[bug] "Access is denied" (os error 5) when patching binary for NSIS bundle on Windows 11

[ggligor1967]

Describe the bug

When running cargo tauri build --bundles nsis or cargo tauri bundle --bundles nsis on Windows 11, the build succeeds but bundling fails at the "Patching binary" step with "Access is denied" error.

The error occurs immediately after Info Target: x64 is logged, before NSIS runs.

Reproduction

1. Create a Tauri v2 project on Windows 11
2. Run cargo tauri build --bundles nsis
3. Build succeeds, but bundling fails at patching step

Expected behavior

The binary should be patched successfully and NSIS installer should be created.

Full cargo tauri info output

tauri-cli 2.7.1

Stack trace

Info Patching binary "D:\\playground\\Aplicatia\\apps\\ui\\src-tauri\\target\\release\\video-orchestrator.exe" for type nsis
Info Target: x64
Error failed to bundle project:
    - `Access is denied. (os error 5)`

With RUST_BACKTRACE=full and -v flag:

Debug [tauri_bundler::bundle::windows::nsis] Target: x64
Error [tauri_cli] failed to bundle project:
    - `Access is denied. (os error 5)`

Additional context

Extensive debugging performed:

1. File is NOT locked - verified with PowerShell:

$stream = [System.IO.File]::Open($exe, 'Open', 'ReadWrite', 'None')
$stream.Close()  # Succeeds - file NOT locked

2. File CAN be written to - verified:

$bytes = [System.IO.File]::ReadAllBytes($exe)
[System.IO.File]::WriteAllBytes($exe, $bytes)  # Succeeds!

3. File can be renamed - no locks:

Rename-Item $exe "test.exe"  # Succeeds
Rename-Item "test.exe" $exe  # Succeeds

4. Tried different target directories - same error:

   • Original: D:\playground\Aplicatia\apps\ui\src-tauri\target\release\
   • Moved to: C:\TauriTarget\release\ via CARGO_TARGET_DIR - same error

5. Windows Defender settings verified:

   • Controlled Folder Access: Disabled (value=0)
   • Real-time Protection: Temporarily disabled - same error
   • Exclusion path added for project folder - same error
   • Process exclusions added for cargo.exe, rustc.exe, cargo-tauri.exe - same error

6. No other antivirus - only Windows Defender

7. Manual NSIS works - Created installer manually with makensis.exe successfully:

& "C:\Users\gglig\AppData\Local\tauri\NSIS\makensis.exe" installer.nsi
# Output: "VideoOrchestrator-Setup.exe" - 3.04 MB - SUCCESS

Conclusion: The issue is specifically in Tauri's binary patching code, not in Windows permissions, file locks, or antivirus software.

Platform and versions

• OS: Windows 11 Pro (Build 22631)
• Rust: 1.90.0
• Cargo: 1.90.0
• Node: 22.21.1
• tauri-cli: 2.7.1
• NSIS: 3.08 (at C:\Users\gglig\AppData\Local\tauri\NSIS\)

Workaround

Creating NSIS installer manually works:

!include "MUI2.nsh"
Name "Video Orchestrator"
OutFile "VideoOrchestrator-Setup.exe"
InstallDir "$PROGRAMFILES\Video Orchestrator"
; ... rest of script

& "C:\Users\gglig\AppData\Local\tauri\NSIS\makensis.exe" installer.nsi  # Works!

[Legend-Master]

The latest tauri-cli is at 2.9.5, do you mind give that a try?