ITADN

How to reduce the number of code-signing invocations for NSIS bundles (cloud HSM / eSigner)?

#15601OpenMrutunjay-50 创建于 2026-06-29
M
Mrutunjay-50commented
Hi! Looking for guidance here. When I build a Windows NSIS bundle with signing enabled, Tauri runs the signing command 7 times per build — once per binary (command - `npm run tauri build`): 1. <app>.exe (main app) 2. NSISdl.dll 3. StartMenu.dll 4. System.dll 5. nsDialogs.dll 6. nsis_tauri_utils.dll 7. <app>_x64-setup.exe (installer) With a local cert this is no problem. But we sign with a cloud HSM — SSL.com eSigner CKA (EV code signing via a KSP provider) — where every signing call has network latency and is subject to rate limits / quota / cost. Signing the 5 internal NSIS plugin DLLs on every build is slow and expensive, given they ship inside an installer that is itself signed. **Questions:** - Is there a supported way to reduce the number of signings — ideally to just the main binary + final installer (≤3 total)? - Is it safe/intended to use a custom signCommand that skips .dll files (no-op for the NSIS plugins)? Does Tauri later verify the plugin DLL signatures, or would skipping them break anything? - Is there any option to skip signing the bundled NSIS plugins, or to sign all files in a single batch invocation? **Environment:** Tauri v2 (CLI 2.11.x), Windows, target: nsis Cert: SSL.com EV code signing via eSigner CKA (cloud KSP)
0 条评论