mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-10-27 23:20:05 -05:00
Dave Page
0dc122cb2e
The one-step "signtool sign /fd sha256" fails on the build host with 0xc0000225 before the PIN is asked for, because crypt32 converts the legacy CryptoAPI key handle to a CNG one for SHA-2 digests, and no CNG provider is registered under the name of Certum's crypto3 CSP. Rebinding to cryptoCertum3 KSP is not an option, as it cannot see the Common profile's code-signing key. signtool's split flow avoids the conversion, so pkg/win32/sign-files.bat now does the signing in /dg, /ds, /di, timestamp and verify steps, with one PIN prompt per call as before. Make.bat's :SIGN_FILES and Inno Setup's SignTool both go through it, the latter via cmd /c. Also default PGADMIN_SIGNTOOL_DIR to SDK 10.0.26100.0, the one installed on the host, and match the PIN dialog on "Logowanie do profilu zwyk" so that a Secure profile prompt is never answered with the Common PIN. SIGNING.md gains the full setup procedure, the root cause and the split signing flow.