fix: windows code signing

[filfreire]

todo

• disable winCodeSign unused download
• remove unused CSC links for windows
• try to get Update.exe and Insomnia.exe (stub) codesigned
• prevent portable.exe windows (used for recurring builds) from being signed
• test in a dummy GitHub actions workflow - https://github.com/Kong/insomnia/actions/runs/11363590563/artifacts/2062742332

windows codesigning process after merging this PR

The approach is:

1. run package:windows:unpacked to bake windows-unpacked folder (which runs npm run build:app) with all common baked insomnia files
2. codesign the .dll and .exe unpacked files (common to all installers) (using GitHub actions intermediate steps that use SSL.com's esigner-codesign
3. run the package:windows:dist and point it to the same windows-unpacked folder (using electron-builder's --dir flag) for baking the temporary squirrel related files, signing with SSL.com's ci-images via customSign.js hook, bake the installer package, and sign that as well from hook.

debugging

found that Update.exe and Insomnia.exe (squirrel stub) are only available to codesign via hook

Solution

We use the container image for EV codesigner from a custom-hook during packaging.

Afterwards, both the Stub, Updater.exe and the installer are all code-signed in a single go:

(using upstream branch instead of fork to test, closed #8069)

[jackkav]

maybe just add npm run build:app && for consistency, can do it in future if you need

[filfreire]

@jackkav about:

maybe just add npm run build:app && for consistency, can do it in future if you need

We should not add it in this case. The approach is:

• First we run package:windows:unpacked to bake windows-unpacked (which runs npm run build:app)
• Then we codesign the .dll and .exe unpacked files (common to all installers)
• Then we run the package:windows:dist and point it to the same windows-unpacked folder for baking the temporary squirrel related files, signing via customSign hook, bake the installer package, and sign that as well.

The unpacked files need to get codesigned in an intermediate step, and then we build the Squirrel package from the codesigned windows-unpacked folder for which we have already previously run build:app.