From 111acb445c8c1000be9b5131b21e6d8a3b1479f1 Mon Sep 17 00:00:00 2001 From: talksik Date: Wed, 15 Apr 2026 12:25:13 -0700 Subject: [PATCH] ci: fix duplicate signtool flags --- js/forge.config.ts | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/js/forge.config.ts b/js/forge.config.ts index 13ee4cc..76997a6 100644 --- a/js/forge.config.ts +++ b/js/forge.config.ts @@ -10,14 +10,16 @@ import { FuseV1Options, FuseVersion } from '@electron/fuses'; // Windows code signing via Azure Trusted Signing. Dormant unless the workflow // provisions the dlib + metadata file and exports these env vars, so local // `yarn make` and unsigned CI builds both work unchanged. +// @electron/windows-sign prepends `sign /tr /td sha256 /fd sha256` +// to the sha256 pass, so `signWithParams` only carries the Azure Trusted Signing +// bits. Skip the sha1 pass (deprecated; not supported by Trusted Signing). const windowsSign = process.env.AZURE_METADATA_JSON_PATH ? { debug: true, signToolPath: process.env.SIGNTOOL_PATH, + hashes: ['sha256' as any], + timestampServer: 'http://timestamp.acs.microsoft.com', signWithParams: [ '/v', - '/fd', 'SHA256', - '/tr', 'http://timestamp.acs.microsoft.com', - '/td', 'SHA256', '/dlib', process.env.AZURE_DLIB_PATH, '/dmdf', process.env.AZURE_METADATA_JSON_PATH, ].join(' '),