Skip to content

[release/10.0] Add catalog signing for .js files for VS signing compliance#1674

Merged
akoeplinger merged 4 commits intorelease/10.0from
backport/pr-1671-to-release/10.0
Mar 31, 2026
Merged

[release/10.0] Add catalog signing for .js files for VS signing compliance#1674
akoeplinger merged 4 commits intorelease/10.0from
backport/pr-1671-to-release/10.0

Conversation

@github-actions
Copy link
Copy Markdown

Backport of #1671 to release/10.0

/cc @akoeplinger @jesuszarate

jesuszarate and others added 4 commits March 31, 2026 16:05
The .js files in the Emscripten SDK are customer-modifiable toolchain files
that cannot be directly Authenticode-signed (modifying a signed file breaks
the signature). Instead, generate a .cat catalog file covering all .js files,
which is signed with MicrosoftDotNet500 via the existing FileExtensionSignInfo
entry for .cat files.

The GenerateCatalogFiles target runs after ReallyBuild on Windows only
(makecat.exe is a Windows SDK tool). It invokes eng/generate-catalog.ps1 which
enumerates all .js files, generates a CDF, runs makecat.exe, and produces
emscripten-js.cat in the SDK package directory so it ships alongside the
files it covers.

This fixes ~14,468 unsigned .js files flagged by VS signing compliance scans.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@akoeplinger akoeplinger enabled auto-merge (squash) March 31, 2026 16:05
@akoeplinger akoeplinger merged commit d49dc02 into release/10.0 Mar 31, 2026
10 checks passed
@akoeplinger akoeplinger deleted the backport/pr-1671-to-release/10.0 branch April 1, 2026 14:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants