npmazure-keyvaultcode-signingsigntooltauri

Why does npm run tauri build fail to run signtool.exe

Recently I have been building an application using Svelte, .NET and Tauri, and it is time to sign it and make it available for the customer.

I have bought an EV Code Signing certificate and added it to Azure Key Vault per the documentation from the certificate provider. The certificate provides a thumbprint, which I have added to tauri.conf.json:

tauri.conf.json file

Azure Key Vault Thumbprint

I have tried changing digestAlgorithm to sha1, but that does not seem to make any difference.

When building the application using "npm run tauri build --verbose", I get this:

enter image description here

The scribbled part in this last one is the same thumbprint as the one I scribbled out in the other two.

Adding "--verbose" to the command did not really help much, as "npm verb exit 1" and "npm verb code 1" does not really tell me much.

I can also verify that signtool.exe is located at the filepath it is trying to run it from.

What can I do to make the signing successful?

UPDATE:

@FabianLars - you are absolutely correct, I missed the two dashes ahead of the --verbose command. Here is the output I am getting now:

Output when correctly using --verbose

@DeveloperMindset.com - The Key Vault is set up to not generate a private key, but I am able to download a CER file, and a PFX/PEM file. The PEM file looks like a text file with a --BEGIN CERTIFICATE-- and a key, I'm not sure what to do with that in case. I have added "tsp": false to my tauri.conf.json. I have also downloaded a CER file, and installed the certificate to my local machine. The output after trying to build is in the screenshot above, using --verbose.

Installed certificate issued to the company

Solution

  • I figured it out, finally.

    I was way too fixated on using the Tauri built in signing, and trying to figure out how to use Microsoft Sign Tool, that I completely overlooked the fact that I could use Azure Sign Tool.

    For anyone having their certificate in Azure Key Vault, this is definitely the way, don't bother with the tauri.conf.json stuff, just build the app like you normally do, and sign the file with Azure Sign Tool.

    Here is a link to the documentation I used. I imagine every certificate issuer will have their own, but this one worked very well for me:

    https://trustzone.com/knowledge-base/how-to-sign-files-with-azure-sign-tool/