[bug] NSIS Auto-Updater requires Admin Permissions, while manual install does not

florianzachstailoryoung commented 1 week ago

Describe the bug

I am implementing Auto-Updating in my App and I am using Tauri v2 and the Updater plugin. (sorry if it's the wrong place here) The update itself works. However, when the update installs automatically, a UAC prompt pops up, requiring administrative rights. I confirmed that no administrative rights are required when i install both versions manually, but when i install the older one, which then tries to install the newer one, admin is required. (which is a deal breaker)

It may be a misconfiguration on my side, but it honestly sounds like a bug. I would be happy to give more information if someone can tell me how to further troubleshoot this issue.

Reproduction

Take a Tauri project, install the updater plugin, define the required config keys and signatures, build it, setup a CI pipeline with the Tauri Action and set everything up to automatically download and install an update from GitHub Releases. You should see that after the update downloads and installs, a UAC prompt pops up, asking for administrative rights.

Repro is really hard without making code public I shouldn't. The update signing and server setup is quite a hassle. I can try to create one later if nobody can recreate my issue.

Expected behavior

The Updater should install the new version without admin password, because when i install it manually, it also doesn't need it.

Full `tauri info` output

> ty-teamtime@1.0.42 tauri
> tauri info

[✔] Environment
    - OS: Windows 10.0.22631 x86_64 (X64)
    ✔ WebView2: 130.0.2849.56
    ✔ MSVC: Visual Studio Community 2022
    ✔ rustc: 1.82.0 (f6e511eec 2024-10-15)
    ✔ cargo: 1.82.0 (8f40fc59f 2024-08-21)
    ✔ rustup: 1.27.1 (54dd3d00f 2024-04-24)
    ✔ Rust toolchain: stable-x86_64-pc-windows-msvc (default)
    - node: 20.12.1
    - pnpm: 8.15.6
    - npm: 10.9.0

[-] Packages
    - tauri 🦀: 2.0.4
    - tauri-build 🦀: 2.0.1
    - wry 🦀: 0.46.2
    - tao 🦀: 0.30.3
    - @tauri-apps/api : 2.0.2 (outdated, latest: 2.1.1)
    - @tauri-apps/cli : 2.0.3 (outdated, latest: 2.1.0)

[-] Plugins
    - tauri-plugin-process 🦀: 2.0.1
    - @tauri-apps/plugin-process : 2.0.0
    - tauri-plugin-single-instance 🦀: 2.0.1
    - @tauri-apps/plugin-single-instance : not installed!
    - tauri-plugin-autostart 🦀: 2.0.1
    - @tauri-apps/plugin-autostart : 2.0.0
    - tauri-plugin-updater 🦀: 2.0.2
    - @tauri-apps/plugin-updater : 2.0.0

[-] App
    - build-type: bundle
    - CSP: unset
    - frontendDist: ../dist
    - devUrl: http://localhost:1420/
    - framework: Vue.js
    - bundler: Vite

Stack trace

No response

Additional context

I want to know if this is a misconfiguration on my side, or if it's an actual bug. I could try setting up a repro repo but it's a huge pain and I want to avoid it if possible.

FabianLars commented 1 week ago

If we're talking about this release https://github.com/TYP-Consulting-GmbH/TY-TeamTime-Deployment/releases/tag/v1.0.42 then it's a misconfig.

The latest.json points to the .msi installer which currently always requires admin. Also, updating from setup.exe to .msi is not supported (the other around works).

I'd recommend to just not build the .msi. If you do require it for something it has to be decoupled somehow so that it gets it's own updater endpoint.

florianzachstailoryoung commented 4 days ago

Ah, thank you for pointing that out, I did not know .msi is in latest.json. I will try to get rid of msi installers 👍

tauri-apps / tauri