Unable to code sign DMG + MAS builds from a single configuration

[IsaacAderogba]

• Electron-Builder Version: 24.13.3

• Node Version: 18.20.3

• Electron Version: 31.1.0
• Electron Type (current, beta, nightly): current

• Target: Mac zip and mas

I'm building an application for the conventional Mac artifacts (dmg, zip, etc...) and Mac App Store (mas). This should require providing the different configuration keys with the correct certificate files. E.g.

 ...
  mac: {
    target: [
      { arch: ["x64", "arm64"], target: "zip" },
      { target: "mas", arch: "universal" },
    ],
    cscLink: "path-to-developer-id-certificate",
    cscKeyPassword: "...",
  },
  mas: {
    cscLink: "path-to-distribution-certificate",
    cscKeyPassword: "...",
    cscInstallerLink: "path-to-installer-certificate",
    cscInstallerKeyPassword: "...",
  },
...

When doing this, however, the certificate file path on mas.cscLink seems to be ignored. I was under the impression that, when building for Mac App Store, the keys on the mas configuration object would have precedence over those that were defined on the mac object.

From digging through the source code for macPackager, what seems to be happening is that the codeSigningInfo property is only being resolved once and then its cached value is being reused for all of the different artifacts (even if those artifacts specify that a different cscLink should be used).

This seems counterintuitive and unintentional. I should be able to patch this out, but wanted to see whether it's being tracked internally first.