app-builder-lib 27.0.0-alpha.4 → 27.0.0-alpha.6

package/dist/options/winOptions.d.ts

@@ -3,8 +3,8 @@ import { TargetConfigType } from "../core.js";
 import { PlatformSpecificBuildOptions } from "./PlatformSpecificBuildOptions.js";
 export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
     /**
-     * The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable]https://www.electron.build/nsis#portable) app without installation), `appx`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.
-     * AppX package can be built only on Windows 10.
+     * The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable app](https://www.electron.build/nsis#portable) without installation), `appx`, `msix`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.
+     * AppX and MSIX packages can be built on Windows 10 or Windows Server 2012 R2 (version 6.3+) or later, and on macOS via Parallels Desktop.
      *
      * To use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency.
      *
@@ -21,25 +21,50 @@ export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
      */
     readonly legalTrademarks?: string | null;
     /**
-     * Code signing configuration. Set to `false` or `null` to disable Windows code signing
-     * (executable resources such as the icon and metadata are still edited). Leave unset to
-     * sign using credentials discovered from the environment (e.g. `WIN_CSC_LINK`). Otherwise
-     * provide exactly one of the following signing modes:
+     * Code signing configuration. Code signing stamps every installer and executable
+     * electron-builder produces with an Authenticode signature, so that Windows (SmartScreen / UAC)
+     * and your auto-updater can verify the publisher and that the files were not tampered with.
+     *
+     * How this option behaves:
+     * - Leave **unset** to sign using credentials discovered from the environment — primarily a
+     *   certificate supplied via `WIN_CSC_LINK` (or `CSC_LINK`) with its password in
+     *   `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`). `WIN_CSC_LINK` accepts a file path, an
+     *   `https://` URL, or a base64-encoded certificate. This is the recommended setup for CI.
+     * - Set to `false` or `null` to **disable** code signing entirely (executable resources such as
+     *   the icon and metadata are still edited).
+     * - Set to an **object** to configure signing explicitly. The `type` field selects the signing
+     *   backend (`signtool` is the implicit default) and dispatches to a dedicated sign manager;
+     *   provide exactly one of the modes below. Each output artifact is signed individually, and by
+     *   default executables are dual-signed (see `signingHashAlgorithms`).
      *
      * - `{ type: "signtool", ... }` — Sign with a local certificate file (.pfx/.p12) or a
-     *   certificate from the Windows certificate store.
+     *   certificate from the Windows certificate store. Uses Microsoft `signtool.exe` on Windows and
+     *   `osslsigncode` on macOS/Linux.
      * - `{ type: "hsm", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant
      *   hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key
-     *   container) flags. Requires `toolsets.winCodeSign: "1.x"`. Windows-only.
+     *   container) flags. Requires a modern `winCodeSign` toolset (the default — only the legacy
+     *   `"0.0.0"` pin is unsupported). Windows-only.
      * - `{ type: "pkcs11", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.
      *   Available on macOS and Linux CI without a Windows VM.
      * - `{ type: "azure", ... }` — Sign via Azure Trusted Signing (cloud service). Requires
      *   Azure Entra ID environment variables for authentication.
+     *
+     * See [Code Signing](https://www.electron.build/code-signing).
      */
     readonly sign?: WindowsSigningConfiguration | false | null;
     /**
-     * Whether to verify the signature of an available update before installation.
-     * The [publisher name](#publisherName) will be used for the signature verification.
+     * Whether the NSIS auto-updater should verify the Authenticode signature of a downloaded update
+     * before installing it. This is a **runtime** check performed by your app via electron-updater,
+     * not a build-time check.
+     *
+     * When enabled (the default), the resolved [publisher name](#publisherName) is embedded into
+     * `app-update.yml` at build time. At update time electron-updater inspects the certificate that
+     * signed the downloaded installer and compares its subject (Distinguished Name / Common Name)
+     * against that publisher name, refusing to install on a mismatch. This prevents a tampered or
+     * maliciously substituted update from being installed.
+     *
+     * Set to `false` to skip verification — in which case the publisher name is **not** embedded.
+     * Disable this only if your updates are not Authenticode-signed.
      *
      * @default true
      */
@@ -51,63 +76,146 @@ export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
      */
     readonly requestedExecutionLevel?: RequestedExecutionLevel | null;
     /**
-     * Explicit file name/extensions (`str.endsWith`) to also sign. Advanced option.
-     * Supports negative patterns, e.g. example that excludes `.appx` files: `["somefilename", ".dll", "!.appx"]`.
+     * Additional file name suffixes to code sign, beyond the default. By default electron-builder
+     * only signs `.exe` files; list extra suffixes here to also sign e.g. `.dll`, `.node`, or
+     * specific file names. Advanced option — most apps do not need it.
+     *
+     * Each entry is matched with `String.endsWith`, so both bare extensions (`".dll"`) and full file
+     * names (`"mybinary.dll"`) work. Prefix a pattern with `!` to *exclude* a suffix that would
+     * otherwise be signed. Positive patterns are evaluated first, then negative ones. For example,
+     * `["somefilename", ".dll", "!.appx"]` signs `.dll` files (and anything ending in `somefilename`)
+     * but never signs `.appx` files.
+     *
      * @see https://github.com/electron-userland/electron-builder/issues/7329
      * @default null
      */
     readonly signExts?: string[] | null;
 }
 export type RequestedExecutionLevel = "asInvoker" | "highestAvailable" | "requireAdministrator";
+/**
+ * Options shared by every certificate-based signing mode (`signtool`, `hsm`, `pkcs11`). These
+ * control the signature itself — publisher identity, digest algorithms, timestamping, and the
+ * extra certificates added to the signature block — independently of where the private key lives.
+ */
 interface WindowsSigningSharedOptions {
     /**
-     * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.
-     * Defaults to common name from your code signing certificate.
+     * The publisher name(s) to associate with the signature, written exactly as the subject appears
+     * in your code signing certificate. May be a single string or an array — an array is useful when
+     * rotating certificates, so updates signed by either the old or the new certificate still verify.
+     *
+     * This value is not a `signtool` argument; it is consumed in two places:
+     * - **Update verification** — when [verifyUpdateCodeSignature](#verifyUpdateCodeSignature) is
+     *   enabled, it is written into `app-update.yml` and electron-updater checks it against the
+     *   certificate that signed each downloaded update.
+     * - **AppX / MSIX identity** — the package `Publisher` attribute must equal the certificate
+     *   subject, so electron-builder derives it from this value (or the certificate) to keep them
+     *   in sync; a mismatch makes packaging fail with `ERROR_BAD_FORMAT`.
+     *
+     * Defaults to the Common Name (CN) extracted from your code signing certificate. Set to `null`
+     * to opt out.
+     *
+     * @see https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073
      */
     readonly publisherName?: string | Array<string> | null;
     /**
-     * Array of signing algorithms used. For AppX `sha256` is always used.
+     * The digest (hash) algorithms to sign with, applied via signtool's `/fd` flag (or
+     * osslsigncode's `-h`). One signing pass runs per entry, in order; listing more than one
+     * **dual-signs** the file, with each additional signature appended as a nested signature
+     * (signtool `/as`). Signing with both `sha1` and `sha256` lets a single binary validate on
+     * legacy (pre-SHA-2) Windows as well as modern Windows.
+     *
+     * Some targets override this: `.msi` cannot be dual-signed (a single hash is used) and AppX/MSIX
+     * is always `sha256` only.
+     *
      * @default ['sha1', 'sha256']
      */
     readonly signingHashAlgorithms?: Array<"sha1" | "sha256"> | null;
     /**
-     * The URL of the RFC 3161 time stamp server.
+     * The URL of the [RFC 3161](https://www.ietf.org/rfc/rfc3161.txt) timestamp server, used for
+     * SHA-256 and nested/appended signatures (signtool's `/tr` flag). Timestamping records *when*
+     * the file was signed so the signature stays valid after the signing certificate expires.
+     * Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.
+     *
      * @default http://timestamp.digicert.com
      */
     readonly rfc3161TimeStampServer?: string | null;
     /**
-     * The URL of the time stamp server.
+     * The URL of the legacy Authenticode timestamp server, used for SHA-1 signatures (signtool's
+     * `/t` flag). This is also the timestamp server used by `osslsigncode` (`-t`) when signing on
+     * macOS/Linux. See [rfc3161TimeStampServer](#rfc3161TimeStampServer) for SHA-256 / nested
+     * signatures. Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.
+     *
      * @default http://timestamp.digicert.com
      */
     readonly timeStampServer?: string | null;
     /**
-     * The path to an additional certificate file you want to add to the signature block.
+     * Path to an additional certificate file (typically an intermediate / cross-signing CA
+     * certificate) whose contents are added to the signature block via signtool's `/ac` flag. Use
+     * this when the signing certificate's full chain is not already present on target machines and
+     * you want it embedded in the signature so the chain can be validated.
      */
     readonly additionalCertificateFile?: string | null;
     /**
-     * The custom function (or path to file or module id) to sign Windows executables.
+     * A custom signing hook that **replaces** electron-builder's built-in `signtool` /
+     * `osslsigncode` invocation. Provide a function, or the path / module id of a file that exports
+     * a `sign` function (resolved relative to the project, then as a module).
+     *
+     * The hook is invoked once per signing pass (i.e. once per entry in
+     * [signingHashAlgorithms](#signingHashAlgorithms)) and receives a configuration object describing
+     * the file to sign (`path`), the resolved certificate info (`cscInfo`), the current `hash`, and
+     * whether this pass is a nested signature (`isNest`), plus a `computeSignToolArgs(isWin)` helper
+     * that returns the default arguments electron-builder would otherwise have used. Use this to
+     * integrate an external or cloud signing service. See
+     * [Code Signing](https://www.electron.build/code-signing).
      */
     readonly sign?: CustomWindowsSign | string | null;
 }
+/**
+ * Sign with a certificate file (`.pfx` / `.p12`) or with a certificate from the Windows
+ * certificate store, using Microsoft `signtool.exe` on Windows and `osslsigncode` on macOS/Linux.
+ * This is the default mode when `win.sign` is unset. Supply the certificate one of four ways:
+ * a file via `certificateFile` (or the `WIN_CSC_LINK` env var), or a store lookup via
+ * `certificateSubjectName` or `certificateSha1`.
+ */
 export interface WindowsSigntoolSigningConfig extends WindowsSigningSharedOptions {
+    /** Discriminator selecting the default file/store signing mode. */
     readonly type: "signtool";
     /**
-     * The path to the *.pfx or *.p12 certificate file. Prefer the `WIN_CSC_LINK` environment
-     * variable when possible. See [Code Signing](https://www.electron.build/code-signing).
+     * Path to the PKCS#12 certificate file (`.pfx` or `.p12`) holding both the signing certificate
+     * and its private key. Passed to signtool via `/f` (or osslsigncode via `-pkcs12`).
+     *
+     * Prefer supplying this out-of-band via the `WIN_CSC_LINK` (or `CSC_LINK`) environment variable
+     * instead of hardcoding a path — that variable also accepts an `https://` URL or a base64-encoded
+     * certificate, which is safer and more convenient on CI. See
+     * [Code Signing](https://www.electron.build/code-signing).
      */
     readonly certificateFile?: string | null;
     /**
-     * The password to the certificate provided in `certificateFile`. Prefer the
-     * `WIN_CSC_KEY_PASSWORD` environment variable when possible.
+     * The password protecting the private key in `certificateFile`. Passed to signtool via `/p`
+     * (or osslsigncode via `-pass`).
+     *
+     * Prefer the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable so the secret
+     * never lands in your build configuration.
      */
     readonly certificatePassword?: string | null;
     /**
-     * The name of the subject of the signing certificate. Required for EV Code Signing.
-     * Works only on Windows (or macOS with Parallels Desktop).
+     * Select the signing certificate from the Windows certificate store by (a substring of) its
+     * subject name, instead of pointing at a `.pfx` file. electron-builder enumerates the installed
+     * code-signing certificates, picks the match, and signs by its thumbprint
+     * (`/sha1 <thumbprint> /s <store>`). **Required for EV (Extended Validation) certificates**,
+     * whose private keys live on a hardware token and cannot be exported to a file.
+     *
+     * Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).
      */
     readonly certificateSubjectName?: string | null;
     /**
-     * The SHA1 hash of the signing certificate. Works only on Windows (or macOS with Parallels Desktop).
+     * Select the signing certificate from the Windows certificate store by its SHA-1 thumbprint,
+     * instead of pointing at a `.pfx` file. electron-builder looks the certificate up in the store
+     * and signs with `/sha1 <thumbprint> /s <store>`. Like
+     * [certificateSubjectName](#certificateSubjectName), this suits EV certificates backed by a
+     * hardware token; if both are set, both must resolve to the same certificate.
+     *
+     * Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).
      */
     readonly certificateSha1?: string | null;
 }
@@ -116,6 +224,7 @@ export interface WindowsSigntoolSigningConfig extends WindowsSigningSharedOption
  * real-hardware test coverage is limited.
  */
 export interface WindowsHsmSigningConfig extends WindowsSigningSharedOptions {
+    /** Discriminator selecting HSM / hardware-token signing via signtool's `/csp` and `/kc` flags. */
     readonly type: "hsm";
     /**
      * The name of the cryptographic service provider (CSP) that holds the private key.
@@ -123,7 +232,8 @@ export interface WindowsHsmSigningConfig extends WindowsSigningSharedOptions {
      * - Google Cloud KMS: `"Google Cloud KMS Provider"`
      * - Smart card / FIPS token: `"Microsoft Base Smart Card Crypto Provider"`
      *
-     * Requires `toolsets.winCodeSign: "1.x"`. Windows-only — use `type: "pkcs11"` on macOS/Linux.
+     * Requires a modern `winCodeSign` toolset (the default; only the legacy `"0.0.0"` pin is
+     * unsupported). Windows-only — use `type: "pkcs11"` on macOS/Linux.
      */
     readonly cryptoServiceProvider: string;
     /**
@@ -139,19 +249,31 @@ export interface WindowsHsmSigningConfig extends WindowsSigningSharedOptions {
      */
     readonly certificateFile?: string | null;
     /**
-     * The SHA1 thumbprint of the certificate in the Windows certificate store.
+     * Alternative to `certificateFile`: locate the public certificate in the Windows certificate
+     * store by its SHA-1 thumbprint. The private key still comes from the HSM via
+     * `cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign
+     * with.
      */
     readonly certificateSha1?: string | null;
     /**
-     * The subject name of the certificate in the Windows certificate store.
+     * Alternative to `certificateFile`: locate the public certificate in the Windows certificate
+     * store by (a substring of) its subject name. The private key still comes from the HSM via
+     * `cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign
+     * with.
      */
     readonly certificateSubjectName?: string | null;
 }
 /**
+ * Sign with a PKCS#11 hardware token (smart card, USB HSM, cloud KMS exposed via a PKCS#11
+ * provider) using `osslsigncode`. Unlike `hsm`, this mode does **not** require Windows or a
+ * Windows VM, so it can sign Windows binaries directly from macOS/Linux CI. The token PIN is read
+ * from the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable.
+ *
  * @beta PKCS#11 signing is available in v27 as a beta feature. The interface is stable but
  * real-hardware test coverage is limited.
  */
 export interface WindowsPkcs11SigningConfig extends WindowsSigningSharedOptions {
+    /** Discriminator selecting cross-platform PKCS#11 token signing via `osslsigncode`. */
     readonly type: "pkcs11";
     /**
      * Path to the PKCS#11 shared library (`.so` on Linux, `.dylib` on macOS).
@@ -178,14 +300,19 @@ export interface WindowsPkcs11SigningConfig extends WindowsSigningSharedOptions
     readonly certificateFile?: string | null;
 }
 /**
- * @beta The `signtool /dlib` Azure Trusted Signing integration introduced in v27 is a beta
- * feature. The legacy PowerShell fallback (triggered when `toolsets.winCodeSign` is unset or
- * `"0.0.0"`) remains supported for migration.
+ * The `signtool /dlib` Azure Trusted Signing integration was introduced in `toolsets.winCodeSign: 1.3.0`.
+ * The legacy PowerShell integration is deprecated, but leverages the same underlying Azure APIs, so both interfaces share the same config shape.
  */
 export interface WindowsAzureSigningConfig {
+    /** Discriminator selecting Azure Trusted Signing (cloud signing — no local certificate). */
     readonly type: "azure";
     /**
-     * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.
+     * The publisher name to associate with the signature, exactly as it appears in the certificate
+     * issued by your Trusted Signing certificate profile. Required. Used for
+     * [update verification](#verifyUpdateCodeSignature) (embedded in `app-update.yml` and checked by
+     * electron-updater) and must match the certificate subject.
+     *
+     * @see https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073
      */
     readonly publisherName: string;
     /**
@@ -197,15 +324,18 @@ export interface WindowsAzureSigningConfig {
      */
     readonly endpoint: string;
     /**
-     * The Certificate Profile name. Translates to field: CertificateProfileName.
+     * The name of the Trusted Signing Certificate Profile to sign with, as created in your Azure
+     * Code Signing Account. Maps to the DLib metadata field `CertificateProfileName`.
      */
     readonly certificateProfileName: string;
     /**
-     * The Code Signing Account name. Translates to field: CodeSigningAccountName.
+     * The name of the Azure Trusted Signing (Code Signing) Account that owns the certificate profile.
+     * Maps to the DLib metadata field `CodeSigningAccountName`.
      */
     readonly codeSigningAccountName: string;
     /**
-     * The file digest algorithm. Translates to field: FileDigest.
+     * The digest algorithm used to hash the files being signed. Maps to the DLib metadata field
+     * `FileDigest`.
      * @default SHA256
      */
     readonly fileDigest?: string;

package/dist/options/winOptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"winOptions.d.ts","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAEhF,MAAM,WAAW,oBAAqB,SAAQ,4BAA4B;IACxE;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,2BAA2B,GAAG,KAAK,GAAG,IAAI,CAAA;IAE1D;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;IAEjE;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,kBAAkB,GAAG,sBAAsB,CAAA;AAI/F,UAAU,2BAA2B;IACnC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAEtD;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEhE;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;OAEG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElD;;OAEG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAAA;CAClD;AAID,MAAM,WAAW,4BAA6B,SAAQ,2BAA2B;IAC/E,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IAEzB;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5C;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,2BAA2B;IAC1E,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IAEpB;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IAEtC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD;AAID;;;GAGG;AACH,MAAM,WAAW,0BAA2B,SAAQ,2BAA2B;IAC7E,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IAEvB;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IAEtB;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAE9B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAE5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrD;AAID,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;AAEzJ,uEAAuE;AACvE,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,CAAA;AAE7H;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,oBAAoB,GAAG,2BAA2B,GAAG,IAAI,CAGnH;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAE9E"}
+{"version":3,"file":"winOptions.d.ts","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAA;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAEhF,MAAM,WAAW,oBAAqB,SAAQ,4BAA4B;IACxE;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE7B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,2BAA2B,GAAG,KAAK,GAAG,IAAI,CAAA;IAE1D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IAE5C;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;IAEjE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,kBAAkB,GAAG,sBAAsB,CAAA;AAI/F;;;;GAIG;AACH,UAAU,2BAA2B;IACnC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAEtD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAA;IAEhE;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAElD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAAA;CAClD;AAID;;;;;;GAMG;AACH,MAAM,WAAW,4BAA6B,SAAQ,2BAA2B;IAC/E,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAE/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,2BAA2B;IAC1E,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IAEpB;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IAEtC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA2B,SAAQ,2BAA2B;IAC7E,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IAEvB;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAE7B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAID;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IAEtB;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAE9B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;;OAGG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IAEvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAE5B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAElC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrD;AAID,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,GAAG,yBAAyB,CAAA;AAEzJ,uEAAuE;AACvE,MAAM,MAAM,2BAA2B,GAAG,4BAA4B,GAAG,uBAAuB,GAAG,0BAA0B,CAAA;AAE7H;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,oBAAoB,GAAG,2BAA2B,GAAG,IAAI,CAGnH;AAED,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAE9E"}

package/dist/options/winOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"winOptions.js","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AA4RA;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAA4B;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;IACvB,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;AACtD,CAAC","sourcesContent":["import { CustomWindowsSign } from \"../codeSign/win/windowsSignToolManager.js\"\nimport { TargetConfigType } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\n\nexport interface WindowsConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable]https://www.electron.build/nsis#portable) app without installation), `appx`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * AppX package can be built only on Windows 10.\n   *\n   * To use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency.\n   *\n   * @default nsis\n   */\n  readonly target?: TargetConfigType\n\n  /**\n   * The path to application icon.\n   * @default build/icon.ico\n   */\n  readonly icon?: string | null\n\n  /**\n   * The trademarks and registered trademarks.\n   */\n  readonly legalTrademarks?: string | null\n\n  /**\n   * Code signing configuration. Set to `false` or `null` to disable Windows code signing\n   * (executable resources such as the icon and metadata are still edited). Leave unset to\n   * sign using credentials discovered from the environment (e.g. `WIN_CSC_LINK`). Otherwise\n   * provide exactly one of the following signing modes:\n   *\n   * - `{ type: \"signtool\", ... }` — Sign with a local certificate file (.pfx/.p12) or a\n   *   certificate from the Windows certificate store.\n   * - `{ type: \"hsm\", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant\n   *   hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key\n   *   container) flags. Requires `toolsets.winCodeSign: \"1.x\"`. Windows-only.\n   * - `{ type: \"pkcs11\", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.\n   *   Available on macOS and Linux CI without a Windows VM.\n   * - `{ type: \"azure\", ... }` — Sign via Azure Trusted Signing (cloud service). Requires\n   *   Azure Entra ID environment variables for authentication.\n   */\n  readonly sign?: WindowsSigningConfiguration | false | null\n\n  /**\n   * Whether to verify the signature of an available update before installation.\n   * The [publisher name](#publisherName) will be used for the signature verification.\n   *\n   * @default true\n   */\n  readonly verifyUpdateCodeSignature?: boolean\n\n  /**\n   * The [security level](https://msdn.microsoft.com/en-us/library/6ad1fshk.aspx#Anchor_9) at which the application requests to be executed.\n   * Cannot be specified per target, allowed only in the `win`.\n   * @default asInvoker\n   */\n  readonly requestedExecutionLevel?: RequestedExecutionLevel | null\n\n  /**\n   * Explicit file name/extensions (`str.endsWith`) to also sign. Advanced option.\n   * Supports negative patterns, e.g. example that excludes `.appx` files: `[\"somefilename\", \".dll\", \"!.appx\"]`.\n   * @see https://github.com/electron-userland/electron-builder/issues/7329\n   * @default null\n   */\n  readonly signExts?: string[] | null\n}\n\nexport type RequestedExecutionLevel = \"asInvoker\" | \"highestAvailable\" | \"requireAdministrator\"\n\n// ─── Shared base for signtool-family signing modes ───────────────────────────\n\ninterface WindowsSigningSharedOptions {\n  /**\n   * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.\n   * Defaults to common name from your code signing certificate.\n   */\n  readonly publisherName?: string | Array<string> | null\n\n  /**\n   * Array of signing algorithms used. For AppX `sha256` is always used.\n   * @default ['sha1', 'sha256']\n   */\n  readonly signingHashAlgorithms?: Array<\"sha1\" | \"sha256\"> | null\n\n  /**\n   * The URL of the RFC 3161 time stamp server.\n   * @default http://timestamp.digicert.com\n   */\n  readonly rfc3161TimeStampServer?: string | null\n\n  /**\n   * The URL of the time stamp server.\n   * @default http://timestamp.digicert.com\n   */\n  readonly timeStampServer?: string | null\n\n  /**\n   * The path to an additional certificate file you want to add to the signature block.\n   */\n  readonly additionalCertificateFile?: string | null\n\n  /**\n   * The custom function (or path to file or module id) to sign Windows executables.\n   */\n  readonly sign?: CustomWindowsSign | string | null\n}\n\n// ─── Signing mode: signtool (file or Windows certificate store) ──────────────\n\nexport interface WindowsSigntoolSigningConfig extends WindowsSigningSharedOptions {\n  readonly type: \"signtool\"\n\n  /**\n   * The path to the *.pfx or *.p12 certificate file. Prefer the `WIN_CSC_LINK` environment\n   * variable when possible. See [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * The password to the certificate provided in `certificateFile`. Prefer the\n   * `WIN_CSC_KEY_PASSWORD` environment variable when possible.\n   */\n  readonly certificatePassword?: string | null\n\n  /**\n   * The name of the subject of the signing certificate. Required for EV Code Signing.\n   * Works only on Windows (or macOS with Parallels Desktop).\n   */\n  readonly certificateSubjectName?: string | null\n\n  /**\n   * The SHA1 hash of the signing certificate. Works only on Windows (or macOS with Parallels Desktop).\n   */\n  readonly certificateSha1?: string | null\n}\n\n// ─── Signing mode: hsm (Hardware Security Module via signtool /csp /kc) ──────\n\n/**\n * @beta HSM signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsHsmSigningConfig extends WindowsSigningSharedOptions {\n  readonly type: \"hsm\"\n\n  /**\n   * The name of the cryptographic service provider (CSP) that holds the private key.\n   * Maps to signtool's `/csp` flag. Examples:\n   * - Google Cloud KMS: `\"Google Cloud KMS Provider\"`\n   * - Smart card / FIPS token: `\"Microsoft Base Smart Card Crypto Provider\"`\n   *\n   * Requires `toolsets.winCodeSign: \"1.x\"`. Windows-only — use `type: \"pkcs11\"` on macOS/Linux.\n   */\n  readonly cryptoServiceProvider: string\n\n  /**\n   * The key container name within the CSP. Maps to signtool's `/kc` flag.\n   *\n   * Example for Google Cloud KMS:\n   * `\"projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME/cryptoKeyVersions/1\"`\n   */\n  readonly keyContainer: string\n\n  /**\n   * Path to the certificate file containing the public certificate chain (.crt / .cer / .pfx).\n   * The private key is NOT read from this file — it is provided by the HSM via `cryptoServiceProvider`.\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * The SHA1 thumbprint of the certificate in the Windows certificate store.\n   */\n  readonly certificateSha1?: string | null\n\n  /**\n   * The subject name of the certificate in the Windows certificate store.\n   */\n  readonly certificateSubjectName?: string | null\n}\n\n// ─── Signing mode: pkcs11 (cross-platform PKCS#11 via osslsigncode) ──────────\n\n/**\n * @beta PKCS#11 signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsPkcs11SigningConfig extends WindowsSigningSharedOptions {\n  readonly type: \"pkcs11\"\n\n  /**\n   * Path to the PKCS#11 shared library (`.so` on Linux, `.dylib` on macOS).\n   * The library must be installed separately — electron-builder does not bundle it.\n   *\n   * Example: `\"/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so\"`\n   *\n   * Must be paired with `pkcs11KeyUri`.\n   */\n  readonly pkcs11Module: string\n\n  /**\n   * RFC 7512 PKCS#11 URI identifying the private key within the module.\n   * Maps to osslsigncode's `-key` parameter.\n   *\n   * Example: `\"pkcs11:token=MyToken;object=MyKey;type=private\"`\n   *\n   * Must be paired with `pkcs11Module`.\n   */\n  readonly pkcs11KeyUri: string\n\n  /**\n   * Optional path to a certificate chain file to accompany the PKCS#11 key.\n   * If omitted the certificate embedded in the token is used.\n   */\n  readonly certificateFile?: string | null\n}\n\n// ─── Signing mode: azure (Azure Trusted Signing) ──────────────────────────────\n\n/**\n * @beta The `signtool /dlib` Azure Trusted Signing integration introduced in v27 is a beta\n * feature. The legacy PowerShell fallback (triggered when `toolsets.winCodeSign` is unset or\n * `\"0.0.0\"`) remains supported for migration.\n */\nexport interface WindowsAzureSigningConfig {\n  readonly type: \"azure\"\n\n  /**\n   * [The publisher name](https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073), exactly as in your code signed certificate. Several names can be provided.\n   */\n  readonly publisherName: string\n\n  /**\n   * The Trusted Signing Account endpoint. The URI value must align to the region your Trusted\n   * Signing Account and Certificate Profile were created in.\n   *\n   * Requires Azure Entra ID environment variables per\n   * [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition).\n   */\n  readonly endpoint: string\n\n  /**\n   * The Certificate Profile name. Translates to field: CertificateProfileName.\n   */\n  readonly certificateProfileName: string\n\n  /**\n   * The Code Signing Account name. Translates to field: CodeSigningAccountName.\n   */\n  readonly codeSigningAccountName: string\n\n  /**\n   * The file digest algorithm. Translates to field: FileDigest.\n   * @default SHA256\n   */\n  readonly fileDigest?: string\n\n  /**\n   * The RFC3161 timestamp server. Translates to field: TimestampRfc3161.\n   * @default http://timestamp.acs.microsoft.com\n   */\n  readonly timestampRfc3161?: string\n\n  /**\n   * The timestamp digest algorithm. Translates to field: TimestampDigest.\n   * @default SHA256\n   */\n  readonly timestampDigest?: string\n\n  /**\n   * Additional fields to include verbatim in the `metadata.json` file passed to\n   * `Azure.CodeSigning.Dlib.dll` via `signtool /dmdf`. Use this for DLib-specific options\n   * not covered by the typed fields above (e.g. `ExcludeCredentials`, `CorrelationId`).\n   */\n  readonly additionalMetadata?: Record<string, string>\n}\n\n// ─── Discriminated union ──────────────────────────────────────────────────────\n\nexport type WindowsSigningConfiguration = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig | WindowsAzureSigningConfig\n\n/** Signing modes that use signtool.exe or osslsigncode (not Azure). */\nexport type WindowsSigntoolFamilyConfig = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig\n\n/**\n * Resolves the active signing configuration object. `false`, `null`, and unset all mean\n * \"no explicit signing config object\" (env-based discovery still applies when unset).\n */\nexport function resolveWindowsSigningConfiguration(config: WindowsConfiguration): WindowsSigningConfiguration | null {\n  const { sign } = config\n  return sign == null || sign === false ? null : sign\n}\n\n/** Whether Windows code signing has been explicitly disabled via `sign: false | null`. */\nexport function isWindowsSigningDisabled(config: WindowsConfiguration): boolean {\n  return config.sign === false || config.sign === null\n}\n"]}
+{"version":3,"file":"winOptions.js","sourceRoot":"","sources":["../../src/options/winOptions.ts"],"names":[],"mappings":"AA8ZA;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,MAA4B;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;IACvB,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACrD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,MAA4B;IACnE,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAA;AACtD,CAAC","sourcesContent":["import { CustomWindowsSign } from \"../codeSign/win/windowsSignToolManager.js\"\nimport { TargetConfigType } from \"../core.js\"\nimport { PlatformSpecificBuildOptions } from \"./PlatformSpecificBuildOptions.js\"\n\nexport interface WindowsConfiguration extends PlatformSpecificBuildOptions {\n  /**\n   * The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` ([portable app](https://www.electron.build/nsis#portable) without installation), `appx`, `msix`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.\n   * AppX and MSIX packages can be built on Windows 10 or Windows Server 2012 R2 (version 6.3+) or later, and on macOS via Parallels Desktop.\n   *\n   * To use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency.\n   *\n   * @default nsis\n   */\n  readonly target?: TargetConfigType\n\n  /**\n   * The path to application icon.\n   * @default build/icon.ico\n   */\n  readonly icon?: string | null\n\n  /**\n   * The trademarks and registered trademarks.\n   */\n  readonly legalTrademarks?: string | null\n\n  /**\n   * Code signing configuration. Code signing stamps every installer and executable\n   * electron-builder produces with an Authenticode signature, so that Windows (SmartScreen / UAC)\n   * and your auto-updater can verify the publisher and that the files were not tampered with.\n   *\n   * How this option behaves:\n   * - Leave **unset** to sign using credentials discovered from the environment — primarily a\n   *   certificate supplied via `WIN_CSC_LINK` (or `CSC_LINK`) with its password in\n   *   `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`). `WIN_CSC_LINK` accepts a file path, an\n   *   `https://` URL, or a base64-encoded certificate. This is the recommended setup for CI.\n   * - Set to `false` or `null` to **disable** code signing entirely (executable resources such as\n   *   the icon and metadata are still edited).\n   * - Set to an **object** to configure signing explicitly. The `type` field selects the signing\n   *   backend (`signtool` is the implicit default) and dispatches to a dedicated sign manager;\n   *   provide exactly one of the modes below. Each output artifact is signed individually, and by\n   *   default executables are dual-signed (see `signingHashAlgorithms`).\n   *\n   * - `{ type: \"signtool\", ... }` — Sign with a local certificate file (.pfx/.p12) or a\n   *   certificate from the Windows certificate store. Uses Microsoft `signtool.exe` on Windows and\n   *   `osslsigncode` on macOS/Linux.\n   * - `{ type: \"hsm\", ... }` — Sign using a Hardware Security Module (HSM) or FIPS-compliant\n   *   hardware token via signtool's `/csp` (cryptographic service provider) and `/kc` (key\n   *   container) flags. Requires a modern `winCodeSign` toolset (the default — only the legacy\n   *   `\"0.0.0\"` pin is unsupported). Windows-only.\n   * - `{ type: \"pkcs11\", ... }` — Sign using a PKCS#11 hardware token via osslsigncode.\n   *   Available on macOS and Linux CI without a Windows VM.\n   * - `{ type: \"azure\", ... }` — Sign via Azure Trusted Signing (cloud service). Requires\n   *   Azure Entra ID environment variables for authentication.\n   *\n   * See [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly sign?: WindowsSigningConfiguration | false | null\n\n  /**\n   * Whether the NSIS auto-updater should verify the Authenticode signature of a downloaded update\n   * before installing it. This is a **runtime** check performed by your app via electron-updater,\n   * not a build-time check.\n   *\n   * When enabled (the default), the resolved [publisher name](#publisherName) is embedded into\n   * `app-update.yml` at build time. At update time electron-updater inspects the certificate that\n   * signed the downloaded installer and compares its subject (Distinguished Name / Common Name)\n   * against that publisher name, refusing to install on a mismatch. This prevents a tampered or\n   * maliciously substituted update from being installed.\n   *\n   * Set to `false` to skip verification — in which case the publisher name is **not** embedded.\n   * Disable this only if your updates are not Authenticode-signed.\n   *\n   * @default true\n   */\n  readonly verifyUpdateCodeSignature?: boolean\n\n  /**\n   * The [security level](https://msdn.microsoft.com/en-us/library/6ad1fshk.aspx#Anchor_9) at which the application requests to be executed.\n   * Cannot be specified per target, allowed only in the `win`.\n   * @default asInvoker\n   */\n  readonly requestedExecutionLevel?: RequestedExecutionLevel | null\n\n  /**\n   * Additional file name suffixes to code sign, beyond the default. By default electron-builder\n   * only signs `.exe` files; list extra suffixes here to also sign e.g. `.dll`, `.node`, or\n   * specific file names. Advanced option — most apps do not need it.\n   *\n   * Each entry is matched with `String.endsWith`, so both bare extensions (`\".dll\"`) and full file\n   * names (`\"mybinary.dll\"`) work. Prefix a pattern with `!` to *exclude* a suffix that would\n   * otherwise be signed. Positive patterns are evaluated first, then negative ones. For example,\n   * `[\"somefilename\", \".dll\", \"!.appx\"]` signs `.dll` files (and anything ending in `somefilename`)\n   * but never signs `.appx` files.\n   *\n   * @see https://github.com/electron-userland/electron-builder/issues/7329\n   * @default null\n   */\n  readonly signExts?: string[] | null\n}\n\nexport type RequestedExecutionLevel = \"asInvoker\" | \"highestAvailable\" | \"requireAdministrator\"\n\n// ─── Shared base for signtool-family signing modes ───────────────────────────\n\n/**\n * Options shared by every certificate-based signing mode (`signtool`, `hsm`, `pkcs11`). These\n * control the signature itself — publisher identity, digest algorithms, timestamping, and the\n * extra certificates added to the signature block — independently of where the private key lives.\n */\ninterface WindowsSigningSharedOptions {\n  /**\n   * The publisher name(s) to associate with the signature, written exactly as the subject appears\n   * in your code signing certificate. May be a single string or an array — an array is useful when\n   * rotating certificates, so updates signed by either the old or the new certificate still verify.\n   *\n   * This value is not a `signtool` argument; it is consumed in two places:\n   * - **Update verification** — when [verifyUpdateCodeSignature](#verifyUpdateCodeSignature) is\n   *   enabled, it is written into `app-update.yml` and electron-updater checks it against the\n   *   certificate that signed each downloaded update.\n   * - **AppX / MSIX identity** — the package `Publisher` attribute must equal the certificate\n   *   subject, so electron-builder derives it from this value (or the certificate) to keep them\n   *   in sync; a mismatch makes packaging fail with `ERROR_BAD_FORMAT`.\n   *\n   * Defaults to the Common Name (CN) extracted from your code signing certificate. Set to `null`\n   * to opt out.\n   *\n   * @see https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073\n   */\n  readonly publisherName?: string | Array<string> | null\n\n  /**\n   * The digest (hash) algorithms to sign with, applied via signtool's `/fd` flag (or\n   * osslsigncode's `-h`). One signing pass runs per entry, in order; listing more than one\n   * **dual-signs** the file, with each additional signature appended as a nested signature\n   * (signtool `/as`). Signing with both `sha1` and `sha256` lets a single binary validate on\n   * legacy (pre-SHA-2) Windows as well as modern Windows.\n   *\n   * Some targets override this: `.msi` cannot be dual-signed (a single hash is used) and AppX/MSIX\n   * is always `sha256` only.\n   *\n   * @default ['sha1', 'sha256']\n   */\n  readonly signingHashAlgorithms?: Array<\"sha1\" | \"sha256\"> | null\n\n  /**\n   * The URL of the [RFC 3161](https://www.ietf.org/rfc/rfc3161.txt) timestamp server, used for\n   * SHA-256 and nested/appended signatures (signtool's `/tr` flag). Timestamping records *when*\n   * the file was signed so the signature stays valid after the signing certificate expires.\n   * Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.\n   *\n   * @default http://timestamp.digicert.com\n   */\n  readonly rfc3161TimeStampServer?: string | null\n\n  /**\n   * The URL of the legacy Authenticode timestamp server, used for SHA-1 signatures (signtool's\n   * `/t` flag). This is also the timestamp server used by `osslsigncode` (`-t`) when signing on\n   * macOS/Linux. See [rfc3161TimeStampServer](#rfc3161TimeStampServer) for SHA-256 / nested\n   * signatures. Ignored when the build runs with `ELECTRON_BUILDER_OFFLINE=true`.\n   *\n   * @default http://timestamp.digicert.com\n   */\n  readonly timeStampServer?: string | null\n\n  /**\n   * Path to an additional certificate file (typically an intermediate / cross-signing CA\n   * certificate) whose contents are added to the signature block via signtool's `/ac` flag. Use\n   * this when the signing certificate's full chain is not already present on target machines and\n   * you want it embedded in the signature so the chain can be validated.\n   */\n  readonly additionalCertificateFile?: string | null\n\n  /**\n   * A custom signing hook that **replaces** electron-builder's built-in `signtool` /\n   * `osslsigncode` invocation. Provide a function, or the path / module id of a file that exports\n   * a `sign` function (resolved relative to the project, then as a module).\n   *\n   * The hook is invoked once per signing pass (i.e. once per entry in\n   * [signingHashAlgorithms](#signingHashAlgorithms)) and receives a configuration object describing\n   * the file to sign (`path`), the resolved certificate info (`cscInfo`), the current `hash`, and\n   * whether this pass is a nested signature (`isNest`), plus a `computeSignToolArgs(isWin)` helper\n   * that returns the default arguments electron-builder would otherwise have used. Use this to\n   * integrate an external or cloud signing service. See\n   * [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly sign?: CustomWindowsSign | string | null\n}\n\n// ─── Signing mode: signtool (file or Windows certificate store) ──────────────\n\n/**\n * Sign with a certificate file (`.pfx` / `.p12`) or with a certificate from the Windows\n * certificate store, using Microsoft `signtool.exe` on Windows and `osslsigncode` on macOS/Linux.\n * This is the default mode when `win.sign` is unset. Supply the certificate one of four ways:\n * a file via `certificateFile` (or the `WIN_CSC_LINK` env var), or a store lookup via\n * `certificateSubjectName` or `certificateSha1`.\n */\nexport interface WindowsSigntoolSigningConfig extends WindowsSigningSharedOptions {\n  /** Discriminator selecting the default file/store signing mode. */\n  readonly type: \"signtool\"\n\n  /**\n   * Path to the PKCS#12 certificate file (`.pfx` or `.p12`) holding both the signing certificate\n   * and its private key. Passed to signtool via `/f` (or osslsigncode via `-pkcs12`).\n   *\n   * Prefer supplying this out-of-band via the `WIN_CSC_LINK` (or `CSC_LINK`) environment variable\n   * instead of hardcoding a path — that variable also accepts an `https://` URL or a base64-encoded\n   * certificate, which is safer and more convenient on CI. See\n   * [Code Signing](https://www.electron.build/code-signing).\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * The password protecting the private key in `certificateFile`. Passed to signtool via `/p`\n   * (or osslsigncode via `-pass`).\n   *\n   * Prefer the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable so the secret\n   * never lands in your build configuration.\n   */\n  readonly certificatePassword?: string | null\n\n  /**\n   * Select the signing certificate from the Windows certificate store by (a substring of) its\n   * subject name, instead of pointing at a `.pfx` file. electron-builder enumerates the installed\n   * code-signing certificates, picks the match, and signs by its thumbprint\n   * (`/sha1 <thumbprint> /s <store>`). **Required for EV (Extended Validation) certificates**,\n   * whose private keys live on a hardware token and cannot be exported to a file.\n   *\n   * Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).\n   */\n  readonly certificateSubjectName?: string | null\n\n  /**\n   * Select the signing certificate from the Windows certificate store by its SHA-1 thumbprint,\n   * instead of pointing at a `.pfx` file. electron-builder looks the certificate up in the store\n   * and signs with `/sha1 <thumbprint> /s <store>`. Like\n   * [certificateSubjectName](#certificateSubjectName), this suits EV certificates backed by a\n   * hardware token; if both are set, both must resolve to the same certificate.\n   *\n   * Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).\n   */\n  readonly certificateSha1?: string | null\n}\n\n// ─── Signing mode: hsm (Hardware Security Module via signtool /csp /kc) ──────\n\n/**\n * @beta HSM signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsHsmSigningConfig extends WindowsSigningSharedOptions {\n  /** Discriminator selecting HSM / hardware-token signing via signtool's `/csp` and `/kc` flags. */\n  readonly type: \"hsm\"\n\n  /**\n   * The name of the cryptographic service provider (CSP) that holds the private key.\n   * Maps to signtool's `/csp` flag. Examples:\n   * - Google Cloud KMS: `\"Google Cloud KMS Provider\"`\n   * - Smart card / FIPS token: `\"Microsoft Base Smart Card Crypto Provider\"`\n   *\n   * Requires a modern `winCodeSign` toolset (the default; only the legacy `\"0.0.0\"` pin is\n   * unsupported). Windows-only — use `type: \"pkcs11\"` on macOS/Linux.\n   */\n  readonly cryptoServiceProvider: string\n\n  /**\n   * The key container name within the CSP. Maps to signtool's `/kc` flag.\n   *\n   * Example for Google Cloud KMS:\n   * `\"projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME/cryptoKeyVersions/1\"`\n   */\n  readonly keyContainer: string\n\n  /**\n   * Path to the certificate file containing the public certificate chain (.crt / .cer / .pfx).\n   * The private key is NOT read from this file — it is provided by the HSM via `cryptoServiceProvider`.\n   */\n  readonly certificateFile?: string | null\n\n  /**\n   * Alternative to `certificateFile`: locate the public certificate in the Windows certificate\n   * store by its SHA-1 thumbprint. The private key still comes from the HSM via\n   * `cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign\n   * with.\n   */\n  readonly certificateSha1?: string | null\n\n  /**\n   * Alternative to `certificateFile`: locate the public certificate in the Windows certificate\n   * store by (a substring of) its subject name. The private key still comes from the HSM via\n   * `cryptoServiceProvider` / `keyContainer`; this only identifies which public certificate to sign\n   * with.\n   */\n  readonly certificateSubjectName?: string | null\n}\n\n// ─── Signing mode: pkcs11 (cross-platform PKCS#11 via osslsigncode) ──────────\n\n/**\n * Sign with a PKCS#11 hardware token (smart card, USB HSM, cloud KMS exposed via a PKCS#11\n * provider) using `osslsigncode`. Unlike `hsm`, this mode does **not** require Windows or a\n * Windows VM, so it can sign Windows binaries directly from macOS/Linux CI. The token PIN is read\n * from the `WIN_CSC_KEY_PASSWORD` (or `CSC_KEY_PASSWORD`) environment variable.\n *\n * @beta PKCS#11 signing is available in v27 as a beta feature. The interface is stable but\n * real-hardware test coverage is limited.\n */\nexport interface WindowsPkcs11SigningConfig extends WindowsSigningSharedOptions {\n  /** Discriminator selecting cross-platform PKCS#11 token signing via `osslsigncode`. */\n  readonly type: \"pkcs11\"\n\n  /**\n   * Path to the PKCS#11 shared library (`.so` on Linux, `.dylib` on macOS).\n   * The library must be installed separately — electron-builder does not bundle it.\n   *\n   * Example: `\"/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so\"`\n   *\n   * Must be paired with `pkcs11KeyUri`.\n   */\n  readonly pkcs11Module: string\n\n  /**\n   * RFC 7512 PKCS#11 URI identifying the private key within the module.\n   * Maps to osslsigncode's `-key` parameter.\n   *\n   * Example: `\"pkcs11:token=MyToken;object=MyKey;type=private\"`\n   *\n   * Must be paired with `pkcs11Module`.\n   */\n  readonly pkcs11KeyUri: string\n\n  /**\n   * Optional path to a certificate chain file to accompany the PKCS#11 key.\n   * If omitted the certificate embedded in the token is used.\n   */\n  readonly certificateFile?: string | null\n}\n\n// ─── Signing mode: azure (Azure Trusted Signing) ──────────────────────────────\n\n/**\n * The `signtool /dlib` Azure Trusted Signing integration was introduced in `toolsets.winCodeSign: 1.3.0`.\n * The legacy PowerShell integration is deprecated, but leverages the same underlying Azure APIs, so both interfaces share the same config shape.\n */\nexport interface WindowsAzureSigningConfig {\n  /** Discriminator selecting Azure Trusted Signing (cloud signing — no local certificate). */\n  readonly type: \"azure\"\n\n  /**\n   * The publisher name to associate with the signature, exactly as it appears in the certificate\n   * issued by your Trusted Signing certificate profile. Required. Used for\n   * [update verification](#verifyUpdateCodeSignature) (embedded in `app-update.yml` and checked by\n   * electron-updater) and must match the certificate subject.\n   *\n   * @see https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073\n   */\n  readonly publisherName: string\n\n  /**\n   * The Trusted Signing Account endpoint. The URI value must align to the region your Trusted\n   * Signing Account and Certificate Profile were created in.\n   *\n   * Requires Azure Entra ID environment variables per\n   * [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition).\n   */\n  readonly endpoint: string\n\n  /**\n   * The name of the Trusted Signing Certificate Profile to sign with, as created in your Azure\n   * Code Signing Account. Maps to the DLib metadata field `CertificateProfileName`.\n   */\n  readonly certificateProfileName: string\n\n  /**\n   * The name of the Azure Trusted Signing (Code Signing) Account that owns the certificate profile.\n   * Maps to the DLib metadata field `CodeSigningAccountName`.\n   */\n  readonly codeSigningAccountName: string\n\n  /**\n   * The digest algorithm used to hash the files being signed. Maps to the DLib metadata field\n   * `FileDigest`.\n   * @default SHA256\n   */\n  readonly fileDigest?: string\n\n  /**\n   * The RFC3161 timestamp server. Translates to field: TimestampRfc3161.\n   * @default http://timestamp.acs.microsoft.com\n   */\n  readonly timestampRfc3161?: string\n\n  /**\n   * The timestamp digest algorithm. Translates to field: TimestampDigest.\n   * @default SHA256\n   */\n  readonly timestampDigest?: string\n\n  /**\n   * Additional fields to include verbatim in the `metadata.json` file passed to\n   * `Azure.CodeSigning.Dlib.dll` via `signtool /dmdf`. Use this for DLib-specific options\n   * not covered by the typed fields above (e.g. `ExcludeCredentials`, `CorrelationId`).\n   */\n  readonly additionalMetadata?: Record<string, string>\n}\n\n// ─── Discriminated union ──────────────────────────────────────────────────────\n\nexport type WindowsSigningConfiguration = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig | WindowsAzureSigningConfig\n\n/** Signing modes that use signtool.exe or osslsigncode (not Azure). */\nexport type WindowsSigntoolFamilyConfig = WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | WindowsPkcs11SigningConfig\n\n/**\n * Resolves the active signing configuration object. `false`, `null`, and unset all mean\n * \"no explicit signing config object\" (env-based discovery still applies when unset).\n */\nexport function resolveWindowsSigningConfiguration(config: WindowsConfiguration): WindowsSigningConfiguration | null {\n  const { sign } = config\n  return sign == null || sign === false ? null : sign\n}\n\n/** Whether Windows code signing has been explicitly disabled via `sign: false | null`. */\nexport function isWindowsSigningDisabled(config: WindowsConfiguration): boolean {\n  return config.sign === false || config.sign === null\n}\n"]}

package/dist/packager.d.ts

@@ -49,6 +49,8 @@ export declare class Packager {
     _appInfo: AppInfo | null;
     get appInfo(): AppInfo;
     readonly tempDirManager: TmpDir;
+    private readonly buildFinalizeTasks;
+    addBuildFinalizeTask(task: () => Promise<void>): void;
     private _repositoryInfo;
     readonly options: PackagerOptions;
     readonly debugLogger: DebugLogger;

package/dist/packager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packager.d.ts","sourceRoot":"","sources":["../src/packager.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,IAAI,EAGJ,WAAW,EAUX,MAAM,EACP,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,iBAAiB,EAAqB,MAAM,sBAAsB,CAAA;AAM3E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAElE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AASxD,OAAO,EAAqB,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAE5E,OAAO,EAA8B,EAAE,EAAE,MAAM,kCAAkC,CAAA;AAMjF,KAAK,cAAc,GAAG;IACpB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAA;IAEtD,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IACzC,YAAY,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAC7C,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IACvC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IAEvC,sBAAsB,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAEnD,iBAAiB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACrC,mBAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAGvC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;CAC7C,CAAA;AAED,qBAAa,QAAQ;IAgHjB,QAAQ,CAAC,iBAAiB;IA/G5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,OAAO,CAAC,OAAO,CAAQ;IACvB,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA8D;IACxF,iBAAiB,IAAI,OAAO,CAAC,EAAE,CAAC;IAGhC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIzC,6EAA6E;IAC7E,OAAO,CAAC,SAAS,CAAwB;IACzC,IAAI,QAAQ,IAAI,QAAQ,CAEvB;IAED,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAAwB;IACjD,IAAI,gBAAgB,IAAI,QAAQ,CAE/B;IAED,0CAA0C;IAC1C,IAAI,eAAe,WAElB;IAED,OAAO,CAAC,6BAA6B,CAAQ;IAE7C,IAAI,+BAA+B,IAAI,OAAO,CAE7C;IAED,OAAO,CAAC,mBAAmB,CAAQ;IAEnC,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED,OAAO,CAAC,YAAY,CAAwB;IAC5C,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED,OAAO,CAAC,cAAc,CAA6B;IAEnD,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,iCAAiC,UAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAO;IAC/B,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,QAAQ,CAAC,cAAc,SAAyB;IAEhD,OAAO,CAAC,eAAe,CAAmH;IAE1I,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IAEjC,QAAQ,CAAC,WAAW,cAAsC;IAE1D,IAAI,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEzD;IAED,OAAO,CAAC,2BAA2B,CAAwB;IAE3D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAE9F;IAED,OAAO,CAAC,kBAAkB,CAAsB;IAEhD,IAAI,iBAAiB,IAAI,MAAM,CAO9B;IAED,IAAI,6BAA6B,IAAI,MAAM,CAE1C;IAED,OAAO,CAAC,UAAU,CAAyB;IAC3C,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D,oBAAoB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;gBAMhD,OAAO,EAAE,eAAe,EACf,iBAAiB,oBAA0B;YA4DxC,wBAAwB;IAetC,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,QAAQ;IAK3D,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,iBAAiB,CAAC,GAAG,QAAQ;IAKvE,4BAA4B,CAAC,KAAK,EAAE,MAAM,cAAc,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS;;;;IAIvF,2BAA2B;IAIrB,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,EAAE,SAAS,CAAC,EAAE,GAAG;IAY3E;;OAEG;IACG,mBAAmB,CAAC,KAAK,EAAE,eAAe;IAI1C,0BAA0B,CAAC,KAAK,EAAE,eAAe;IAKjD,uBAAuB,CAAC,IAAI,EAAE,MAAM;IAIpC,qBAAqB,CAAC,IAAI,EAAE,MAAM;IAIlC,cAAc,CAAC,OAAO,EAAE,iBAAiB;IAIzC,aAAa,CAAC,OAAO,EAAE,gBAAgB;IAIvC,aAAa,CAAC,OAAO,EAAE,gBAAgB;IAIvC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB;IAI1C,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD/B,KAAK,CAAC,cAAc,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;YA2E1D,mDAAmD;YAenD,OAAO;YA0FP,YAAY;IAwBb,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;CAgDlF;AA+BD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;CACtC"}
+{"version":3,"file":"packager.d.ts","sourceRoot":"","sources":["../src/packager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EAGJ,WAAW,EAUX,MAAM,EACP,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,iBAAiB,EAAqB,MAAM,sBAAsB,CAAA;AAM3E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAClH,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAGlE,OAAO,EAAE,SAAS,EAAmB,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AASxD,OAAO,EAAqB,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAE5E,OAAO,EAA8B,EAAE,EAAE,MAAM,kCAAkC,CAAA;AAMjF,KAAK,cAAc,GAAG;IACpB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAA;IAEtD,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA;IACzC,YAAY,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;IAC7C,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IACvC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;IAEvC,sBAAsB,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAEnD,iBAAiB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACrC,mBAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAGvC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;CAC7C,CAAA;AAED,qBAAa,QAAQ;IAyHjB,QAAQ,CAAC,iBAAiB;IAxH5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,OAAO,CAAC,OAAO,CAAQ;IACvB,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA8D;IACxF,iBAAiB,IAAI,OAAO,CAAC,EAAE,CAAC;IAGhC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIzC,6EAA6E;IAC7E,OAAO,CAAC,SAAS,CAAwB;IACzC,IAAI,QAAQ,IAAI,QAAQ,CAEvB;IAED,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAAwB;IACjD,IAAI,gBAAgB,IAAI,QAAQ,CAE/B;IAED,0CAA0C;IAC1C,IAAI,eAAe,WAElB;IAED,OAAO,CAAC,6BAA6B,CAAQ;IAE7C,IAAI,+BAA+B,IAAI,OAAO,CAE7C;IAED,OAAO,CAAC,mBAAmB,CAAQ;IAEnC,IAAI,kBAAkB,IAAI,OAAO,CAEhC;IAED,OAAO,CAAC,YAAY,CAAwB;IAC5C,IAAI,WAAW,IAAI,QAAQ,GAAG,IAAI,CAEjC;IAED,OAAO,CAAC,cAAc,CAA6B;IAEnD,IAAI,MAAM,IAAI,aAAa,CAE1B;IAED,iCAAiC,UAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0C;IAEvE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAO;IAC/B,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,QAAQ,CAAC,cAAc,SAAyB;IAKhD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiC;IAEpE,oBAAoB,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIrD,OAAO,CAAC,eAAe,CAAmH;IAE1I,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IAEjC,QAAQ,CAAC,WAAW,cAAsC;IAE1D,IAAI,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEzD;IAED,OAAO,CAAC,2BAA2B,CAAwB;IAE3D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAE9F;IAED,OAAO,CAAC,kBAAkB,CAAsB;IAEhD,IAAI,iBAAiB,IAAI,MAAM,CAO9B;IAED,IAAI,6BAA6B,IAAI,MAAM,CAE1C;IAED,OAAO,CAAC,UAAU,CAAyB;IAC3C,IAAI,SAAS,IAAI,SAAS,CAEzB;IAED,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAE3D,oBAAoB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;gBAMhD,OAAO,EAAE,eAAe,EACf,iBAAiB,oBAA0B;YA0CxC,wBAAwB;IAetC,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,QAAQ;IAK3D,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,iBAAiB,CAAC,GAAG,QAAQ;IAKvE,4BAA4B,CAAC,KAAK,EAAE,MAAM,cAAc,EAAE,IAAI,EAAE,WAAW,GAAG,SAAS;;;;IAIvF,2BAA2B;IAIrB,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,EAAE,SAAS,CAAC,EAAE,GAAG;IAY3E;;OAEG;IACG,mBAAmB,CAAC,KAAK,EAAE,eAAe;IAI1C,0BAA0B,CAAC,KAAK,EAAE,eAAe;IAKjD,uBAAuB,CAAC,IAAI,EAAE,MAAM;IAIpC,qBAAqB,CAAC,IAAI,EAAE,MAAM;IAIlC,cAAc,CAAC,OAAO,EAAE,iBAAiB;IAIzC,aAAa,CAAC,OAAO,EAAE,gBAAgB;IAIvC,aAAa,CAAC,OAAO,EAAE,gBAAgB;IAIvC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB;IAI1C,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD/B,KAAK,CAAC,cAAc,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;YA2E1D,mDAAmD;YAenD,OAAO;YAyGP,YAAY;IAwBb,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;CAgDlF;AA+BD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;CACtC"}

package/dist/packager.js

@@ -1,4 +1,4 @@
-import { addValue, Arch, archFromString, AsyncTaskManager, DebugLogger, executeFinally, getArtifactArchName, InvalidConfigurationError, log, MAX_FILE_REQUESTS, orNullIfFileNotExist, sanitizeDirPath, safeStringifyJson, serializeToYaml, TmpDir, } from "builder-util";
+import { Arch, archFromString, AsyncTaskManager, DebugLogger, executeFinally, getArtifactArchName, InvalidConfigurationError, log, MAX_FILE_REQUESTS, orNullIfFileNotExist, sanitizeDirPath, safeStringifyJson, serializeToYaml, TmpDir, } from "builder-util";
 import { CancellationToken, deepAssign, retry } from "builder-util-runtime";
 import { isCI } from "ci-info";
 import { Lazy } from "lazy-val";
@@ -8,7 +8,9 @@ import { AppInfo } from "./appInfo.js";
 import { readAsarJson } from "./asar/asar.js";
 import { Platform } from "./core.js";
 import { createElectronFrameworkSupport } from "./electron/ElectronFramework.js";
-import { computeArchToTargetNamesMap, createTargets, NoOpTarget } from "./targets/targetFactory.js";
+import { assertElectronArchSupported } from "./electron/electronArchSupport.js";
+import { isElectronBased } from "./Framework.js";
+import { addTargetsForPlatform, computeArchToTargetNamesMap, createTargets, NoOpTarget } from "./targets/targetFactory.js";
 import { computeDefaultAppDirectory, getConfig, validateConfiguration } from "./util/config/config.js";
 import { expandMacro } from "./util/macroExpander.js";
 import { checkMetadata, readPackageJson } from "./util/packageMetadata.js";
@@ -58,6 +60,9 @@ export class Packager {
     get appInfo() {
         return this._appInfo;
     }
+    addBuildFinalizeTask(task) {
+        this.buildFinalizeTasks.push(task);
+    }
     get repositoryInfo() {
         return this._repositoryInfo.value;
     }
@@ -93,6 +98,10 @@ export class Packager {
         this.eventEmitter = new AsyncEventEmitter();
         this._appInfo = null;
         this.tempDirManager = new TmpDir("packager");
+        // Tasks that must run after EVERY target has finished building — the only point at which the
+        // shared appOutDir can be mutated without racing a concurrent target that reads it. Used by NSIS
+        // to write elevate.exe into win-unpacked without it leaking into Squirrel/zip/etc. (see #9852).
+        this.buildFinalizeTasks = [];
         this._repositoryInfo = new Lazy(() => getRepositoryInfo(this.projectDir, this.metadata, this.devMetadata));
         this.debugLogger = new DebugLogger(log.isDebugEnabled);
         this.runtimeEnvironmentVariables = {};
@@ -111,28 +120,11 @@ export class Packager {
                 const result = Array();
                 return result.length === 0 && currentIfNotSpecified ? [archFromString(process.arch)] : result;
             }
-            let archToType = targets.get(platform);
-            if (archToType == null) {
-                archToType = new Map();
-                targets.set(platform, archToType);
-            }
-            if (types.length === 0) {
+            addTargetsForPlatform(targets, platform, types, commonArch, archToType => {
                 for (const arch of commonArch(false)) {
                     archToType.set(arch, []);
                 }
-                return;
-            }
-            for (const type of types) {
-                const suffixPos = type.lastIndexOf(":");
-                if (suffixPos > 0) {
-                    addValue(archToType, archFromString(type.substring(suffixPos + 1)), type.substring(0, suffixPos));
-                }
-                else {
-                    for (const arch of commonArch(true)) {
-                        addValue(archToType, arch, type);
-                    }
-                }
-            }
+            });
         }
         if (options.mac != null) {
             processTargets(Platform.MAC, options.mac);
@@ -361,6 +353,11 @@ export class Packager {
                 if (this.cancellationToken.cancelled) {
                     break;
                 }
+                // fail fast when the requested arch has no official Electron build anymore (Electron 44 removed win32-ia32 and linux-armv7l);
+                // skipped for prepackaged apps since nothing is downloaded then
+                if (this.options.prepackaged == null && isElectronBased(this.framework)) {
+                    assertElectronArchSupported(platform, arch, this.framework.version, this.config);
+                }
                 // support os and arch macro in output value
                 const outDir = path.resolve(this.projectDir, packager.expandMacro(this.config.directories.output, Arch[arch]));
                 const targetList = createTargets(nameToTarget, targetNames.length === 0 ? packager.defaultTarget : targetNames, outDir, packager);
@@ -398,6 +395,14 @@ export class Packager {
             }
             await target.finishBuild();
         }
+        // Every target has now finished reading the shared appOutDir(s), so finalize tasks may safely
+        // mutate them (e.g. NSIS copying elevate.exe into win-unpacked — see #9852).
+        for (const task of this.buildFinalizeTasks) {
+            if (this.cancellationToken.cancelled) {
+                break;
+            }
+            await task();
+        }
         return platformToTarget;
     }
     async createHelper(platform) {