Squirrel / Squirrel.Windows

An installation and update framework for Windows desktop apps
MIT License
7.23k stars 1.02k forks source link

The shortcut exe is missing code signing #1861

Closed JunzheFan closed 11 months ago

JunzheFan commented 11 months ago

Squirrel version(s) same as (https://github.com/electron/windows-installer) latest Description I am using squirrel with Electron on Windows, I code-sign the original electron exe in the app-0.xx.xxx using a third party GUI signing tool , and I also sign the installer exe using the third party GUI signing tool. However, when I run the installer, I see the short cut exe produced by the Update.exe are not having the digital sign signature on it while the original electron exe in the app-0.xx.xxx does, I assume the short-cut is exe is essentailly copy over the original electron exe in the app-0.xx.xxx directory , can't figure out why it's missing the sign signature..

I also examine the source code of the electron windows installer, it seems the squirrle is invoking the signtool.exe at the end of the day when supply certificateFile && certificatePassword, but since I am using a third party signing GUI, therefore I am not providing these two args to squirrel, does that mean it will break the signing of all the squirrel-related exes ? because I see the Update.exe on the root folder is not having sign signature on it either

thansk for the help in advance

anaisbetts commented 11 months ago

You can't use 3rd-party signing tools with Squirrel, you need to have Squirrel do it, for exactly this reason