enable debug logging for windows sign (#2034)

.github/workflows/release.yml

@@ -65,6 +65,7 @@ jobs:
         # Publish (all platforms)
       - name: Publish app
         env:
+          DEBUG: "@electron/*"
           NODE_OPTIONS: "--max-old-space-size=4096"
           SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

forge.config.ts

@@ -88,6 +88,7 @@ const config: ForgeConfig = {
   makers: [
     new MakerSquirrel({
       windowsSign: {
+        debug: true,
         hookModulePath: path.join(__dirname, "scripts", "windows-sign-hook.js"),
       },
     }),

scripts/windows-sign-hook.js

 const { execSync } = require("child_process");
 const path = require("path");
 
-// Path to signtool.exe bundled with electron-winstaller
-// On GitHub Actions, this is the full path:
-// D:\a\dyad\dyad\node_modules\electron-winstaller\vendor\signtool.exe
 const SIGNTOOL_PATH = path.join(
   __dirname,
   "..",
@@ -13,19 +10,32 @@ const SIGNTOOL_PATH = path.join(
   "signtool.exe",
 );
 
-/**
- * Custom hook function for Windows code signing.
- * Only signs dyad.exe, skips all other files.
- * @param {string} filePath - Path to the file to sign
- */
 module.exports = function (filePath) {
+  console.log(`[windows-sign-hook] Called with: ${filePath}`);
+  console.log(`[windows-sign-hook] SIGNTOOL_PATH: ${SIGNTOOL_PATH}`);
+  console.log(
+    `[windows-sign-hook] SM_CODE_SIGNING_CERT_SHA1_HASH: ${process.env.SM_CODE_SIGNING_CERT_SHA1_HASH ? "SET" : "NOT SET"}`,
+  );
+
   const fileName = path.basename(filePath).toLowerCase();
-  // Only sign dyad.exe, skip all other files
   if (fileName !== "dyad.exe") {
+    console.log(`[windows-sign-hook] Skipping: ${fileName}`);
     return;
   }
-  const signParams = `/sha1 ${process.env.SM_CODE_SIGNING_CERT_SHA1_HASH} /tr http://timestamp.digicert.com /td SHA256 /fd SHA256`;
-  execSync(`"${SIGNTOOL_PATH}" sign ${signParams} "${filePath}"`, {
-    stdio: "inherit",
-  });
+
+  console.log(`[windows-sign-hook] Signing: ${fileName}`);
+  const certHash = process.env.SM_CODE_SIGNING_CERT_SHA1_HASH;
+  const signParams = `/sha1 ${certHash} /tr http://timestamp.digicert.com /td SHA256 /fd SHA256`;
+  const cmd = `"${SIGNTOOL_PATH}" sign ${signParams} "${filePath}"`;
+  const redactedSignParams = `/sha1 ${certHash ? "[REDACTED]" : "[NOT SET]"} /tr http://timestamp.digicert.com /td SHA256 /fd SHA256`;
+  const redactedCmd = `"${SIGNTOOL_PATH}" sign ${redactedSignParams} "${filePath}"`;
+  console.log(`[windows-sign-hook] Command: ${redactedCmd}`);
+
+  try {
+    execSync(cmd, { stdio: "inherit" });
+    console.log(`[windows-sign-hook] Signing successful`);
+  } catch (error) {
+    console.error(`[windows-sign-hook] Signing failed:`, error);
+    throw error;
+  }
 };