The Compass windows setup .exe file is an exception in that electron-winstaller does the signing for us. It calls signtool.exe. We do the signing with our own code and a remote server so to get around this we have a drop-in replacement for signtool.exe that we put over the one that comes with elecrton-winstaller. This is written in go. (see signtool.go).

This go program broke without us noticing. Fixed with another hack now, but would really like to reduce the number of hacks.

Newer versions of winstaller seem to be more configurable, so we might be able to sign from javascript or at least without monkeypatching it.

See:

https://github.com/electron/windows-installer?tab=readme-ov-file#advanced-codesigning-with-electronwindows-sign

https://github.com/electron/windows-sign/

Consider doing https://jira.mongodb.org/browse/COMPASS-8963 first so we can be sure we don't break anything.