From c08f945f93db180d6c69558f31f1c36cec037eaa Mon Sep 17 00:00:00 2001 From: Victor Irzak Date: Tue, 28 Jul 2026 07:38:10 -0400 Subject: [PATCH] Clarify that --signTemplate works when cross compiling Two places state that signing a Windows package requires Windows, which contradicts the Cross Platform Signing section documenting JSign via --signTemplate: - cross-compiling.mdx said the "--signParams / --signTemplate path relies on signtool.exe". --signTemplate does not; it runs an arbitrary command. - signing.mdx said signing relies on signtool.exe and that other operating systems must sign on a Windows machine. In WindowsPackCommand.cs, --signParams and --azureTrustedSignFile are registered inside 'if (VelopackRuntimeInfo.IsWindows)' while --signTemplate is registered unconditionally, and WindowsPackCommandRunner runs the template before the 'if (!VelopackRuntimeInfo.IsWindows) return' guard. Scope both notes to the signtool-backed options and point at the existing Cross Platform Signing section. --- docs/packaging/cross-compiling.mdx | 8 +++++++- docs/packaging/signing.mdx | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/packaging/cross-compiling.mdx b/docs/packaging/cross-compiling.mdx index 60b200a..919f9c7 100644 --- a/docs/packaging/cross-compiling.mdx +++ b/docs/packaging/cross-compiling.mdx @@ -32,7 +32,13 @@ Before running a command for a different OS, you should review the help text of you must use a MacOS machine to create MacOS packages. ## Signing caveat -While you can *build* a Windows package from Linux or macOS, **signing** it has additional requirements. The standard `--signParams` / `--signTemplate` path relies on `signtool.exe`, which only runs on Windows. If you need to sign a Windows package from Linux or macOS, use a cross-platform tool such as JSign. See the [code signing guide](./signing.mdx) for details. +Windows packages built on Linux or macOS can also be signed there, using `--signTemplate`. It runs whatever command you give it, so any cross-platform signing tool works: + +```sh +vpk [win] pack ... --signTemplate " sign {{file...}}" +``` + +What does *not* work off Windows is `--signParams` and `--azureTrustedSignFile`, both of which invoke the bundled `signtool.exe`. See [Cross Platform Signing](./signing.mdx#cross-platform-signing) for tools that fill the gap. diff --git a/docs/packaging/signing.mdx b/docs/packaging/signing.mdx index 51181be..d702838 100644 --- a/docs/packaging/signing.mdx +++ b/docs/packaging/signing.mdx @@ -55,7 +55,9 @@ Note that since June 1, 2023 there [has been a policy change](https://knowledge. For detailed information on Azure Artifact Signing please refer to the [official documentation](https://learn.microsoft.com/azure/trusted-signing/). :::note -Signing relies on `signtool.exe` which is only supported on Windows. If you are using a different operating system, you will need to sign your binaries on a Windows machine before deploying them. +`--signParams` and `--azureTrustedSignFile` rely on `signtool.exe`, which only runs on Windows. Signing with either of those on Linux or macOS is not possible. + +`--signTemplate` has no such restriction: it runs whatever command you give it, on any operating system. See [Cross Platform Signing](#cross-platform-signing) below. ::: 1. First you will need to create an Azure account at: https://azure.microsoft.com/pricing/purchase-options/azure-account. This account will need to have an [active subscription](https://learn.microsoft.com/azure/cost-management-billing/manage/create-subscription#create-a-subscription).