Signing Windows installer doesn't sign every binary

• I have read the contribution documentation for this project.
• I agree to follow the code of conduct that this project follows, as appropriate.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Please describe your issue: It appears that electron-packager and electron-wininstaller do not support signing all of the Windows binaries such as ffmpeg.dll, libEGL.dll, and node.dll; AND the resources/*.asar. This means that someone could replace the files in resources/*.asar or the unsigned dll’s with malicious code.

Who is looking into this issue?

[drjasonharrison]

Yes, sadly Windows went fully for the “sign only the executables” where the definition of “executables” has become increasingly out of date. It sounds like the electron/asar library would need to be extended, or a detached signature for the resource/*.asar files be embedded in the electron-builder output.

And as in my situation, the signing would need to be able to be performed by a third party tool.

I’m some what surprised that this issue hasn’t already been raised by any of the other electron application users. I’ve filed https://github.com/electron/asar/issues/123

[develar]

Asar file cannot be signed using windows tool. File format doesn’t support it simply. Electron should support it, because it is not possible to implement check on application side (since asar files can be changed).

Good news is that on macOS it is possible to fix without Electron team — https://stackoverflow.com/questions/35013006/where-does-codesign-store-the-signature-for-a-signed-text-file-on-osx I will file PR to electron-osx-sign soon (cc @sethlu).