From d88b9de7aaeaaa2e42e4795dbc2b8642b5ae7a50 Mon Sep 17 00:00:00 2001
From: Lucas Fernandes Nogueira <lucas@tauri.studio>
Date: Thu, 4 Aug 2022 14:58:26 -0300
Subject: [PATCH] feat(core): add `fips_compliant` wix config option, closes
 #4541 (#4843)

---
 .changes/fips-compliant-env-var.md            |  6 ++++++
 .changes/fips-compliant.md                    |  5 +++++
 tooling/bundler/src/bundle/settings.rs        |  2 ++
 tooling/bundler/src/bundle/windows/msi/wix.rs | 12 +++++++++++-
 tooling/cli/src/helpers/config.rs             |  3 ++-
 5 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 .changes/fips-compliant-env-var.md
 create mode 100644 .changes/fips-compliant.md

diff --git a/.changes/fips-compliant-env-var.md b/.changes/fips-compliant-env-var.md
new file mode 100644
index 000000000..44934310e
--- /dev/null
+++ b/.changes/fips-compliant-env-var.md
@@ -0,0 +1,6 @@
+---
+"cli.rs": patch
+"cli.js": patch
+---
+
+Enable WiX FIPS compliance when the `TAURI_FIPS_COMPLIANT` environment variable is set to `true`.
diff --git a/.changes/fips-compliant.md b/.changes/fips-compliant.md
new file mode 100644
index 000000000..508d192f0
--- /dev/null
+++ b/.changes/fips-compliant.md
@@ -0,0 +1,5 @@
+---
+"tauri-bundler": patch
+---
+
+Add `fips_compliant` configuration option for WiX.
diff --git a/tooling/bundler/src/bundle/settings.rs b/tooling/bundler/src/bundle/settings.rs
index 2a8809df6..a81aeaefa 100644
--- a/tooling/bundler/src/bundle/settings.rs
+++ b/tooling/bundler/src/bundle/settings.rs
@@ -237,6 +237,8 @@ pub struct WixSettings {
 
   /// The required dimensions are 493px × 312px.
   pub dialog_image_path: Option<PathBuf>,
+  /// Enables FIPS compliant algorithms.
+  pub fips_compliant: bool,
 }
 
 /// The Windows bundle settings.
diff --git a/tooling/bundler/src/bundle/windows/msi/wix.rs b/tooling/bundler/src/bundle/windows/msi/wix.rs
index cfa5cc79f..f8cdf38be 100644
--- a/tooling/bundler/src/bundle/windows/msi/wix.rs
+++ b/tooling/bundler/src/bundle/windows/msi/wix.rs
@@ -305,7 +305,7 @@ fn run_candle(
     .find(|bin| bin.main())
     .ok_or_else(|| anyhow::anyhow!("Failed to get main binary"))?;
 
-  let args = vec![
+  let mut args = vec![
     "-arch".to_string(),
     arch.to_string(),
     wxs_file_path.to_string_lossy().to_string(),
@@ -315,6 +315,16 @@ fn run_candle(
     ),
   ];
 
+  if settings
+    .windows()
+    .wix
+    .as_ref()
+    .map(|w| w.fips_compliant)
+    .unwrap_or_default()
+  {
+    args.push("-fips".into());
+  }
+
   let candle_exe = wix_toolset_path.join("candle.exe");
 
   info!(action = "Running"; "candle for {:?}", wxs_file_path);
diff --git a/tooling/cli/src/helpers/config.rs b/tooling/cli/src/helpers/config.rs
index 65d177fa4..5681d8b32 100644
--- a/tooling/cli/src/helpers/config.rs
+++ b/tooling/cli/src/helpers/config.rs
@@ -11,7 +11,7 @@ pub use tauri_utils::config::*;
 
 use std::{
   collections::HashMap,
-  env::set_var,
+  env::{set_var, var_os},
   ffi::OsStr,
   process::exit,
   sync::{Arc, Mutex},
@@ -92,6 +92,7 @@ pub fn wix_settings(config: WixConfig) -> tauri_bundler::WixSettings {
     enable_elevated_update_task: config.enable_elevated_update_task,
     banner_path: config.banner_path,
     dialog_image_path: config.dialog_image_path,
+    fips_compliant: var_os("TAURI_FIPS_COMPLIANT").map_or(false, |v| v == "true"),
   }
 }