsrs"]
-rustdoc-args = ["--cfg", "docsrs"]

 [dependencies]
 anyhow = "1"
 quote = { version = "1", optional = true }
-tauri-codegen = { version = "2.1.1", path = "../tauri-codegen", optional = true }
-tauri-utils = { version = "2.3.1", path = "../tauri-utils", features = [
-  "build",
+tauri-codegen = { version = "2.5.5", path = "../tauri-codegen", optional = true }
+tauri-utils = { version = "2.8.3", path = "../tauri-utils", features = [
+  "build-2",
  "resources",
 ] }
 cargo_toml = "0.22"
@@ -43,9 +41,8 @@ tauri-winres = "0.3"
 semver = "1"
 dirs = "6"
 glob = "0.3"
-toml = "0.8"
-# Our code requires at least 0.8.18 so don't simplify this to 0.8
-schemars = { version = "0.8.18", features = ["preserve_order"] }
+# Our code requires at least 0.8.21 so don't simplify this to 0.8
+schemars = { version = "0.8.21", features = ["preserve_order"] }

 [features]
 default = ["config-json"]
--- a/crates/tauri-build/src/acl.rs
+++ b/crates/tauri-build/src/acl.rs
@@ -157,7 +157,7 @@ fn read_plugins_manifests() -> Result<BTreeMap<String, Manifest>> {
  Ok(manifests)
 }

-struct InlinedPuginsAcl {
+struct InlinedPluginsAcl {
  manifests: BTreeMap<String, Manifest>,
  permission_files: BTreeMap<String, Vec<PermissionFile>>,
 }
@@ -165,7 +165,7 @@ struct InlinedPuginsAcl {
 fn inline_plugins(
  out_dir: &Path,
  inlined_plugins: HashMap<&'static str, InlinedPlugin>,
-) -> Result<InlinedPuginsAcl> {
+) -> Result<InlinedPluginsAcl> {
  let mut acl_manifests = BTreeMap::new();
  let mut permission_files_map = BTreeMap::new();

@@ -250,7 +250,7 @@ permissions = [{default_permissions}]
    acl_manifests.insert(name.into(), manifest);
  }

-  Ok(InlinedPuginsAcl {
+  Ok(InlinedPluginsAcl {
    manifests: acl_manifests,
    permission_files: permission_files_map,
  })
@@ -437,7 +437,7 @@ pub fn build(out_dir: &Path, target: Target, attributes: &Attributes) -> super::
    permissions_map.insert(APP_ACL_KEY.to_string(), app_acl.permission_files);
  }

-  tauri_utils::acl::build::generate_allowed_commands(out_dir, permissions_map)?;
+  tauri_utils::acl::build::generate_allowed_commands(out_dir, Some(capabilities), permissions_map)?;

  Ok(())
 }
--- a/crates/tauri-build/src/codegen/context.rs
+++ b/crates/tauri-build/src/codegen/context.rs
@@ -120,6 +120,13 @@ impl CodegenContext {
      if info_plist_path.exists() {
        println!("cargo:rerun-if-changed={}", info_plist_path.display());
      }
+
+      if let Some(plist_path) = &config.bundle.macos.info_plist {
+        let info_plist_path = config_parent.join(plist_path);
+        if info_plist_path.exists() {
+          println!("cargo:rerun-if-changed={}", info_plist_path.display());
+        }
+      }
    }

    let code = context_codegen(ContextData {
--- a/crates/tauri-build/src/lib.rs
+++ b/crates/tauri-build/src/lib.rs
@@ -57,7 +57,7 @@ fn copy_binaries(
  binaries: ResourcePaths,
  target_triple: &str,
  path: &Path,
-  package_name: Option<&String>,
+  package_name: Option<&str>,
 ) -> Result<()> {
  for src in binaries {
    let src = src?;
@@ -165,21 +165,21 @@ fn copy_frameworks(dest_dir: &Path, frameworks: &[String]) -> Result<()> {
    .with_context(|| format!("Failed to create frameworks output directory at {dest_dir:?}"))?;
  for framework in frameworks.iter() {
    if framework.ends_with(".framework") {
-      let src_path = PathBuf::from(framework);
+      let src_path = Path::new(framework);
      let src_name = src_path
        .file_name()
        .expect("Couldn't get framework filename");
      let dest_path = dest_dir.join(src_name);
-      copy_dir(&src_path, &dest_path)?;
+      copy_dir(src_path, &dest_path)?;
      continue;
    } else if framework.ends_with(".dylib") {
-      let src_path = PathBuf::from(framework);
+      let src_path = Path::new(framework);
      if !src_path.exists() {
        return Err(anyhow::anyhow!("Library not found: {}", framework));
      }
      let src_name = src_path.file_name().expect("Couldn't get library filename");
      let dest_path = dest_dir.join(src_name);
-      copy_file(&src_path, &dest_path)?;
+      copy_file(src_path, &dest_path)?;
      continue;
    } else if framework.contains('/') {
      return Err(anyhow::anyhow!(
@@ -192,12 +192,8 @@ fn copy_frameworks(dest_dir: &Path, frameworks: &[String]) -> Result<()> {
        continue;
      }
    }
-    if copy_framework_from(&PathBuf::from("/Library/Frameworks/"), framework, dest_dir)?
-      || copy_framework_from(
-        &PathBuf::from("/Network/Library/Frameworks/"),
-        framework,
-        dest_dir,
-      )?
+    if copy_framework_from("/Library/Frameworks/".as_ref(), framework, dest_dir)?
+      || copy_framework_from("/Network/Library/Frameworks/".as_ref(), framework, dest_dir)?
    {
      continue;
    }
@@ -263,7 +259,7 @@ impl WindowsAttributes {
    }
  }

-  /// Creates the default attriute set wihtou the default app manifest.
+  /// Creates the default attribute set without the default app manifest.
  #[must_use]
  pub fn new_without_app_manifest() -> Self {
    Self {
@@ -367,6 +363,8 @@ impl Attributes {

  /// Set the glob pattern to be used to find the capabilities.
  ///
+  /// **WARNING:** The `removeUnusedCommands` option does not work with a custom capabilities path.
+  ///
  /// **Note:** You must emit [rerun-if-changed] instructions for your capabilities directory.
  ///
  /// [rerun-if-changed]: https://doc.rust-lang.org/cargo/reference/build-scripts.html#rerun-if-changed
@@ -413,7 +411,8 @@ impl Attributes {
 }

 pub fn is_dev() -> bool {
-  env::var("DEP_TAURI_DEV").expect("missing `cargo:dev` instruction, please update tauri to latest")
+  env::var_os("DEP_TAURI_DEV")
+    .expect("missing `cargo:dev` instruction, please update tauri to latest")
    == "true"
 }

@@ -460,7 +459,7 @@ pub fn try_build(attributes: Attributes) -> Result<()> {

  println!("cargo:rerun-if-env-changed=TAURI_CONFIG");

-  let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap();
+  let target_os = env::var_os("CARGO_CFG_TARGET_OS").unwrap();
  let mobile = target_os == "ios" || target_os == "android";
  cfg_alias("desktop", !mobile);
  cfg_alias("mobile", mobile);
@@ -497,7 +496,7 @@ pub fn try_build(attributes: Attributes) -> Result<()> {
  println!("cargo:rustc-env=TAURI_ANDROID_PACKAGE_NAME_PREFIX={android_package_prefix}");

  if let Some(project_dir) = env::var_os("TAURI_ANDROID_PROJECT_PATH").map(PathBuf::from) {
-    mobile::generate_gradle_files(project_dir, &config)?;
+    mobile::generate_gradle_files(project_dir)?;
  }

  cfg_alias("dev", is_dev());
@@ -505,7 +504,7 @@ pub fn try_build(attributes: Attributes) -> Result<()> {
  let cargo_toml_path = Path::new("Cargo.toml").canonicalize()?;
  let mut manifest = Manifest::<cargo_toml::Value>::from_path_with_metadata(cargo_toml_path)?;

-  let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
+  let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());

  manifest::check(&config, &mut manifest)?;

@@ -528,10 +527,10 @@ pub fn try_build(attributes: Attributes) -> Result<()> {

  if let Some(paths) = &config.bundle.external_bin {
    copy_binaries(
-      ResourcePaths::new(external_binaries(paths, &target_triple).as_slice(), true),
+      ResourcePaths::new(&external_binaries(paths, &target_triple, &target), true),
      &target_triple,
      target_dir,
-      manifest.package.as_ref().map(|p| &p.name),
+      manifest.package.as_ref().map(|p| p.name.as_ref()),
    )?;
  }

@@ -540,7 +539,7 @@ pub fn try_build(attributes: Attributes) -> Result<()> {
    .bundle
    .resources
    .clone()
-    .unwrap_or_else(|| BundleResources::List(Vec::new()));
+    .unwrap_or(BundleResources::List(Vec::new()));
  if target_triple.contains("windows") {
    if let Some(fixed_webview2_runtime_path) = match &config.bundle.windows.webview_install_mode {
      WebviewInstallMode::FixedRuntime { path } => Some(path),
@@ -571,8 +570,10 @@ pub fn try_build(attributes: Attributes) -> Result<()> {
      }
    }

-    if let Some(version) = &config.bundle.macos.minimum_system_version {
-      println!("cargo:rustc-env=MACOSX_DEPLOYMENT_TARGET={version}");
+    if !is_dev() {
+      if let Some(version) = &config.bundle.macos.minimum_system_version {
+        println!("cargo:rustc-env=MACOSX_DEPLOYMENT_TARGET={version}");
+      }
    }
  }

@@ -587,21 +588,19 @@ pub fn try_build(attributes: Attributes) -> Result<()> {
    use semver::Version;
    use tauri_winres::{VersionInfo, WindowsResource};

-    fn find_icon<F: Fn(&&String) -> bool>(config: &Config, predicate: F, default: &str) -> PathBuf {
-      let icon_path = config
-        .bundle
-        .icon
-        .iter()
-        .find(|i| predicate(i))
-        .cloned()
-        .unwrap_or_else(|| default.to_string());
-      icon_path.into()
-    }
-
    let window_icon_path = attributes
      .windows_attributes
      .window_icon_path
-      .unwrap_or_else(|| find_icon(&config, |i| i.ends_with(".ico"), "icons/icon.ico"));
+      .unwrap_or_else(|| {
+        config
+          .bundle
+          .icon
+          .iter()
+          .find(|i| i.ends_with(".ico"))
+          .map(AsRef::as_ref)
+          .unwrap_or("icons/icon.ico")
+          .into()
+      });

    let mut res = WindowsResource::new();

@@ -684,7 +683,7 @@ pub fn try_build(attributes: Attributes) -> Result<()> {
        }
      }
      "msvc" => {
-        if env::var("STATIC_VCRUNTIME").is_ok_and(|v| v == "true") {
+        if env::var_os("STATIC_VCRUNTIME").is_some_and(|v| v == "true") {
          static_vcruntime::build();
        }
      }
--- a/crates/tauri-build/src/manifest.rs
+++ b/crates/tauri-build/src/manifest.rs
@@ -23,7 +23,7 @@ struct AllowlistedDependency {
  name: String,
  alias: Option<String>,
  kind: DependencyKind,
-  all_cli_managed_features: Option<Vec<&'static str>>,
+  all_cli_managed_features: Vec<&'static str>,
  expected_features: Vec<String>,
 }

@@ -33,7 +33,7 @@ pub fn check(config: &Config, manifest: &mut Manifest) -> Result<()> {
      name: "tauri-build".into(),
      alias: None,
      kind: DependencyKind::Build,
-      all_cli_managed_features: Some(vec!["isolation"]),
+      all_cli_managed_features: vec!["isolation"],
      expected_features: match config.app.security.pattern {
        PatternKind::Isolation { .. } => vec!["isolation".to_string()],
        _ => vec![],
@@ -43,12 +43,10 @@ pub fn check(config: &Config, manifest: &mut Manifest) -> Result<()> {
      name: "tauri".into(),
      alias: None,
      kind: DependencyKind::Normal,
-      all_cli_managed_features: Some(
-        AppConfig::all_features()
-          .into_iter()
-          .filter(|f| f != &"tray-icon")
-          .collect(),
-      ),
+      all_cli_managed_features: AppConfig::all_features()
+        .into_iter()
+        .filter(|f| f != &"tray-icon")
+        .collect(),
      expected_features: config
        .app
        .features()
@@ -129,23 +127,13 @@ fn check_features(dependency: Dependency, metadata: &AllowlistedDependency) -> R
    Dependency::Inherited(dep) => dep.features,
  };

-  let diff = if let Some(all_cli_managed_features) = &metadata.all_cli_managed_features {
-    features_diff(
-      &features
-        .into_iter()
-        .filter(|f| all_cli_managed_features.contains(&f.as_str()))
-        .collect::<Vec<String>>(),
-      &metadata.expected_features,
-    )
-  } else {
-    features_diff(
-      &features
-        .into_iter()
-        .filter(|f| f.starts_with("allow-"))
-        .collect::<Vec<String>>(),
-      &metadata.expected_features,
-    )
-  };
+  let diff = features_diff(
+    &features
+      .into_iter()
+      .filter(|f| metadata.all_cli_managed_features.contains(&f.as_str()))
+      .collect::<Vec<String>>(),
+    &metadata.expected_features,
+  );

  let mut error_message = String::new();
  if !diff.remove.is_empty() {
--- a/crates/tauri-build/src/mobile.rs
+++ b/crates/tauri-build/src/mobile.rs
@@ -2,26 +2,22 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-License-Identifier: MIT

-use std::{fs::write, path::PathBuf};
+use std::path::PathBuf;

 use anyhow::{Context, Result};
-use semver::Version;
-use tauri_utils::{config::Config, write_if_changed};
+use tauri_utils::write_if_changed;

-use crate::is_dev;
-
-pub fn generate_gradle_files(project_dir: PathBuf, config: &Config) -> Result<()> {
+pub fn generate_gradle_files(project_dir: PathBuf) -> Result<()> {
  let gradle_settings_path = project_dir.join("tauri.settings.gradle");
  let app_build_gradle_path = project_dir.join("app").join("tauri.build.gradle.kts");
-  let app_tauri_properties_path = project_dir.join("app").join("tauri.properties");

  let mut gradle_settings =
    "// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.\n".to_string();
  let mut app_build_gradle = "// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 val implementation by configurations
-dependencies {"
+dependencies {
+  implementation(\"androidx.lifecycle:lifecycle-process:2.10.0\")"
    .to_string();
-  let mut app_tauri_properties = Vec::new();

  for (env, value) in std::env::vars_os() {
    let env = env.to_string_lossy();
@@ -54,32 +50,6 @@ dependencies {"

  app_build_gradle.push_str("\n}");

-  if let Some(version) = config.version.as_ref() {
-    app_tauri_properties.push(format!("tauri.android.versionName={version}"));
-    if let Some(version_code) = config.bundle.android.version_code.as_ref() {
-      app_tauri_properties.push(format!("tauri.android.versionCode={version_code}"));
-    } else if let Ok(version) = Version::parse(version) {
-      let mut version_code = version.major * 1000000 + version.minor * 1000 + version.patch;
-
-      if is_dev() {
-        version_code = version_code.clamp(1, 2100000000);
-      }
-
-      if version_code == 0 {
-        return Err(anyhow::anyhow!(
-              "You must change the `version` in `tauri.conf.json`. The default value `0.0.0` is not allowed for Android package and must be at least `0.0.1`."
-            ));
-      } else if version_code > 2100000000 {
-        return Err(anyhow::anyhow!(
-          "Invalid version code {}. Version code must be between 1 and 2100000000. You must change the `version` in `tauri.conf.json`.",
-          version_code
-        ));
-      }
-
-      app_tauri_properties.push(format!("tauri.android.versionCode={version_code}"));
-    }
-  }
-
  // Overwrite only if changed to not trigger rebuilds
  write_if_changed(&gradle_settings_path, gradle_settings)
    .context("failed to write tauri.settings.gradle")?;
@@ -87,28 +57,8 @@ dependencies {"
  write_if_changed(&app_build_gradle_path, app_build_gradle)
    .context("failed to write tauri.build.gradle.kts")?;

-  if !app_tauri_properties.is_empty() {
-    let app_tauri_properties_content = format!(
-      "// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.\n{}",
-      app_tauri_properties.join("\n")
-    );
-    if std::fs::read_to_string(&app_tauri_properties_path)
-      .map(|o| o != app_tauri_properties_content)
-      .unwrap_or(true)
-    {
-      write(&app_tauri_properties_path, app_tauri_properties_content)
-        .context("failed to write tauri.properties")?;
-    }
-  }
-
  println!("cargo:rerun-if-changed={}", gradle_settings_path.display());
  println!("cargo:rerun-if-changed={}", app_build_gradle_path.display());
-  if !app_tauri_properties.is_empty() {
-    println!(
-      "cargo:rerun-if-changed={}",
-      app_tauri_properties_path.display()
-    );
-  }

  Ok(())
 }
--- a/crates/tauri-bundler/CHANGELOG.md
+++ b/crates/tauri-bundler/CHANGELOG.md
@@ -1,5 +1,202 @@
 # Changelog

+## \[2.8.1]
+
+### Bug Fixes
+
+- [`6252432f0`](https://www.github.com/tauri-apps/tauri/commit/6252432f0757d896d7a61819bbff127efac5a156) ([#14945](https://www.github.com/tauri-apps/tauri/pull/14945) by [@veeceey](https://www.github.com/tauri-apps/tauri/../../veeceey)) Fix WIX installer registry search order so that the named `InstallDir` key takes priority over the NSIS default key, preventing install location from changing on updates.
+
+### What's Changed
+
+- [`7be58a1c6`](https://www.github.com/tauri-apps/tauri/commit/7be58a1c643a7ed6d0f484a7e1134022618eb2b2) ([#14894](https://www.github.com/tauri-apps/tauri/pull/14894) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Log patching bundle type information again
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.8.3`
+
+## \[2.8.0]
+
+### Enhancements
+
+- [`c769f211f`](https://www.github.com/tauri-apps/tauri/commit/c769f211fcaa543884c9d0f87ebd2ee106c01382) ([#14824](https://www.github.com/tauri-apps/tauri/pull/14824) by [@Kf637](https://www.github.com/tauri-apps/tauri/../../Kf637)) feat(nsis): add Norwegian language support for installer.
+
+### Bug Fixes
+
+- [`7fca58230`](https://www.github.com/tauri-apps/tauri/commit/7fca58230f97c3e6834134419514a0c7dbbe784b) ([#14830](https://www.github.com/tauri-apps/tauri/pull/14830) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Updated `nsis_tauri_utils` to 0.5.3:
+
+  - Use an alternative method `CreateProcessWithTokenW` to run programs as user, this fixed a problem that the program launched with the previous method can't query its own handle
+
+### What's Changed
+
+- [`0575dd287`](https://www.github.com/tauri-apps/tauri/commit/0575dd287e021b61d2aedf64d62ae84a2c925fb4) ([#14521](https://www.github.com/tauri-apps/tauri/pull/14521) by [@kandrelczyk](https://www.github.com/tauri-apps/tauri/../../kandrelczyk)) Change the way bundle type information is added to binary files. Instead of looking up the value of a variable we simply look for the default value.
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.8.2`
+- Upgraded to `tauri-macos-sign@2.3.3`
+
+## \[2.7.5]
+
+### Enhancements
+
+- [`4176f93ae`](https://www.github.com/tauri-apps/tauri/commit/4176f93ae43ef66714c4934feb3df19df3a3e28a) ([#14570](https://www.github.com/tauri-apps/tauri/pull/14570) by [@chfaft](https://www.github.com/tauri-apps/tauri/../../chfaft)) Consider extensions that are defined in the wxs template.
+
+### Bug Fixes
+
+- [`018b4db22`](https://www.github.com/tauri-apps/tauri/commit/018b4db22e167fa67b37b0933e192a0f3556d3e5) ([#14625](https://www.github.com/tauri-apps/tauri/pull/14625) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Skip signing for NSIS uninstaller when using `--no-sign` flag
+- [`91becd9e4`](https://www.github.com/tauri-apps/tauri/commit/91becd9e4fa2db089ddc6b21dadc06133e939e08) ([#14627](https://www.github.com/tauri-apps/tauri/pull/14627) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Fix NSIS plugins not being signed due to wrong path handlings
+
+### Dependencies
+
+- Upgraded to `tauri-macos-sign@2.3.2`
+
+## \[2.7.4]
+
+### Bug Fixes
+
+- [`1496145f8`](https://www.github.com/tauri-apps/tauri/commit/1496145f8222649efeff22b819a96208670bbea1) ([#14585](https://www.github.com/tauri-apps/tauri/pull/14585) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) Fixed an issue that caused the AppImage bundler to fail with 404 errors for 32-bit builds.
+
+### Performance Improvements
+
+- [`ce98d87ce`](https://www.github.com/tauri-apps/tauri/commit/ce98d87ce0aaa907285852eb80691197424e03c3) ([#14474](https://www.github.com/tauri-apps/tauri/pull/14474) by [@Tunglies](https://www.github.com/tauri-apps/tauri/../../Tunglies)) refactor: remove needless collect. No user facing changes.
+- [`ee3cc4a91`](https://www.github.com/tauri-apps/tauri/commit/ee3cc4a91bf1315ecaefe90f423ffd55ef6c40db) ([#14475](https://www.github.com/tauri-apps/tauri/pull/14475) by [@Tunglies](https://www.github.com/tauri-apps/tauri/../../Tunglies)) perf: remove needless clones in various files for improved performance. No user facing changes.
+
+### Dependencies
+
+- Upgraded to `tauri-macos-sign@2.3.1`
+- Upgraded to `tauri-utils@2.8.1`
+- [`b5ef603d8`](https://www.github.com/tauri-apps/tauri/commit/b5ef603d84bd8044625e50dcfdabb099b2e9fdd9) ([#14478](https://www.github.com/tauri-apps/tauri/pull/14478) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Updated NSIS from 3.8 to 3.11
+
+## \[2.7.3]
+
+### Enhancements
+
+- [`22edc65aa`](https://www.github.com/tauri-apps/tauri/commit/22edc65aad0b3e45515008e8e0866112da70c8a1) ([#14408](https://www.github.com/tauri-apps/tauri/pull/14408) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) Set user-agent in bundler and cli http requests when fetching build tools.
+
+### Bug Fixes
+
+- [`9a1922636`](https://www.github.com/tauri-apps/tauri/commit/9a192263693d71123a9953e2a6ee60fad07500b4) ([#14410](https://www.github.com/tauri-apps/tauri/pull/14410) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Fix uninstall fails if you close the app manually during the 'Click Ok to kill it' dialog
+
+## \[2.7.2]
+
+### Enhancements
+
+- [`7f710b8f3`](https://www.github.com/tauri-apps/tauri/commit/7f710b8f3b509ed327d76761926511cf56e66b2d) ([#14390](https://www.github.com/tauri-apps/tauri/pull/14390) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) Inline linuxdeploy plugins which were previously downloaded from `https://raw.githubusercontent.com` which lately blocks many users with a 429 error.
+- [`fc017ee25`](https://www.github.com/tauri-apps/tauri/commit/fc017ee2577f48615367ea519386d3f37837e2c1) ([#14368](https://www.github.com/tauri-apps/tauri/pull/14368) by [@kandrelczyk](https://www.github.com/tauri-apps/tauri/../../kandrelczyk)) Mention symbol stripping on Linux in binary patch failed warning message
+
+## \[2.7.1]
+
+### Dependencies
+
+- Upgraded to `tauri-macos-sign@2.3.0`
+
+## \[2.7.0]
+
+### New Features
+
+- [`2a06d1006`](https://www.github.com/tauri-apps/tauri/commit/2a06d10066a806e392efe8bfb16d943ee0b0b61d) ([#14052](https://www.github.com/tauri-apps/tauri/pull/14052)) Add a `--no-sign` flag to the `tauri build` and `tauri bundle` commands to skip the code signing step, improving the developer experience for local testing and development without requiring code signing keys.
+- [`cc8c0b531`](https://www.github.com/tauri-apps/tauri/commit/cc8c0b53171173dbd1d01781a50de1a3ea159031) ([#14031](https://www.github.com/tauri-apps/tauri/pull/14031)) Support providing `plist::Value` as macOS entitlements.
+
+### Enhancements
+
+- [`b06b3bd09`](https://www.github.com/tauri-apps/tauri/commit/b06b3bd091b0fed26cdcfb23cacb0462a7a9cc2d) ([#14126](https://www.github.com/tauri-apps/tauri/pull/14126)) Improve error messages with more context.
+
+### Bug Fixes
+
+- [`06d4a4ed6`](https://www.github.com/tauri-apps/tauri/commit/06d4a4ed6c146d6c7782016cf90037b56b944445) ([#14241](https://www.github.com/tauri-apps/tauri/pull/14241)) Set `APPIMAGE_EXTRACT_AND_RUN` on top of using the `--appimage-extra-and-run` cli arg for linuxdeploy.
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.8.0`
+
+### Breaking Changes
+
+- [`ed7c9a410`](https://www.github.com/tauri-apps/tauri/commit/ed7c9a4100e08c002212265549d12130d021ad1e) ([#14108](https://www.github.com/tauri-apps/tauri/pull/14108)) Changed `MacOsSettings::info_plist_path` to `MacOsSettings::info_plist`.
+
+## \[2.6.1]
+
+### Bug Fixes
+
+- [`f3df96fb3`](https://www.github.com/tauri-apps/tauri/commit/f3df96fb38e2f27ce6bf232fe87f35bcfec50ce4) ([#14065](https://www.github.com/tauri-apps/tauri/pull/14065) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Fix binary patching updater type fails on 32 bit Windows builds
+
+## \[2.6.0]
+
+### New Features
+
+- [`a9ec12843`](https://www.github.com/tauri-apps/tauri/commit/a9ec12843aa7d0eb774bd3a53e2e63da12cfa77b) ([#13521](https://www.github.com/tauri-apps/tauri/pull/13521) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) Added a `--skip-stapling` option to make `tauri build|bundle` *not* wait for notarization to finish on macOS.
+
+### Enhancements
+
+- [`8b465a12b`](https://www.github.com/tauri-apps/tauri/commit/8b465a12ba73e94d7a3995defd9cc362d15eeebe) ([#13913](https://www.github.com/tauri-apps/tauri/pull/13913) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) The bundler now pulls the latest AppImage linuxdeploy plugin instead of using the built-in one. This should remove the libfuse requirement.
+- [`4475e93e1`](https://www.github.com/tauri-apps/tauri/commit/4475e93e136e9e2bd5f3c7817fa2040924f630f6) ([#13824](https://www.github.com/tauri-apps/tauri/pull/13824) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) The bundler and cli will now read TLS Certificates installed on the system when downloading tools and checking versions.
+
+### Bug Fixes
+
+- [`a8f1569b0`](https://www.github.com/tauri-apps/tauri/commit/a8f1569b04edf7b54a19e19ad37b421b0808f512) ([#13921](https://www.github.com/tauri-apps/tauri/pull/13921) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) The bundler will no longer try to sign non-binary and already signed binary files on Windows
+- [`bc6b125b2`](https://www.github.com/tauri-apps/tauri/commit/bc6b125b24589ffc412a4f17d899a387a0fc0bb2) ([#13909](https://www.github.com/tauri-apps/tauri/pull/13909) by [@Andrew15-5](https://www.github.com/tauri-apps/tauri/../../Andrew15-5)) The bundler now falls back to `1` for the release in case an empty string was provided instead of using `-.` in the file name.
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.7.0`
+- Upgraded to `tauri-macos-sign@2.2.0`
+
+## \[2.5.2]
+
+### Bug Fixes
+
+- [`af95fb601`](https://www.github.com/tauri-apps/tauri/commit/af95fb6014ea54a2636bfd299095608f6cd93221) ([#13870](https://www.github.com/tauri-apps/tauri/pull/13870) by [@kittuov](https://www.github.com/tauri-apps/tauri/../../kittuov)) The bundler now signs the main binary after patching it for every package type on windows
+
+## \[2.5.1]
+
+### Bug Fixes
+
+- [`f94af9035`](https://www.github.com/tauri-apps/tauri/commit/f94af90359ec8b01138ae542391caa704ec18ca8) ([#13786](https://www.github.com/tauri-apps/tauri/pull/13786) by [@catalinsh](https://www.github.com/tauri-apps/tauri/../../catalinsh)) Fix NSIS per-machine installer not requesting elevation when run by non-admin users.
+- [`f2dbe7309`](https://www.github.com/tauri-apps/tauri/commit/f2dbe730979d570be3ee3ecac9621204c4ceb788) ([#13772](https://www.github.com/tauri-apps/tauri/pull/13772) by [@catalinsh](https://www.github.com/tauri-apps/tauri/../../catalinsh)) Fix incorrect expected file path for `nsis_tauri_utils.dll` resulting in tauri-cli re-downloading the file on every build.
+- [`7a6fd5b75`](https://www.github.com/tauri-apps/tauri/commit/7a6fd5b75d61071e2771f6277c0376ec206d302a) ([#13863](https://www.github.com/tauri-apps/tauri/pull/13863) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) The AppImage bundler now pulls the AppRun binaries from our GitHub mirror, fixing 404 errors.
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.6.0`
+
+## \[2.5.0]
+
+### New Features
+
+- [`414619c36`](https://www.github.com/tauri-apps/tauri/commit/414619c36e94e21939534dd72c0438b93da75546) ([#13536](https://www.github.com/tauri-apps/tauri/pull/13536) by [@Tunglies](https://www.github.com/tauri-apps/tauri/../../Tunglies)) Added support for the `bundleName` property in the macOS bundler configuration. This allows specifying the `CFBundleName` value for generated macOS bundles.
+- [`7322f0579`](https://www.github.com/tauri-apps/tauri/commit/7322f057923aaec88960ad5556776774b745762f) ([#13502](https://www.github.com/tauri-apps/tauri/pull/13502) by [@amrbashir](https://www.github.com/tauri-apps/tauri/../../amrbashir)) Allow using `CheckIfAppIsRunning` macro inside NSIS hooks, for example `!insertmacro CheckIfAppIsRunning "another-executable.exe" "Another Executable"`.
+
+### Bug Fixes
+
+- [`479cee3d3`](https://www.github.com/tauri-apps/tauri/commit/479cee3d3680f9020005bdfb380d3a9482e286a1) ([#13260](https://www.github.com/tauri-apps/tauri/pull/13260) by [@FabianLars](https://www.github.com/tauri-apps/tauri/../../FabianLars)) The bundler now sets the `ARCH` env var to the current build target to prevent potential issues with `appimagetool`'s auto-detection.
+- [`e045fe32c`](https://www.github.com/tauri-apps/tauri/commit/e045fe32c9b0bed954916dc42528e28ee19f75b8) ([#13334](https://www.github.com/tauri-apps/tauri/pull/13334) by [@lucasfernog](https://www.github.com/tauri-apps/tauri/../../lucasfernog)) Fix custom Windows sign command failing to sign app uninstaller if it references relative paths.
+- [`bd8a7cf39`](https://www.github.com/tauri-apps/tauri/commit/bd8a7cf39df316bf27c73a303d5e650301af0104) ([#13581](https://www.github.com/tauri-apps/tauri/pull/13581) by [@martpie](https://www.github.com/tauri-apps/tauri/../../martpie)) Fixes app icon not being displayed on Gnome dock and grid view when using Wayland.
+- [`b52da29d5`](https://www.github.com/tauri-apps/tauri/commit/b52da29d5dbdb675ddba438a335e6a59f620e536) ([#13429](https://www.github.com/tauri-apps/tauri/pull/13429) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Fix `mainBinaryName` doesn't work when there's `.` in it
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.5.0`
+
+## \[2.4.0]
+
+### New Features
+
+- [`b0babb6df`](https://www.github.com/tauri-apps/tauri/commit/b0babb6df12dafe45c21a2c9c424fd86ffd75ca7) ([#12938](https://www.github.com/tauri-apps/tauri/pull/12938)) Added hebrew translation for the custom Tauri messages in the NSIS bundle.
+- [`0aa48fb9e`](https://www.github.com/tauri-apps/tauri/commit/0aa48fb9e4b9d7b5bf3522000a76ebc1836394ed) ([#13030](https://www.github.com/tauri-apps/tauri/pull/13030)) Added `bundleVersion` to iOS and macOS configuration to support specifying a `CFBundleVersion`.
+
+### Enhancements
+
+- [`8d994f60f`](https://www.github.com/tauri-apps/tauri/commit/8d994f60fe05ec0f45cbe926506bbe10b0d36e3c) ([#11676](https://www.github.com/tauri-apps/tauri/pull/11676)) Sign NSIS and WiX DLLs when bundling
+- [`8d994f60f`](https://www.github.com/tauri-apps/tauri/commit/8d994f60fe05ec0f45cbe926506bbe10b0d36e3c) ([#11676](https://www.github.com/tauri-apps/tauri/pull/11676)) Sign DLLs from resources.
+
+### Bug Fixes
+
+- [`9ea76503d`](https://www.github.com/tauri-apps/tauri/commit/9ea76503dcf8da11fab65550f4ab8d3565a424ef) ([#13186](https://www.github.com/tauri-apps/tauri/pull/13186)) Fix NSIS bundler can't include resources and sidecars with `$` in the path
+- [`2dccfab53`](https://www.github.com/tauri-apps/tauri/commit/2dccfab5321fef55d45f3a4c674b6151b1c4424a) ([#13236](https://www.github.com/tauri-apps/tauri/pull/13236)) Fix `fileAssociations` missing `LSHandlerRank` on macOS.
+
+### Dependencies
+
+- Upgraded to `tauri-utils@2.4.0`
+
 ## \[2.3.1]

 ### Bug Fixes
--- a/crates/tauri-bundler/Cargo.toml
+++ b/crates/tauri-bundler/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "tauri-bundler"
-version = "2.3.1"
+version = "2.8.1"
 authors = [
  "George Burton <burtonageo@gmail.com>",
  "Tauri Programme within The Commons Conservancy",
@@ -15,13 +15,13 @@ rust-version = "1.77.2"
 exclude = ["CHANGELOG.md", "/target", "rustfmt.toml"]

 [dependencies]
-tauri-utils = { version = "2.3.1", path = "../tauri-utils", features = [
+tauri-utils = { version = "2.8.3", path = "../tauri-utils", features = [
  "resources",
 ] }
 image = "0.25"
 flate2 = "1"
-anyhow = "1"
 thiserror = "2"
+anyhow = "1"
 serde_json = "1"
 serde = { version = "1", features = ["derive"] }
 strsim = "0.11"
@@ -38,11 +38,14 @@ hex = "0.4"
 semver = "1"
 sha1 = "0.10"
 sha2 = "0.10"
-zip = { version = "2", default-features = false, features = ["deflate"] }
+zip = { version = "4", default-features = false, features = ["deflate"] }
 dunce = "1"
 url = "2"
 uuid = { version = "1", features = ["v4", "v5"] }
 regex = "1"
+goblin = "0.9"
+plist = "1"
+

 [target."cfg(target_os = \"windows\")".dependencies]
 bitness = "0.4"
@@ -50,27 +53,30 @@ windows-registry = "0.5"
 glob = "0.3"

 [target."cfg(target_os = \"windows\")".dependencies.windows-sys]
-version = "0.59"
+version = "0.60"
 features = ["Win32_System_SystemInformation", "Win32_System_Diagnostics_Debug"]

 [target."cfg(target_os = \"macos\")".dependencies]
 icns = { package = "tauri-icns", version = "0.1" }
 time = { version = "0.3", features = ["formatting"] }
-plist = "1"
-tauri-macos-sign = { version = "2.1.0", path = "../tauri-macos-sign" }
+tauri-macos-sign = { version = "2.3.3", path = "../tauri-macos-sign" }

 [target."cfg(target_os = \"linux\")".dependencies]
 heck = "0.5"
 ar = "0.9"
-md5 = "0.7"
+md5 = "0.8"
 rpm = { version = "0.16", features = ["bzip2-compression"] }

+[target."cfg(unix)".dependencies]
+which = "8"
+
 [lib]
 name = "tauri_bundler"
 path = "src/lib.rs"

 [features]
-default = ["rustls"]
+default = ["rustls", "platform-certs"]
 native-tls = ["ureq/native-tls"]
 native-tls-vendored = ["native-tls", "native-tls/vendored"]
 rustls = ["ureq/rustls"]
+platform-certs = ["ureq/platform-verifier"]
--- a/crates/tauri-bundler/src/bundle.rs
+++ b/crates/tauri-bundler/src/bundle.rs
@@ -4,6 +4,7 @@
 // SPDX-License-Identifier: MIT

 mod category;
+mod kmp;
 #[cfg(target_os = "linux")]
 mod linux;
 #[cfg(target_os = "macos")]
@@ -13,21 +14,84 @@ mod settings;
 mod updater_bundle;
 mod windows;

-use tauri_utils::display_path;
+use tauri_utils::{display_path, platform::Target as TargetPlatform};
+
+const BUNDLE_VAR_TOKEN: &[u8] = b"__TAURI_BUNDLE_TYPE_VAR_UNK";
+/// Patch a binary with bundle type information
+fn patch_binary(binary: &PathBuf, package_type: &PackageType) -> crate::Result<()> {
+  #[cfg(target_os = "linux")]
+  let bundle_type = match package_type {
+    crate::PackageType::Deb => b"__TAURI_BUNDLE_TYPE_VAR_DEB",
+    crate::PackageType::Rpm => b"__TAURI_BUNDLE_TYPE_VAR_RPM",
+    crate::PackageType::AppImage => b"__TAURI_BUNDLE_TYPE_VAR_APP",
+    // NSIS installers can be built in linux using cargo-xwin
+    crate::PackageType::Nsis => b"__TAURI_BUNDLE_TYPE_VAR_NSS",
+    _ => {
+      return Err(crate::Error::InvalidPackageType(
+        package_type.short_name().to_owned(),
+        "Linux".to_owned(),
+      ))
+    }
+  };
+  #[cfg(target_os = "windows")]
+  let bundle_type = match package_type {
+    crate::PackageType::Nsis => b"__TAURI_BUNDLE_TYPE_VAR_NSS",
+    crate::PackageType::WindowsMsi => b"__TAURI_BUNDLE_TYPE_VAR_MSI",
+    _ => {
+      return Err(crate::Error::InvalidPackageType(
+        package_type.short_name().to_owned(),
+        "Windows".to_owned(),
+      ))
+    }
+  };
+  #[cfg(target_os = "macos")]
+  let bundle_type = match package_type {
+    // NSIS installers can be built in macOS using cargo-xwin
+    crate::PackageType::Nsis => b"__TAURI_BUNDLE_TYPE_VAR_NSS",
+    crate::PackageType::MacOsBundle | crate::PackageType::Dmg => {
+      // skip patching for macOS-native bundles
+      return Ok(());
+    }
+    _ => {
+      return Err(crate::Error::InvalidPackageType(
+        package_type.short_name().to_owned(),
+        "macOS".to_owned(),
+      ))
+    }
+  };
+
+  log::info!(
+    "Patching {} with bundle type information: {}",
+    display_path(binary),
+    package_type.short_name()
+  );
+
+  let mut file_data = std::fs::read(binary).expect("Could not read binary file.");
+  let bundle_var_index =
+    kmp::index_of(BUNDLE_VAR_TOKEN, &file_data).ok_or(crate::Error::MissingBundleTypeVar)?;
+  file_data[bundle_var_index..bundle_var_index + BUNDLE_VAR_TOKEN.len()]
+    .copy_from_slice(bundle_type);
+
+  std::fs::write(binary, &file_data).map_err(|e| crate::Error::BinaryWriteError(e.to_string()))?;
+
+  Ok(())
+}

 pub use self::{
  category::AppCategory,
  settings::{
    AppImageSettings, BundleBinary, BundleSettings, CustomSignCommandSettings, DebianSettings,
-    DmgSettings, IosSettings, MacOsSettings, PackageSettings, PackageType, Position, RpmSettings,
-    Settings, SettingsBuilder, Size, UpdaterSettings,
+    DmgSettings, Entitlements, IosSettings, MacOsSettings, PackageSettings, PackageType, PlistKind,
+    Position, RpmSettings, Settings, SettingsBuilder, Size, UpdaterSettings,
  },
 };
-#[cfg(target_os = "macos")]
-use anyhow::Context;
 pub use settings::{NsisSettings, WindowsSettings, WixLanguage, WixLanguageConfig, WixSettings};

-use std::{fmt::Write, path::PathBuf};
+use std::{
+  fmt::Write,
+  io::{Seek, SeekFrom},
+  path::PathBuf,
+};

 /// Generated bundle metadata.
 #[derive(Debug)]
@@ -48,49 +112,32 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {

  package_types.sort_by_key(|a| a.priority());

-  let target_os = settings
-    .target()
-    .split('-')
-    .nth(2)
-    .unwrap_or(std::env::consts::OS)
-    .replace("darwin", "macos");
+  let target_os = settings.target_platform();

-  if target_os != std::env::consts::OS {
+  if *target_os != TargetPlatform::current() {
    log::warn!("Cross-platform compilation is experimental and does not support all features. Please use a matching host system for full compatibility.");
  }

  // Sign windows binaries before the bundling step in case neither wix and nsis bundles are enabled
-  if target_os == "windows" {
-    if settings.can_sign() {
-      for bin in settings.binaries() {
-        let bin_path = settings.binary_path(bin);
-        windows::sign::try_sign(&bin_path, settings)?;
-      }
+  sign_binaries_if_needed(settings, target_os)?;

-      // Sign the sidecar binaries
-      for bin in settings.external_binaries() {
-        let path = bin?;
-        let skip = std::env::var("TAURI_SKIP_SIDECAR_SIGNATURE_CHECK").is_ok_and(|v| v == "true");
-        if skip {
-          continue;
-        }
+  let main_binary = settings
+    .binaries()
+    .iter()
+    .find(|b| b.main())
+    .expect("Main binary missing in settings");
+  let main_binary_path = settings.binary_path(main_binary);

-        #[cfg(windows)]
-        if windows::sign::verify(&path)? {
-          log::info!(
-            "sidecar at \"{}\" already signed. Skipping...",
-            path.display()
-          );
-          continue;
-        }
-
-        windows::sign::try_sign(&path, settings)?;
-      }
-    } else {
-      #[cfg(not(target_os = "windows"))]
-      log::warn!("Signing, by default, is only supported on Windows hosts, but you can specify a custom signing command in `bundler > windows > sign_command`, for now, skipping signing the installer...");
-    }
-  }
+  // We make a copy of the unsigned main_binary so that we can restore it after each package_type step.
+  // This allows us to patch the binary correctly and avoids two issues:
+  //  - modifying a signed binary without updating its PE checksum can break signature verification
+  //    - codesigning tools should handle calculating+updating this, we just need to ensure
+  //      (re)signing is performed after every `patch_binary()` operation
+  //  - signing an already-signed binary can result in multiple signatures, causing verification errors
+  // TODO: change this to work on a copy while preserving the main binary unchanged
+  let mut main_binary_copy = tempfile::tempfile()?;
+  let mut main_binary_orignal = std::fs::File::open(&main_binary_path)?;
+  std::io::copy(&mut main_binary_orignal, &mut main_binary_copy)?;

  let mut bundles = Vec::<Bundle>::new();
  for package_type in &package_types {
@@ -99,6 +146,15 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {
      continue;
    }

+    if let Err(e) = patch_binary(&main_binary_path, package_type) {
+      log::warn!("Failed to add bundler type to the binary: {e}. Updater plugin may not be able to update this package. This shouldn't normally happen, please report it to https://github.com/tauri-apps/tauri/issues");
+    }
+
+    // sign main binary for every package type after patch
+    if matches!(target_os, TargetPlatform::Windows) && settings.windows().can_sign() {
+      windows::sign::try_sign(&main_binary_path, settings)?;
+    }
+
    let bundle_paths = match package_type {
      #[cfg(target_os = "macos")]
      PackageType::MacOsBundle => macos::app::bundle_project(settings)?,
@@ -119,6 +175,7 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {

      #[cfg(target_os = "windows")]
      PackageType::WindowsMsi => windows::msi::bundle_project(settings, false)?,
+      // don't restrict to windows as NSIS installers can be built in linux+macOS using cargo-xwin
      PackageType::Nsis => windows::nsis::bundle_project(settings, false)?,

      #[cfg(target_os = "linux")]
@@ -137,6 +194,14 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {
      package_type: package_type.to_owned(),
      bundle_paths,
    });
+
+    // Restore unsigned and unpatched binary
+    let mut modified_main_binary = std::fs::OpenOptions::new()
+      .write(true)
+      .truncate(true)
+      .open(&main_binary_path)?;
+    main_binary_copy.seek(SeekFrom::Start(0))?;
+    std::io::copy(&mut main_binary_copy, &mut modified_main_binary)?;
  }

  if let Some(updater) = settings.updater() {
@@ -186,31 +251,30 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {
        .map(|b| b.bundle_paths)
      {
        for app_bundle_path in &app_bundle_paths {
+          use crate::error::ErrorExt;
+
          log::info!(action = "Cleaning"; "{}", app_bundle_path.display());
          match app_bundle_path.is_dir() {
            true => std::fs::remove_dir_all(app_bundle_path),
            false => std::fs::remove_file(app_bundle_path),
          }
-          .with_context(|| {
-            format!(
-              "Failed to clean the app bundle at {}",
-              app_bundle_path.display()
-            )
-          })?
+          .fs_context(
+            "failed to clean the app bundle",
+            app_bundle_path.to_path_buf(),
+          )?;
        }
      }
    }
  }

  if bundles.is_empty() {
-    return Err(anyhow::anyhow!("No bundles were built").into());
+    return Ok(bundles);
  }

-  let bundles_wo_updater = bundles
+  let finished_bundles = bundles
    .iter()
    .filter(|b| b.package_type != PackageType::Updater)
-    .collect::<Vec<_>>();
-  let finished_bundles = bundles_wo_updater.len();
+    .count();
  let pluralised = if finished_bundles == 1 {
    "bundle"
  } else {
@@ -235,6 +299,51 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {
  Ok(bundles)
 }

+fn sign_binaries_if_needed(settings: &Settings, target_os: &TargetPlatform) -> crate::Result<()> {
+  if matches!(target_os, TargetPlatform::Windows) {
+    if settings.windows().can_sign() {
+      if settings.no_sign() {
+        log::warn!("Skipping binary signing due to --no-sign flag.");
+        return Ok(());
+      }
+
+      for bin in settings.binaries() {
+        if bin.main() {
+          // we will sign the main binary after patching per "package type"
+          continue;
+        }
+        let bin_path = settings.binary_path(bin);
+        windows::sign::try_sign(&bin_path, settings)?;
+      }
+
+      // Sign the sidecar binaries
+      for bin in settings.external_binaries() {
+        let path = bin?;
+        let skip = std::env::var("TAURI_SKIP_SIDECAR_SIGNATURE_CHECK").is_ok_and(|v| v == "true");
+        if skip {
+          continue;
+        }
+
+        #[cfg(windows)]
+        if windows::sign::verify(&path)? {
+          log::info!(
+            "sidecar at \"{}\" already signed. Skipping...",
+            path.display()
+          );
+          continue;
+        }
+
+        windows::sign::try_sign(&path, settings)?;
+      }
+    } else {
+      #[cfg(not(target_os = "windows"))]
+      log::warn!("Signing, by default, is only supported on Windows hosts, but you can specify a custom signing command in `bundler > windows > sign_command`, for now, skipping signing the installer...");
+    }
+  }
+
+  Ok(())
+}
+
 /// Check to see if there are icons in the settings struct
 pub fn check_icons(settings: &Settings) -> crate::Result<bool> {
  // make a peekable iterator of the icon_files
--- a/crates/tauri-bundler/src/bundle/kmp/mod.rs
+++ b/crates/tauri-bundler/src/bundle/kmp/mod.rs
@@ -0,0 +1,59 @@
+// Copyright 2016-2019 Cargo-Bundle developers <https://github.com/burtonageo/cargo-bundle>
+// Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+// Knuth–Morris–Pratt algorithm
+// based on https://github.com/howeih/rust_kmp
+pub fn index_of(pattern: &[u8], target: &[u8]) -> Option<usize> {
+  let failure_function = find_failure_function(pattern);
+
+  let mut t_i: usize = 0;
+  let mut p_i: usize = 0;
+  let target_len = target.len();
+  let mut result_idx = None;
+  let pattern_len = pattern.len();
+
+  while (t_i < target_len) && (p_i < pattern_len) {
+    if target[t_i] == pattern[p_i] {
+      if result_idx.is_none() {
+        result_idx.replace(t_i);
+      }
+      t_i += 1;
+      p_i += 1;
+      if p_i >= pattern_len {
+        return result_idx;
+      }
+    } else {
+      if p_i == 0 {
+        p_i = 0;
+        t_i += 1;
+      } else {
+        p_i = failure_function[p_i - 1];
+      }
+      result_idx = None;
+    }
+  }
+  None
+}
+
+fn find_failure_function(pattern: &[u8]) -> Vec<usize> {
+  let mut i = 1;
+  let mut j = 0;
+  let pattern_length = pattern.len();
+  let end_i = pattern_length - 1;
+  let mut failure_function = vec![0usize; pattern_length];
+  while i <= end_i {
+    if pattern[i] == pattern[j] {
+      failure_function[i] = j + 1;
+      i += 1;
+      j += 1;
+    } else if j == 0 {
+      failure_function[i] = 0;
+      i += 1;
+    } else {
+      j = failure_function[j - 1];
+    }
+  }
+  failure_function
+}
--- a/crates/tauri-bundler/src/bundle/linux/appimage/linuxdeploy-plugin-gstreamer.sh
+++ b/crates/tauri-bundler/src/bundle/linux/appimage/linuxdeploy-plugin-gstreamer.sh
@@ -0,0 +1,165 @@
+#! /bin/bash
+
+# abort on all errors
+set -e
+
+if [ "$DEBUG" != "" ]; then
+    set -x
+fi
+
+script=$(readlink -f "$0")
+
+show_usage() {
+    echo "Usage: $script --appdir <path to AppDir>"
+    echo
+    echo "Bundles GStreamer plugins into an AppDir"
+    echo
+    echo "Required variables:"
+    echo "  LINUXDEPLOY=\".../linuxdeploy\" path to linuxdeploy (e.g., AppImage); set automatically when plugin is run directly by linuxdeploy"
+    echo
+    echo "Optional variables:"
+    echo "  GSTREAMER_INCLUDE_BAD_PLUGINS=\"1\" (default: disabled; set to empty string or unset to disable)"
+    echo "  GSTREAMER_PLUGINS_DIR=\"...\" (directory containing GStreamer plugins; default: guessed based on main distro architecture)"
+    echo "  GSTREAMER_HELPERS_DIR=\"...\" (directory containing GStreamer helper tools like gst-plugin-scanner; default: guessed based on main distro architecture)"
+    echo "  GSTREAMER_VERSION=\"1.0\" (default: 1.0)"
+}
+
+while [ "$1" != "" ]; do
+    case "$1" in
+        --plugin-api-version)
+            echo "0"
+            exit 0
+            ;;
+        --appdir)
+            APPDIR="$2"
+            shift
+            shift
+            ;;
+        --help)
+            show_usage
+            exit 0
+            ;;
+        *)
+            echo "Invalid argument: $1"
+            echo
+            show_usage
+            exit 1
+            ;;
+    esac
+done
+
+if [ "$APPDIR" == "" ]; then
+    show_usage
+    exit 1
+fi
+
+if ! which patchelf &>/dev/null && ! type patchelf &>/dev/null; then
+    echo "Error: patchelf not found"
+    echo
+    show_usage
+    exit 2
+fi
+
+if [[ "$LINUXDEPLOY" == "" ]]; then
+    echo "Error: \$LINUXDEPLOY not set"
+    echo
+    show_usage
+    exit 3
+fi
+
+mkdir -p "$APPDIR"
+
+export GSTREAMER_VERSION="${GSTREAMER_VERSION:-1.0}"
+
+plugins_target_dir="$APPDIR"/usr/lib/gstreamer-"$GSTREAMER_VERSION"
+helpers_target_dir="$APPDIR"/usr/lib/gstreamer"$GSTREAMER_VERSION"/gstreamer-"$GSTREAMER_VERSION"
+
+if [ "$GSTREAMER_PLUGINS_DIR" != "" ]; then
+    plugins_dir="${GSTREAMER_PLUGINS_DIR}"
+elif [ -d /usr/lib/"$(uname -m)"-linux-gnu/gstreamer-"$GSTREAMER_VERSION" ]; then
+    plugins_dir=/usr/lib/$(uname -m)-linux-gnu/gstreamer-"$GSTREAMER_VERSION"
+else
+    plugins_dir=/usr/lib/gstreamer-"$GSTREAMER_VERSION"
+fi
+
+if [ "$GSTREAMER_HELPERS_DIR" != "" ]; then
+    helpers_dir="${GSTREAMER_HELPERS_DIR}"
+else
+    helpers_dir=/usr/lib/$(uname -m)-linux-gnu/gstreamer"$GSTREAMER_VERSION"/gstreamer-"$GSTREAMER_VERSION"
+fi
+
+if [ ! -d "$plugins_dir" ]; then
+    echo "Error: could not find plugins directory: $plugins_dir"
+    exit 1
+fi
+
+mkdir -p "$plugins_target_dir"
+
+echo "Copying plugins into $plugins_target_dir"
+for i in "$plugins_dir"/*; do
+    [ -d "$i" ] && continue
+    [ ! -f "$i" ] && echo "File does not exist: $i" && continue
+
+    echo "Copying plugin: $i"
+    cp "$i" "$plugins_target_dir"
+done
+
+"$LINUXDEPLOY" --appdir "$APPDIR"
+
+for i in "$plugins_target_dir"/*; do
+    [ -d "$i" ] && continue
+    [ ! -f "$i" ] && echo "File does not exist: $i" && continue
+    (file "$i" | grep -v ELF --silent) && echo "Ignoring non ELF file: $i" && continue
+
+    echo "Manually setting rpath for $i"
+    patchelf --set-rpath '$ORIGIN/..:$ORIGIN' "$i"
+done
+
+mkdir -p "$helpers_target_dir"
+
+echo "Copying helpers in $helpers_target_dir"
+for i in "$helpers_dir"/*; do
+    [ -d "$i" ] && continue
+    [ ! -f "$i" ] && echo "File does not exist: $i" && continue
+
+    echo "Copying helper: $i"
+    cp "$i" "$helpers_target_dir"
+done
+
+for i in "$helpers_target_dir"/*; do
+    [ -d "$i" ] && continue
+    [ ! -f "$i" ] && echo "File does not exist: $i" && continue
+    (file "$i" | grep -v ELF --silent) && echo "Ignoring non ELF file: $i" && continue
+
+    echo "Manually setting rpath for $i"
+    patchelf --set-rpath '$ORIGIN/../..' "$i"
+done
+
+echo "Installing AppRun hook"
+mkdir -p "$APPDIR"/apprun-hooks
+
+if [ "$GSTREAMER_VERSION" == "1.0" ]; then
+    cat > "$APPDIR"/apprun-hooks/linuxdeploy-plugin-gstreamer.sh <<\EOF
+#! /bin/bash
+
+export GST_REGISTRY_REUSE_PLUGIN_SCANNER="no"
+export GST_PLUGIN_SYSTEM_PATH_1_0="${APPDIR}/usr/lib/gstreamer-1.0"
+export GST_PLUGIN_PATH_1_0="${APPDIR}/usr/lib/gstreamer-1.0"
+
+export GST_PLUGIN_SCANNER_1_0="${APPDIR}/usr/lib/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner"
+export GST_PTP_HELPER_1_0="${APPDIR}/usr/lib/gstreamer1.0/gstreamer-1.0/gst-ptp-helper"
+EOF
+elif [ "$GSTREAMER_VERSION" == "0.10" ]; then
+    cat > "$APPDIR"/apprun-hooks/linuxdeploy-plugin-gstreamer.sh <<\EOF
+#! /bin/bash
+
+export GST_REGISTRY_REUSE_PLUGIN_SCANNER="no"
+export GST_PLUGIN_SYSTEM_PATH_0_10="${APPDIR}/usr/lib/gstreamer-1.0"
+
+export GST_PLUGIN_SCANNER_0_10="${APPDIR}/usr/lib/gstreamer1.0/gstreamer-1.0/gst-plugin-scanner"
+export GST_PTP_HELPER_0_10="${APPDIR}/usr/lib/gstreamer1.0/gstreamer-1.0/gst-ptp-helper"
+EOF
+else
+    echo "Warning: unknown GStreamer version: $GSTREAMER_VERSION, cannot install AppRun hook"
+fi
+
--- a/crates/tauri-bundler/src/bundle/linux/appimage/linuxdeploy-plugin-gtk.sh
+++ b/crates/tauri-bundler/src/bundle/linux/appimage/linuxdeploy-plugin-gtk.sh
@@ -0,0 +1,327 @@
+#! /usr/bin/env bash
+
+# GTK3 environment variables: https://docs.gtk.org/gtk3/running.html
+# GTK4 environment variables: https://docs.gtk.org/gtk4/running.html
+
+# abort on all errors
+set -e
+
+if [ "$DEBUG" != "" ]; then
+    set -x
+    verbose="--verbose"
+fi
+
+script=$(readlink -f "$0")
+
+show_usage() {
+    echo "Usage: $script --appdir <path to AppDir>"
+    echo
+    echo "Bundles resources for applications that use GTK into an AppDir"
+    echo
+    echo "Required variables:"
+    echo "  LINUXDEPLOY=\".../linuxdeploy\" path to linuxdeploy (e.g., AppImage); set automatically when plugin is run directly by linuxdeploy"
+    #echo
+    #echo "Optional variables:"
+    #echo "  DEPLOY_GTK_VERSION (major version of GTK to deploy, e.g. '2', '3' or '4'; auto-detect by default)"
+}
+
+variable_is_true() {
+    local var="$1"
+
+    if [ -n "$var" ] && { [ "$var" == "true" ] || [ "$var" -gt 0 ]; } 2> /dev/null; then
+        return 0 # true
+    else
+        return 1 # false
+    fi
+}
+
+get_pkgconf_variable() {
+    local variable="$1"
+    local library="$2"
+    local default_path="$3"
+
+    path="$("$PKG_CONFIG" --variable="$variable" "$library")"
+    if [ -n "$path" ]; then
+        echo "$path"
+    elif [ -n "$default_path" ]; then
+        echo "$default_path"
+    else
+        echo "$0: there is no '$variable' variable for '$library' library." > /dev/stderr
+        echo "Please check the '$library.pc' file is present in \$PKG_CONFIG_PATH (you may need to install the appropriate -dev/-devel package)." > /dev/stderr
+        exit 1
+    fi
+}
+
+copy_tree() {
+    local src=("${@:1:$#-1}")
+    local dst="${*:$#}"
+
+    for elem in "${src[@]}"; do
+        mkdir -p "${dst::-1}$elem"
+        cp "$elem" --archive --parents --target-directory="$dst" $verbose
+    done
+}
+
+search_tool() {
+    local tool="$1"
+    local directory="$2"
+
+    if command -v "$tool"; then
+        return 0
+    fi
+
+    PATH_ARRAY=(
+        "/usr/lib/$(uname -m)-linux-gnu/$directory/$tool"
+        "/usr/lib/$directory/$tool"
+        "/usr/bin/$tool"
+        "/usr/bin/$tool-64"
+        "/usr/bin/$tool-32"
+    )
+
+    for path in "${PATH_ARRAY[@]}"; do
+        if [ -x "$path" ]; then
+            echo "$path"
+            return 0
+        fi
+    done
+}
+
+#DEPLOY_GTK_VERSION="${DEPLOY_GTK_VERSION:-0}" # When not set by user, this variable use the integer '0' as a sentinel value
+DEPLOY_GTK_VERSION=3 # Force GTK3 for tauri apps
+APPDIR=
+
+while [ "$1" != "" ]; do
+    case "$1" in
+        --plugin-api-version)
+            echo "0"
+            exit 0
+            ;;
+        --appdir)
+            APPDIR="$2"
+            shift
+            shift
+            ;;
+        --help)
+            show_usage
+            exit 0
+            ;;
+        *)
+            echo "Invalid argument: $1"
+            echo
+            show_usage
+            exit 1
+            ;;
+    esac
+done
+
+if [ "$APPDIR" == "" ]; then
+    show_usage
+    exit 1
+fi
+
+mkdir -p "$APPDIR"
+# make lib64 writable again.
+chmod +w "$APPDIR"/usr/lib64 || true
+
+if command -v pkgconf > /dev/null; then
+    PKG_CONFIG="pkgconf"
+elif command -v pkg-config > /dev/null; then
+    PKG_CONFIG="pkg-config"
+else
+    echo "$0: pkg-config/pkgconf not found in PATH, aborting"
+    exit 1
+fi
+
+if ! command -v find &>/dev/null && ! type find &>/dev/null; then
+    echo -e "$0: find not found.\nInstall findutils then re-run the plugin."
+    exit 1
+fi
+
+if [ -z "$LINUXDEPLOY" ]; then
+    echo -e "$0: LINUXDEPLOY environment variable is not set.\nDownload a suitable linuxdeploy AppImage, set the environment variable and re-run the plugin."
+    exit 1
+fi
+
+gtk_versions=0 # Count major versions of GTK when auto-detect GTK version
+if [ "$DEPLOY_GTK_VERSION" -eq 0 ]; then
+    echo "Determining which GTK version to deploy"
+    while IFS= read -r -d '' file; do
+        if [ "$DEPLOY_GTK_VERSION" -ne 2 ] && ldd "$file" | grep -q "libgtk-x11-2.0.so"; then
+            DEPLOY_GTK_VERSION=2
+            gtk_versions="$((gtk_versions+1))"
+        fi
+        if [ "$DEPLOY_GTK_VERSION" -ne 3 ] && ldd "$file" | grep -q "libgtk-3.so"; then
+            DEPLOY_GTK_VERSION=3
+            gtk_versions="$((gtk_versions+1))"
+        fi
+        if [ "$DEPLOY_GTK_VERSION" -ne 4 ] && ldd "$file" | grep -q "libgtk-4.so"; then
+            DEPLOY_GTK_VERSION=4
+            gtk_versions="$((gtk_versions+1))"
+        fi
+    done < <(find "$APPDIR/usr/bin" -executable -type f -print0)
+fi
+
+if [ "$gtk_versions" -gt 1 ]; then
+    echo "$0: can not deploy multiple GTK versions at the same time."
+    echo "Please set DEPLOY_GTK_VERSION to {2, 3, 4}."
+    exit 1
+elif [ "$DEPLOY_GTK_VERSION" -eq 0 ]; then
+    echo "$0: failed to auto-detect GTK version."
+    echo "Please set DEPLOY_GTK_VERSION to {2, 3, 4}."
+    exit 1
+fi
+
+echo "Installing AppRun hook"
+HOOKSDIR="$APPDIR/apprun-hooks"
+HOOKFILE="$HOOKSDIR/linuxdeploy-plugin-gtk.sh"
+mkdir -p "$HOOKSDIR"
+cat > "$HOOKFILE" <<\EOF
+#! /usr/bin/env bash
+
+gsettings get org.gnome.desktop.interface gtk-theme 2> /dev/null | grep -qi "dark" && GTK_THEME_VARIANT="dark" || GTK_THEME_VARIANT="light"
+APPIMAGE_GTK_THEME="${APPIMAGE_GTK_THEME:-"Adwaita:$GTK_THEME_VARIANT"}" # Allow user to override theme (discouraged)
+
+export APPDIR="${APPDIR:-"$(dirname "$(realpath "$0")")"}" # Workaround to run extracted AppImage
+export GTK_DATA_PREFIX="$APPDIR"
+export GTK_THEME="$APPIMAGE_GTK_THEME" # Custom themes are broken
+export GDK_BACKEND=x11 # Crash with Wayland backend on Wayland - We tested it without it and ended up with this: https://github.com/tauri-apps/tauri/issues/8541
+export XDG_DATA_DIRS="$APPDIR/usr/share:/usr/share:$XDG_DATA_DIRS" # g_get_system_data_dirs() from GLib
+EOF
+
+echo "Installing GLib schemas"
+# Note: schemasdir is undefined on Ubuntu 16.04
+glib_schemasdir="$(get_pkgconf_variable "schemasdir" "gio-2.0" "/usr/share/glib-2.0/schemas")"
+copy_tree "$glib_schemasdir" "$APPDIR/"
+glib-compile-schemas "$APPDIR/$glib_schemasdir"
+cat >> "$HOOKFILE" <<EOF
+export GSETTINGS_SCHEMA_DIR="\$APPDIR/$glib_schemasdir"
+EOF
+
+case "$DEPLOY_GTK_VERSION" in
+    2)
+        # https://github.com/linuxdeploy/linuxdeploy-plugin-gtk/pull/20#issuecomment-826354261
+        echo "WARNING: Gtk+2 applications are not fully supported by this plugin"
+        ;;
+    3)
+        echo "Installing GTK 3.0 modules"
+        gtk3_exec_prefix="$(get_pkgconf_variable "exec_prefix" "gtk+-3.0")"
+        gtk3_libdir="$(get_pkgconf_variable "libdir" "gtk+-3.0")/gtk-3.0"
+        #gtk3_path="$gtk3_libdir/modules" export GTK_PATH="\$APPDIR/$gtk3_path"
+        gtk3_immodulesdir="$gtk3_libdir/$(get_pkgconf_variable "gtk_binary_version" "gtk+-3.0")/immodules"
+        gtk3_printbackendsdir="$gtk3_libdir/$(get_pkgconf_variable "gtk_binary_version" "gtk+-3.0")/printbackends"
+        gtk3_immodules_cache_file="$(dirname "$gtk3_immodulesdir")/immodules.cache"
+        gtk3_immodules_query="$(search_tool "gtk-query-immodules-3.0" "libgtk-3-0")"
+        copy_tree "$gtk3_libdir" "$APPDIR/"
+        cat >> "$HOOKFILE" <<EOF
+export GTK_EXE_PREFIX="\$APPDIR/$gtk3_exec_prefix"
+export GTK_PATH="\$APPDIR/$gtk3_libdir:/usr/lib64/gtk-3.0:/usr/lib/x86_64-linux-gnu/gtk-3.0"
+export GTK_IM_MODULE_FILE="\$APPDIR/$gtk3_immodules_cache_file"
+
+EOF
+        if [ -x "$gtk3_immodules_query" ]; then
+            echo "Updating immodules cache in $APPDIR/$gtk3_immodules_cache_file"
+            "$gtk3_immodules_query" > "$APPDIR/$gtk3_immodules_cache_file"
+        else
+            echo "WARNING: gtk-query-immodules-3.0 not found"
+        fi
+        if [ ! -f "$APPDIR/$gtk3_immodules_cache_file" ]; then
+            echo "WARNING: immodules.cache file is missing"
+        fi
+        sed -i "s|$gtk3_libdir/3.0.0/immodules/||g" "$APPDIR/$gtk3_immodules_cache_file"
+        ;;
+    4)
+        echo "Installing GTK 4.0 modules"
+        gtk4_exec_prefix="$(get_pkgconf_variable "exec_prefix" "gtk4" "/usr")"
+        gtk4_libdir="$(get_pkgconf_variable "libdir" "gtk4")/gtk-4.0"
+        gtk4_path="$gtk4_libdir/modules"
+        copy_tree "$gtk4_libdir" "$APPDIR/"
+        cat >> "$HOOKFILE" <<EOF
+export GTK_EXE_PREFIX="\$APPDIR/$gtk4_exec_prefix"
+export GTK_PATH="\$APPDIR/$gtk4_path"
+EOF
+        ;;
+    *)
+        echo "$0: '$DEPLOY_GTK_VERSION' is not a valid GTK major version."
+        echo "Please set DEPLOY_GTK_VERSION to {2, 3, 4}."
+        exit 1
+esac
+
+echo "Installing GDK PixBufs"
+gdk_libdir="$(get_pkgconf_variable "libdir" "gdk-pixbuf-2.0")"
+gdk_pixbuf_binarydir="$(get_pkgconf_variable "gdk_pixbuf_binarydir" "gdk-pixbuf-2.0")"
+gdk_pixbuf_cache_file="$(get_pkgconf_variable "gdk_pixbuf_cache_file" "gdk-pixbuf-2.0")"
+gdk_pixbuf_moduledir="$(get_pkgconf_variable "gdk_pixbuf_moduledir" "gdk-pixbuf-2.0")"
+# Note: gdk_pixbuf_query_loaders variable is not defined on some systems
+gdk_pixbuf_query="$(search_tool "gdk-pixbuf-query-loaders" "gdk-pixbuf-2.0")"
+copy_tree "$gdk_pixbuf_binarydir" "$APPDIR/"
+cat >> "$HOOKFILE" <<EOF
+export GDK_PIXBUF_MODULE_FILE="\$APPDIR/$gdk_pixbuf_cache_file"
+EOF
+if [ -x "$gdk_pixbuf_query" ]; then
+    echo "Updating pixbuf cache in $APPDIR/$gdk_pixbuf_cache_file"
+    "$gdk_pixbuf_query" > "$APPDIR/$gdk_pixbuf_cache_file"
+else
+    echo "WARNING: gdk-pixbuf-query-loaders not found"
+fi
+if [ ! -f "$APPDIR/$gdk_pixbuf_cache_file" ]; then
+    echo "WARNING: loaders.cache file is missing"
+fi
+sed -i "s|$gdk_pixbuf_moduledir/||g" "$APPDIR/$gdk_pixbuf_cache_file"
+
+echo "Copying more libraries"
+gobject_libdir="$(get_pkgconf_variable "libdir" "gobject-2.0")"
+gio_libdir="$(get_pkgconf_variable "libdir" "gio-2.0")"
+librsvg_libdir="$(get_pkgconf_variable "libdir" "librsvg-2.0")"
+pango_libdir="$(get_pkgconf_variable "libdir" "pango")"
+pangocairo_libdir="$(get_pkgconf_variable "libdir" "pangocairo")"
+pangoft2_libdir="$(get_pkgconf_variable "libdir" "pangoft2")"
+FIND_ARRAY=(
+    "$gdk_libdir"     "libgdk_pixbuf-*.so*"
+    "$gobject_libdir" "libgobject-*.so*"
+    "$gio_libdir"     "libgio-*.so*"
+    "$librsvg_libdir" "librsvg-*.so*"
+    "$pango_libdir"      "libpango-*.so*"
+    "$pangocairo_libdir" "libpangocairo-*.so*"
+    "$pangoft2_libdir"   "libpangoft2-*.so*"
+)
+LIBRARIES=()
+for (( i=0; i<${#FIND_ARRAY[@]}; i+=2 )); do
+    directory=${FIND_ARRAY[i]}
+    library=${FIND_ARRAY[i+1]}
+    while IFS= read -r -d '' file; do
+        LIBRARIES+=( "--library=$file" )
+    done < <(find "$directory" \( -type l -o -type f \) -name "$library" -print0)
+done
+
+env LINUXDEPLOY_PLUGIN_MODE=1 "$LINUXDEPLOY" --appdir="$APPDIR" "${LIBRARIES[@]}"
+
+# Create symbolic links as a workaround
+# Details: https://github.com/linuxdeploy/linuxdeploy-plugin-gtk/issues/24#issuecomment-1030026529
+echo "Manually setting rpath for GTK modules"
+PATCH_ARRAY=(
+    "$gtk3_immodulesdir"
+    "$gtk3_printbackendsdir"
+    "$gdk_pixbuf_moduledir"
+)
+for directory in "${PATCH_ARRAY[@]}"; do
+    while IFS= read -r -d '' file; do
+        ln $verbose -s "${file/\/usr\/lib\//}" "$APPDIR/usr/lib"
+    done < <(find "$directory" -name '*.so' -print0)
+done
+
+# set write permission on lib64 again to make it deletable.
+chmod +w "$APPDIR"/usr/lib64 || true
+
+# We have to copy the files first to not get permission errors when we assign gio_extras_dir
+find /usr/lib* -name libgiognutls.so -exec mkdir -p "$APPDIR"/"$(dirname '{}')" \; -exec cp --parents '{}' "$APPDIR/" \; || true
+# related files that we seemingly don't need:
+# libgiolibproxy.so - libgiognomeproxy.so - glib-pacrunner
+
+gio_extras_dir=$(find "$APPDIR"/usr/lib* -name libgiognutls.so -exec dirname '{}' \; 2>/dev/null)
+cat >> "$HOOKFILE" <<EOF
+export GIO_EXTRA_MODULES="\$APPDIR/${gio_extras_dir#"$APPDIR"/}"
+EOF
+
+#binary patch absolute paths in libwebkit files
+find "$APPDIR"/usr/lib* -name 'libwebkit*' -exec sed -i -e "s|/usr|././|g" '{}' \;
+
--- a/crates/tauri-bundler/src/bundle/linux/appimage/linuxdeploy.rs
+++ b/crates/tauri-bundler/src/bundle/linux/appimage/linuxdeploy.rs
@@ -3,13 +3,13 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-License-Identifier: MIT

-use super::debian;
+use super::{super::debian, write_and_make_executable};
 use crate::{
  bundle::settings::Arch,
+  error::{Context, ErrorExt},
  utils::{fs_utils, http_utils::download, CommandExt},
  Settings,
 };
-use anyhow::Context;
 use std::{
  fs,
  path::{Path, PathBuf},
@@ -27,13 +27,17 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
    Arch::Armhf => "armhf",
    target => {
      return Err(crate::Error::ArchError(format!(
-        "Unsupported architecture: {:?}",
-        target
+        "Unsupported architecture: {target:?}"
      )));
    }
  };

-  let tools_arch = settings.target().split('-').next().unwrap();
+  let tools_arch = if settings.binary_arch() == Arch::Armhf {
+    "armhf"
+  } else {
+    settings.target().split('-').next().unwrap()
+  };
+
  let output_path = settings.project_out_directory().join("bundle/appimage");
  if output_path.exists() {
    fs::remove_dir_all(&output_path)?;
@@ -48,7 +52,11 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {

  fs::create_dir_all(&tools_path)?;

-  let linuxdeploy_path = prepare_tools(&tools_path, tools_arch)?;
+  let linuxdeploy_path = prepare_tools(
+    &tools_path,
+    tools_arch,
+    settings.log_level() != log::Level::Error,
+  )?;

  let package_dir = settings.project_out_directory().join("bundle/appimage_deb");

@@ -116,13 +124,13 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
  // xdg-open will be handled by the `files` config instead
  if settings.deep_link_protocols().is_some() && !app_dir_usr_bin.join("xdg-open").exists() {
    fs::copy("/usr/bin/xdg-mime", app_dir_usr_bin.join("xdg-mime"))
-      .context("xdg-mime binary not found")?;
+      .fs_context("xdg-mime binary not found", "/usr/bin/xdg-mime".to_string())?;
  }

  // we also check if the user may have provided their own copy already
  if settings.appimage().bundle_xdg_open && !app_dir_usr_bin.join("xdg-open").exists() {
    fs::copy("/usr/bin/xdg-open", app_dir_usr_bin.join("xdg-open"))
-      .context("xdg-open binary not found")?;
+      .fs_context("xdg-open binary not found", "/usr/bin/xdg-open".to_string())?;
  }

  let search_dirs = [
@@ -181,6 +189,9 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {

  let mut cmd = Command::new(linuxdeploy_path);
  cmd.env("OUTPUT", &appimage_path);
+  cmd.env("ARCH", tools_arch);
+  // Looks like the cli arg isn't enough for the updated AppImage output-plugin.
+  cmd.env("APPIMAGE_EXTRACT_AND_RUN", "1");
  cmd.args([
    "--appimage-extract-and-run",
    "--verbosity",
@@ -212,16 +223,16 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
 }

 // returns the linuxdeploy path to keep linuxdeploy_arch contained
-fn prepare_tools(tools_path: &Path, arch: &str) -> crate::Result<PathBuf> {
+fn prepare_tools(tools_path: &Path, arch: &str, verbose: bool) -> crate::Result<PathBuf> {
  let apprun = tools_path.join(format!("AppRun-{arch}"));
  if !apprun.exists() {
    let data = download(&format!(
-      "https://github.com/AppImage/AppImageKit/releases/download/continuous/AppRun-{arch}"
+      "https://github.com/tauri-apps/binary-releases/releases/download/apprun-old/AppRun-{arch}"
    ))?;
    write_and_make_executable(&apprun, data)?;
  }

-  let linuxdeploy_arch = if arch == "i686" { "i383" } else { arch };
+  let linuxdeploy_arch = if arch == "i686" { "i386" } else { arch };
  let linuxdeploy = tools_path.join(format!("linuxdeploy-{linuxdeploy_arch}.AppImage"));
  if !linuxdeploy.exists() {
    let data = download(&format!("https://github.com/tauri-apps/binary-releases/releases/download/linuxdeploy/linuxdeploy-{linuxdeploy_arch}.AppImage"))?;
@@ -240,6 +251,21 @@ fn prepare_tools(tools_path: &Path, arch: &str) -> crate::Result<PathBuf> {
    write_and_make_executable(&gstreamer, data)?;
  }

+  let appimage = tools_path.join("linuxdeploy-plugin-appimage.AppImage");
+  if !appimage.exists() {
+    // This is optional, linuxdeploy will fall back to its built-in version if the download failed.
+    let data = download(&format!("https://github.com/linuxdeploy/linuxdeploy-plugin-appimage/releases/download/continuous/linuxdeploy-plugin-appimage-{arch}.AppImage"));
+    match data {
+      Ok(data) => write_and_make_executable(&appimage, data)?,
+      Err(err) => {
+        log::error!("Download of AppImage plugin failed. Using older built-in version instead.");
+        if verbose {
+          log::debug!("{err:?}");
+        }
+      }
+    }
+  }
+
  // This should prevent linuxdeploy to be detected by appimage integration tools
  let _ = Command::new("dd")
    .args([
@@ -254,12 +280,3 @@ fn prepare_tools(tools_path: &Path, arch: &str) -> crate::Result<PathBuf> {

  Ok(linuxdeploy)
 }
-
-fn write_and_make_executable(path: &Path, data: Vec<u8>) -> std::io::Result<()> {
-  use std::os::unix::fs::PermissionsExt;
-
-  fs::write(path, data)?;
-  fs::set_permissions(path, fs::Permissions::from_mode(0o770))?;
-
-  Ok(())
-}
--- a/crates/tauri-bundler/src/bundle/linux/appimage/mod.rs
+++ b/crates/tauri-bundler/src/bundle/linux/appimage/mod.rs
@@ -0,0 +1,25 @@
+// Copyright 2019-2024 Tauri Programme within The Commons Conservancy
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT
+
+use std::{
+  fs,
+  path::{Path, PathBuf},
+};
+
+use crate::Settings;
+
+mod linuxdeploy;
+
+pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
+  linuxdeploy::bundle_project(settings)
+}
+
+fn write_and_make_executable(path: &Path, data: Vec<u8>) -> std::io::Result<()> {
+  use std::os::unix::fs::PermissionsExt;
+
+  fs::write(path, data)?;
+  fs::set_permissions(path, fs::Permissions::from_mode(0o770))?;
+
+  Ok(())
+}
--- a/crates/tauri-bundler/src/bundle/linux/debian.rs
+++ b/crates/tauri-bundler/src/bundle/linux/debian.rs
@@ -24,8 +24,12 @@
 // generate postinst or prerm files.

 use super::freedesktop;
-use crate::{bundle::settings::Arch, utils::fs_utils, Settings};
-use anyhow::Context;
+use crate::{
+  bundle::settings::Arch,
+  error::{Context, ErrorExt},
+  utils::fs_utils,
+  Settings,
+};
 use flate2::{write::GzEncoder, Compression};
 use tar::HeaderMode;
 use walkdir::WalkDir;
@@ -49,8 +53,7 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
    Arch::Riscv64 => "riscv64",
    target => {
      return Err(crate::Error::ArchError(format!(
-        "Unsupported architecture: {:?}",
-        target
+        "Unsupported architecture: {target:?}"
      )));
    }
  };
@@ -65,30 +68,32 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
  let base_dir = settings.project_out_directory().join("bundle/deb");
  let package_dir = base_dir.join(&package_base_name);
  if package_dir.exists() {
-    fs::remove_dir_all(&package_dir)
-      .with_context(|| format!("Failed to remove old {package_base_name}"))?;
+    fs::remove_dir_all(&package_dir).fs_context(
+      "Failed to Remove old package directory",
+      package_dir.clone(),
+    )?;
  }
  let package_path = base_dir.join(&package_name);

  log::info!(action = "Bundling"; "{} ({})", package_name, package_path.display());

-  let (data_dir, _) = generate_data(settings, &package_dir)
-    .with_context(|| "Failed to build data folders and files")?;
+  let (data_dir, _) =
+    generate_data(settings, &package_dir).context("Failed to build data folders and files")?;
  fs_utils::copy_custom_files(&settings.deb().files, &data_dir)
-    .with_context(|| "Failed to copy custom files")?;
+    .context("Failed to copy custom files")?;

  // Generate control files.
  let control_dir = package_dir.join("control");
  generate_control_file(settings, arch, &control_dir, &data_dir)
-    .with_context(|| "Failed to create control file")?;
-  generate_scripts(settings, &control_dir).with_context(|| "Failed to create control scripts")?;
-  generate_md5sums(&control_dir, &data_dir).with_context(|| "Failed to create md5sums file")?;
+    .context("Failed to create control file")?;
+  generate_scripts(settings, &control_dir).context("Failed to create control scripts")?;
+  generate_md5sums(&control_dir, &data_dir).context("Failed to create md5sums file")?;

  // Generate `debian-binary` file; see
  // http://www.tldp.org/HOWTO/Debian-Binary-Package-Building-HOWTO/x60.html#AEN66
  let debian_binary_path = package_dir.join("debian-binary");
  create_file_with_data(&debian_binary_path, "2.0\n")
-    .with_context(|| "Failed to create debian-binary file")?;
+    .context("Failed to create debian-binary file")?;

  // Apply tar/gzip/ar to create the final package file.
  let control_tar_gz_path =
@@ -114,8 +119,9 @@ pub fn generate_data(

  for bin in settings.binaries() {
    let bin_path = settings.binary_path(bin);
-    fs_utils::copy_file(&bin_path, &bin_dir.join(bin.name()))
-      .with_context(|| format!("Failed to copy binary from {bin_path:?}"))?;
+    let trgt = bin_dir.join(bin.name());
+    fs_utils::copy_file(&bin_path, &trgt)
+      .with_context(|| format!("Failed to copy binary from {bin_path:?} to {trgt:?}"))?;
  }

  copy_resource_files(settings, &data_dir).with_context(|| "Failed to copy resource files")?;
@@ -164,7 +170,7 @@ fn generate_control_file(
  let dest_path = control_dir.join("control");
  let mut file = fs_utils::create_file(&dest_path)?;
  let package = heck::AsKebabCase(settings.product_name());
-  writeln!(file, "Package: {}", package)?;
+  writeln!(file, "Package: {package}")?;
  writeln!(file, "Version: {}", settings.version_string())?;
  writeln!(file, "Architecture: {arch}")?;
  // Installed-Size must be divided by 1024, see https://www.debian.org/doc/debian-policy/ch-controlfields.html#installed-size
@@ -183,16 +189,16 @@ fn generate_control_file(

  writeln!(file, "Maintainer: {authors}")?;
  if let Some(section) = &settings.deb().section {
-    writeln!(file, "Section: {}", section)?;
+    writeln!(file, "Section: {section}")?;
  }
  if let Some(priority) = &settings.deb().priority {
-    writeln!(file, "Priority: {}", priority)?;
+    writeln!(file, "Priority: {priority}")?;
  } else {
    writeln!(file, "Priority: optional")?;
  }

  if let Some(homepage) = settings.homepage_url() {
-    writeln!(file, "Homepage: {}", homepage)?;
+    writeln!(file, "Homepage: {homepage}")?;
  }

  let dependencies = settings.deb().depends.as_ref().cloned().unwrap_or_default();
@@ -305,7 +311,7 @@ fn generate_md5sums(control_dir: &Path, data_dir: &Path) -> crate::Result<()> {
    let mut file = File::open(path)?;
    let mut hash = md5::Context::new();
    io::copy(&mut file, &mut hash)?;
-    for byte in hash.compute().iter() {
+    for byte in hash.finalize().iter() {
      write!(md5sums_file, "{byte:02x}")?;
    }
    let rel_path = path.strip_prefix(data_dir)?;
--- a/crates/tauri-bundler/src/bundle/linux/freedesktop/main.desktop
+++ b/crates/tauri-bundler/src/bundle/linux/freedesktop/main.desktop
@@ -4,6 +4,7 @@ Categories={{categories}}
 Comment={{comment}}
 {{/if}}
 Exec={{exec}}
+StartupWMClass={{exec}}
 Icon={{icon}}
 Name={{name}}
 Terminal=false
--- a/crates/tauri-bundler/src/bundle/linux/freedesktop/mod.rs
+++ b/crates/tauri-bundler/src/bundle/linux/freedesktop/mod.rs
@@ -21,12 +21,12 @@ use std::fs::{read_to_string, File};
 use std::io::BufReader;
 use std::path::{Path, PathBuf};

-use anyhow::Context;
 use handlebars::Handlebars;
 use image::{self, codecs::png::PngDecoder, ImageDecoder};
 use serde::Serialize;

 use crate::{
+  error::Context,
  utils::{self, fs_utils},
  Settings,
 };
@@ -114,11 +114,13 @@ pub fn generate_desktop_file(
  if let Some(template) = custom_template_path {
    handlebars
      .register_template_string("main.desktop", read_to_string(template)?)
-      .with_context(|| "Failed to setup custom handlebar template")?;
+      .map_err(Into::into)
+      .context("Failed to setup custom handlebar template")?;
  } else {
    handlebars
      .register_template_string("main.desktop", include_str!("./main.desktop"))
-      .with_context(|| "Failed to setup default handlebar template")?;
+      .map_err(Into::into)
+      .context("Failed to setup default handlebar template")?;
  }

  #[derive(Serialize)]
--- a/crates/tauri-bundler/src/bundle/linux/rpm.rs
+++ b/crates/tauri-bundler/src/bundle/linux/rpm.rs
@@ -3,9 +3,8 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-License-Identifier: MIT

-use crate::{bundle::settings::Arch, Settings};
+use crate::{bundle::settings::Arch, error::ErrorExt, Settings};

-use anyhow::Context;
 use rpm::{self, signature::pgp, Dependency, FileMode, FileOptions};
 use std::{
  env,
@@ -21,7 +20,10 @@ use super::freedesktop;
 pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
  let product_name = settings.product_name();
  let version = settings.version_string();
-  let release = settings.rpm().release.as_str();
+  let release = match settings.rpm().release.as_str() {
+    "" => "1", // Considered the default. If left empty, you get file with "-.".
+    v => v,
+  };
  let epoch = settings.rpm().epoch;
  let arch = match settings.binary_arch() {
    Arch::X86_64 => "x86_64",
@@ -32,8 +34,7 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
    Arch::Riscv64 => "riscv64",
    target => {
      return Err(crate::Error::ArchError(format!(
-        "Unsupported architecture: {:?}",
-        target
+        "Unsupported architecture: {target:?}"
      )));
    }
  };
@@ -46,10 +47,13 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
  let base_dir = settings.project_out_directory().join("bundle/rpm");
  let package_dir = base_dir.join(&package_base_name);
  if package_dir.exists() {
-    fs::remove_dir_all(&package_dir)
-      .with_context(|| format!("Failed to remove old {package_base_name}"))?;
+    fs::remove_dir_all(&package_dir).fs_context(
+      "Failed to remove old package directory",
+      package_dir.clone(),
+    )?;
  }
-  fs::create_dir_all(&package_dir)?;
+  fs::create_dir_all(&package_dir)
+    .fs_context("Failed to create package directory", package_dir.clone())?;
  let package_path = base_dir.join(&package_name);

  log::info!(action = "Bundling"; "{} ({})", package_name, package_path.display());
@@ -235,6 +239,5 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {

  let mut f = fs::File::create(&package_path)?;
  pkg.write(&mut f)?;
-
  Ok(vec![package_path])
 }
--- a/crates/tauri-bundler/src/bundle/macos/app.rs
+++ b/crates/tauri-bundler/src/bundle/macos/app.rs
@@ -23,16 +23,17 @@
 // files into the `Contents` directory of the bundle.

 use super::{
-  icon::create_icns_file,
-  sign::{notarize, notarize_auth, sign, NotarizeAuthError, SignTarget},
+  icon::{app_icon_name_from_assets_car, create_assets_car_file, create_icns_file},
+  sign::{notarize, notarize_auth, notarize_without_stapling, sign, SignTarget},
 };
 use crate::{
+  bundle::settings::PlistKind,
+  error::{Context, ErrorExt, NotarizeAuthError},
  utils::{fs_utils, CommandExt},
+  Error::GenericError,
  Settings,
 };

-use anyhow::Context;
-
 use std::{
  ffi::OsStr,
  fs,
@@ -65,25 +66,29 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {

  if app_bundle_path.exists() {
    fs::remove_dir_all(&app_bundle_path)
-      .with_context(|| format!("Failed to remove old {}", app_product_name))?;
+      .fs_context("failed to remove old app bundle", &app_bundle_path)?;
  }
  let bundle_directory = app_bundle_path.join("Contents");
-  fs::create_dir_all(&bundle_directory).with_context(|| {
-    format!(
-      "Failed to create bundle directory at {:?}",
-      bundle_directory
-    )
-  })?;
+  fs::create_dir_all(&bundle_directory)
+    .fs_context("failed to create bundle directory", &bundle_directory)?;

  let resources_dir = bundle_directory.join("Resources");
  let bin_dir = bundle_directory.join("MacOS");
  let mut sign_paths = Vec::new();

-  let bundle_icon_file: Option<PathBuf> =
-    { create_icns_file(&resources_dir, settings).with_context(|| "Failed to create app icon")? };
+  let bundle_icon_file =
+    create_icns_file(&resources_dir, settings).with_context(|| "Failed to create app icon")?;

-  create_info_plist(&bundle_directory, bundle_icon_file, settings)
-    .with_context(|| "Failed to create Info.plist")?;
+  let assets_car_file = create_assets_car_file(&resources_dir, settings)
+    .with_context(|| "Failed to create app Assets.car")?;
+
+  create_info_plist(
+    &bundle_directory,
+    bundle_icon_file,
+    assets_car_file,
+    settings,
+  )
+  .with_context(|| "Failed to create Info.plist")?;

  let framework_paths = copy_frameworks_to_bundle(&bundle_directory, settings)
    .with_context(|| "Failed to bundle frameworks")?;
@@ -107,7 +112,11 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {

  copy_custom_files_to_bundle(&bundle_directory, settings)?;

-  if let Some(keychain) = super::sign::keychain(settings.macos().signing_identity.as_deref())? {
+  if settings.no_sign() {
+    log::warn!("Skipping signing due to --no-sign flag.",);
+  } else if let Some(keychain) =
+    super::sign::keychain(settings.macos().signing_identity.as_deref())?
+  {
    // Sign frameworks and sidecar binaries first, per apple, signing must be done inside out
    // https://developer.apple.com/forums/thread/701514
    sign_paths.push(SignTarget {
@@ -125,13 +134,17 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
    // notarization is required for distribution
    match notarize_auth() {
      Ok(auth) => {
-        notarize(&keychain, app_bundle_path.clone(), &auth)?;
+        if settings.macos().skip_stapling {
+          notarize_without_stapling(&keychain, app_bundle_path.clone(), &auth)?;
+        } else {
+          notarize(&keychain, app_bundle_path.clone(), &auth)?;
+        }
      }
      Err(e) => {
        if matches!(e, NotarizeAuthError::MissingTeamId) {
-          return Err(anyhow::anyhow!("{e}").into());
+          return Err(e.into());
        } else {
-          log::warn!("skipping app notarization, {}", e.to_string());
+          log::warn!("skipping app notarization, {e}");
        }
      }
    }
@@ -160,7 +173,7 @@ fn copy_binaries_to_bundle(
    let bin_path = settings.binary_path(bin);
    let dest_path = dest_dir.join(bin.name());
    fs_utils::copy_file(&bin_path, &dest_path)
-      .with_context(|| format!("Failed to copy binary from {:?}", bin_path))?;
+      .with_context(|| format!("Failed to copy binary from {bin_path:?}"))?;
    paths.push(dest_path);
  }
  Ok(paths)
@@ -169,6 +182,12 @@ fn copy_binaries_to_bundle(
 /// Copies user-defined files to the app under Contents.
 fn copy_custom_files_to_bundle(bundle_directory: &Path, settings: &Settings) -> crate::Result<()> {
  for (contents_path, path) in settings.macos().files.iter() {
+    if !path.try_exists()? {
+      return Err(GenericError(format!(
+        "Failed to copy {path:?} to {contents_path:?}. {path:?} does not exist."
+      )));
+    }
+
    let contents_path = if contents_path.is_absolute() {
      contents_path.strip_prefix("/").unwrap()
    } else {
@@ -176,10 +195,14 @@ fn copy_custom_files_to_bundle(bundle_directory: &Path, settings: &Settings) ->
    };
    if path.is_file() {
      fs_utils::copy_file(path, &bundle_directory.join(contents_path))
-        .with_context(|| format!("Failed to copy file {:?} to {:?}", path, contents_path))?;
-    } else {
+        .with_context(|| format!("Failed to copy file {path:?} to {contents_path:?}"))?;
+    } else if path.is_dir() {
      fs_utils::copy_dir(path, &bundle_directory.join(contents_path))
-        .with_context(|| format!("Failed to copy directory {:?} to {:?}", path, contents_path))?;
+        .with_context(|| format!("Failed to copy directory {path:?} to {contents_path:?}"))?;
+    } else {
+      return Err(GenericError(format!(
+        "{path:?} is not a file or directory."
+      )));
    }
  }
  Ok(())
@@ -189,6 +212,7 @@ fn copy_custom_files_to_bundle(bundle_directory: &Path, settings: &Settings) ->
 fn create_info_plist(
  bundle_dir: &Path,
  bundle_icon_file: Option<PathBuf>,
+  assets_car_file: Option<PathBuf>,
  settings: &Settings,
 ) -> crate::Result<()> {
  let mut plist = plist::Dictionary::new();
@@ -198,23 +222,20 @@ fn create_info_plist(
    "CFBundleExecutable".into(),
    settings.main_binary_name()?.into(),
  );
-  if let Some(path) = bundle_icon_file {
-    plist.insert(
-      "CFBundleIconFile".into(),
-      path
-        .file_name()
-        .expect("No file name")
-        .to_string_lossy()
-        .into_owned()
-        .into(),
-    );
-  }
  plist.insert(
    "CFBundleIdentifier".into(),
    settings.bundle_identifier().into(),
  );
  plist.insert("CFBundleInfoDictionaryVersion".into(), "6.0".into());
-  plist.insert("CFBundleName".into(), settings.product_name().into());
+  if let Some(bundle_name) = settings
+    .macos()
+    .bundle_name
+    .as_deref()
+    .unwrap_or_else(|| settings.product_name())
+    .into()
+  {
+    plist.insert("CFBundleName".into(), bundle_name.into());
+  }
  plist.insert("CFBundlePackageType".into(), "APPL".into());
  plist.insert(
    "CFBundleShortVersionString".into(),
@@ -241,6 +262,55 @@ fn create_info_plist(
  }

  if let Some(associations) = settings.file_associations() {
+    let exported_associations = associations
+      .iter()
+      .filter_map(|association| {
+        association.exported_type.as_ref().map(|exported_type| {
+          let mut dict = plist::Dictionary::new();
+
+          dict.insert(
+            "UTTypeIdentifier".into(),
+            exported_type.identifier.clone().into(),
+          );
+          if let Some(description) = &association.description {
+            dict.insert("UTTypeDescription".into(), description.clone().into());
+          }
+          if let Some(conforms_to) = &exported_type.conforms_to {
+            dict.insert(
+              "UTTypeConformsTo".into(),
+              plist::Value::Array(conforms_to.iter().map(|s| s.clone().into()).collect()),
+            );
+          }
+
+          let mut specification = plist::Dictionary::new();
+          specification.insert(
+            "public.filename-extension".into(),
+            plist::Value::Array(
+              association
+                .ext
+                .iter()
+                .map(|s| s.to_string().into())
+                .collect(),
+            ),
+          );
+          if let Some(mime_type) = &association.mime_type {
+            specification.insert("public.mime-type".into(), mime_type.clone().into());
+          }
+
+          dict.insert("UTTypeTagSpecification".into(), specification.into());
+
+          plist::Value::Dictionary(dict)
+        })
+      })
+      .collect::<Vec<_>>();
+
+    if !exported_associations.is_empty() {
+      plist.insert(
+        "UTExportedTypeDeclarations".into(),
+        plist::Value::Array(exported_associations),
+      );
+    }
+
    plist.insert(
      "CFBundleDocumentTypes".into(),
      plist::Value::Array(
@@ -248,16 +318,27 @@ fn create_info_plist(
          .iter()
          .map(|association| {
            let mut dict = plist::Dictionary::new();
-            dict.insert(
-              "CFBundleTypeExtensions".into(),
-              plist::Value::Array(
-                association
-                  .ext
-                  .iter()
-                  .map(|ext| ext.to_string().into())
-                  .collect(),
-              ),
-            );
+
+            if !association.ext.is_empty() {
+              dict.insert(
+                "CFBundleTypeExtensions".into(),
+                plist::Value::Array(
+                  association
+                    .ext
+                    .iter()
+                    .map(|ext| ext.to_string().into())
+                    .collect(),
+                ),
+              );
+            }
+
+            if let Some(content_types) = &association.content_types {
+              dict.insert(
+                "LSItemContentTypes".into(),
+                plist::Value::Array(content_types.iter().map(|s| s.to_string().into()).collect()),
+              );
+            }
+
            dict.insert(
              "CFBundleTypeName".into(),
              association
@@ -271,6 +352,7 @@ fn create_info_plist(
              "CFBundleTypeRole".into(),
              association.role.to_string().into(),
            );
+            dict.insert("LSHandlerRank".into(), association.rank.to_string().into());
            plist::Value::Dictionary(dict)
          })
          .collect(),
@@ -278,12 +360,34 @@ fn create_info_plist(
    );
  }

+  if let Some(path) = bundle_icon_file {
+    plist.insert(
+      "CFBundleIconFile".into(),
+      path
+        .file_name()
+        .expect("No file name")
+        .to_string_lossy()
+        .into_owned()
+        .into(),
+    );
+  }
+
+  if let Some(assets_car_file) = assets_car_file {
+    if let Some(icon_name) = app_icon_name_from_assets_car(&assets_car_file) {
+      // only set CFBundleIconName for the Assets.car, CFBundleIconFile is the fallback icns file
+      plist.insert("CFBundleIconName".into(), icon_name.clone().into());
+    } else {
+      log::warn!("Failed to get icon name from Assets.car file");
+    }
+  }
+
  if let Some(protocols) = settings.deep_link_protocols() {
    plist.insert(
      "CFBundleURLTypes".into(),
      plist::Value::Array(
        protocols
          .iter()
+          .filter(|p| !p.schemes.is_empty())
          .map(|protocol| {
            let mut dict = plist::Dictionary::new();
            dict.insert(
@@ -334,8 +438,11 @@ fn create_info_plist(
    plist.insert("NSAppTransportSecurity".into(), security.into());
  }

-  if let Some(user_plist_path) = &settings.macos().info_plist_path {
-    let user_plist = plist::Value::from_file(user_plist_path)?;
+  if let Some(user_plist) = &settings.macos().info_plist {
+    let user_plist = match user_plist {
+      PlistKind::Path(path) => plist::Value::from_file(path)?,
+      PlistKind::Plist(value) => value.clone(),
+    };
    if let Some(dict) = user_plist.into_dictionary() {
      for (key, value) in dict {
        plist.insert(key, value);
@@ -350,7 +457,7 @@ fn create_info_plist(

 // Copies the framework under `{src_dir}/{framework}.framework` to `{dest_dir}/{framework}.framework`.
 fn copy_framework_from(dest_dir: &Path, framework: &str, src_dir: &Path) -> crate::Result<bool> {
-  let src_name = format!("{}.framework", framework);
+  let src_name = format!("{framework}.framework");
  let src_path = src_dir.join(&src_name);
  if src_path.exists() {
    fs_utils::copy_dir(&src_path, &dest_dir.join(&src_name))?;
@@ -367,18 +474,12 @@ fn copy_frameworks_to_bundle(
 ) -> crate::Result<Vec<SignTarget>> {
  let mut paths = Vec::new();

-  let frameworks = settings
-    .macos()
-    .frameworks
-    .as_ref()
-    .cloned()
-    .unwrap_or_default();
+  let frameworks = settings.macos().frameworks.clone().unwrap_or_default();
  if frameworks.is_empty() {
    return Ok(paths);
  }
  let dest_dir = bundle_directory.join("Frameworks");
-  fs::create_dir_all(bundle_directory)
-    .with_context(|| format!("Failed to create Frameworks directory at {:?}", dest_dir))?;
+  fs::create_dir_all(&dest_dir).fs_context("failed to create Frameworks directory", &dest_dir)?;
  for framework in frameworks.iter() {
    if framework.ends_with(".framework") {
      let src_path = PathBuf::from(framework);
@@ -392,10 +493,7 @@ fn copy_frameworks_to_bundle(
    } else if framework.ends_with(".dylib") {
      let src_path = PathBuf::from(framework);
      if !src_path.exists() {
-        return Err(crate::Error::GenericError(format!(
-          "Library not found: {}",
-          framework
-        )));
+        return Err(GenericError(format!("Library not found: {framework}")));
      }
      let src_name = src_path.file_name().expect("Couldn't get library filename");
      let dest_path = dest_dir.join(src_name);
@@ -406,9 +504,8 @@ fn copy_frameworks_to_bundle(
      });
      continue;
    } else if framework.contains('/') {
-      return Err(crate::Error::GenericError(format!(
-        "Framework path should have .framework extension: {}",
-        framework
+      return Err(GenericError(format!(
+        "Framework path should have .framework extension: {framework}"
      )));
    }
    if let Some(home_dir) = dirs::home_dir() {
@@ -425,9 +522,8 @@ fn copy_frameworks_to_bundle(
    {
      continue;
    }
-    return Err(crate::Error::GenericError(format!(
-      "Could not locate framework: {}",
-      framework
+    return Err(GenericError(format!(
+      "Could not locate framework: {framework}"
    )));
  }
  Ok(paths)
@@ -519,3 +615,153 @@ fn add_nested_code_sign_path(src_path: &Path, dest_path: &Path, sign_paths: &mut
    }
  }
 }
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+  use crate::bundle::{BundleSettings, MacOsSettings, PackageSettings, SettingsBuilder};
+  use std::{
+    collections::HashMap,
+    fs,
+    path::{Path, PathBuf},
+  };
+
+  /// Helper that builds a `Settings` instance and bundle directory for tests.
+  /// It receives a mapping of bundle-relative paths to source paths and
+  /// returns the generated bundle directory and settings.
+  fn create_test_bundle(
+    project_dir: &Path,
+    files: HashMap<PathBuf, PathBuf>,
+  ) -> (PathBuf, crate::bundle::Settings) {
+    let macos_settings = MacOsSettings {
+      files,
+      ..Default::default()
+    };
+
+    let settings = SettingsBuilder::new()
+      .project_out_directory(project_dir)
+      .package_settings(PackageSettings {
+        product_name: "TestApp".into(),
+        version: "0.1.0".into(),
+        description: "test".into(),
+        homepage: None,
+        authors: None,
+        default_run: None,
+      })
+      .bundle_settings(BundleSettings {
+        macos: macos_settings,
+        ..Default::default()
+      })
+      .target("x86_64-apple-darwin".into())
+      .build()
+      .expect("failed to build settings");
+
+    let bundle_dir = project_dir.join("TestApp.app/Contents");
+    fs::create_dir_all(&bundle_dir).expect("failed to create bundle dir");
+
+    (bundle_dir, settings)
+  }
+
+  #[test]
+  fn test_copy_custom_file_to_bundle_file() {
+    let tmp_dir = tempfile::tempdir().expect("failed to create temp dir");
+
+    // Prepare a single file to copy.
+    let src_file = tmp_dir.path().join("sample.txt");
+    fs::write(&src_file, b"hello tauri").expect("failed to write sample file");
+
+    let files_map = HashMap::from([(PathBuf::from("Resources/sample.txt"), src_file.clone())]);
+
+    let (bundle_dir, settings) = create_test_bundle(tmp_dir.path(), files_map);
+
+    copy_custom_files_to_bundle(&bundle_dir, &settings)
+      .expect("copy_custom_files_to_bundle failed");
+
+    let dest_file = bundle_dir.join("Resources/sample.txt");
+    assert!(dest_file.exists() && dest_file.is_file());
+    assert_eq!(fs::read_to_string(dest_file).unwrap(), "hello tauri");
+  }
+
+  #[test]
+  fn test_copy_custom_file_to_bundle_dir() {
+    let tmp_dir = tempfile::tempdir().expect("failed to create temp dir");
+
+    // Create a source directory with a nested file.
+    let src_dir = tmp_dir.path().join("assets");
+    fs::create_dir_all(&src_dir).expect("failed to create assets directory");
+    let nested_file = src_dir.join("nested.txt");
+    fs::write(&nested_file, b"nested").expect("failed to write nested file");
+
+    let files_map = HashMap::from([(PathBuf::from("MyAssets"), src_dir.clone())]);
+
+    let (bundle_dir, settings) = create_test_bundle(tmp_dir.path(), files_map);
+
+    copy_custom_files_to_bundle(&bundle_dir, &settings)
+      .expect("copy_custom_files_to_bundle failed");
+
+    let dest_nested_file = bundle_dir.join("MyAssets/nested.txt");
+    assert!(
+      dest_nested_file.exists(),
+      "{dest_nested_file:?} does not exist"
+    );
+    assert!(
+      dest_nested_file.is_file(),
+      "{dest_nested_file:?} is not a file"
+    );
+    assert_eq!(
+      fs::read_to_string(dest_nested_file).unwrap().trim(),
+      "nested"
+    );
+  }
+
+  #[test]
+  fn test_copy_custom_files_to_bundle_missing_source() {
+    let tmp_dir = tempfile::tempdir().expect("failed to create temp dir");
+
+    // Intentionally reference a non-existent path.
+    let missing_path = tmp_dir.path().join("does_not_exist.txt");
+
+    let files_map = HashMap::from([(PathBuf::from("Missing.txt"), missing_path)]);
+
+    let (bundle_dir, settings) = create_test_bundle(tmp_dir.path(), files_map);
+
+    let result = copy_custom_files_to_bundle(&bundle_dir, &settings);
+
+    assert!(result.is_err());
+    assert!(result.err().unwrap().to_string().contains("does not exist"));
+  }
+
+  #[test]
+  fn test_copy_custom_files_to_bundle_invalid_source() {
+    let tmp_dir = tempfile::tempdir().expect("failed to create temp dir");
+
+    let files_map = HashMap::from([(PathBuf::from("Invalid.txt"), PathBuf::from("///"))]);
+
+    let (bundle_dir, settings) = create_test_bundle(tmp_dir.path(), files_map);
+
+    let result = copy_custom_files_to_bundle(&bundle_dir, &settings);
+    assert!(result.is_err());
+    assert!(result
+      .err()
+      .unwrap()
+      .to_string()
+      .contains("Failed to copy directory"));
+  }
+
+  #[test]
+  fn test_copy_custom_files_to_bundle_dev_null() {
+    let tmp_dir = tempfile::tempdir().expect("failed to create temp dir");
+
+    let files_map = HashMap::from([(PathBuf::from("Invalid.txt"), PathBuf::from("/dev/null"))]);
+
+    let (bundle_dir, settings) = create_test_bundle(tmp_dir.path(), files_map);
+
+    let result = copy_custom_files_to_bundle(&bundle_dir, &settings);
+    assert!(result.is_err());
+    assert!(result
+      .err()
+      .unwrap()
+      .to_string()
+      .contains("is not a file or directory."));
+  }
+}
--- a/crates/tauri-bundler/src/bundle/macos/dmg/mod.rs
+++ b/crates/tauri-bundler/src/bundle/macos/dmg/mod.rs
@@ -6,12 +6,11 @@
 use super::{app, icon::create_icns_file};
 use crate::{
  bundle::{settings::Arch, Bundle},
+  error::{Context, ErrorExt},
  utils::CommandExt,
  PackageType, Settings,
 };

-use anyhow::Context;
-
 use std::{
  env,
  fs::{self, write},
@@ -49,8 +48,7 @@ pub fn bundle_project(settings: &Settings, bundles: &[Bundle]) -> crate::Result<
      Arch::Universal => "universal",
      target => {
        return Err(crate::Error::ArchError(format!(
-          "Unsupported architecture: {:?}",
-          target
+          "Unsupported architecture: {target:?}"
        )));
      }
    }
@@ -59,7 +57,7 @@ pub fn bundle_project(settings: &Settings, bundles: &[Bundle]) -> crate::Result<
  let dmg_path = output_path.join(&dmg_name);

  let product_name = settings.product_name();
-  let bundle_file_name = format!("{}.app", product_name);
+  let bundle_file_name = format!("{product_name}.app");
  let bundle_dir = settings.project_out_directory().join("bundle/macos");

  let support_directory_path = output_path
@@ -69,10 +67,9 @@ pub fn bundle_project(settings: &Settings, bundles: &[Bundle]) -> crate::Result<

  for path in &[&support_directory_path, &output_path] {
    if path.exists() {
-      fs::remove_dir_all(path).with_context(|| format!("Failed to remove old {}", dmg_name))?;
+      fs::remove_dir_all(path).fs_context("failed to remove old dmg", path.to_path_buf())?;
    }
-    fs::create_dir_all(path)
-      .with_context(|| format!("Failed to create output directory at {:?}", path))?;
+    fs::create_dir_all(path).fs_context("failed to create output directory", path.to_path_buf())?;
  }

  // create paths for script
@@ -196,7 +193,7 @@ pub fn bundle_project(settings: &Settings, bundles: &[Bundle]) -> crate::Result<
  // Sign DMG if needed
  // skipping self-signing DMGs https://github.com/tauri-apps/tauri/issues/12288
  let identity = settings.macos().signing_identity.as_deref();
-  if identity != Some("-") {
+  if !settings.no_sign() && identity != Some("-") {
    if let Some(keychain) = super::sign::keychain(identity)? {
      super::sign::sign(
        &keychain,
--- a/crates/tauri-bundler/src/bundle/macos/icon.rs
+++ b/crates/tauri-bundler/src/bundle/macos/icon.rs
@@ -4,13 +4,14 @@
 // SPDX-License-Identifier: MIT

 use crate::bundle::Settings;
-use crate::utils::{self, fs_utils};
+use crate::utils::{self, fs_utils, CommandExt};
 use std::{
  cmp::min,
  ffi::OsStr,
  fs::{self, File},
  io::{self, BufWriter},
  path::{Path, PathBuf},
+  process::Command,
 };

 use image::GenericImageView;
@@ -63,6 +64,11 @@ pub fn create_icns_file(out_dir: &Path, settings: &Settings) -> crate::Result<Op
  let mut images_to_resize: Vec<(image::DynamicImage, u32, u32)> = vec![];
  for icon_path in settings.icon_files() {
    let icon_path = icon_path?;
+
+    if icon_path.extension().map_or(false, |ext| ext == "car") {
+      continue;
+    }
+
    let icon = image::open(&icon_path)?;
    let density = if utils::is_retina(&icon_path) { 2 } else { 1 };
    let (w, h) = icon.dimensions();
@@ -113,3 +119,206 @@ fn make_icns_image(img: image::DynamicImage) -> io::Result<icns::Image> {
  };
  icns::Image::from_data(pixel_format, img.width(), img.height(), img.into_bytes())
 }
+
+/// Creates an Assets.car file from a .icon file if there are any in the settings.
+/// Uses an existing Assets.car file if it exists in the settings.
+/// Returns the path to the Assets.car file.
+pub fn create_assets_car_file(
+  out_dir: &Path,
+  settings: &Settings,
+) -> crate::Result<Option<PathBuf>> {
+  let Some(icons) = settings.icons() else {
+    return Ok(None);
+  };
+  // If one of the icon files is already a CAR file, just use that.
+  let mut icon_composer_icon_path = None;
+  for icon in icons {
+    let icon_path = Path::new(&icon).to_path_buf();
+    if icon_path.extension() == Some(OsStr::new("car")) {
+      let dest_path = out_dir.join("Assets.car");
+      fs_utils::copy_file(&icon_path, &dest_path)?;
+      return Ok(Some(dest_path));
+    }
+
+    if icon_path.extension() == Some(OsStr::new("icon")) {
+      icon_composer_icon_path.replace(icon_path);
+    }
+  }
+
+  let Some(icon_composer_icon_path) = icon_composer_icon_path else {
+    return Ok(None);
+  };
+
+  // Check actool version - must be >= 26
+  if let Some(version) = get_actool_version() {
+    // Parse the major version number (before the dot)
+    let major_version: Option<u32> = version.split('.').next().and_then(|s| s.parse().ok());
+
+    if let Some(major) = major_version {
+      if major < 26 {
+        log::error!("actool version is less than 26, skipping Assets.car file creation. Please update Xcode to 26 or above and try again.");
+        return Ok(None);
+      }
+    } else {
+      // If we can't parse the version, return None to be safe
+      log::error!("failed to parse actool version, skipping Assets.car file creation");
+      return Ok(None);
+    }
+  } else {
+    log::error!("failed to get actool version, skipping Assets.car file creation");
+    // If we can't get the version, return None to be safe
+    return Ok(None);
+  }
+
+  // Create a temporary directory for actool work
+  let temp_dir = tempfile::tempdir()
+    .map_err(|e| crate::Error::GenericError(format!("failed to create temp dir: {e}")))?;
+
+  let icon_dest_path = temp_dir.path().join("Icon.icon");
+  let output_path = temp_dir.path().join("out");
+
+  // Copy the input .icon directory to the temp directory
+  if icon_composer_icon_path.is_dir() {
+    fs_utils::copy_dir(&icon_composer_icon_path, &icon_dest_path)?;
+  } else {
+    return Err(crate::Error::GenericError(format!(
+      "{} must be a directory",
+      icon_composer_icon_path.display()
+    )));
+  }
+
+  // Create the output directory
+  fs::create_dir_all(&output_path)?;
+
+  // Run actool command
+  let mut cmd = Command::new("actool");
+  cmd.arg(&icon_dest_path);
+  cmd.arg("--compile");
+  cmd.arg(&output_path);
+  cmd.arg("--output-format");
+  cmd.arg("human-readable-text");
+  cmd.arg("--notices");
+  cmd.arg("--warnings");
+  cmd.arg("--output-partial-info-plist");
+  cmd.arg(output_path.join("assetcatalog_generated_info.plist"));
+  cmd.arg("--app-icon");
+  cmd.arg("Icon");
+  cmd.arg("--include-all-app-icons");
+  cmd.arg("--accent-color");
+  cmd.arg("AccentColor");
+  cmd.arg("--enable-on-demand-resources");
+  cmd.arg("NO");
+  cmd.arg("--development-region");
+  cmd.arg("en");
+  cmd.arg("--target-device");
+  cmd.arg("mac");
+  cmd.arg("--minimum-deployment-target");
+  cmd.arg("26.0");
+  cmd.arg("--platform");
+  cmd.arg("macosx");
+
+  cmd.output_ok()?;
+
+  let assets_car_path = output_path.join("Assets.car");
+  if !assets_car_path.exists() {
+    return Err(crate::Error::GenericError(
+      "actool did not generate Assets.car file".to_owned(),
+    ));
+  }
+
+  // copy to out_dir
+  fs_utils::copy_file(&assets_car_path, &out_dir.join("Assets.car"))?;
+
+  Ok(Some(out_dir.join("Assets.car")))
+}
+
+#[derive(serde::Deserialize)]
+struct AssetsCarInfo {
+  #[serde(rename = "AssetType", default)]
+  asset_type: String,
+  #[serde(rename = "Name", default)]
+  name: String,
+}
+
+pub fn app_icon_name_from_assets_car(assets_car_path: &Path) -> Option<String> {
+  let Ok(output) = Command::new("assetutil")
+    .arg("--info")
+    .arg(assets_car_path)
+    .output_ok()
+    .inspect_err(|e| log::error!("Failed to get app icon name from Assets.car file: {e}"))
+  else {
+    return None;
+  };
+
+  let output = String::from_utf8(output.stdout).ok()?;
+  let assets_car_info: Vec<AssetsCarInfo> = serde_json::from_str(&output)
+    .inspect_err(|e| log::error!("Failed to parse Assets.car file info: {e}"))
+    .ok()?;
+  assets_car_info
+    .iter()
+    .find(|info| info.asset_type == "Icon Image")
+    .map(|info| info.name.clone())
+}
+
+/// Returns the actool short bundle version by running `actool --version --output-format=human-readable-text`.
+/// Returns `None` if the command fails or the output cannot be parsed.
+pub fn get_actool_version() -> Option<String> {
+  let Ok(output) = Command::new("actool")
+    .arg("--version")
+    .arg("--output-format=human-readable-text")
+    .output_ok()
+    .inspect_err(|e| log::error!("Failed to get actool version: {e}"))
+  else {
+    return None;
+  };
+
+  let output = String::from_utf8(output.stdout).ok()?;
+  parse_actool_version(&output)
+}
+
+fn parse_actool_version(output: &str) -> Option<String> {
+  // The output format is:
+  // /* com.apple.actool.version */
+  // bundle-version: 24411
+  // short-bundle-version: 26.1
+  for line in output.lines() {
+    let line = line.trim();
+    if let Some(version) = line.strip_prefix("short-bundle-version:") {
+      return Some(version.trim().to_string());
+    }
+  }
+
+  None
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+
+  #[test]
+  fn test_parse_actool_version() {
+    let output = r#"/* com.apple.actool.version */
+some other line
+bundle-version: 24411
+short-bundle-version: 26.1
+another line
+"#;
+
+    let version = parse_actool_version(output).expect("Failed to parse version");
+    assert_eq!(version, "26.1");
+  }
+
+  #[test]
+  fn test_parse_actool_version_missing_fields() {
+    let output = r#"/* com.apple.actool.version */
+bundle-version: 24411
+"#;
+
+    assert!(parse_actool_version(output).is_none());
+  }
+
+  #[test]
+  fn test_parse_actool_version_empty() {
+    assert!(parse_actool_version("").is_none());
+  }
+}
--- a/crates/tauri-bundler/src/bundle/macos/ios.rs
+++ b/crates/tauri-bundler/src/bundle/macos/ios.rs
@@ -14,11 +14,11 @@
 // explanation.

 use crate::{
+  error::{Context, ErrorExt},
  utils::{self, fs_utils},
  Settings,
 };

-use anyhow::Context;
 use image::{codecs::png::PngDecoder, GenericImageView, ImageDecoder};

 use std::{
@@ -45,16 +45,16 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {

  if app_bundle_path.exists() {
    fs::remove_dir_all(&app_bundle_path)
-      .with_context(|| format!("Failed to remove old {}", app_product_name))?;
+      .fs_context("failed to remove old app bundle", &app_bundle_path)?;
  }
  fs::create_dir_all(&app_bundle_path)
-    .with_context(|| format!("Failed to create bundle directory at {:?}", app_bundle_path))?;
+    .fs_context("failed to create bundle directory", &app_bundle_path)?;

  for src in settings.resource_files() {
    let src = src?;
    let dest = app_bundle_path.join(tauri_utils::resources::resource_relpath(&src));
    fs_utils::copy_file(&src, &dest)
-      .with_context(|| format!("Failed to copy resource file {:?}", src))?;
+      .with_context(|| format!("Failed to copy resource file {src:?}"))?;
  }

  let icon_filenames = generate_icon_files(&app_bundle_path, settings)
@@ -65,7 +65,7 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<PathBuf>> {
  for bin in settings.binaries() {
    let bin_path = settings.binary_path(bin);
    fs_utils::copy_file(&bin_path, &app_bundle_path.join(bin.name()))
-      .with_context(|| format!("Failed to copy binary from {:?}", bin_path))?;
+      .with_context(|| format!("Failed to copy binary from {bin_path:?}"))?;
  }

  Ok(vec![app_bundle_path])
@@ -106,7 +106,10 @@ fn generate_icon_files(bundle_dir: &Path, settings: &Settings) -> crate::Result<
    // Fall back to non-PNG files for any missing sizes.
    for icon_path in settings.icon_files() {
      let icon_path = icon_path?;
-      if icon_path.extension() == Some(OsStr::new("png")) {
+      if icon_path
+        .extension()
+        .map_or(false, |ext| ext == "png" || ext == "car")
+      {
        continue;
      } else if icon_path.extension() == Some(OsStr::new("icns")) {
        let icon_family = icns::IconFamily::read(File::open(&icon_path)?)?;
@@ -197,7 +200,7 @@ fn generate_info_plist(
  if !icon_filenames.is_empty() {
    writeln!(file, "  <key>CFBundleIconFiles</key>\n  <array>")?;
    for filename in icon_filenames {
-      writeln!(file, "    <string>{}</string>", filename)?;
+      writeln!(file, "    <string>{filename}</string>")?;
    }
    writeln!(file, "  </array>")?;
  }
--- a/crates/tauri-bundler/src/bundle/macos/sign.rs
+++ b/crates/tauri-bundler/src/bundle/macos/sign.rs
@@ -6,10 +6,10 @@
 use std::{
  env::{var, var_os},
  ffi::OsString,
-  path::{Path, PathBuf},
+  path::PathBuf,
 };

-use crate::Settings;
+use crate::{error::NotarizeAuthError, Entitlements, Settings};

 pub struct SignTarget {
  pub path: PathBuf,
@@ -21,13 +21,16 @@ pub fn keychain(identity: Option<&str>) -> crate::Result<Option<tauri_macos_sign
    var_os("APPLE_CERTIFICATE"),
    var_os("APPLE_CERTIFICATE_PASSWORD"),
  ) {
-    // import user certificate - useful for for CI build
+    // import user certificate - useful for CI build
    let keychain =
-      tauri_macos_sign::Keychain::with_certificate(&certificate_encoded, &certificate_password)?;
+      tauri_macos_sign::Keychain::with_certificate(&certificate_encoded, &certificate_password)
+        .map_err(Box::new)?;
    if let Some(identity) = identity {
      let certificate_identity = keychain.signing_identity();
      if !certificate_identity.contains(identity) {
-        return Err(anyhow::anyhow!("certificate from APPLE_CERTIFICATE \"{certificate_identity}\" environment variable does not match provided identity \"{identity}\"").into());
+        return Err(crate::Error::GenericError(format!(
+          "certificate from APPLE_CERTIFICATE \"{certificate_identity}\" environment variable does not match provided identity \"{identity}\""
+        )));
      }
    }
    Ok(Some(keychain))
@@ -48,16 +51,23 @@ pub fn sign(
  log::info!(action = "Signing"; "with identity \"{}\"", keychain.signing_identity());

  for target in targets {
-    let entitlements_path = if target.is_an_executable {
-      settings.macos().entitlements.as_ref().map(Path::new)
-    } else {
-      None
+    let (entitlements_path, _temp_file) = match settings.macos().entitlements.as_ref() {
+      Some(Entitlements::Path(path)) => (Some(path.to_owned()), None),
+      Some(Entitlements::Plist(plist)) => {
+        let mut temp_file = tempfile::NamedTempFile::new()?;
+        plist::to_writer_xml(temp_file.as_file_mut(), &plist)?;
+        (Some(temp_file.path().to_path_buf()), Some(temp_file))
+      }
+      None => (None, None),
    };
-    keychain.sign(
-      &target.path,
-      entitlements_path,
-      target.is_an_executable && settings.macos().hardened_runtime,
-    )?;
+
+    keychain
+      .sign(
+        &target.path,
+        entitlements_path.as_deref(),
+        target.is_an_executable && settings.macos().hardened_runtime,
+      )
+      .map_err(Box::new)?;
  }

  Ok(())
@@ -68,17 +78,19 @@ pub fn notarize(
  app_bundle_path: PathBuf,
  credentials: &tauri_macos_sign::AppleNotarizationCredentials,
 ) -> crate::Result<()> {
-  tauri_macos_sign::notarize(keychain, &app_bundle_path, credentials).map_err(Into::into)
+  tauri_macos_sign::notarize(keychain, &app_bundle_path, credentials)
+    .map_err(Box::new)
+    .map_err(Into::into)
 }

-#[derive(Debug, thiserror::Error)]
-pub enum NotarizeAuthError {
-  #[error(
-    "The team ID is now required for notarization with app-specific password as authentication. Please set the `APPLE_TEAM_ID` environment variable. You can find the team ID in https://developer.apple.com/account#MembershipDetailsCard."
-  )]
-  MissingTeamId,
-  #[error(transparent)]
-  Anyhow(#[from] anyhow::Error),
+pub fn notarize_without_stapling(
+  keychain: &tauri_macos_sign::Keychain,
+  app_bundle_path: PathBuf,
+  credentials: &tauri_macos_sign::AppleNotarizationCredentials,
+) -> crate::Result<()> {
+  tauri_macos_sign::notarize_without_stapling(keychain, &app_bundle_path, credentials)
+    .map_err(Box::new)
+    .map_err(Into::into)
 }

 pub fn notarize_auth() -> Result<tauri_macos_sign::AppleNotarizationCredentials, NotarizeAuthError>
@@ -97,10 +109,18 @@ pub fn notarize_auth() -> Result<tauri_macos_sign::AppleNotarizationCredentials,
    }
    (Some(_apple_id), Some(_password), None) => Err(NotarizeAuthError::MissingTeamId),
    _ => {
-      match (var_os("APPLE_API_KEY"), var_os("APPLE_API_ISSUER"), var("APPLE_API_KEY_PATH")) {
+      match (
+        var_os("APPLE_API_KEY"),
+        var_os("APPLE_API_ISSUER"),
+        var("APPLE_API_KEY_PATH"),
+      ) {
        (Some(key_id), Some(issuer), Ok(key_path)) => {
-          Ok(tauri_macos_sign::AppleNotarizationCredentials::ApiKey { key_id, key: tauri_macos_sign::ApiKey::Path( key_path.into()), issuer })
-        },
+          Ok(tauri_macos_sign::AppleNotarizationCredentials::ApiKey {
+            key_id,
+            key: tauri_macos_sign::ApiKey::Path(key_path.into()),
+            issuer,
+          })
+        }
        (Some(key_id), Some(issuer), Err(_)) => {
          let mut api_key_file_name = OsString::from("AuthKey_");
          api_key_file_name.push(&key_id);
@@ -122,12 +142,18 @@ pub fn notarize_auth() -> Result<tauri_macos_sign::AppleNotarizationCredentials,
          }

          if let Some(key_path) = key_path {
-          Ok(tauri_macos_sign::AppleNotarizationCredentials::ApiKey { key_id, key: tauri_macos_sign::ApiKey::Path(key_path), issuer })
+            Ok(tauri_macos_sign::AppleNotarizationCredentials::ApiKey {
+              key_id,
+              key: tauri_macos_sign::ApiKey::Path(key_path),
+              issuer,
+            })
          } else {
-            Err(anyhow::anyhow!("could not find API key file. Please set the APPLE_API_KEY_PATH environment variables to the path to the {api_key_file_name:?} file").into())
+            Err(NotarizeAuthError::MissingApiKey {
+              file_name: api_key_file_name.to_string_lossy().into_owned(),
+            })
          }
        }
-        _ => Err(anyhow::anyhow!("no APPLE_ID & APPLE_PASSWORD & APPLE_TEAM_ID or APPLE_API_KEY & APPLE_API_ISSUER & APPLE_API_KEY_PATH environment variables found").into())
+        _ => Err(NotarizeAuthError::MissingCredentials),
      }
    }
  }
--- a/crates/tauri-bundler/src/bundle/settings.rs
+++ b/crates/tauri-bundler/src/bundle/settings.rs
@@ -4,14 +4,14 @@
 // SPDX-License-Identifier: MIT

 use super::category::AppCategory;
-use crate::{bundle::platform::target_triple, utils::fs_utils};
-use anyhow::Context;
+use crate::{bundle::platform::target_triple, error::Context, utils::fs_utils};
 pub use tauri_utils::config::WebviewInstallMode;
 use tauri_utils::{
  config::{
    BundleType, DeepLinkProtocol, FileAssociation, NSISInstallerMode, NsisCompression,
    RpmCompression,
  },
+  platform::Target as TargetPlatform,
  resources::{external_binaries, ResourcePaths},
 };

@@ -126,7 +126,7 @@ const ALL_PACKAGE_TYPES: &[PackageType] = &[
  PackageType::IosBundle,
  #[cfg(target_os = "windows")]
  PackageType::WindowsMsi,
-  #[cfg(target_os = "windows")]
+  // NSIS installers can be built on all platforms but it's hidden in the --help output on macOS/Linux.
  PackageType::Nsis,
  #[cfg(target_os = "macos")]
  PackageType::MacOsBundle,
@@ -231,7 +231,7 @@ pub struct AppImageSettings {
 pub struct RpmSettings {
  /// The list of RPM dependencies your application relies on.
  pub depends: Option<Vec<String>>,
-  /// the list of of RPM dependencies your application recommends.
+  /// the list of RPM dependencies your application recommends.
  pub recommends: Option<Vec<String>>,
  /// The list of RPM dependencies your application provides.
  pub provides: Option<Vec<String>>,
@@ -332,6 +332,10 @@ pub struct MacOsSettings {
  pub files: HashMap<PathBuf, PathBuf>,
  /// The version of the build that identifies an iteration of the bundle.
  pub bundle_version: Option<String>,
+  /// The name of the build that identifies a string of the bundle.
+  ///
+  /// If not set, defaults to the package's product name.
+  pub bundle_name: Option<String>,
  /// A version string indicating the minimum MacOS version that the bundled app supports (e.g. `"10.11"`).
  /// If you are using this config field, you may also want have your `build.rs` script emit `cargo:rustc-env=MACOSX_DEPLOYMENT_TARGET=10.11`.
  pub minimum_system_version: Option<String>,
@@ -341,16 +345,43 @@ pub struct MacOsSettings {
  pub exception_domain: Option<String>,
  /// Code signing identity.
  pub signing_identity: Option<String>,
+  /// Whether to wait for notarization to finish and `staple` the ticket onto the app.
+  ///
+  /// Gatekeeper will look for stapled tickets to tell whether your app was notarized without
+  /// reaching out to Apple's servers which is helpful in offline environments.
+  ///
+  /// Enabling this option will also result in `tauri build` not waiting for notarization to finish
+  /// which is helpful for the very first time your app is notarized as this can take multiple hours.
+  /// On subsequent runs, it's recommended to disable this setting again.
+  pub skip_stapling: bool,
  /// Preserve the hardened runtime version flag, see <https://developer.apple.com/documentation/security/hardened_runtime>
  ///
  /// Settings this to `false` is useful when using an ad-hoc signature, making it less strict.
  pub hardened_runtime: bool,
  /// Provider short name for notarization.
  pub provider_short_name: Option<String>,
+  /// Path or contents of the entitlements.plist file.
+  pub entitlements: Option<Entitlements>,
+  /// Path to the Info.plist file or raw plist value to merge with the bundle Info.plist.
+  pub info_plist: Option<PlistKind>,
+}
+
+/// Entitlements for macOS code signing.
+#[derive(Debug, Clone)]
+pub enum Entitlements {
  /// Path to the entitlements.plist file.
-  pub entitlements: Option<String>,
-  /// Path to the Info.plist file for the bundle.
-  pub info_plist_path: Option<PathBuf>,
+  Path(PathBuf),
+  /// Raw plist::Value.
+  Plist(plist::Value),
+}
+
+/// Plist format.
+#[derive(Debug, Clone)]
+pub enum PlistKind {
+  /// Path to a .plist file.
+  Path(PathBuf),
+  /// Raw plist value.
+  Plist(plist::Value),
 }

 /// Configuration for a target language for the WiX build.
@@ -439,6 +470,13 @@ pub struct NsisSettings {
  pub sidebar_image: Option<PathBuf>,
  /// The path to an icon file used as the installer icon.
  pub installer_icon: Option<PathBuf>,
+  /// The path to an icon file used as the uninstaller icon.
+  pub uninstaller_icon: Option<PathBuf>,
+  /// The path to a bitmap file to display on the header of uninstallers pages.
+  /// Defaults to [`Self::header_image`]. If this is set but [`Self::header_image`] is not, a default image from NSIS will be applied to `header_image`
+  ///
+  /// The recommended dimensions are 150px x 57px.
+  pub uninstaller_header_image: Option<PathBuf>,
  /// Whether the installation will be for all users or just the current user.
  pub install_mode: NSISInstallerMode,
  /// A list of installer languages.
@@ -501,6 +539,10 @@ pub struct NsisSettings {
  /// Try to ensure that the WebView2 version is equal to or newer than this version,
  /// if the user's WebView2 is older than this version,
  /// the installer will try to trigger a WebView2 update.
+  #[deprecated(
+    since = "2.8.0",
+    note = "Use `WindowsSettings::minimum_webview2_version` instead."
+  )]
  pub minimum_webview2_version: Option<String>,
 }

@@ -556,6 +598,16 @@ pub struct WindowsSettings {
  /// if you are on another platform and want to cross-compile and sign you will
  /// need to use another tool like `osslsigncode`.
  pub sign_command: Option<CustomSignCommandSettings>,
+  /// Try to ensure that the WebView2 version is equal to or newer than this version,
+  /// if the user's WebView2 is older than this version,
+  /// the installer will try to trigger a WebView2 update.
+  pub minimum_webview2_version: Option<String>,
+}
+
+impl WindowsSettings {
+  pub(crate) fn can_sign(&self) -> bool {
+    self.sign_command.is_some() || self.certificate_thumbprint.is_some()
+  }
 }

 #[allow(deprecated)]
@@ -575,6 +627,7 @@ mod _default {
        webview_install_mode: Default::default(),
        allow_downgrades: true,
        sign_command: None,
+        minimum_webview2_version: None,
      }
    }
  }
@@ -758,10 +811,16 @@ pub struct Settings {
  local_tools_directory: Option<PathBuf>,
  /// the bundle settings.
  bundle_settings: BundleSettings,
+  /// Same as `bundle_settings.icon`, but without the .icon directory.
+  icon_files: Option<Vec<String>>,
  /// the binaries to bundle.
  binaries: Vec<BundleBinary>,
+  /// The target platform.
+  target_platform: TargetPlatform,
  /// The target triple.
  target: String,
+  /// Whether to disable code signing during the bundling process.
+  no_sign: bool,
 }

 /// A builder for [`Settings`].
@@ -775,6 +834,7 @@ pub struct SettingsBuilder {
  binaries: Vec<BundleBinary>,
  target: Option<String>,
  local_tools_directory: Option<PathBuf>,
+  no_sign: bool,
 }

 impl SettingsBuilder {
@@ -844,6 +904,13 @@ impl SettingsBuilder {
    self
  }

+  /// Sets whether to skip code signing.
+  #[must_use]
+  pub fn no_sign(mut self, no_sign: bool) -> Self {
+    self.no_sign = no_sign;
+    self
+  }
+
  /// Builds a Settings from the CLI args.
  ///
  /// Package settings will be read from Cargo.toml.
@@ -855,6 +922,15 @@ impl SettingsBuilder {
    } else {
      target_triple()?
    };
+    let target_platform = TargetPlatform::from_triple(&target);
+
+    let icon_files = self.bundle_settings.icon.as_ref().map(|paths| {
+      paths
+        .iter()
+        .filter(|p| !p.ends_with(".icon"))
+        .cloned()
+        .collect()
+    });

    Ok(Settings {
      log_level: self.log_level.unwrap_or(log::Level::Error),
@@ -872,10 +948,13 @@ impl SettingsBuilder {
          .bundle_settings
          .external_bin
          .as_ref()
-          .map(|bins| external_binaries(bins, &target)),
+          .map(|bins| external_binaries(bins, &target, &target_platform)),
        ..self.bundle_settings
      },
+      icon_files,
+      target_platform,
      target,
+      no_sign: self.no_sign,
    })
  }
 }
@@ -901,6 +980,16 @@ impl Settings {
    &self.target
  }

+  /// Returns the [`TargetPlatform`].
+  pub fn target_platform(&self) -> &TargetPlatform {
+    &self.target_platform
+  }
+
+  /// Raw list of icons.
+  pub fn icons(&self) -> Option<&Vec<String>> {
+    self.bundle_settings.icon.as_ref()
+  }
+
  /// Returns the architecture for the binary being bundled (e.g. "arm", "x86" or "x86_64").
  pub fn binary_arch(&self) -> Arch {
    if self.target.starts_with("x86_64") {
@@ -929,7 +1018,6 @@ impl Settings {
      .iter()
      .find(|bin| bin.main)
      .context("failed to find main binary, make sure you have a `package > default-run` in the Cargo.toml file")
-      .map_err(Into::into)
  }

  /// Returns the file name of the binary being bundled.
@@ -939,7 +1027,6 @@ impl Settings {
      .iter_mut()
      .find(|bin| bin.main)
      .context("failed to find main binary, make sure you have a `package > default-run` in the Cargo.toml file")
-      .map_err(Into::into)
  }

  /// Returns the file name of the binary being bundled.
@@ -950,24 +1037,27 @@ impl Settings {
      .find(|bin| bin.main)
      .context("failed to find main binary, make sure you have a `package > default-run` in the Cargo.toml file")
      .map(|b| b.name())
-      .map_err(Into::into)
  }

  /// Returns the path to the specified binary.
  pub fn binary_path(&self, binary: &BundleBinary) -> PathBuf {
-    let target_os = self
-      .target()
-      .split('-')
-      .nth(2)
-      .unwrap_or(std::env::consts::OS);
+    let target_os = self.target_platform();

-    let path = self.project_out_directory.join(binary.name());
+    let mut path = self.project_out_directory.join(binary.name());

-    if target_os == "windows" {
-      path.with_extension("exe")
-    } else {
-      path
-    }
+    if matches!(target_os, TargetPlatform::Windows) {
+      // Append the `.exe` extension without overriding the existing extensions
+      let extension = if let Some(extension) = path.extension() {
+        let mut extension = extension.to_os_string();
+        extension.push(".exe");
+        extension
+      } else {
+        "exe".into()
+      };
+      path.set_extension(extension);
+    };
+
+    path
  }

  /// Returns the list of binaries to bundle.
@@ -985,18 +1075,13 @@ impl Settings {
  ///
  /// Fails if the host/target's native package type is not supported.
  pub fn package_types(&self) -> crate::Result<Vec<PackageType>> {
-    let target_os = self
-      .target
-      .split('-')
-      .nth(2)
-      .unwrap_or(std::env::consts::OS)
-      .replace("darwin", "macos");
+    let target_os = self.target_platform();

-    let platform_types = match target_os.as_str() {
-      "macos" => vec![PackageType::MacOsBundle, PackageType::Dmg],
-      "ios" => vec![PackageType::IosBundle],
-      "linux" => vec![PackageType::Deb, PackageType::Rpm, PackageType::AppImage],
-      "windows" => vec![PackageType::WindowsMsi, PackageType::Nsis],
+    let platform_types = match target_os {
+      TargetPlatform::MacOS => vec![PackageType::MacOsBundle, PackageType::Dmg],
+      TargetPlatform::Ios => vec![PackageType::IosBundle],
+      TargetPlatform::Linux => vec![PackageType::Deb, PackageType::Rpm, PackageType::AppImage],
+      TargetPlatform::Windows => vec![PackageType::WindowsMsi, PackageType::Nsis],
      os => {
        return Err(crate::Error::GenericError(format!(
          "Native {os} bundles not yet supported."
@@ -1039,7 +1124,7 @@ impl Settings {

  /// Returns an iterator over the icon files to be used for this bundle.
  pub fn icon_files(&self) -> ResourcePaths<'_> {
-    match self.bundle_settings.icon {
+    match self.icon_files {
      Some(ref paths) => ResourcePaths::new(paths.as_slice(), false),
      None => ResourcePaths::new(&[], false),
    }
@@ -1220,4 +1305,14 @@ impl Settings {
  pub fn updater(&self) -> Option<&UpdaterSettings> {
    self.bundle_settings.updater.as_ref()
  }
+
+  /// Whether to skip signing.
+  pub fn no_sign(&self) -> bool {
+    self.no_sign
+  }
+
+  /// Set whether to skip signing.
+  pub fn set_no_sign(&mut self, no_sign: bool) {
+    self.no_sign = no_sign;
+  }
 }
--- a/crates/tauri-bundler/src/bundle/updater_bundle.rs
+++ b/crates/tauri-bundler/src/bundle/updater_bundle.rs
@@ -11,10 +11,11 @@ use crate::{
    },
    Bundle,
  },
+  error::{Context, ErrorExt},
  utils::fs_utils,
  Settings,
 };
-use tauri_utils::display_path;
+use tauri_utils::{display_path, platform::Target as TargetPlatform};

 use std::{
  fs::{self, File},
@@ -22,19 +23,13 @@ use std::{
  path::{Path, PathBuf},
 };

-use anyhow::Context;
 use zip::write::SimpleFileOptions;

 // Build update
 pub fn bundle_project(settings: &Settings, bundles: &[Bundle]) -> crate::Result<Vec<PathBuf>> {
-  let target_os = settings
-    .target()
-    .split('-')
-    .nth(2)
-    .unwrap_or(std::env::consts::OS)
-    .replace("darwin", "macos");
+  let target_os = settings.target_platform();

-  if target_os == "windows" {
+  if matches!(target_os, TargetPlatform::Windows) {
    return bundle_update_windows(settings, bundles);
  }

@@ -193,7 +188,7 @@ fn bundle_update_windows(settings: &Settings, bundles: &[Bundle]) -> crate::Resu
          p.push(c);
          (p, b)
        });
-    let archived_path = archived_path.with_extension(format!("{}.zip", bundle_name));
+    let archived_path = archived_path.with_extension(format!("{bundle_name}.zip"));

    log::info!(action = "Bundling"; "{}", display_path(&archived_path));

@@ -221,7 +216,9 @@ pub fn create_zip(src_file: &Path, dst_file: &Path) -> crate::Result<PathBuf> {
    .unix_permissions(0o755);

  zip.start_file(file_name.to_string_lossy(), options)?;
-  let mut f = File::open(src_file)?;
+  let mut f =
+    File::open(src_file).fs_context("failed to open updater ZIP file", src_file.to_path_buf())?;
+
  let mut buffer = Vec::new();
  f.read_to_end(&mut buffer)?;
  zip.write_all(&buffer)?;
--- a/crates/tauri-bundler/src/bundle/windows/mod.rs
+++ b/crates/tauri-bundler/src/bundle/windows/mod.rs
@@ -5,6 +5,7 @@

 #[cfg(target_os = "windows")]
 pub mod msi;
+
 pub mod nsis;
 pub mod sign;

--- a/crates/tauri-bundler/src/bundle/windows/msi/main.wxs
+++ b/crates/tauri-bundler/src/bundle/windows/msi/main.wxs
@@ -70,12 +70,16 @@
        <Property Id="ARPURLUPDATEINFO" Value="{{homepage}}"/>
        {{/if}}

+        <!-- NOTE: The order of RegistrySearch elements below matters. In WIX, when multiple
+             RegistrySearch elements are listed under a single Property, the LAST successful
+             match wins. We list the NSIS default-key search first and the MSI InstallDir
+             search second so that the MSI-specific path takes priority when both keys exist. -->
        <Property Id="INSTALLDIR">
-          <!-- First attempt: Search for "InstallDir" -->
-          <RegistrySearch Id="PrevInstallDirWithName" Root="HKCU" Key="Software\\{{manufacturer}}\\{{product_name}}" Name="InstallDir" Type="raw" />
-
-          <!-- Second attempt: If the first fails, search for the default key value (this is how the nsis installer currently stores the path) -->
+          <!-- First attempt: Search for the default key value (this is how the nsis installer stores the path) -->
          <RegistrySearch Id="PrevInstallDirNoName" Root="HKCU" Key="Software\\{{manufacturer}}\\{{product_name}}" Type="raw" />
+
+          <!-- Second attempt: Search for "InstallDir" which takes priority if found (this is how the msi installer stores the path) -->
+          <RegistrySearch Id="PrevInstallDirWithName" Root="HKCU" Key="Software\\{{manufacturer}}\\{{product_name}}" Name="InstallDir" Type="raw" />
        </Property>

        <!-- launch app checkbox -->
@@ -279,38 +283,62 @@

        {{#if install_webview}}
        <!-- WebView2 -->
-        <Property Id="WVRTINSTALLED">
-            <RegistrySearch Id="WVRTInstalledSystem" Root="HKLM" Key="SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" Name="pv" Type="raw" Win64="no" />
-            <RegistrySearch Id="WVRTInstalledUser" Root="HKCU" Key="SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" Name="pv" Type="raw"/>
+        <Property Id="INSTALLED_WEBVIEW2_VERSION">
+            <RegistrySearch Id="Webview2VersionSystemx64" Root="HKLM" Key="SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" Name="pv" Type="raw" />
+            <RegistrySearch Id="Webview2VersionSystemx86" Root="HKLM" Key="SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" Name="pv" Type="raw" />
+            <RegistrySearch Id="Webview2VersionUser" Root="HKCU" Key="SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" Name="pv" Type="raw"/>
        </Property>

        {{#if download_bootstrapper}}
+        <!-- Download webview bootstrapper mode -->
        <CustomAction Id='DownloadAndInvokeBootstrapper' Directory="INSTALLDIR" Execute="deferred" ExeCommand='powershell.exe -NoProfile -windowstyle hidden try [\{] [\[]Net.ServicePointManager[\]]::SecurityProtocol = [\[]Net.SecurityProtocolType[\]]::Tls12 [\}] catch [\{][\}]; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ({{webview_installer_args}} &apos;/install&apos;) -Wait' Return='check'/>
        <InstallExecuteSequence>
            <Custom Action='DownloadAndInvokeBootstrapper' Before='InstallFinalize'>
-                <![CDATA[NOT(REMOVE OR WVRTINSTALLED)]]>
+                <![CDATA[NOT(REMOVE OR INSTALLED_WEBVIEW2_VERSION)]]>
            </Custom>
        </InstallExecuteSequence>
        {{/if}}

-        <!-- Embedded webview bootstrapper mode -->
        {{#if webview2_bootstrapper_path}}
+        <!-- Embedded webview bootstrapper mode -->
        <Binary Id="MicrosoftEdgeWebview2Setup.exe" SourceFile="{{webview2_bootstrapper_path}}"/>
        <CustomAction Id='InvokeBootstrapper' BinaryKey='MicrosoftEdgeWebview2Setup.exe' Execute="deferred" ExeCommand='{{webview_installer_args}} /install' Return='check' />
        <InstallExecuteSequence>
            <Custom Action='InvokeBootstrapper' Before='InstallFinalize'>
-                <![CDATA[NOT(REMOVE OR WVRTINSTALLED)]]>
+                <![CDATA[NOT(REMOVE OR INSTALLED_WEBVIEW2_VERSION)]]>
            </Custom>
        </InstallExecuteSequence>
        {{/if}}

-        <!-- Embedded offline installer -->
        {{#if webview2_installer_path}}
+        <!-- Embedded offline installer -->
        <Binary Id="MicrosoftEdgeWebView2RuntimeInstaller.exe" SourceFile="{{webview2_installer_path}}"/>
        <CustomAction Id='InvokeStandalone' BinaryKey='MicrosoftEdgeWebView2RuntimeInstaller.exe' Execute="deferred" ExeCommand='{{webview_installer_args}} /install' Return='check' />
        <InstallExecuteSequence>
            <Custom Action='InvokeStandalone' Before='InstallFinalize'>
-                <![CDATA[NOT(REMOVE OR WVRTINSTALLED)]]>
+                <![CDATA[NOT(REMOVE OR INSTALLED_WEBVIEW2_VERSION)]]>
+            </Custom>
+        </InstallExecuteSequence>
+        {{/if}}
+
+        {{#if minimum_webview2_version}}
+        <!-- Update WebView2 if minimum version requirement not met -->
+        <Property Id="MINIMUM_WEBVIEW2_VERSION" Value="{{minimum_webview2_version}}" />
+        <Property Id="EDGEUPDATE_PATH">
+            <RegistrySearch Id="EdgeUpdateLocalMachine64" Root="HKLM" Key="SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate" Name="path" Type="raw" />
+            <RegistrySearch Id="EdgeUpdateLocalMachine32" Root="HKLM" Key="SOFTWARE\Microsoft\EdgeUpdate" Name="path" Type="raw"/>
+            <RegistrySearch Id="EdgeUpdateCurrentUser" Root="HKCU" Key="SOFTWARE\Microsoft\EdgeUpdate" Name="path" Type="raw"/>
+        </Property>
+        <!-- Chromium updater docs: https://source.chromium.org/chromium/chromium/src/+/main:docs/updater/user_manual.md -->
+        <!-- Modified from "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView\ModifyPath" -->
+        <CustomAction Id="UpdateWebView2ViaEdgeUpdate" Execute="deferred" Property="EDGEUPDATE_PATH" Return="check" Impersonate="no" ExeCommand="/install appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&amp;needsadmin=true" />
+        <InstallExecuteSequence>
+            <Custom Action='UpdateWebView2ViaEdgeUpdate' Before='InstallFinalize'>
+                <![CDATA[
+                  NOT REMOVE
+                  AND INSTALLED_WEBVIEW2_VERSION
+                  AND (INSTALLED_WEBVIEW2_VERSION < MINIMUM_WEBVIEW2_VERSION)
+                ]]>
            </Custom>
        </InstallExecuteSequence>
        {{/if}}
--- a/crates/tauri-bundler/src/bundle/windows/msi/mod.rs
+++ b/crates/tauri-bundler/src/bundle/windows/msi/mod.rs
@@ -7,20 +7,20 @@ use crate::{
  bundle::{
    settings::{Arch, Settings},
    windows::{
-      sign::try_sign,
+      sign::{should_sign, try_sign},
      util::{
        download_webview2_bootstrapper, download_webview2_offline_installer,
        WIX_OUTPUT_FOLDER_NAME, WIX_UPDATER_OUTPUT_FOLDER_NAME,
      },
    },
  },
+  error::Context,
  utils::{
    fs_utils::copy_file,
    http_utils::{download_and_verify, extract_zip, HashAlgorithm},
    CommandExt,
  },
 };
-use anyhow::{bail, Context};
 use handlebars::{html_escape, to_json, Handlebars};
 use regex::Regex;
 use serde::{Deserialize, Serialize};
@@ -177,7 +177,7 @@ impl ResourceDirectory {
      directories.push_str(wix_string.as_str());
    }
    let wix_string = if self.name.is_empty() {
-      format!("{}{}", files, directories)
+      format!("{files}{directories}")
    } else {
      format!(
        r#"<Directory Id="I{id}" Name="{name}">{files}{directories}</Directory>"#,
@@ -221,8 +221,7 @@ fn app_installer_output_path(
    Arch::AArch64 => "arm64",
    target => {
      return Err(crate::Error::ArchError(format!(
-        "Unsupported architecture: {:?}",
-        target
+        "Unsupported architecture: {target:?}"
      )))
    }
  };
@@ -280,37 +279,40 @@ fn clear_env_for_wix(cmd: &mut Command) {
  }
 }

-fn validate_wix_version(version_str: &str) -> anyhow::Result<()> {
+fn validate_wix_version(version_str: &str) -> crate::Result<()> {
  let components = version_str
    .split('.')
    .flat_map(|c| c.parse::<u64>().ok())
    .collect::<Vec<_>>();

-  anyhow::ensure!(
-    components.len() >= 3,
-    "app wix version should be in the format major.minor.patch.build (build is optional)"
-  );
+  if components.len() < 3 {
+    crate::error::bail!(
+      "app wix version should be in the format major.minor.patch.build (build is optional)"
+    );
+  }

  if components[0] > 255 {
-    bail!("app version major number cannot be greater than 255");
+    crate::error::bail!("app version major number cannot be greater than 255");
  }
  if components[1] > 255 {
-    bail!("app version minor number cannot be greater than 255");
+    crate::error::bail!("app version minor number cannot be greater than 255");
  }
  if components[2] > 65535 {
-    bail!("app version patch number cannot be greater than 65535");
+    crate::error::bail!("app version patch number cannot be greater than 65535");
  }

  if components.len() == 4 && components[3] > 65535 {
-    bail!("app version build number cannot be greater than 65535");
+    crate::error::bail!("app version build number cannot be greater than 65535");
  }

  Ok(())
 }

 // WiX requires versions to be numeric only in a `major.minor.patch.build` format
-fn convert_version(version_str: &str) -> anyhow::Result<String> {
-  let version = semver::Version::parse(version_str).context("invalid app version")?;
+fn convert_version(version_str: &str) -> crate::Result<String> {
+  let version = semver::Version::parse(version_str)
+    .map_err(Into::into)
+    .context("invalid app version")?;
  if !version.build.is_empty() {
    let build = version.build.parse::<u64>();
    if build.map(|b| b <= 65535).unwrap_or_default() {
@@ -319,7 +321,7 @@ fn convert_version(version_str: &str) -> anyhow::Result<String> {
        version.major, version.minor, version.patch, version.build
      ));
    } else {
-      bail!("optional build metadata in app version must be numeric-only and cannot be greater than 65535 for msi target");
+      crate::error::bail!("optional build metadata in app version must be numeric-only and cannot be greater than 65535 for msi target");
    }
  }

@@ -331,7 +333,7 @@ fn convert_version(version_str: &str) -> anyhow::Result<String> {
        version.major, version.minor, version.patch, version.pre
      ));
    } else {
-      bail!("optional pre-release identifier in app version must be numeric-only and cannot be greater than 65535 for msi target");
+      crate::error::bail!("optional pre-release identifier in app version must be numeric-only and cannot be greater than 65535 for msi target");
    }
  }

@@ -352,8 +354,7 @@ fn run_candle(
    Arch::AArch64 => "arm64",
    target => {
      return Err(crate::Error::ArchError(format!(
-        "unsupported architecture: {:?}",
-        target
+        "unsupported architecture: {target:?}"
      )))
    }
  };
@@ -389,11 +390,7 @@ fn run_candle(
    cmd.arg(ext);
  }
  clear_env_for_wix(&mut cmd);
-  cmd
-    .args(&args)
-    .current_dir(cwd)
-    .output_ok()
-    .context("error running candle.exe")?;
+  cmd.args(&args).current_dir(cwd).output_ok()?;

  Ok(())
 }
@@ -418,11 +415,7 @@ fn run_light(
    cmd.arg(ext);
  }
  clear_env_for_wix(&mut cmd);
-  cmd
-    .args(&args)
-    .current_dir(build_path)
-    .output_ok()
-    .context("error running light.exe")?;
+  cmd.args(&args).current_dir(build_path).output_ok()?;

  Ok(())
 }
@@ -443,8 +436,7 @@ pub fn build_wix_app_installer(
    Arch::AArch64 => "arm64",
    target => {
      return Err(crate::Error::ArchError(format!(
-        "unsupported architecture: {:?}",
-        target
+        "unsupported architecture: {target:?}"
      )))
    }
  };
@@ -472,6 +464,15 @@ pub fn build_wix_app_installer(
  }
  fs::create_dir_all(&output_path)?;

+  // when we're performing code signing, we'll sign some WiX DLLs, so we make a local copy
+  let wix_toolset_path = if settings.windows().can_sign() {
+    let wix_path = output_path.join("wix");
+    crate::utils::fs_utils::copy_dir(wix_toolset_path, &wix_path)?;
+    wix_path
+  } else {
+    wix_toolset_path.to_path_buf()
+  };
+
  let mut data = BTreeMap::new();

  let silent_webview_install = if let WebviewInstallMode::DownloadBootstrapper { silent }
@@ -531,6 +532,13 @@ pub fn build_wix_app_installer(
    }
  }

+  if let Some(minimum_webview2_version) = &settings.windows().minimum_webview2_version {
+    data.insert(
+      "minimum_webview2_version",
+      to_json(minimum_webview2_version),
+    );
+  }
+
  if let Some(license) = settings.license_file() {
    if license.ends_with(".rtf") {
      data.insert("license", to_json(license));
@@ -696,7 +704,9 @@ pub fn build_wix_app_installer(
      .iter()
      .flat_map(|p| &p.schemes)
      .collect::<Vec<_>>();
-    data.insert("deep_link_protocols", to_json(schemes));
+    if !schemes.is_empty() {
+      data.insert("deep_link_protocols", to_json(schemes));
+    }
  }

  if let Some(path) = custom_template_path {
@@ -750,22 +760,28 @@ pub fn build_wix_app_installer(
  }

  let main_wxs_path = output_path.join("main.wxs");
-  fs::write(main_wxs_path, handlebars.render("main.wxs", &data)?)?;
+  fs::write(&main_wxs_path, handlebars.render("main.wxs", &data)?)?;

-  let mut candle_inputs = vec![("main.wxs".into(), Vec::new())];
+  let mut candle_inputs = vec![];

  let current_dir = std::env::current_dir()?;
  let extension_regex = Regex::new("\"http://schemas.microsoft.com/wix/(\\w+)\"")?;
-  for fragment_path in fragment_paths {
-    let fragment_path = current_dir.join(fragment_path);
-    let fragment_content = fs::read_to_string(&fragment_path)?;
-    let fragment_handlebars = Handlebars::new();
-    let fragment = fragment_handlebars.render_template(&fragment_content, &data)?;
+  let input_paths =
+    std::iter::once(main_wxs_path).chain(fragment_paths.iter().map(|p| current_dir.join(p)));
+
+  for input_path in input_paths {
+    let input_content = fs::read_to_string(&input_path)?;
+    let input_handlebars = Handlebars::new();
+    let input = input_handlebars.render_template(&input_content, &data)?;
    let mut extensions = Vec::new();
-    for cap in extension_regex.captures_iter(&fragment) {
-      extensions.push(wix_toolset_path.join(format!("Wix{}.dll", &cap[1])));
+    for cap in extension_regex.captures_iter(&input) {
+      let path = wix_toolset_path.join(format!("Wix{}.dll", &cap[1]));
+      if settings.windows().can_sign() {
+        try_sign(&path, settings)?;
+      }
+      extensions.push(path);
    }
-    candle_inputs.push((fragment_path, extensions));
+    candle_inputs.push((input_path, extensions));
  }

  let mut fragment_extensions = HashSet::new();
@@ -773,11 +789,18 @@ pub fn build_wix_app_installer(
  fragment_extensions.insert(wix_toolset_path.join("WixUIExtension.dll"));
  fragment_extensions.insert(wix_toolset_path.join("WixUtilExtension.dll"));

+  // sign default extensions
+  if settings.windows().can_sign() {
+    for path in &fragment_extensions {
+      try_sign(path, settings)?;
+    }
+  }
+
  for (path, extensions) in candle_inputs {
    for ext in &extensions {
      fragment_extensions.insert(ext.clone());
    }
-    run_candle(settings, wix_toolset_path, &output_path, path, extensions)?;
+    run_candle(settings, &wix_toolset_path, &output_path, path, extensions)?;
  }

  let mut output_paths = Vec::new();
@@ -824,7 +847,7 @@ pub fn build_wix_app_installer(

    let locale_contents = locale_contents.replace(
      "</WixLocalization>",
-      &format!("{}</WixLocalization>", unset_locale_strings),
+      &format!("{unset_locale_strings}</WixLocalization>"),
    );
    let locale_path = output_path.join("locale.wxl");
    {
@@ -853,7 +876,7 @@ pub fn build_wix_app_installer(
    log::info!(action = "Running"; "light to produce {}", display_path(&msi_path));

    run_light(
-      wix_toolset_path,
+      &wix_toolset_path,
      &output_path,
      arguments,
      &(fragment_extensions.clone().into_iter().collect()),
@@ -861,7 +884,7 @@ pub fn build_wix_app_installer(
    )?;
    fs::rename(&msi_output_path, &msi_path)?;

-    if settings.can_sign() {
+    if settings.windows().can_sign() {
      try_sign(&msi_path, settings)?;
    }

@@ -968,9 +991,12 @@ fn generate_resource_data(settings: &Settings) -> crate::Result<ResourceMap> {
    if added_resources.contains(&resource_path) {
      continue;
    }
-
    added_resources.push(resource_path.clone());

+    if settings.windows().can_sign() && should_sign(&resource_path)? {
+      try_sign(&resource_path, settings)?;
+    }
+
    let resource_entry = ResourceFile {
      id: format!("I{}", Uuid::new_v4().as_simple()),
      guid: Uuid::new_v4().to_string(),
@@ -1055,6 +1081,10 @@ fn generate_resource_data(settings: &Settings) -> crate::Result<ResourceMap> {
      .to_string_lossy()
      .into_owned();
    if !added_resources.iter().any(|r| r.ends_with(&relative_path)) {
+      if settings.windows().can_sign() {
+        try_sign(resource_path, settings)?;
+      }
+
      dlls.push(ResourceFile {
        id: format!("I{}", Uuid::new_v4().as_simple()),
        guid: Uuid::new_v4().to_string(),
--- a/crates/tauri-bundler/src/bundle/windows/nsis/installer.nsi
+++ b/crates/tauri-bundler/src/bundle/windows/nsis/installer.nsi
@@ -41,13 +41,15 @@ ${StrLoc}
 !define INSTALLERICON "{{installer_icon}}"
 !define SIDEBARIMAGE "{{sidebar_image}}"
 !define HEADERIMAGE "{{header_image}}"
+!define UNINSTALLERICON "{{uninstaller_icon}}"
+!define UNINSTALLERHEADERIMAGE "{{uninstaller_header_image}}"
 !define MAINBINARYNAME "{{main_binary_name}}"
 !define MAINBINARYSRCPATH "{{main_binary_path}}"
 !define BUNDLEID "{{bundle_id}}"
 !define COPYRIGHT "{{copyright}}"
 !define OUTFILE "{{out_file}}"
 !define ARCH "{{arch}}"
-!define PLUGINSPATH "{{additional_plugins_path}}"
+!define ADDITIONALPLUGINSPATH "{{additional_plugins_path}}"
 !define ALLOWDOWNGRADES "{{allow_downgrades}}"
 !define DISPLAYLANGUAGESELECTOR "{{display_language_selector}}"
 !define INSTALLWEBVIEW2MODE "{{install_webview2_mode}}"
@@ -85,10 +87,8 @@ VIAddVersionKey "LegalCopyright" "${COPYRIGHT}"
 VIAddVersionKey "FileVersion" "${VERSION}"
 VIAddVersionKey "ProductVersion" "${VERSION}"

-; Plugins path, currently exists for linux only
-!if "${PLUGINSPATH}" != ""
-    !addplugindir "${PLUGINSPATH}"
-!endif
+# additional plugins
+!addplugindir "${ADDITIONALPLUGINSPATH}"

 ; Uninstaller signing command
 !if "${UNINSTALLERSIGNCOMMAND}" != ""
@@ -97,7 +97,7 @@ VIAddVersionKey "ProductVersion" "${VERSION}"

 ; Handle install mode, `perUser`, `perMachine` or `both`
 !if "${INSTALLMODE}" == "perMachine"
-  RequestExecutionLevel highest
+  RequestExecutionLevel admin
 !endif

 !if "${INSTALLMODE}" == "currentUser"
@@ -131,10 +131,26 @@ VIAddVersionKey "ProductVersion" "${VERSION}"
  !define MUI_WELCOMEFINISHPAGE_BITMAP "${SIDEBARIMAGE}"
 !endif

-; Installer header image
+; Enable header images for installer and uninstaller pages when either image is configured.
 !if "${HEADERIMAGE}" != ""
  !define MUI_HEADERIMAGE
-  !define MUI_HEADERIMAGE_BITMAP  "${HEADERIMAGE}"
+!else if "${UNINSTALLERHEADERIMAGE}" != ""
+  !define MUI_HEADERIMAGE
+!endif
+
+; Installer header image
+!if "${HEADERIMAGE}" != ""
+  !define MUI_HEADERIMAGE_BITMAP "${HEADERIMAGE}"
+!endif
+
+; Uninstaller header image
+!if "${UNINSTALLERHEADERIMAGE}" != ""
+  !define MUI_HEADERIMAGE_UNBITMAP "${UNINSTALLERHEADERIMAGE}"
+!endif
+
+; Uninstaller icon
+!if "${UNINSTALLERICON}" != ""
+  !define MUI_UNICON "${UNINSTALLERICON}"
 !endif

 ; Define registry key to store installer language
@@ -620,7 +636,7 @@ Section Install
    !insertmacro NSIS_HOOK_PREINSTALL
  !endif

-  !insertmacro CheckIfAppIsRunning
+  !insertmacro CheckIfAppIsRunning "${MAINBINARYNAME}.exe" "${PRODUCTNAME}"

  ; Copy main executable
  File "${MAINBINARYSRCPATH}"
@@ -757,7 +773,7 @@ Section Uninstall
    !insertmacro NSIS_HOOK_PREUNINSTALL
  !endif

-  !insertmacro CheckIfAppIsRunning
+  !insertmacro CheckIfAppIsRunning "${MAINBINARYNAME}.exe" "${PRODUCTNAME}"

  ; Delete the app directory and its content from disk
  ; Copy main executable
--- a/crates/tauri-bundler/src/bundle/windows/nsis/languages/Arabic.nsh
+++ b/crates/tauri-bundler/src/bundle/windows/nsis/languages/Arabic.nsh
@@ -1,14 +1,14 @@
 LangString addOrReinstall ${LANG_ARABIC} "إضافة أو إزالة المكونات"
 LangString alreadyInstalled ${LANG_ARABIC} "التطبيق مثبت بالفعل"
 LangString alreadyInstalledLong ${LANG_ARABIC} "${PRODUCTNAME} ${VERSION} مثبت بالفعل. قم باختيار العملية التى تريدها ثم اضغط على التالى."
-LangString appRunning ${LANG_ARABIC} "${PRODUCTNAME} مازال يعمل! من فضلك، قم بإغلاق التطبيق أولاً ثم حاول مرة أخرى."
-LangString appRunningOkKill ${LANG_ARABIC} "${PRODUCTNAME} مازال يعمل!$\nاضغط OK لإغلاقه"
+LangString appRunning ${LANG_ARABIC} "{{product_name}} مازال يعمل! من فضلك، قم بإغلاق التطبيق أولاً ثم حاول مرة أخرى."
+LangString appRunningOkKill ${LANG_ARABIC} "{{product_name}} مازال يعمل!$\nاضغط OK لإغلاقه"
 LangString chooseMaintenanceOption ${LANG_ARABIC} "قم باختيار نوع الصيانة التى تريدها."
 LangString choowHowToInstall ${LANG_ARABIC} "قم باختيار طريقة تنصيب ${PRODUCTNAME}."
 LangString createDesktop ${LANG_ARABIC} "اضف اختصار على سطح المكتب"
 LangString dontUninstall ${LANG_ARABIC} "عدم إزالة"
 LangString dontUninstallDowngrade ${LANG_ARABIC} "عدم إزالة (التخفيض بدون إزالة غير مسموح لهذا المثبت)"
-LangString failedToKillApp ${LANG_ARABIC} "فشل فى غلف ${PRODUCTNAME}. من فضلك، قم بإغلاق التطبيق أولاً ثم حاول مرة أخرى."
+LangString failedToKillApp ${LANG_ARABIC} "فشل فى غلف {{product_name}}. من فضلك، قم بإغلاق التطبيق أولاً ثم حاول مرة أخرى."
 LangString installingWebview2 ${LANG_ARABIC} "تنصيب WebView2..."
 LangString newerVersionInstalled ${LANG_ARABIC} "يوجد نسخة جديدة من ${PRODUCTNAME} مثبتة بالغعل! لا ينصح بتنصيب نسخة اقدم من النسخة الحالية. اذا مازلت ترغب فى تنصيب النسخة الأقدم، فينصح بإزالة النسخة الحالية أولاً. قم باختيار العملية التى تريدها ثم اضغط على التالى للاستمرار."
 LangString older ${LANG_ARABIC} "أقدم"
--- a/crates/tauri-bundler/src/bundle/windows/nsis/languages/Bulgarian.nsh
+++ b/crates/tauri-bundler/src/bundle/windows/nsis/languages/Bulgarian.nsh
@@ -1,14 +1,14 @@
 LangString addOrReinstall ${LANG_BULGARIAN} "Добавяне/Преинсталиране на компоненти"
 LangString alreadyInstalled ${LANG_BULGARIAN} "Вече инсталиран"
 LangString alreadyInstalledLong ${LANG_BULGARIAN} "${PRODUCTNAME} ${VERSION} е вече е инсталиран. Изберете операцията, която искате да извършите и натиснете Напред, за да продължите."
-LangString appRunning ${LANG_BULGARIAN} "${PRODUCTNAME} е отворен! Моля, затворете го първо и опитайте отново."
-LangString appRunningOkKill ${LANG_BULGARIAN} "${PRODUCTNAME} е отворен!$\nНатиснете ОК, за да го затворите."
+LangString appRunning ${LANG_BULGARIAN} "{{product_name}} е отворен! Моля, затворете го първо и опитайте отново."
+LangString appRunningOkKill ${LANG_BULGARIAN} "{{product_name}} е отворен!$\nНатиснете ОК, за да го затворите."
 LangString chooseMaintenanceOption ${LANG_BULGARIAN} "Изберете опция за поддръжка."
 LangString choowHowToInstall ${LANG_BULGARIAN} "Изберете как искате да инсталирате ${PRODUCTNAME}."
 LangString createDesktop ${LANG_BULGARIAN} "Създайте пряк път на работния плот"
 LangString dontUninstall ${LANG_BULGARIAN} "Не деинсталирайте"
 LangString dontUninstallDowngrade ${LANG_BULGARIAN} "Не деинсталирайте (Понижаването без деинсталация е забранено за този инсталатор)"
-LangString failedToKillApp ${LANG_BULGARIAN} "Неуспешно прекратяване на ${PRODUCTNAME}. Моля, затворете го първо и опитайте отново."
+LangString failedToKillApp ${LANG_BULGARIAN} "Неуспешно прекратяване на {{product_name}}. Моля, затворете го първо и опитайте отново."
 LangString installingWebview2 ${LANG_BULGARIAN} "Инсталиране на WebView2..."
 LangString newerVersionInstalled ${LANG_BULGARIAN} "Вече е инсталирана по-нова версия на ${PRODUCTNAME}! Не се препоръчва да инсталирате по-стара версия. Ако наистина желаете да инсталирате тази по-стара версия, по-добре е да деинсталирате текущата версия първо. Изберете операцията, която искате да извършите и натиснете Напред, за да продължите."
 LangString older ${LANG_BULGARIAN} "по-стара"
--- a/crates/tauri-bundler/src/bundle/windows/nsis/languages/Dutch.nsh
+++ b/crates/tauri-bundler/src/bundle/windows/nsis/languages/Dutch.nsh
@@ -1,14 +1,14 @@
 LangString addOrReinstall ${LANG_DUTCH} "(Her)installeer componenten"
 LangString alreadyInstalled ${LANG_DUTCH} "Al geïnstalleerd"
 LangString alreadyInstalledLong ${LANG_DUTCH} "${PRODUCTNAME} ${VERSION} is al geïnstalleerd. Kies een van de volgende opties en klik op Volgende om door te gaan."
-LangString appRunning ${LANG_DUTCH} "${PRODUCTNAME} is geopend! Sluit het programma eerst en probeer het dan opnieuw."
-LangString appRunningOkKill ${LANG_DUTCH} "${PRODUCTNAME} is geopend!$\nKlik op OK om het te stoppen."
+LangString appRunning ${LANG_DUTCH} "{{product_name}} is geopend! Sluit het programma eerst en probeer het dan opnieuw."
+LangString appRunningOkKill ${LANG_DUTCH} "{{product_name}} is geopend!$\nKlik op OK om het te stoppen."
 LangString chooseMaintenanceOption ${LANG_DUTCH} "Kies de onderhoudsoptie die u wilt uitvoeren."
 LangString choowHowToInstall ${LANG_DUTCH} "Kies hoe u ${PRODUCTNAME} wilt installeren."
 LangString createDesktop ${LANG_DUTCH} "Maak een snelkoppeling aan op het bureaublad"
 LangString dontUninstall ${LANG_DUTCH} "Deïnstalleer niet"
 LangString dontUninstallDowngrade ${LANG_DUTCH} "Deïnstalleer niet (Downgraden zonder deïnstalleren is uitgeschakeld voor deze installer)"
-LangString failedToKillApp ${LANG_DUTCH} "Het is niet gelukt ${PRODUCTNAME} te stoppen. Sluit het eerst zelf en probeer het dan nog een keer"
+LangString failedToKillApp ${LANG_DUTCH} "Het is niet gelukt {{product_name}} te stoppen. Sluit het eerst zelf en probeer het dan nog een keer"
 LangString installingWebview2 ${LANG_DUTCH} "WebView2 wordt geïnstalleerd..."
 LangString newerVersionInstalled ${LANG_DUTCH} "Een nieuwere versie van ${PRODUCTNAME} is al geïnstalleerd! Het word niet aangeraden om een oudere versie te installeren. Als u echt deze oudere versie wilt installeren, kunt u beter de huidige versie eerst deïnstalleren. Kies een van de volgende opties en klik op Volgende om door te gaan."
 LangString older ${LANG_DUTCH} "oudere"
--- a/crates/tauri-bundler/src/bundle/windows/nsis/languages/English.nsh
+++ b/crates/tauri-bundler/src/bundle/windows/nsis/languages/English.nsh
@@ -1,14 +1,14 @@
 LangString addOrReinstall ${LANG_ENGLISH} "Add/Reinstall components"
 LangString alreadyInstalled ${LANG_ENGLISH} "Already Installed"
 LangString alreadyInstalledLong ${LANG_ENGLISH} "${PRODUCTNAME} ${VERSION} is already installed. Select the operation you want to perform and click Next to continue."
-LangString appRunning ${LANG_ENGLISH} "${PRODUCTNAME} is running! Please close it first then try again."
-LangString appRunningOkKill ${LANG_ENGLISH} "${PRODUCTNAME} is running!$\nClick OK to kill it"
+LangString appRunning ${LANG_ENGLISH} "{{product_name}} is running! Please close it first then try again."
+LangString appRunningOkKill ${LANG_ENGLISH} "{{product_name}} is running!$\nClick OK to kill it"
 LangString chooseMaintenanceOption ${LANG_ENGLISH} "Choose the maintenance option to perform."
 LangString choowHowToInstall ${LANG_ENGLISH} "Choose how you want to install ${PRODUCTNAME}."
 LangString createDesktop ${LANG_ENGLISH} "Create desktop shortcut"
 LangString dontUninstall ${LANG_ENGLISH} "Do not uninstall"
 LangString dontUninstallDowngrade ${LANG_ENGLISH} "Do not uninstall (Downgrading without uninstall is disabled for this installer)"
-LangString failedToKillApp ${LANG_ENGLISH} "Failed to kill ${PRODUCTNAME}. Please close it first then try again"
+LangString failedToKillApp ${LANG_ENGLISH} "Failed to kill {{product_name}}. Please close it first then try again"
 LangString installingWebview2 ${LANG_ENGLISH} "Installing WebView2..."
 LangString newerVersionInstalled ${LANG_ENGLISH} "A newer version of ${PRODUCTNAME} is already installed! It is not recommended that you install an older version. If you really want to install this older version, it's better to uninstall the current version first. Select the operation you want to perform and click Next to continue."
 LangString older ${LANG_ENGLISH} "older"
--- a/Show More
+++ b/Show More