Remove Windows PFX signing fallback

.buildkite/commands/package_windows.ps1

@@ -1,41 +1,13 @@
 # Stop script execution when a non-terminating error occurs
 $ErrorActionPreference = "Stop"
 
-# Windows code signing defaults to Azure Artifact Signing. Set USE_PFX_CODE_SIGNING to use PFX.
-$usePfx = -not [string]::IsNullOrEmpty($env:USE_PFX_CODE_SIGNING)
-$useAzure = -not $usePfx
-
-If ($useAzure) {
-    Write-Host "--- :windows: Configure Azure Artifact Signing"
-    # From the CI toolkit; fails here with diagnostics if Azure credentials are wrong.
-    & "setup_azure_trusted_signing.ps1"
-    If ($LastExitCode -ne 0) { Exit $LastExitCode }
-}
-
-If ($usePfx) {
-    Write-Host "--- :windows: Configure PFX code signing"
-    # From the CI toolkit; materializes certificate.pfx.
-    & "setup_windows_code_signing.ps1"
-    If ($LastExitCode -ne 0) { Exit $LastExitCode }
-
-    # Read the PFX password from the process env, falling back to the machine-wide env.
-    $windowsCertPassword = [System.Environment]::GetEnvironmentVariable('WINDOWS_CODE_SIGNING_CERT_PASSWORD', [System.EnvironmentVariableTarget]::Process)
-    If ([string]::IsNullOrEmpty($windowsCertPassword)) {
-        $windowsCertPassword = [System.Environment]::GetEnvironmentVariable('WINDOWS_CODE_SIGNING_CERT_PASSWORD', [System.EnvironmentVariableTarget]::Machine)
-    }
-    If ([string]::IsNullOrEmpty($windowsCertPassword)) {
-        Write-Host "[!] WINDOWS_CODE_SIGNING_CERT_PASSWORD is not set in either process or machine environments."
-        Exit 1
-    }
-
-    $certPath = (Convert-Path .\certificate.pfx)
-    If (-not (Test-Path $certPath)) {
-        Write-Host "[!] Certificate file does not exist at given path $certPath."
-        Exit 1
-    }
-
-    # Import the cert so electron-builder's certificateSubjectName lookup finds it.
-    Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\LocalMachine\Root -Password (ConvertTo-SecureString -String $windowsCertPassword -AsPlainText -Force)
+Write-Host "--- :windows: Configure Azure Artifact Signing"
+# From the CI toolkit; fails here with diagnostics if Azure credentials are wrong.
+& "setup_azure_trusted_signing.ps1"
+If ($LastExitCode -ne 0) { Exit $LastExitCode }
+If ([string]::IsNullOrEmpty($env:SIGNTOOL_PATH)) {
+    Write-Host "[!] SIGNTOOL_PATH is not set after Azure Trusted Signing setup."
+    Exit 1
 }
 
 Write-Host "--- :windows: Installing make"
@@ -54,21 +26,19 @@ Write-Host "--- :windows: Packaging for Windows"
 make package-win32 SKIP_BUILD=true
 If ($LastExitCode -ne 0) { Exit $LastExitCode }
 
-If ($useAzure) {
-    Write-Host "--- :windows: Verify Azure signatures"
-    # Every NSIS installer must carry a valid Authenticode signature. The Store AppX is intentionally
-    # unsigned (re-signed by the Store), so it is not verified here.
-    $exes = Get-ChildItem release\*.exe
-    If ($exes.Count -eq 0) {
-        Write-Host "[!] No release\*.exe found to verify."
-        Exit 1
-    }
-    ForEach ($exe in $exes) {
-        & $env:SIGNTOOL_PATH verify /pa /v $exe.FullName
-        If ($LastExitCode -ne 0) {
-            Write-Host "[!] Signature verification failed for $($exe.FullName)"
-            Exit $LastExitCode
-        }
+Write-Host "--- :windows: Verify Azure signatures"
+# Every NSIS installer must carry a valid Authenticode signature. The Store AppX is intentionally
+# unsigned (re-signed by the Store), so it is not verified here.
+$exes = Get-ChildItem release\*.exe
+If ($exes.Count -eq 0) {
+    Write-Host "[!] No release\*.exe found to verify."
+    Exit 1
+}
+ForEach ($exe in $exes) {
+    & $env:SIGNTOOL_PATH verify /pa /v $exe.FullName
+    If ($LastExitCode -ne 0) {
+        Write-Host "[!] Signature verification failed for $($exe.FullName)"
+        Exit $LastExitCode
     }
-    Write-Host "All Windows installers verified signed."
 }
+Write-Host "All Windows installers verified signed."

.buildkite/pipeline.yml

@@ -85,25 +85,6 @@ steps:
       - release\*.blockmap
       - release\*.yml
 
-  # Validates the legacy PFX path alongside the default Azure build above.
-  - label: Package on Windows (PFX code signing)
-    key: package-windows-pfx
-    agents:
-      queue: windows
-    plugins:
-      - $CI_TOOLKIT_PLUGIN
-      - $NVM_PLUGIN
-    command: .buildkite/commands/package_windows.ps1
-    env:
-      USE_PFX_CODE_SIGNING: 1
-      CSC_FOR_PULL_REQUEST: true
-      PUBLISH: never
-    artifact_paths:
-      - release\*.exe
-      - release\*.appx
-      - release\*.blockmap
-      - release\*.yml
-
   - label: Package on Linux
     key: package-linux
     plugins:

Makefile

@@ -139,14 +139,10 @@ win32: config-release build-if-changed
 .PHONY: package
 package: build-if-changed
 
-# Windows signing: Azure Artifact Signing by default, or PFX when USE_PFX_CODE_SIGNING is set. In
-# Azure mode the NSIS exe signs through the win.sign callback, and the Store AppX builds unsigned —
-# `env -u` removes PFX cert vars so electron-builder skips its built-in /fd-less PFX call. The
-# Store re-signs the AppX regardless. In PFX mode both keep native cert signing, unchanged.
-ifndef USE_PFX_CODE_SIGNING
+# Windows signing: Azure Artifact Signing via the win.sign callback. The Store AppX builds
+# unsigned because Store re-signs the AppX regardless.
 WIN_NSIS_SIGN := -c.win.sign=./scripts/azure-sign.cjs
 APPX_NO_SIGN := env -u CSC_LINK -u CSC_KEY_PASSWORD -u WIN_CSC_LINK -u WIN_CSC_KEY_PASSWORD
-endif
 
 .PHONY: package-win32
 package-win32:

electron-builder.json

@@ -48,7 +48,6 @@
   },
   "win": {
     "icon": "resources/images/simplenote.ico",
-    "certificateSubjectName": "Automattic, Inc.",
     "publisherName": ["Automattic, Inc.", "Automattic Inc."],
     "artifactName": "Simplenote-win-${version}-${arch}.${ext}",
     "target": [

scripts/azure-sign.cjs

@@ -1,8 +1,4 @@
-// electron-builder `win.sign` callback for Azure Artifact Signing.
-//
-// Azure Artifact Signing is the default Windows signing path. Set `USE_PFX_CODE_SIGNING` to leave
-// this callback unwired and use electron-builder's native `certificateSubjectName` PFX path instead.
-// Reaching this callback means Azure is intended, so missing Azure env fails CI.
+// electron-builder `win.sign` callback for Azure Artifact Signing, the sole Windows signing path.
 //
 // electron-builder calls this once per file per signing-hash algorithm, after `rcedit` rewrites
 // the PE resource directory (so signatures are not orphaned). Azure Artifact Signing is