Ben GotowandClaude 4fda46c63f Sign the Squirrel binaries users actually launch on Windows (#2881) ...

Windows 11 Smart App Control blocks Mailspring on launch with "we
couldn't verify its publisher", because three of the binaries Squirrel
puts on disk carry no Authenticode signature.

MailspringSetup.exe and everything under mailspring-win32-x64 are signed,
but Squirrel generates Update.exe, squirrel.exe and
mailspring_ExecutionStub.exe while building the installer, after the
workflow's app-directory signing step and before the one that signs the
installer. The stub is the binary users run: Squirrel copies it to
%LocalAppData%\Mailspring\mailspring.exe and points every shortcut at it.
A signature on the copy in app-<version>\ does not carry over, since
Squirrel rebuilds the stub from StubExecutable.exe on each releasify and
copies mailspring.exe's resources into it.

Squirrel signs all three itself when given --signWithParams, which it
forwards to signtool.exe in its vendor directory. The signtool
electron-winstaller bundles is the Windows 7 SDK build from 2009, which
predates /dlib, so the installer build now runs against a copy of the
vendor directory holding the SDK's signtool and the Trusted Signing dlib.

A new verification step then reads the shipped artifacts back and fails
the build if any PE inside them lacks a certificate table. Run against
the 1.24.1 installer it reports exactly the three binaries above.


Claude-Session: https://claude.ai/code/session_016AMFqLD28XxsYt18nsMdPj

Co-authored-by: Claude <noreply@anthropic.com>

2026-09-18 12:34:09 -05:00

..

ISSUE_TEMPLATE

Update developer_issue.md

2021-03-17 13:05:28 -07:00

workflows

Sign the Squirrel binaries users actually launch on Windows (#2881)

2026-09-18 12:34:09 -05:00