From 6755ab9a1b074d1dbf240ff09677160597ae91c5 Mon Sep 17 00:00:00 2001
From: talksik <patel.arjun50@gmail.com>
Date: Wed, 15 Apr 2026 12:12:13 -0700
Subject: [PATCH] ci: use newer sign tool for windows

The electron forge one won't support azure trusted account signing
---
 .github/workflows/build-windows.yml | 10 +++++++++
 js/forge.config.ts                  | 34 ++++++++++++++++-------------
 2 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index 6aca800..12af2ca 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -53,6 +53,16 @@ jobs:
           "AZURE_DLIB_PATH=$dlib" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
           "AZURE_METADATA_JSON_PATH=$env:GITHUB_WORKSPACE\js\build\signing-metadata.json" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
 
+      - name: Locate signtool.exe
+        shell: pwsh
+        working-directory: .
+        run: |
+          $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" -ErrorAction SilentlyContinue |
+            Sort-Object FullName -Descending |
+            Select-Object -First 1
+          if (-not $signtool) { throw "signtool.exe not found in Windows Kits" }
+          "SIGNTOOL_PATH=$($signtool.FullName)" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@v2
         with:
diff --git a/js/forge.config.ts b/js/forge.config.ts
index f47e78b..13ee4cc 100644
--- a/js/forge.config.ts
+++ b/js/forge.config.ts
@@ -7,6 +7,22 @@ import { VitePlugin } from '@electron-forge/plugin-vite';
 import { FusesPlugin } from '@electron-forge/plugin-fuses';
 import { FuseV1Options, FuseVersion } from '@electron/fuses';
 
+// Windows code signing via Azure Trusted Signing. Dormant unless the workflow
+// provisions the dlib + metadata file and exports these env vars, so local
+// `yarn make` and unsigned CI builds both work unchanged.
+const windowsSign = process.env.AZURE_METADATA_JSON_PATH ? {
+  debug: true,
+  signToolPath: process.env.SIGNTOOL_PATH,
+  signWithParams: [
+    '/v',
+    '/fd', 'SHA256',
+    '/tr', 'http://timestamp.acs.microsoft.com',
+    '/td', 'SHA256',
+    '/dlib', process.env.AZURE_DLIB_PATH,
+    '/dmdf', process.env.AZURE_METADATA_JSON_PATH,
+  ].join(' '),
+} : undefined;
+
 const config: ForgeConfig = {
   packagerConfig: {
     asar: true,
@@ -22,7 +38,8 @@ const config: ForgeConfig = {
     osxSign: {},
     osxNotarize: {
       keychainProfile: 'default',
-    }
+    },
+    windowsSign
   },
   publishers: [
     {
@@ -42,20 +59,7 @@ const config: ForgeConfig = {
   makers: [
     new MakerSquirrel((arch) => ({
       remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`,
-      // Windows code signing via Azure Trusted Signing. Dormant unless the workflow
-      // provisions the dlib + metadata file and exports these env vars, so local
-      // `yarn make` and unsigned CI builds both work unchanged.
-      windowsSign: process.env.AZURE_METADATA_JSON_PATH ? {
-        debug: true,
-        signWithParams: [
-          '/v',
-          '/fd', 'SHA256',
-          '/tr', 'http://timestamp.acs.microsoft.com',
-          '/td', 'SHA256',
-          '/dlib', process.env.AZURE_DLIB_PATH,
-          '/dmdf', process.env.AZURE_METADATA_JSON_PATH,
-        ].join(' '),
-      } : undefined,
+      windowsSign
     })),
     new MakerZIP((arch) => ({
       macUpdateManifestBaseUrl: `https://storage.googleapis.com/flowy-releases/llink/darwin/${arch}`