From 91bf5ee6b739b3fb7da3736a43d614df8c7a1829 Mon Sep 17 00:00:00 2001
From: emozilla <emozilla@nousresearch.com>
Date: Thu, 28 May 2026 12:59:14 -0400
Subject: [PATCH] fix(desktop): use no-op sign function instead of sign=null
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VM run 6 still hit the symlink crash even with signtoolOptions.sign=null.
electron-builder 26.8.1 treats null as 'use the default signtool path'
rather than 'skip signing', so the winCodeSign fetch + extraction still
fired for the bundled prebuild re-sign.

The Electron docs (electronjs.org/docs/latest/tutorial/code-signing)
make it clear signing is OPTIONAL and unsigned apps work fine — users
just see SmartScreen on first launch. The electron-builder mechanism
for 'don't actually sign anything' is to supply a custom sign function
(via signtoolOptions.sign: '<path-to-cjs-module>') that resolves
without invoking signtool.

build-noop-sign.cjs is that module — a 5-line async function that
returns undefined. electron-builder calls it for every binary it would
have signed, gets back a resolved promise, and considers each binary
'signed.' No signtool spawn, no winCodeSign fetch, no symlink crash.

When Nous's cert arrives, replace this file with a real signing hook
(@electron/windows-sign-based or a direct signtool invocation). The
architecture's signing-ready and the cutover is a one-file edit.
---
 apps/desktop/build-noop-sign.cjs | 28 ++++++++++++++++++++++++++++
 apps/desktop/package.json        |  2 +-
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 apps/desktop/build-noop-sign.cjs

diff --git a/apps/desktop/build-noop-sign.cjs b/apps/desktop/build-noop-sign.cjs
new file mode 100644
index 0000000000..d1ef352db7
--- /dev/null
+++ b/apps/desktop/build-noop-sign.cjs
@@ -0,0 +1,28 @@
+// No-op sign function for electron-builder.
+//
+// electron-builder's win.signtoolOptions.sign hook lets you BYO signing
+// logic instead of letting electron-builder fetch signtool from winCodeSign
+// and run it itself. We don't sign on grandma's box (no cert, no cert
+// infrastructure, and the bundled node-pty prebuilds are already signed
+// by their authors upstream).
+//
+// By providing this no-op function, electron-builder:
+//   1. Doesn't try to fetch winCodeSign from GitHub
+//   2. Doesn't try to extract winCodeSign-2.6.0.7z (which fails on
+//      non-admin Windows due to the darwin/*.dylib symlinks needing
+//      SeCreateSymbolicLinkPrivilege)
+//   3. Considers every bundled binary "signed" and moves on
+//
+// The produced Hermes.exe and its bundled prebuild .exes ship unsigned.
+// SmartScreen will warn once on first launch ("More info → Run anyway"),
+// same friction as Hermes-Setup.exe itself. The architecture's signing-
+// ready: when Nous Research's signing cert lands, replace this file with
+// a real signtool invocation or @electron/windows-sign-based hook.
+//
+// Referenced from package.json's build.win.signtoolOptions.sign.
+
+module.exports = async function noopSign(_configuration) {
+  // Intentionally do nothing. electron-builder treats a resolved promise
+  // (or non-Error return) as "signing succeeded."
+  return undefined
+}
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index de92f3ab8b..00c7b88d6c 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -202,7 +202,7 @@
         "msi"
       ],
       "signtoolOptions": {
-        "sign": null
+        "sign": "./build-noop-sign.cjs"
       }
     },
     "nsis": {