Skip to content

Change how Windows code signing works because it broke #628

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
micahflee merged 1 commit into from
Feb 18, 2026
Merged

Change how Windows code signing works because it broke #628

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 31 additions & 4 deletions forge.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,35 @@ if (!fs.existsSync(buildPath)) {
}
const assetsPath = path.join(__dirname, "assets");

// Ensure the vendor signtool.exe used by Squirrel is the Windows SDK version.
// The bundled vendor signtool.exe is too old for RFC 3161 timestamping with ECC
// certificates. We also need to restore it if a previous failed build left a
// stale SEA binary in its place.
if (os.platform() === "win32") {
const vendorDir = path.join(
__dirname,
"node_modules",
"electron-winstaller",
"vendor",
);
const vendorSigntoolPath = path.join(vendorDir, "signtool.exe");
const backupPath = path.join(vendorDir, "signtool-original.exe");

// Clean up any stale SEA backup from a previous failed build
if (fs.existsSync(backupPath)) {
fs.unlinkSync(backupPath);
}

// Replace the vendor signtool.exe with the Windows SDK version
const sdkSigntoolPath = findLatestSigntoolPath();
if (sdkSigntoolPath) {
console.log(
`🔧 Replacing vendor signtool.exe with Windows SDK version: ${sdkSigntoolPath}`,
);
fs.copyFileSync(sdkSigntoolPath, vendorSigntoolPath);
}
}

// Build the X archive site
if (os.platform() == "win32") {
const scriptPath = path.join(__dirname, "scripts", "build-archive-sites.ps1");
Expand Down Expand Up @@ -232,11 +261,9 @@ const config: ForgeConfig = {
name: process.env.CYD_ENV == "prod" ? "Cyd" : "CydDev",
setupIcon: path.join(assetsPath, "installer-icon.ico"),
loadingGif: path.join(assetsPath, "installer-loading.gif"),
windowsSign:
signWithParams:
process.env.WINDOWS_RELEASE === "true"
? {
signToolPath: findLatestSigntoolPath(),
}
? `/v /n "Lockdown Systems LLC" /fd sha256 /td sha256 /tr http://ts.harica.gr /d "${process.env.CYD_ENV == "prod" ? "Cyd" : "Cyd Dev"}"`
: undefined,
// For auto-updates
remoteReleases: `https://releases.lockdown.systems/cyd/${process.env.CYD_ENV}/windows/${process.arch}`,
Expand Down