How to reduce the number of code-signing invocations for NSIS bundles (cloud HSM / eSigner)?
Hi! Looking for guidance here.
When I build a Windows NSIS bundle with signing enabled, Tauri runs the signing command 7 times per build — once per binary (command - `npm run tauri build`):
1. <app>.exe (main app)
2. NSISdl.dll
3. StartMenu.dll
4. System.dll
5. nsDialogs.dll
6. nsis_tauri_utils.dll
7. <app>_x64-setup.exe (installer)
With a local cert this is no problem. But we sign with a cloud HSM — SSL.com eSigner CKA (EV code signing via a KSP provider) — where every signing call has network latency and is subject to rate limits / quota / cost. Signing the 5 internal NSIS plugin DLLs on every build is slow and expensive, given they ship inside an installer that is itself signed.
**Questions:**
- Is there a supported way to reduce the number of signings — ideally to just the main binary + final installer (≤3 total)?
- Is it safe/intended to use a custom signCommand that skips .dll files (no-op for the NSIS plugins)? Does Tauri later verify the plugin DLL signatures, or would skipping them break anything?
- Is there any option to skip signing the bundled NSIS plugins, or to sign all files in a single batch invocation?
**Environment:**
Tauri v2 (CLI 2.11.x), Windows, target: nsis
Cert: SSL.com EV code signing via eSigner CKA (cloud KSP)
0 条评论