fix: generate stubExecutableExe and sign it (electron-userland#8959)

fix electron-userland#8952

**Root Cause**

when createExecutableStubForExe is executed, WriteZipToSetup writes
information to the file, essentially creating a new file, which
invalidates the original signature.

![Image](https://github.com/user-attachments/assets/9f5b0f4b-8f50-4373-8dad-45b00a730ee1)


https://github.com/Squirrel/Squirrel.Windows/blob/51f5e2cb01add79280a53d51e8d0cfa20f8c9f9f/src/Update/Program.cs#L633-L647


![Image](https://github.com/user-attachments/assets/f0ea1e22-9727-4599-a836-1fa1f3c77dcc)

**How to fix**
Apply a patch to the Squirrel Windows source
code(Squirrel/Squirrel.Windows#1903). For the
existing stub exe files, don't generate them anymore. Then, a new stub
exe can be generated in Electron Builder and signed.

---------

Co-authored-by: Mike Maietta <[email protected]>

Author: 2 people

.changeset/lovely-brooms-move.md

@@ -0,0 +1,5 @@
+---
+"electron-builder-squirrel-windows": patch
+---
+
+fix: generate stubExecutableExe and sign it for squirrel.windows using new electron-builder-binaries asset

packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts

@@ -1,4 +1,6 @@
 import { InvalidConfigurationError, log, isEmptyOrSpaces } from "builder-util"
+import { execWine } from "app-builder-lib/out/wine"
+import { getBinFromUrl } from "app-builder-lib/out/binDownload"
 import { sanitizeFileName } from "builder-util/out/filename"
 import { Arch, getArchSuffix, SquirrelWindowsOptions, Target, WinPackager } from "app-builder-lib"
 import * as path from "path"
@@ -20,31 +22,56 @@ export default class SquirrelWindowsTarget extends Target {
   }
 
   private async prepareSignedVendorDirectory(): Promise<string> {
-    // If not specified will use the Squirrel.Windows that is shipped with electron-installer(https://github.com/electron/windows-installer/tree/main/vendor)
-    // After https://github.com/electron-userland/electron-builder-binaries/pull/56 merged, will add `electron-builder-binaries` to get the latest version of squirrel.
-    let vendorDirectory = this.options.customSquirrelVendorDir || path.join(require.resolve("electron-winstaller/package.json"), "..", "vendor")
-    if (isEmptyOrSpaces(vendorDirectory) || !fs.existsSync(vendorDirectory)) {
-      log.warn({ vendorDirectory }, "unable to access Squirrel.Windows vendor directory, falling back to default electron-winstaller")
-      vendorDirectory = path.join(require.resolve("electron-winstaller/package.json"), "..", "vendor")
-    }
-
+    const customSquirrelVendorDirectory = this.options.customSquirrelVendorDir
     const tmpVendorDirectory = await this.packager.info.tempDirManager.createTempDir({ prefix: "squirrel-windows-vendor" })
-    // Copy entire vendor directory to temp directory
-    await fs.promises.cp(vendorDirectory, tmpVendorDirectory, { recursive: true })
-    log.debug({ from: vendorDirectory, to: tmpVendorDirectory }, "copied vendor directory")
 
-    const files = await fs.promises.readdir(tmpVendorDirectory)
-    for (const file of files) {
-      if (["Squirrel.exe", "StubExecutable.exe"].includes(file)) {
-        const filePath = path.join(tmpVendorDirectory, file)
-        log.debug({ file: filePath }, "signing vendor executable")
-        await this.packager.sign(filePath)
-      }
+    if (isEmptyOrSpaces(customSquirrelVendorDirectory) || !fs.existsSync(customSquirrelVendorDirectory)) {
+      log.warn({ customSquirrelVendorDirectory: customSquirrelVendorDirectory }, "unable to access custom Squirrel.Windows vendor directory, falling back to default vendor ")
+      const windowInstallerPackage = require.resolve("electron-winstaller/package.json")
+      const vendorDirectory = path.join(path.dirname(windowInstallerPackage), "vendor")
+
+      const squirrelBin = await getBinFromUrl(
+        "[email protected]",
+        "squirrel.windows-2.0.1-patched.7z",
+        "DWijIRRElidu/Rq0yegAKqo2g6aVJUPvcRyvkzUoBPbRasIk61P6xY2fBMdXw6wT17md7NzrTI9/zA1wT9vEqg=="
+      )
+
+      await fs.promises.cp(vendorDirectory, tmpVendorDirectory, { recursive: true })
+      // copy the patched squirrel to tmp vendor directory
+      await fs.promises.cp(path.join(squirrelBin, "electron-winstaller", "vendor"), tmpVendorDirectory, { recursive: true })
+    } else {
+      // copy the custom squirrel vendor directory to tmp vendor directory
+      await fs.promises.cp(customSquirrelVendorDirectory, tmpVendorDirectory, { recursive: true })
     }
 
+    const files = await fs.promises.readdir(tmpVendorDirectory)
+    const squirrelExe = files.find(f => f === "Squirrel.exe")
+    if (squirrelExe) {
+      const filePath = path.join(tmpVendorDirectory, squirrelExe)
+      log.debug({ file: filePath }, "signing vendor executable")
+      await this.packager.sign(filePath)
+    } else {
+      log.warn("Squirrel.exe not found in vendor directory, skipping signing")
+    }
     return tmpVendorDirectory
   }
 
+  private async generateStubExecutableExe(appOutDir: string, vendorDir: string) {
+    const files = await fs.promises.readdir(appOutDir, { withFileTypes: true })
+    const appExe = files.find(f => f.name === `${this.exeName}.exe`)
+    if (!appExe) {
+      throw new Error(`App executable not found in app directory: ${appOutDir}`)
+    }
+
+    const filePath = path.join(appOutDir, appExe.name)
+    const stubExePath = path.join(appOutDir, `${this.exeName}_ExecutionStub.exe`)
+    await fs.promises.copyFile(path.join(vendorDir, "StubExecutable.exe"), stubExePath)
+    await execWine(path.join(vendorDir, "WriteZipToSetup.exe"), null, ["--copy-stub-resources", filePath, stubExePath])
+    await this.packager.sign(stubExePath)
+    log.debug({ file: filePath }, "signing app executable")
+    await this.packager.sign(filePath)
+  }
+
   async build(appOutDir: string, arch: Arch) {
     const packager = this.packager
     const version = packager.appInfo.version
@@ -62,6 +89,7 @@ export default class SquirrelWindowsTarget extends Target {
         arch,
       })
       const distOptions = await this.computeEffectiveDistOptions(appOutDir, installerOutDir, setupFile)
+      await this.generateStubExecutableExe(appOutDir, distOptions.vendorDirectory!)
       await createWindowsInstaller(distOptions)
 
       await packager.signAndEditResources(artifactPath, arch, installerOutDir)
@@ -120,6 +148,10 @@ export default class SquirrelWindowsTarget extends Target {
     return this.options.name || this.packager.appInfo.name
   }
 
+  private get exeName() {
+    return this.packager.appInfo.productFilename || this.options.name || this.packager.appInfo.productName
+  }
+
   private select7zipArch(vendorDirectory: string) {
     // https://github.com/electron/windows-installer/blob/main/script/select-7z-arch.js
     // Even if we're cross-compiling for a different arch like arm64,

packages/electron-builder-squirrel-windows/template.nuspectemplate

@@ -19,6 +19,7 @@
     <file src="*.pak" target="lib\net45" />
     <file src="*.exe.config" target="lib\net45" />
     <file src="*.exe.sig" target="lib\net45" />
+    <file src="*_ExecutionStub.exe" target="lib\net45" />
     <file src="icudtl.dat" target="lib\net45\icudtl.dat" />
     <file src="Squirrel.exe" target="lib\net45\squirrel.exe" />
     <file src="LICENSE.electron.txt" target="lib\net45\LICENSE.electron.txt" />