tauri-apps/tauri · error

failed to convert base64 to string

Error message

failed to convert base64 to string

What it means

Panic in tauri-macos-sign's decode_base64 (used for Keychain::with_certificate and provisioning profiles): the base64-encoded certificate/profile arrives as an OsStr (typically from the APPLE_CERTIFICATE / APPLE_PROVISIONING_PROFILE inputs of the macOS signing flow) and .to_str().expect("failed to convert base64 to string") fails when the value contains non-UTF-8 bytes — before any base64 decoding happens.

Source

Thrown at crates/tauri-macos-sign/src/lib.rs:339

          self
            .arg("--key-id")
            .arg(key_id)
            .arg("--key")
            .arg(key_path)
            .arg("--issuer")
            .arg(issuer),
        )
      }
    }
  }
}

fn decode_base64(base64_input: &OsStr, out_path: &Path) -> Result<()> {
  use base64::Engine;

  let input = base64_input
    .to_str()
    .expect("failed to convert base64 to string");

  // strip whitespace before decoding
  let cleaned: String = input.chars().filter(|c| !c.is_ascii_whitespace()).collect();

  let decoded = base64::engine::general_purpose::STANDARD
    .decode(&cleaned)
    .map_err(Error::Base64Decode)?;

  std::fs::write(out_path, &decoded).map_err(|error| Error::Fs {
    context: "failed to write decoded certificate",
    path: out_path.to_path_buf(),
    error,
  })?;

  Ok(())
}

fn assert_command(

View on GitHub (pinned to 52e4b6e71d)

Solutions

1. Regenerate the base64 cleanly: `openssl base64 -in cert.p12 -out cert.b64` and re-store the secret
2. Verify the storage is UTF-8: `iconv -f utf-8 -t utf-8 .env > /dev/null` and fix any reported bytes
3. In your own wrapper, read the secret with std::env::var (which rejects invalid UTF-8 with a clear error) instead of var_os

Example fix

# before: .env saved as Latin-1 with stray bytes → panic

# after
openssl base64 -in Certificates.p12 -A -out cert.b64
export APPLE_CERTIFICATE="$(cat cert.b64)"  # verified UTF-8

// std::env::var fails with a clear error on non-UTF-8 instead of panicking deep in the signer
let cert = std::env::var("APPLE_CERTIFICATE")
    .map_err(|_| "APPLE_CERTIFICATE missing or not valid UTF-8")?;

When it happens

Trigger: Supplying the certificate or provisioning profile secret from an OsString source with invalid UTF-8: a CI secret written by a binary process, a .env file saved with a legacy encoding or BOM, or a filename/argument with mangled bytes.

Common situations: Locally-sourced env vars from shells with legacy encodings; secrets piped through tools that inject a BOM or stray bytes; provisioning profiles renamed with invalid byte sequences.

Related errors

• {error_message}: {e}
• failed to get bundle filename
• failed to convert bundle_path to string
• failed to convert bundle filename to string
• failed to read plist {}: {}

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/1d644979966489d2. Report an issue: GitHub.