fix(windows): bundler should not sign non-binaries (#13921)

* fix(windows): bundler should not sign non-binaries

* Fix non Windows

Author: Legend-Master

.changes/dont-sign-non-binary-resources.md

@@ -0,0 +1,5 @@
+---
+tauri-bundler: "patch:bug"
+---
+
+The bundler will no longer try to sign non-binary and already signed binary files on Windows

crates/tauri-bundler/src/bundle/windows/msi/mod.rs

@@ -7,7 +7,7 @@ use crate::{
   bundle::{
     settings::{Arch, Settings},
     windows::{
-      sign::try_sign,
+      sign::{should_sign, try_sign},
       util::{
         download_webview2_bootstrapper, download_webview2_offline_installer,
         WIX_OUTPUT_FOLDER_NAME, WIX_UPDATER_OUTPUT_FOLDER_NAME,
@@ -988,7 +988,7 @@ fn generate_resource_data(settings: &Settings) -> crate::Result<ResourceMap> {
     }
     added_resources.push(resource_path.clone());
 
-    if settings.can_sign() {
+    if settings.can_sign() && should_sign(&resource_path)? {
       try_sign(&resource_path, settings)?;
     }
 

crates/tauri-bundler/src/bundle/windows/nsis/mod.rs

@@ -6,7 +6,7 @@ use crate::{
   bundle::{
     settings::Arch,
     windows::{
-      sign::{sign_command, try_sign},
+      sign::{should_sign, sign_command, try_sign},
       util::{
         download_webview2_bootstrapper, download_webview2_offline_installer,
         NSIS_OUTPUT_FOLDER_NAME, NSIS_UPDATER_OUTPUT_FOLDER_NAME,
@@ -743,7 +743,7 @@ fn generate_resource_data(settings: &Settings) -> crate::Result<ResourcesMap> {
     }
     added_resources.push(resource_path.clone());
 
-    if settings.can_sign() {
+    if settings.can_sign() && should_sign(&resource_path)? {
       try_sign(&resource_path, settings)?;
     }
 

crates/tauri-bundler/src/bundle/windows/sign.rs

@@ -257,3 +257,26 @@ pub fn try_sign<P: AsRef<Path>>(file_path: P, settings: &Settings) -> crate::Res
   }
   Ok(())
 }
+
+/// If the file is signable (is a binary file) and not signed already
+/// (will skip the verification if not on Windows since we can't verify it)
+pub fn should_sign(file_path: &Path) -> crate::Result<bool> {
+  let is_binary = file_path
+    .extension()
+    .and_then(|extension| extension.to_str())
+    .is_some_and(|extension| matches!(extension, "exe" | "dll"));
+  if !is_binary {
+    return Ok(false);
+  }
+
+  #[cfg(windows)]
+  {
+    let already_signed = verify(file_path)?;
+    Ok(!already_signed)
+  }
+  // Skip verification if not on Windows since we can't verify it
+  #[cfg(not(windows))]
+  {
+    Ok(true)
+  }
+}