Electron Releases

Description of Change

On Windows, the fuses ASAR Integrity specs copy electron.exe and use resedit to embed the Integrity/ElectronAsar resource into the copy. resedit refuses to parse an executable that has an Authenticode certificate table unless ignoreCert is set. When the Electron under test is a signed release build, the shared beforeEach throws Parsing signed executable binary is not allowed by default. and every test in the block fails. A downstream CI that tests signed release builds fails all of them on every Windows x64 and x86 run. Upstream CI tests unsigned builds and never sees this.

This passes { ignoreCert: true } when parsing the copy. Rewriting the resources would invalidate a signature anyway. With ignoreCert, resedit leaves the certificate table out of the rewritten copy and zeroes its data directory entry, so the copy is a valid unsigned executable. For an unsigned executable, the output is byte-identical to before. The shared executable is not modified, and the unmodified-launch, tampered-header, tampered-main-JS, tampered-renderer-content and disabled-fuse assertions are unchanged.

These specs only run on Windows and macOS. I checked the embed step on Linux against signed PE32 and PE32+ binaries. Without the option, it throws the CI error. With it, the copy no longer has a certificate table, the integrity resource and version info round-trip, and all non-resource sections are unchanged. I haven't run the specs on Windows.

Main has no signed downstream runs, so in practice this matters on the release branches, and those need manual backports. They still embed through @electron/packager's resedit() wrapper, which cannot pass ignoreCert. The backports will keep that call and strip the certificate just before it, with NtExecutable.from(buf, { ignoreCert: true }).generate(). That needs resedit declared in spec/package.json and yarn.lock. It gives output byte-identical to the embed here.

🤖 Generated with Claude Code

Checklist

• I have built and tested this change (the specs run only on Windows and macOS; the embed step was checked on Linux against signed PEs)
• I have filled out the PR description
• I have reviewed and verified the changes
• tests are changed or added

Release Notes

Notes: none