fix: sign main binary after patching with bundle info (fix #13868) (#13870)

* fixed #13868

* add main binary singing only on windows

* updated readme message

Author: kittuov

.changes/fix-code-signing-after-patch.md

@@ -0,0 +1,5 @@
+---
+tauri-bundler: "patch:bug"
+---
+
+The bundler now signs the main binary after patching it for every package type on windows

crates/tauri-bundler/src/bundle.rs

@@ -84,6 +84,10 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {
   if matches!(target_os, TargetPlatform::Windows) {
     if settings.can_sign() {
       for bin in settings.binaries() {
+        if bin.main() {
+          // we will sign the main binary after patching per "package type"
+          continue;
+        }
         let bin_path = settings.binary_path(bin);
         windows::sign::try_sign(&bin_path, settings)?;
       }
@@ -130,6 +134,12 @@ pub fn bundle_project(settings: &Settings) -> crate::Result<Vec<Bundle>> {
       log::warn!("Failed to add bundler type to the binary: {e}. Updater plugin may not be able to update this package. This shouldn't normally happen, please report it to https://github.com/tauri-apps/tauri/issues");
     }
 
+    // sign main binary for every package type after patch
+    if matches!(target_os, TargetPlatform::Windows) && settings.can_sign() {
+      let bin_path = settings.binary_path(main_binary);
+      windows::sign::try_sign(&bin_path, settings)?;
+    }
+
     let bundle_paths = match package_type {
       #[cfg(target_os = "macos")]
       PackageType::MacOsBundle => macos::app::bundle_project(settings)?,