EV Code Signing

• Version: 5.21.0

• Target: Windows x64

Unless I’ve missed something, the current settings with CSC_LINK and CSC_KEY_PASSWORD don’t satisfy the EV Code Signing requirements. DigiCert uses this as an example:

signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /n "subject name" "C:\path\to\fileToSign.exe"

Where subject name is the Issued To column in the Personal > Certificates list.

Here’s the full instructions: https://www.digicert.com/code-signing/ev-authenticode-certificates.htm

Do I need to go in and change the code that builds the signtool line or is there something already in electron-builder to handle this?

I do see CSC_NAME but it says it’s macOS only.

[dharders]

I just coded up a solution that worked for me (note: assumes your cert is in the store, subjectName is set in build.win). This is a quick proof of concept. Further work is needed for error checking etc.

Modify: node_modules\electron-builder\out\windowsCodeSign.js file starting Line 42ish in function spawnSign():

Change:

if (certExtension === ".p12" || certExtension === ".pfx") {
  args.push(isWin ? "/f" : "-pkcs12", options.cert);
  ...

To:

if (options.subjectName) {
  args.push("/n", options.subjectName);
} else if (certExtension === ".p12" || certExtension === ".pfx") {
  args.push(isWin ? "/f" : "-pkcs12", options.cert);
  ...

Also, a little further down (same function): Change if (options.password) { ... To if (!options.subjectName && options.password) { ...

node_modules\electron-builder\out\winPackager.js file starting Line 102ish in function sign(), add the subjectName option:

yield this.doSign({
  path: file,
  ...
  hash: this.platformSpecificBuildOptions.signingHashAlgorithms,
  subjectName: this.platformSpecificBuildOptions.subjectName
});
...

And finally, add subjectName to your package.json:

"win": {
  "target": "nsis",
  "certificateFile": "./resources/cert.pfx",  // required to force codesign (use dummy value))
  "subjectName": "Your Subject Name",
  ...
}

Note for this proof of concept, a dummy certificateFile must be specified to kickstart codesign (the file doesn’t have to exist)

I actually prefer this way (of using /n) as no passwords are needed etc if the cert is in the store already.

[develar]

Duplicates #590