app-builder-lib 27.0.0-alpha.3 → 27.0.0-alpha.5

package/scheme.json

@@ -2173,14 +2173,6 @@
           "description": "Whether to infer update channel from application version pre-release components. e.g. if version `0.12.1-alpha.1`, channel will be set to `alpha`. Otherwise to `latest`.\nThis does *not* apply to github publishing, which will [never auto-detect the update channel](https://github.com/electron-userland/electron-builder/issues/8589).",
           "type": "boolean"
         },
-        "disableDefaultIgnoredFiles": {
-          "default": false,
-          "description": "Whether to exclude all default ignored files(https://www.electron.build/contents#files) and options. Defaults to `false`.",
-          "type": [
-            "null",
-            "boolean"
-          ]
-        },
         "electronLanguages": {
           "anyOf": [
             {
@@ -2421,11 +2413,6 @@
           "$ref": "#/definitions/ReleaseInfo",
           "description": "The release info. Intended for command line usage:\n\n```\n-c.releaseInfo.releaseNotes=\"new features\"\n```"
         },
-        "syncDesktopName": {
-          "default": false,
-          "description": "When `true`, the installed `.desktop` filename is derived from `desktopName` in `package.json`\n(minus the `.desktop` suffix) so that it matches `StartupWMClass` and Electron's `app_id`.\nFalls back to `executableName` when `desktopName` is absent.",
-          "type": "boolean"
-        },
         "synopsis": {
           "description": "The [short description](https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-Description).",
           "type": [
@@ -2824,14 +2811,6 @@
           "description": "Whether to infer update channel from application version pre-release components. e.g. if version `0.12.1-alpha.1`, channel will be set to `alpha`. Otherwise to `latest`.\nThis does *not* apply to github publishing, which will [never auto-detect the update channel](https://github.com/electron-userland/electron-builder/issues/8589).",
           "type": "boolean"
         },
-        "disableDefaultIgnoredFiles": {
-          "default": false,
-          "description": "Whether to exclude all default ignored files(https://www.electron.build/contents#files) and options. Defaults to `false`.",
-          "type": [
-            "null",
-            "boolean"
-          ]
-        },
         "electronLanguages": {
           "anyOf": [
             {
@@ -3310,14 +3289,6 @@
           "description": "Whether to infer update channel from application version pre-release components. e.g. if version `0.12.1-alpha.1`, channel will be set to `alpha`. Otherwise to `latest`.\nThis does *not* apply to github publishing, which will [never auto-detect the update channel](https://github.com/electron-userland/electron-builder/issues/8589).",
           "type": "boolean"
         },
-        "disableDefaultIgnoredFiles": {
-          "default": false,
-          "description": "Whether to exclude all default ignored files(https://www.electron.build/contents#files) and options. Defaults to `false`.",
-          "type": [
-            "null",
-            "boolean"
-          ]
-        },
         "electronLanguages": {
           "anyOf": [
             {
@@ -5910,8 +5881,18 @@
           "type": "boolean"
         },
         "buildFor": {
-          "description": "Target architecture for the remote build. Accepts a single snapcraft arch string\n(e.g. `\"amd64\"`, `\"arm64\"`, `\"armhf\"`).\n\nTo build for multiple architectures, configure electron-builder's top-level `arch` option\n(e.g. `arch: [\"x64\", \"arm64\"]`) — each arch spawns a separate remote-build job on Launchpad,\nkeeping the one-build-per-artifact contract intact.",
-          "type": "string"
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": "string"
+            }
+          ],
+          "description": "Target architecture (or architectures) for the remote build.\n\n- **Single string** (e.g. `\"amd64\"`): one Launchpad job, one output snap.\n- **Array** (e.g. `[\"amd64\", \"arm64\"]`): one Launchpad job that builds all listed\n  architectures and downloads each resulting snap. All produced snaps are emitted as\n  separate build artifacts.\n\nUsing an array here is mutually exclusive with setting `arch: [\"x64\", \"arm64\"]` at the\nelectron-builder top level — the top-level `arch` option spawns a separate remote-build\njob per architecture, which would duplicate work."
         },
         "enabled": {
           "description": "Whether to enable remote build on Launchpad. Must be set explicitly to `true` to opt in.",
@@ -6317,7 +6298,7 @@
     },
     "SnapOptions24": {
       "additionalProperties": false,
-      "description": "**[Beta]** Options for building a core24 snap. This interface does not extend the legacy\n`SnapBaseOptions` — it uses the snapcraft CLI directly.\n\nFields inherited from {@link CommonLinuxOptions} (`description`, `category`, `mimeTypes`,\n`executableArgs`, `desktop`, `synopsis`) are automatically populated from the root `linux.*`\nconfiguration. You do not need to duplicate them here; values set directly on this interface\ntake precedence over the cascaded `linux.*` values.",
+      "description": "Options for building a core24 snap. This interface does not extend the legacy\n`SnapBaseOptions` — it uses the snapcraft CLI directly.\n\nFields inherited from {@link CommonLinuxOptions} (`description`, `category`, `mimeTypes`,\n`executableArgs`, `desktop`, `synopsis`) are automatically populated from the root `linux.*`\nconfiguration. You do not need to duplicate them here; values set directly on this interface\ntake precedence over the cascaded `linux.*` values.",
       "properties": {
         "after": {
           "anyOf": [
@@ -7213,7 +7194,7 @@
               "type": "null"
             }
           ],
-          "description": "**[Beta]** Options for building a core24 snap. Uses the snapcraft CLI directly.\nInherits desktop-entry fields from `CommonLinuxOptions` and publish config from `TargetSpecificOptions`."
+          "description": "Options for building a core24 snap. Uses the snapcraft CLI directly.\nInherits desktop-entry fields from `CommonLinuxOptions` and publish config from `TargetSpecificOptions`."
         },
         "cscLink": {
           "description": "Snapcraft Store credentials — base64-encoded credentials string or file path.\nAccepts the same formats as `WIN_CSC_LINK` / `CSC_LINK`: base64 data,\nabsolute/relative/`~/` file paths, and `file://` URIs.\nRelative paths are resolved against the build resources directory.\n\nInjected as `SNAPCRAFT_STORE_CREDENTIALS` into every snapcraft subprocess\n(core18/core20/core22/core24 builds and `snapcraft upload`).\nNot applied for `base: \"custom\"` — inject credentials manually via environment variables.\n\nThe `SNAP_CSC_LINK` environment variable is the CI-friendly alternative.\nGenerate with: `snapcraft export-login - | base64 -w0`",
@@ -7228,7 +7209,7 @@
               "type": "null"
             }
           ],
-          "description": "**[Beta]** Pass-through custom snap configuration. electron-builder will read the\nsnapcraft.yaml at `yamlPath` and use it verbatim — no plugs, extensions,\norganize mappings, or desktop files are injected."
+          "description": "Pass-through custom snap configuration. electron-builder will read the\nsnapcraft.yaml at `yamlPath` and use it verbatim — no plugs, extensions,\norganize mappings, or desktop files are injected."
         },
         "publish": {
           "anyOf": [
@@ -7762,7 +7743,7 @@
     },
     "ToolsetConfig": {
       "additionalProperties": false,
-      "description": "Version pins and custom bundle overrides for the binary toolsets that electron-builder\ndownloads and caches locally.\n\nEach toolset is a versioned archive hosted at\n[electron-userland/electron-builder-binaries](https://github.com/electron-userland/electron-builder-binaries/releases).\nOmitting a property (or setting it to `null`) selects the modern default for that toolset.\nSetting a property to `\"0.0.0\"` forces the legacy bundle — useful only for diagnosing\nregressions introduced by newer toolset bundles.\n\nTo supply your own bundle, set the property to a {@link ToolsetCustom} object with a `url`\n(https:// or file://) and a `checksum` for verification. The bundle must mirror the expected\ndirectory layout of the corresponding built-in bundle; see the build scripts at\nhttps://github.com/electron-userland/electron-builder-binaries/tree/master/packages.",
+      "description": "Version pins and custom bundle overrides for the binary toolsets that electron-builder downloads and caches locally.\n\nEach toolset is a versioned archive hosted at [electron-userland/electron-builder-binaries](https://github.com/electron-userland/electron-builder-binaries/releases).\nOmitting a property (or setting it to `latest`) selects the modern default for that toolset.\n\nTo supply your own bundle, set the property to a {@link ToolsetCustom} object with a `url` (https:// or file://) and a `checksum` for verification. The bundle must mirror the expected directory layout of the corresponding built-in bundle; see the build scripts at\nhttps://github.com/electron-userland/electron-builder-binaries/tree/master/packages.",
       "properties": {
         "appimage": {
           "anyOf": [
@@ -7772,17 +7753,15 @@
             {
               "enum": [
                 "0.0.0",
-                "1.0.2",
-                "1.0.3"
+                "1.0.3",
+                "1.1.0",
+                "latest"
               ],
               "type": "string"
-            },
-            {
-              "type": "null"
             }
           ],
-          "default": "1.0.3",
-          "description": "Version of the AppImage toolset bundle used for building `.AppImage` files.\n\nThe bundle ships:\n- **`mksquashfs`** — creates the SquashFS filesystem embedded in the AppImage.\n- **`desktop-file-validate`** — validates the generated `.desktop` entry.\n- **AppImage runtime** — the self-executing stub that mounts the SquashFS at launch.\n\nAvailable versions:\n| Version | Runtime date | Notes |\n|---------|-------------|-------|\n| `\"0.0.0\"` | Legacy | FUSE2-based AppImage runtime (pre-v27 default) |\n| `\"1.0.2\"` | 20251108 | Static-runtime (FUSE3-compatible) |\n| `\"1.0.3\"` | 20251108 | Static-runtime (FUSE3-compatible); recommended (default) |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/appimage/CHANGELOG.md"
+          "default": "latest",
+          "description": "Version of the AppImage toolset bundle used for building `.AppImage` files.\n\nThe bundle ships:\n- **`mksquashfs`** — creates the SquashFS filesystem embedded in the AppImage.\n- **`desktop-file-validate`** — validates the generated `.desktop` entry.\n- **AppImage runtime** — the self-executing stub that mounts the SquashFS at launch.\n\nAvailable versions:\n| Version | Runtime date | Notes |\n|---------|-------------|-------|\n| `\"0.0.0\"` | Legacy | FUSE2-based AppImage runtime (pre-v27) |\n| `\"1.0.3\"` | 20251108 | Introduces static AppImage runtime |\n| `\"1.1.0\"` | 20251108 | Adds `unsquashfs` support |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/appimage/CHANGELOG.md"
         },
         "fpm": {
           "anyOf": [
@@ -7790,14 +7769,14 @@
               "$ref": "#/definitions/ToolsetCustom"
             },
             {
-              "const": "2.2.1",
+              "enum": [
+                "2.2.1",
+                "latest"
+              ],
               "type": "string"
-            },
-            {
-              "type": "null"
             }
           ],
-          "default": "2.2.1",
+          "default": "latest",
           "description": "Version of the FPM bundle used to build Linux packages (`.deb`, `.rpm`, `.pacman`, etc.)\non macOS and Linux hosts.\n\nAvailable versions:\n| Version | FPM version | Notes |\n|---------|------------|-------|\n| `\"2.2.1\"` | 1.17.0 (Ruby 3.4.3) | Current default |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/fpm/CHANGELOG.md"
         },
         "icons": {
@@ -7806,15 +7785,15 @@
               "$ref": "#/definitions/ToolsetCustom"
             },
             {
-              "const": "1.1.0",
+              "enum": [
+                "1.2.1",
+                "latest"
+              ],
               "type": "string"
-            },
-            {
-              "type": "null"
             }
           ],
-          "default": "1.1.0",
-          "description": "Version of the icons-conversion bundle used to convert source images to `.icns`, `.ico`,\nand PNG icon sets.\n\nSet to a {@link ToolsetCustom} object to supply your own icons bundle directory.\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.1.0\"` | Current default |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/icons/CHANGELOG.md"
+          "default": "latest",
+          "description": "Version of the icons-conversion bundle used to convert source images to `.icns`, `.ico`,\nand PNG icon sets.\n\nSet to a {@link ToolsetCustom} object to supply your own icons bundle directory.\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.2.1\"` | `wasm-vips` + `@resvg/resvg-wasm` |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/icons/CHANGELOG.md"
         },
         "linuxToolsMac": {
           "anyOf": [
@@ -7822,15 +7801,15 @@
               "$ref": "#/definitions/ToolsetCustom"
             },
             {
-              "const": "1.0.0",
+              "enum": [
+                "1.0.0",
+                "latest"
+              ],
               "type": "string"
-            },
-            {
-              "type": "null"
             }
           ],
-          "default": "1.0.0",
-          "description": "Version of the Linux-tools-mac bundle used to produce `.tar.lz` archives and build\nLinux targets on macOS hosts.\n\nThe bundle ships macOS-native builds of `ar`, `lzip`, and `gtar` (GNU tar).\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.0.0\"` | Current default |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/linux-tools-mac/CHANGELOG.md"
+          "default": "latest",
+          "description": "Version of the Linux-tools-mac bundle used to produce `.tar.lz` archives and build\nLinux targets on macOS hosts.\n\nThe bundle ships macOS-native builds of `ar`, `lzip`, and `gtar` (GNU tar).\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"1.0.0\"` | gnu-tar, lzip, makedepend, glib, libgsf, libtool, pcre, gettext, binutils |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/linux-tools-mac/CHANGELOG.md"
         },
         "nsis": {
           "anyOf": [
@@ -7840,16 +7819,14 @@
             {
               "enum": [
                 "0.0.0",
-                "1.2.1"
+                "1.2.1",
+                "latest"
               ],
               "type": "string"
-            },
-            {
-              "type": "null"
             }
           ],
-          "default": "1.2.1",
-          "description": "Version of the NSIS toolset bundle used to compile Windows installers.\n\nThe bundle ships:\n- **`makensis`** — the NSIS compiler invoked to build `.nsi` scripts into `.exe` installers.\n- **NSIS plugins** — the plugin DLLs (`NsisMultiUser`, `UAC`, `StdUtils`, etc.) referenced by\n  electron-builder's default installer scripts.\n- **`elevate.exe`** — UAC elevation helper included in NSIS installers.\n\nAvailable versions:\n| Version | `makensis` version | Notes |\n|---------|------------------|-------|\n| `\"0.0.0\"` | 3.0.4.1 | Legacy split bundle — `nsis` + `nsis-resources` archives (pre-v27 default) |\n| `\"1.2.1\"` | 3.12 | Unified bundle — single archive, entrypoint scripts auto-set `NSISDIR` (default) |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/nsis/CHANGELOG.md"
+          "default": "latest",
+          "description": "Version of the NSIS toolset bundle used to compile Windows installers.\n\nThe bundle ships:\n- **`makensis`** — the NSIS compiler invoked to build `.nsi` scripts into `.exe` installers.\n- **NSIS plugins** — the plugin DLLs (`NsisMultiUser`, `UAC`, `StdUtils`, etc.) referenced by\n  electron-builder's default installer scripts.\n- **`elevate.exe`** — UAC elevation helper included in NSIS installers.\n\nAvailable versions:\n| Version | `makensis` version | Notes |\n|---------|------------------|-------|\n| `\"0.0.0\"` | 3.0.4.1 | Legacy split bundle — `nsis` + `nsis-resources` archives (pre-v27) |\n| `\"1.2.1\"` | 3.12 | Unified bundle — single archive, entrypoint scripts auto-set `NSISDIR` |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/nsis/CHANGELOG.md"
         },
         "sevenZip": {
           "anyOf": [
@@ -7857,14 +7834,14 @@
               "$ref": "#/definitions/ToolsetCustom"
             },
             {
-              "const": "1.0.0",
+              "enum": [
+                "1.0.0",
+                "latest"
+              ],
               "type": "string"
-            },
-            {
-              "type": "null"
             }
           ],
-          "default": "1.0.0",
+          "default": "latest",
           "description": "Version of the 7-Zip binary bundle used internally to extract `.7z` and `.tar.xz` archives.\n\nSet to a {@link ToolsetCustom} object to supply your own 7za binary.\nThe `url` must point to a directory (or a `.tar.gz`/`.zip` archive of one) that contains\n`bin/7za` (macOS/Linux) or `bin/7za.exe` (Windows).\n\n**Bootstrap constraint:** the custom bundle itself must be a `.tar.gz` or `.zip` archive\n(or a bare `file://` directory). `.7z` and `.tar.xz` archives cannot be used here because\nextracting them requires 7za — a circular dependency."
         },
         "winCodeSign": {
@@ -7879,16 +7856,14 @@
                 "1.1.0",
                 "1.1.1",
                 "1.2.1",
-                "1.3.0"
+                "1.3.0",
+                "latest"
               ],
               "type": "string"
-            },
-            {
-              "type": "null"
             }
           ],
-          "default": "1.1.0",
-          "description": "Version of the `win-codesign` bundle used for Windows code signing and resource editing.\n\nThe bundle ships:\n- **`signtool.exe`** (Windows) / **`osslsigncode`** (macOS & Linux) — used to sign `.exe`,\n  `.dll`, and `.msix` artifacts.\n- **`rcedit`** — used to embed version metadata and icons into `.exe` files.\n- **Windows Kits** (`10.0.26100.0`) — used by AppX/MSIX packaging (`makeappx`, `signtool`).\n\nAvailable versions:\n| Version | Contents |\n|---------|----------|\n| `\"0.0.0\"` | Legacy bundle — `winCodeSign-2.6.0` (pre-v27 default) |\n| `\"1.0.0\"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.0.0 |\n| `\"1.1.0\"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.1.0 |\n| `\"1.1.1\"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.1.1 |\n| `\"1.2.1\"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.2.1 |\n| `\"1.3.0\"` | Modern bundle — Windows Kits 10.0.26100.0, `win-codesign` v1.3.0 + separate ATS dlib bundle + .NET 8 runtime (required for Azure Trusted Signing `signtool /dlib`) |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/win-codesign/CHANGELOG.md"
+          "default": "latest",
+          "description": "Version of the `win-codesign` bundle used for Windows code signing and resource editing.\n\nThe bundle ships:\n- **`signtool.exe`** (Windows) / **`osslsigncode`** (macOS & Linux) — used to sign `.exe`,\n  `.dll`, and `.msix` artifacts.\n- **`rcedit`** — embeds version metadata and icons into `.exe` files (legacy usage, migrated to npm `resedit` package).\n- **Windows Kits** — used by AppX/MSIX packaging (`makeappx`, `signtool`).\n\nAvailable versions:\n| Version | Notes |\n|---------|-------|\n| `\"0.0.0\"` | Legacy bundle — `winCodeSign-2.6.0` (pre-v27) |\n| `\"1.0.0\"` | Windows Kits 10.0.26100.0, `osslsigncode` v2.9 |\n| `\"1.1.1\"` | Updates `osslsigncode` to v2.11 |\n| `\"1.2.1\"` | Adds native `osslsigncode` arm64 |\n| `\"1.3.0\"` | Includes support for Azure Trusted Signing `signtool` via dlib and .NET 8 runtime |\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/win-codesign/CHANGELOG.md"
         },
         "wine": {
           "anyOf": [
@@ -7898,16 +7873,14 @@
             {
               "enum": [
                 "0.0.0",
-                "1.0.1"
+                "1.0.1",
+                "latest"
               ],
               "type": "string"
-            },
-            {
-              "type": "null"
             }
           ],
-          "default": "0.0.0",
-          "description": "Version of the Wine bundle used to run Windows tools (NSIS, rcedit, signtool) on\nnon-Windows hosts (macOS and Linux).\n\nWine is only required when building Windows targets on a non-Windows machine. On Windows,\nthis setting has no effect.\n\nAvailable versions:\n| Version | Wine version | Platform support | Notes |\n|---------|-------------|-----------------|-------|\n| `\"0.0.0\"` | 4.0.1 | macOS | Legacy portable bundle (default) |\n| `\"1.0.1\"` | 11.0 | macOS | Supports arm64 macOS via Rosetta |\n\nTo use a custom Wine binary, use a `ToolsetCustom` object.\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/wine/CHANGELOG.md"
+          "default": "latest",
+          "description": "Version of the Wine bundle used to run Windows tools (NSIS, rcedit, signtool) on\nnon-Windows hosts (macOS and Linux).\n\nWine is only required when building Windows targets on a non-Windows machine. On Windows,\nthis setting has no effect.\n\nAvailable versions:\n| Version | Wine version | Platform support | Notes |\n|---------|-------------|-----------------|-------|\n| `\"0.0.0\"` | 4.0.1 | macOS | Legacy portable bundle (pre-v27) |\n| `\"1.0.1\"` | 11.0 | macOS | Supports arm64 macOS via Rosetta |\n\nTo use a custom Wine binary, use a `ToolsetCustom` object.\n\nReleases: https://github.com/electron-userland/electron-builder-binaries/blob/master/packages/wine/CHANGELOG.md"
         }
       },
       "type": "object"
@@ -7936,17 +7909,18 @@
     },
     "WindowsAzureSigningConfig": {
       "additionalProperties": false,
+      "description": "The `signtool /dlib` Azure Trusted Signing integration was introduced in `toolsets.winCodeSign: 1.3.0`.\nThe legacy PowerShell integration is deprecated, but leverages the same underlying Azure APIs, so both interfaces share the same config shape.",
       "properties": {
         "additionalMetadata": {
           "$ref": "#/definitions/Record<string,string>",
           "description": "Additional fields to include verbatim in the `metadata.json` file passed to\n`Azure.CodeSigning.Dlib.dll` via `signtool /dmdf`. Use this for DLib-specific options\nnot covered by the typed fields above (e.g. `ExcludeCredentials`, `CorrelationId`)."
         },
         "certificateProfileName": {
-          "description": "The Certificate Profile name. Translates to field: CertificateProfileName.",
+          "description": "The name of the Trusted Signing Certificate Profile to sign with, as created in your Azure\nCode Signing Account. Maps to the DLib metadata field `CertificateProfileName`.",
           "type": "string"
         },
         "codeSigningAccountName": {
-          "description": "The Code Signing Account name. Translates to field: CodeSigningAccountName.",
+          "description": "The name of the Azure Trusted Signing (Code Signing) Account that owns the certificate profile.\nMaps to the DLib metadata field `CodeSigningAccountName`.",
           "type": "string"
         },
         "endpoint": {
@@ -7955,11 +7929,11 @@
         },
         "fileDigest": {
           "default": "SHA256",
-          "description": "The file digest algorithm. Translates to field: FileDigest.",
+          "description": "The digest algorithm used to hash the files being signed. Maps to the DLib metadata field\n`FileDigest`.",
           "type": "string"
         },
         "publisherName": {
-          "description": "[The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.",
+          "description": "The publisher name to associate with the signature, exactly as it appears in the certificate\nissued by your Trusted Signing certificate profile. Required. Used for\n[update verification](#verifyUpdateCodeSignature) (embedded in `app-update.yml` and checked by\nelectron-updater) and must match the certificate subject.",
           "type": "string"
         },
         "timestampDigest": {
@@ -7974,6 +7948,7 @@
         },
         "type": {
           "const": "azure",
+          "description": "Discriminator selecting Azure Trusted Signing (cloud signing — no local certificate).",
           "type": "string"
         }
       },
@@ -8057,14 +8032,6 @@
           "description": "Whether to infer update channel from application version pre-release components. e.g. if version `0.12.1-alpha.1`, channel will be set to `alpha`. Otherwise to `latest`.\nThis does *not* apply to github publishing, which will [never auto-detect the update channel](https://github.com/electron-userland/electron-builder/issues/8589).",
           "type": "boolean"
         },
-        "disableDefaultIgnoredFiles": {
-          "default": false,
-          "description": "Whether to exclude all default ignored files(https://www.electron.build/contents#files) and options. Defaults to `false`.",
-          "type": [
-            "null",
-            "boolean"
-          ]
-        },
         "electronLanguages": {
           "anyOf": [
             {
@@ -8314,7 +8281,7 @@
               "type": "null"
             }
           ],
-          "description": "Code signing configuration. Set to `false` or `null` to disable Windows code signing\n(executable resources such as the icon and metadata are still edited). Leave unset to\nsign using credentials discovered from the environment (e.g. `WIN_CSC_LINK`). Otherwise\nprovide exactly one of the following signing modes:\n\n- `{ type: \"signtool\", ... }` — Sign with a local certificate file (.pfx/.p12) or a\n  certificate from the Windows certificate store.\n- `{ type: \"hsm\", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant\n  hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key\n  container) flags. Requires `toolsets.winCodeSign: \"1.x\"`. Windows-only.\n- `{ type: \"pkcs11\", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.\n  Available on macOS and Linux CI without a Windows VM.\n- `{ type: \"azure\", ... }` — Sign via Azure Trusted Signing (cloud service). Requires\n  Azure Entra ID environment variables for authentication."
+          "description": "Code signing configuration. Code signing stamps every installer and executable\nelectron-builder produces with an Authenticode signature, so that Windows (SmartScreen / UAC)\nand your auto-updater can verify the publisher and that the files were not tampered with.\n\nHow this option behaves:\n- Leave **unset** to sign using credentials discovered from the environment — primarily a\n  certificate supplied via `WIN_CSC_LINK` (or `CSC_LINK`) with its password in\n  `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`). `WIN_CSC_LINK` accepts a file path, an\n  `https://` URL, or a base64-encoded certificate. This is the recommended setup for CI.\n- Set to `false` or `null` to **disable** code signing entirely (executable resources such as\n  the icon and metadata are still edited).\n- Set to an **object** to configure signing explicitly. The `type` field selects the signing\n  backend (`signtool` is the implicit default) and dispatches to a dedicated sign manager;\n  provide exactly one of the modes below. Each output artifact is signed individually, and by\n  default executables are dual-signed (see `signingHashAlgorithms`).\n\n- `{ type: \"signtool\", ... }` — Sign with a local certificate file (.pfx/.p12) or a\n  certificate from the Windows certificate store. Uses Microsoft `signtool.exe` on Windows and\n  `osslsigncode` on macOS/Linux.\n- `{ type: \"hsm\", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant\n  hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key\n  container) flags. Requires a modern `winCodeSign` toolset (the default — only the legacy\n  `\"0.0.0\"` pin is unsupported). Windows-only.\n- `{ type: \"pkcs11\", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.\n  Available on macOS and Linux CI without a Windows VM.\n- `{ type: \"azure\", ... }` — Sign via Azure Trusted Signing (cloud service). Requires\n  Azure Entra ID environment variables for authentication.\n\nSee [Code Signing](https://www.electron.build/code-signing)."
         },
         "signExts": {
           "anyOf": [
@@ -8329,7 +8296,7 @@
             }
           ],
           "default": null,
-          "description": "Explicit file name/extensions (`str.endsWith`) to also sign. Advanced option.\nSupports negative patterns, e.g. example that excludes `.appx` files: `[\"somefilename\", \".dll\", \"!.appx\"]`."
+          "description": "Additional file name suffixes to code sign, beyond the default. By default electron-builder\nonly signs `.exe` files; list extra suffixes here to also sign e.g. `.dll`, `.node`, or\nspecific file names. Advanced option — most apps do not need it.\n\nEach entry is matched with `String.endsWith`, so both bare extensions (`\".dll\"`) and full file\nnames (`\"mybinary.dll\"`) work. Prefix a pattern with `!` to *exclude* a suffix that would\notherwise be signed. Positive patterns are evaluated first, then negative ones. For example,\n`[\"somefilename\", \".dll\", \"!.appx\"]` signs `.dll` files (and anything ending in `somefilename`)\nbut never signs `.appx` files."
         },
         "target": {
           "anyOf": [
@@ -8361,7 +8328,7 @@
         },
         "verifyUpdateCodeSignature": {
           "default": true,
-          "description": "Whether to verify the signature of an available update before installation.\nThe [publisher name](#publisherName) will be used for the signature verification.",
+          "description": "Whether the NSIS auto-updater should verify the Authenticode signature of a downloaded update\nbefore installing it. This is a **runtime** check performed by your app via electron-updater,\nnot a build-time check.\n\nWhen enabled (the default), the resolved [publisher name](#publisherName) is embedded into\n`app-update.yml` at build time. At update time electron-updater inspects the certificate that\nsigned the downloaded installer and compares its subject (Distinguished Name / Common Name)\nagainst that publisher name, refusing to install on a mismatch. This prevents a tampered or\nmaliciously substituted update from being installed.\n\nSet to `false` to skip verification — in which case the publisher name is **not** embedded.\nDisable this only if your updates are not Authenticode-signed.",
           "type": "boolean"
         }
       },
@@ -8371,7 +8338,7 @@
       "additionalProperties": false,
       "properties": {
         "additionalCertificateFile": {
-          "description": "The path to an additional certificate file you want to add to the signature block.",
+          "description": "Path to an additional certificate file (typically an intermediate / cross-signing CA\ncertificate) whose contents are added to the signature block via signtool's `/ac` flag. Use\nthis when the signing certificate's full chain is not already present on target machines and\nyou want it embedded in the signature so the chain can be validated.",
           "type": [
             "null",
             "string"
@@ -8385,21 +8352,21 @@
           ]
         },
         "certificateSha1": {
-          "description": "The SHA1 thumbprint of the certificate in the Windows certificate store.",
+          "description": "Alternative to `certificateFile`: locate the public certificate in the Windows certificate\nstore by its SHA-1 thumbprint. The private key still comes from the HSM via\n`cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign\nwith.",
           "type": [
             "null",
             "string"
           ]
         },
         "certificateSubjectName": {
-          "description": "The subject name of the certificate in the Windows certificate store.",
+          "description": "Alternative to `certificateFile`: locate the public certificate in the Windows certificate\nstore by (a substring of) its subject name. The private key still comes from the HSM via\n`cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign\nwith.",
           "type": [
             "null",
             "string"
           ]
         },
         "cryptoServiceProvider": {
-          "description": "The name of the cryptographic service provider (CSP) that holds the private key.\nMaps to signtool's `/csp` flag. Examples:\n- Google Cloud KMS: `\"Google Cloud KMS Provider\"`\n- Smart card / FIPS token: `\"Microsoft Base Smart Card Crypto Provider\"`\n\nRequires `toolsets.winCodeSign: \"1.x\"`. Windows-only — use `type: \"pkcs11\"` on macOS/Linux.",
+          "description": "The name of the cryptographic service provider (CSP) that holds the private key.\nMaps to signtool's `/csp` flag. Examples:\n- Google Cloud KMS: `\"Google Cloud KMS Provider\"`\n- Smart card / FIPS token: `\"Microsoft Base Smart Card Crypto Provider\"`\n\nRequires a modern `winCodeSign` toolset (the default; only the legacy `\"0.0.0\"` pin is\nunsupported). Windows-only — use `type: \"pkcs11\"` on macOS/Linux.",
           "type": "string"
         },
         "keyContainer": {
@@ -8421,11 +8388,11 @@
               ]
             }
           ],
-          "description": "[The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.\nDefaults to common name from your code signing certificate."
+          "description": "The publisher name(s) to associate with the signature, written exactly as the subject appears\nin your code signing certificate. May be a single string or an array — an array is useful when\nrotating certificates, so updates signed by either the old or the new certificate still verify.\n\nThis value is not a `signtool` argument; it is consumed in two places:\n- **Update verification** — when [verifyUpdateCodeSignature](#verifyUpdateCodeSignature) is\n  enabled, it is written into `app-update.yml` and electron-updater checks it against the\n  certificate that signed each downloaded update.\n- **AppX / MSIX identity** — the package `Publisher` attribute must equal the certificate\n  subject, so electron-builder derives it from this value (or the certificate) to keep them\n  in sync; a mismatch makes packaging fail with `ERROR_BAD_FORMAT`.\n\nDefaults to the Common Name (CN) extracted from your code signing certificate. Set to `null`\nto opt out."
         },
         "rfc3161TimeStampServer": {
           "default": "http://timestamp.digicert.com",
-          "description": "The URL of the RFC 3161 time stamp server.",
+          "description": "The URL of the [RFC 3161](https://www.ietf.org/rfc/rfc3161.txt) timestamp server, used for\nSHA-256 and nested/appended signatures (signtool's `/tr` flag). Timestamping records *when*\nthe file was signed so the signature stays valid after the signing certificate expires.\nIgnored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.",
           "type": [
             "null",
             "string"
@@ -8443,7 +8410,7 @@
               ]
             }
           ],
-          "description": "The custom function (or path to file or module id) to sign Windows executables."
+          "description": "A custom signing hook that **replaces** electron-builder's built-in `signtool` /\n`osslsigncode` invocation. Provide a function, or the path / module id of a file that exports\na `sign` function (resolved relative to the project, then as a module).\n\nThe hook is invoked once per signing pass (i.e. once per entry in\n[signingHashAlgorithms](#signingHashAlgorithms)) and receives a configuration object describing\nthe file to sign (`path`), the resolved certificate info (`cscInfo`), the current `hash`, and\nwhether this pass is a nested signature (`isNest`), plus a `computeSignToolArgs(isWin)` helper\nthat returns the default arguments electron-builder would otherwise have used. Use this to\nintegrate an external or cloud signing service. See\n[Code Signing](https://www.electron.build/code-signing)."
         },
         "signingHashAlgorithms": {
           "anyOf": [
@@ -8462,11 +8429,11 @@
             }
           ],
           "default": "['sha1', 'sha256']",
-          "description": "Array of signing algorithms used. For AppX `sha256` is always used."
+          "description": "The digest (hash) algorithms to sign with, applied via signtool's `/fd` flag (or\nosslsigncode's `-h`). One signing pass runs per entry, in order; listing more than one\n**dual-signs** the file, with each additional signature appended as a nested signature\n(signtool `/as`). Signing with both `sha1` and `sha256` lets a single binary validate on\nlegacy (pre-SHA-2) Windows as well as modern Windows.\n\nSome targets override this: `.msi` cannot be dual-signed (a single hash is used) and AppX/MSIX\nis always `sha256` only."
         },
         "timeStampServer": {
           "default": "http://timestamp.digicert.com",
-          "description": "The URL of the time stamp server.",
+          "description": "The URL of the legacy Authenticode timestamp server, used for SHA-1 signatures (signtool's\n`/t` flag). This is also the timestamp server used by `osslsigncode` (`-t`) when signing on\nmacOS/Linux. See [rfc3161TimeStampServer](#rfc3161TimeStampServer) for SHA-256 / nested\nsignatures. Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.",
           "type": [
             "null",
             "string"
@@ -8474,6 +8441,7 @@
         },
         "type": {
           "const": "hsm",
+          "description": "Discriminator selecting HSM / hardware-token signing via signtool's `/csp` and `/kc` flags.",
           "type": "string"
         }
       },
@@ -8486,9 +8454,10 @@
     },
     "WindowsPkcs11SigningConfig": {
       "additionalProperties": false,
+      "description": "Sign with a PKCS#11 hardware token (smart card, USB HSM, cloud KMS exposed via a PKCS#11\nprovider) using `osslsigncode`. Unlike `hsm`, this mode does **not** require Windows or a\nWindows VM, so it can sign Windows binaries directly from macOS/Linux CI. The token PIN is read\nfrom the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable.",
       "properties": {
         "additionalCertificateFile": {
-          "description": "The path to an additional certificate file you want to add to the signature block.",
+          "description": "Path to an additional certificate file (typically an intermediate / cross-signing CA\ncertificate) whose contents are added to the signature block via signtool's `/ac` flag. Use\nthis when the signing certificate's full chain is not already present on target machines and\nyou want it embedded in the signature so the chain can be validated.",
           "type": [
             "null",
             "string"
@@ -8524,11 +8493,11 @@
               ]
             }
           ],
-          "description": "[The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.\nDefaults to common name from your code signing certificate."
+          "description": "The publisher name(s) to associate with the signature, written exactly as the subject appears\nin your code signing certificate. May be a single string or an array — an array is useful when\nrotating certificates, so updates signed by either the old or the new certificate still verify.\n\nThis value is not a `signtool` argument; it is consumed in two places:\n- **Update verification** — when [verifyUpdateCodeSignature](#verifyUpdateCodeSignature) is\n  enabled, it is written into `app-update.yml` and electron-updater checks it against the\n  certificate that signed each downloaded update.\n- **AppX / MSIX identity** — the package `Publisher` attribute must equal the certificate\n  subject, so electron-builder derives it from this value (or the certificate) to keep them\n  in sync; a mismatch makes packaging fail with `ERROR_BAD_FORMAT`.\n\nDefaults to the Common Name (CN) extracted from your code signing certificate. Set to `null`\nto opt out."
         },
         "rfc3161TimeStampServer": {
           "default": "http://timestamp.digicert.com",
-          "description": "The URL of the RFC 3161 time stamp server.",
+          "description": "The URL of the [RFC 3161](https://www.ietf.org/rfc/rfc3161.txt) timestamp server, used for\nSHA-256 and nested/appended signatures (signtool's `/tr` flag). Timestamping records *when*\nthe file was signed so the signature stays valid after the signing certificate expires.\nIgnored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.",
           "type": [
             "null",
             "string"
@@ -8546,7 +8515,7 @@
               ]
             }
           ],
-          "description": "The custom function (or path to file or module id) to sign Windows executables."
+          "description": "A custom signing hook that **replaces** electron-builder's built-in `signtool` /\n`osslsigncode` invocation. Provide a function, or the path / module id of a file that exports\na `sign` function (resolved relative to the project, then as a module).\n\nThe hook is invoked once per signing pass (i.e. once per entry in\n[signingHashAlgorithms](#signingHashAlgorithms)) and receives a configuration object describing\nthe file to sign (`path`), the resolved certificate info (`cscInfo`), the current `hash`, and\nwhether this pass is a nested signature (`isNest`), plus a `computeSignToolArgs(isWin)` helper\nthat returns the default arguments electron-builder would otherwise have used. Use this to\nintegrate an external or cloud signing service. See\n[Code Signing](https://www.electron.build/code-signing)."
         },
         "signingHashAlgorithms": {
           "anyOf": [
@@ -8565,11 +8534,11 @@
             }
           ],
           "default": "['sha1', 'sha256']",
-          "description": "Array of signing algorithms used. For AppX `sha256` is always used."
+          "description": "The digest (hash) algorithms to sign with, applied via signtool's `/fd` flag (or\nosslsigncode's `-h`). One signing pass runs per entry, in order; listing more than one\n**dual-signs** the file, with each additional signature appended as a nested signature\n(signtool `/as`). Signing with both `sha1` and `sha256` lets a single binary validate on\nlegacy (pre-SHA-2) Windows as well as modern Windows.\n\nSome targets override this: `.msi` cannot be dual-signed (a single hash is used) and AppX/MSIX\nis always `sha256` only."
         },
         "timeStampServer": {
           "default": "http://timestamp.digicert.com",
-          "description": "The URL of the time stamp server.",
+          "description": "The URL of the legacy Authenticode timestamp server, used for SHA-1 signatures (signtool's\n`/t` flag). This is also the timestamp server used by `osslsigncode` (`-t`) when signing on\nmacOS/Linux. See [rfc3161TimeStampServer](#rfc3161TimeStampServer) for SHA-256 / nested\nsignatures. Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.",
           "type": [
             "null",
             "string"
@@ -8577,6 +8546,7 @@
         },
         "type": {
           "const": "pkcs11",
+          "description": "Discriminator selecting cross-platform PKCS#11 token signing via `osslsigncode`.",
           "type": "string"
         }
       },
@@ -8589,37 +8559,38 @@
     },
     "WindowsSigntoolSigningConfig": {
       "additionalProperties": false,
+      "description": "Sign with a certificate file (`.pfx` / `.p12`) or with a certificate from the Windows\ncertificate store, using Microsoft `signtool.exe` on Windows and `osslsigncode` on macOS/Linux.\nThis is the default mode when `win.sign` is unset. Supply the certificate one of four ways:\na file via `certificateFile` (or the `WIN_CSC_LINK` env var), or a store lookup via\n`certificateSubjectName` or `certificateSha1`.",
       "properties": {
         "additionalCertificateFile": {
-          "description": "The path to an additional certificate file you want to add to the signature block.",
+          "description": "Path to an additional certificate file (typically an intermediate / cross-signing CA\ncertificate) whose contents are added to the signature block via signtool's `/ac` flag. Use\nthis when the signing certificate's full chain is not already present on target machines and\nyou want it embedded in the signature so the chain can be validated.",
           "type": [
             "null",
             "string"
           ]
         },
         "certificateFile": {
-          "description": "The path to the *.pfx or *.p12 certificate file. Prefer the `WIN_CSC_LINK` environment\nvariable when possible. See [Code Signing](https://www.electron.build/code-signing).",
+          "description": "Path to the PKCS#12 certificate file (`.pfx` or `.p12`) holding both the signing certificate\nand its private key. Passed to signtool via `/f` (or osslsigncode via `-pkcs12`).\n\nPrefer supplying this out-of-band via the `WIN_CSC_LINK` (or `CSC_LINK`) environment variable\ninstead of hardcoding a path — that variable also accepts an `https://` URL or a base64-encoded\ncertificate, which is safer and more convenient on CI. See\n[Code Signing](https://www.electron.build/code-signing).",
           "type": [
             "null",
             "string"
           ]
         },
         "certificatePassword": {
-          "description": "The password to the certificate provided in `certificateFile`. Prefer the\n`WIN_CSC_KEY_PASSWORD` environment variable when possible.",
+          "description": "The password protecting the private key in `certificateFile`. Passed to signtool via `/p`\n(or osslsigncode via `-pass`).\n\nPrefer the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable so the secret\nnever lands in your build configuration.",
           "type": [
             "null",
             "string"
           ]
         },
         "certificateSha1": {
-          "description": "The SHA1 hash of the signing certificate. Works only on Windows (or macOS with Parallels Desktop).",
+          "description": "Select the signing certificate from the Windows certificate store by its SHA-1 thumbprint,\ninstead of pointing at a `.pfx` file. electron-builder looks the certificate up in the store\nand signs with `/sha1 <thumbprint> /s <store>`. Like\n[certificateSubjectName](#certificateSubjectName), this suits EV certificates backed by a\nhardware token; if both are set, both must resolve to the same certificate.\n\nWorks only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).",
           "type": [
             "null",
             "string"
           ]
         },
         "certificateSubjectName": {
-          "description": "The name of the subject of the signing certificate. Required for EV Code Signing.\nWorks only on Windows (or macOS with Parallels Desktop).",
+          "description": "Select the signing certificate from the Windows certificate store by (a substring of) its\nsubject name, instead of pointing at a `.pfx` file. electron-builder enumerates the installed\ncode-signing certificates, picks the match, and signs by its thumbprint\n(`/sha1 <thumbprint> /s <store>`). **Required for EV (Extended Validation) certificates**,\nwhose private keys live on a hardware token and cannot be exported to a file.\n\nWorks only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).",
           "type": [
             "null",
             "string"
@@ -8640,11 +8611,11 @@
               ]
             }
           ],
-          "description": "[The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.\nDefaults to common name from your code signing certificate."
+          "description": "The publisher name(s) to associate with the signature, written exactly as the subject appears\nin your code signing certificate. May be a single string or an array — an array is useful when\nrotating certificates, so updates signed by either the old or the new certificate still verify.\n\nThis value is not a `signtool` argument; it is consumed in two places:\n- **Update verification** — when [verifyUpdateCodeSignature](#verifyUpdateCodeSignature) is\n  enabled, it is written into `app-update.yml` and electron-updater checks it against the\n  certificate that signed each downloaded update.\n- **AppX / MSIX identity** — the package `Publisher` attribute must equal the certificate\n  subject, so electron-builder derives it from this value (or the certificate) to keep them\n  in sync; a mismatch makes packaging fail with `ERROR_BAD_FORMAT`.\n\nDefaults to the Common Name (CN) extracted from your code signing certificate. Set to `null`\nto opt out."
         },
         "rfc3161TimeStampServer": {
           "default": "http://timestamp.digicert.com",
-          "description": "The URL of the RFC 3161 time stamp server.",
+          "description": "The URL of the [RFC 3161](https://www.ietf.org/rfc/rfc3161.txt) timestamp server, used for\nSHA-256 and nested/appended signatures (signtool's `/tr` flag). Timestamping records *when*\nthe file was signed so the signature stays valid after the signing certificate expires.\nIgnored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.",
           "type": [
             "null",
             "string"
@@ -8662,7 +8633,7 @@
               ]
             }
           ],
-          "description": "The custom function (or path to file or module id) to sign Windows executables."
+          "description": "A custom signing hook that **replaces** electron-builder's built-in `signtool` /\n`osslsigncode` invocation. Provide a function, or the path / module id of a file that exports\na `sign` function (resolved relative to the project, then as a module).\n\nThe hook is invoked once per signing pass (i.e. once per entry in\n[signingHashAlgorithms](#signingHashAlgorithms)) and receives a configuration object describing\nthe file to sign (`path`), the resolved certificate info (`cscInfo`), the current `hash`, and\nwhether this pass is a nested signature (`isNest`), plus a `computeSignToolArgs(isWin)` helper\nthat returns the default arguments electron-builder would otherwise have used. Use this to\nintegrate an external or cloud signing service. See\n[Code Signing](https://www.electron.build/code-signing)."
         },
         "signingHashAlgorithms": {
           "anyOf": [
@@ -8681,11 +8652,11 @@
             }
           ],
           "default": "['sha1', 'sha256']",
-          "description": "Array of signing algorithms used. For AppX `sha256` is always used."
+          "description": "The digest (hash) algorithms to sign with, applied via signtool's `/fd` flag (or\nosslsigncode's `-h`). One signing pass runs per entry, in order; listing more than one\n**dual-signs** the file, with each additional signature appended as a nested signature\n(signtool `/as`). Signing with both `sha1` and `sha256` lets a single binary validate on\nlegacy (pre-SHA-2) Windows as well as modern Windows.\n\nSome targets override this: `.msi` cannot be dual-signed (a single hash is used) and AppX/MSIX\nis always `sha256` only."
         },
         "timeStampServer": {
           "default": "http://timestamp.digicert.com",
-          "description": "The URL of the time stamp server.",
+          "description": "The URL of the legacy Authenticode timestamp server, used for SHA-1 signatures (signtool's\n`/t` flag). This is also the timestamp server used by `osslsigncode` (`-t`) when signing on\nmacOS/Linux. See [rfc3161TimeStampServer](#rfc3161TimeStampServer) for SHA-256 / nested\nsignatures. Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.",
           "type": [
             "null",
             "string"
@@ -8693,6 +8664,7 @@
         },
         "type": {
           "const": "signtool",
+          "description": "Discriminator selecting the default file/store signing mode.",
           "type": "string"
         }
       },
@@ -8986,14 +8958,6 @@
       ],
       "description": "Overrides for input/output directory paths used during the build."
     },
-    "disableDefaultIgnoredFiles": {
-      "default": false,
-      "description": "Whether to exclude all default ignored files(https://www.electron.build/contents#files) and options. Defaults to `false`.",
-      "type": [
-        "null",
-        "boolean"
-      ]
-    },
     "dmg": {
       "anyOf": [
         {