fix: disable dual-signing for .msi installer

package.json

@@ -80,7 +80,7 @@
     "mime": "^1.3.4",
     "minimatch": "^3.0.3",
     "normalize-package-data": "^2.3.5",
-    "plist": "^1.2.0",
+    "plist": "^2.0.1",
     "pretty-ms": "^2.1.0",
     "progress": "^1.1.8",
     "progress-stream": "^1.2.0",
@@ -90,7 +90,7 @@
     "source-map-support": "^0.4.2",
     "update-notifier": "^1.0.2",
     "uuid-1345": "^0.99.6",
-    "yargs": "^4.8.1"
+    "yargs": "^5.0.0"
   },
   "optionalDependencies": {
     "appdmg": "^0.4.5"

src/windowsCodeSign.ts

@@ -28,11 +28,17 @@ export interface SignOptions {
 
 export async function sign(options: SignOptions) {
   let hashes = options.hash
-  if (hashes == null) {
-    hashes = ["sha1", "sha256"]
+  // msi does not support dual-signing
+  if (path.extname(options.path) === ".msi") {
+    hashes = [hashes != null && !hashes.includes("sha1") ? "sha256" : "sha1"]
   }
   else {
-    hashes = Array.isArray(hashes) ? hashes.slice() : [hashes]
+    if (hashes == null) {
+      hashes = ["sha1", "sha256"]
+    }
+    else {
+      hashes = Array.isArray(hashes) ? hashes.slice() : [hashes]
+    }
   }
 
   const isWin = process.platform === "win32"
@@ -91,6 +97,7 @@ async function spawnSign(options: SignOptions, inputPath: string, outputPath: st
     args.push(isWin ? "/du" : "-i", options.site)
   }
 
+  // msi does not support dual-signing
   if (nest) {
     args.push(isWin ? "/as" : "-nest")
   }