Azure Code Signing vs. resources

[dmca-glasgow]

Hi there 👋

Although completely out of my comfort zone as a TypeScript dev, I have finally managed to implement Azure Code Signing on GitHub Actions.. for .exe files. However, I've now got a new error:

GitHub Actions log

[
  {
    "cloudName": "AzureCloud",
    "homeTenantId": "***",
    "id": "125ecc14-76ae-4cae-918e-d8da5f3a4d51",
    "isDefault": true,
    "managedByTenants": [],
    "name": "Production",
    "state": "Enabled",
    "tenantId": "***",
    "user": {
      "name": "***",
      "type": "servicePrincipal"
    }
  }
]
Trusted Signing
Version: 1.0.86
"Metadata": {
  "Endpoint": "https://weu.codesigning.azure.net/",
  "CodeSigningAccountName": "***",
  "CertificateProfileName": "***",
  "ExcludeCredentials": []
}
Submitting digest for signing...
OperationId ceae9ec3-db90-48d5-9d8a-5c7daf6aa624: InProgress
Signing completed with status 'Succeeded' in 3.3895898s
Successfully signed: D:\a\isos\isos\src-tauri\target\release\isos.exe
Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0
        Info [tauri_bundler::bundle::windows::sign] "[\r\n  {\r\n    \"cloudName\": \"AzureCloud\",\r\n    \"homeTenantId\": \"***\",\r\n    \"id\": \"125ecc14-76ae-4cae-918e-d8da5f3a4d51\",\r\n    \"isDefault\": true,\r\n    \"managedByTenants\": [],\r\n    \"name\": \"Production\",\r\n    \"state\": \"Enabled\",\r\n    \"tenantId\": \"***\",\r\n    \"user\": {\r\n      \"name\": \"***\",\r\n      \"type\": \"servicePrincipal\"\r\n    }\r\n  }\r\n]\r\n\r\nTrusted Signing\r\n\r\nVersion: 1.0.86\r\n\r\n\"Metadata\": {\r\n  \"Endpoint\": \"https://weu.codesigning.azure.net/\",\r\n  \"CodeSigningAccountName\": \"***\",\r\n  \"CertificateProfileName\": \"***\",\r\n  \"ExcludeCredentials\": []\r\n}\r\n\r\nSubmitting digest for signing...\r\n\r\nOperationId ceae9ec3-db90-48d5-9d8a-5c7daf6aa624: InProgress\r\n\r\nSigning completed with status 'Succeeded' in 3.3895898s\r\n\r\nSuccessfully signed: D:\\a\\isos\\isos\\src-tauri\\target\\release\\isos.exe\r\r\n\r\nNumber of files successfully Signed: 1\r\r\nNumber of war
        Info [tauri_bundler::bundle::windows::msi] Verifying wix package
 Downloading [tauri_bundler::utils::http_utils] https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314-binaries.zip
       Debug [ureq_proto::client::flow] Flow<Prepare>
       Debug [ureq::run] GET https://github.com/******
       Debug [ureq::unversioned::resolver] Resolved: ArrayVec { len: 1, arr: [140.82.112.4:443] }
       Debug [ureq::unversioned::transport::tcp] Connected TcpStream to 140.82.112.4:443
       Debug [rustls::client::hs] No cached session for DnsName("github.com")
       Debug [rustls::client::hs] Not resuming any session
       Debug [ureq::tls::rustls] Wrapped TLS
       Debug [ureq_proto::client::flow] Flow<SendRequest>
       Debug [ureq::run] Request { method: GET, uri: https://github.com/******, version: HTTP/1.1, headers: {"accept-encoding": "gzip", "user-agent": "ureq/3.0.3", "accept": "*/*", "host": "github.com"} }
       Debug [rustls::client::hs] Using ciphersuite TLS13_AES_128_GCM_SHA256
       Debug [rustls::client::tls13] Not resuming
       Debug [rustls::client::tls13] TLS1.3 encrypted extensions: [ServerNameAck]
       Debug [rustls::client::hs] ALPN protocol is None
       Debug [ureq_proto::client::flow] Flow<RecvResponse>
       Debug [ureq_proto::client::call] Partial redirection response, insert fake connection: close
       Debug [ureq_proto::client::flow] Flow<Redirect>
       Debug [ureq::run] Response { status: 302, version: HTTP/1.1, headers: {"date": "Tue, 03 Jun 2025 15:25:33 GMT", "content-type": "text/html; charset=utf-8", "content-length": "0", "connection": "close", "location": "******", "<NOTICE>": "7 HEADERS ARE REDACTED"} }
       Debug [ureq::pool] Close: PoolKey { scheme: "https", authority: github.com, proxy: None }
       Debug [ureq_proto::client::flow] Flow<Prepare>
       Debug [ureq::run] Redirect (302 Found): GET https://objects.githubusercontent.com/******
       Debug [ureq::run] GET https://objects.githubusercontent.com/******
       Debug [ureq::unversioned::resolver] Resolved: ArrayVec { len: 4, arr: [185.199.109.133:443, 185.199.110.133:443, 185.199.111.133:443, 185.199.108.133:443] }
       Debug [ureq::unversioned::transport::tcp] Connected TcpStream to 185.199.109.133:443
       Debug [rustls::client::hs] No cached session for DnsName("objects.githubusercontent.com")
       Debug [rustls::client::hs] Not resuming any session
       Debug [ureq::tls::rustls] Wrapped TLS
       Debug [ureq_proto::client::flow] Flow<SendRequest>
       Debug [ureq::run] Request { method: GET, uri: https://objects.githubusercontent.com/******, version: HTTP/1.1, headers: {"accept-encoding": "gzip", "user-agent": "ureq/3.0.3", "accept": "*/*", "host": "objects.githubusercontent.com"} }
       Debug [rustls::client::hs] Using ciphersuite TLS13_AES_128_GCM_SHA256
       Debug [rustls::client::tls13] Not resuming
       Debug [rustls::client::tls13] TLS1.3 encrypted extensions: [ServerNameAck]
       Debug [rustls::client::hs] ALPN protocol is None
       Debug [ureq_proto::client::flow] Flow<RecvResponse>
       Debug [ureq_proto::client::flow] Flow<RecvBody>
       Debug [ureq::run] Response { status: 200, version: HTTP/1.1, headers: {"connection": "keep-alive", "content-length": "41297[555](https://github.com/dmca-glasgow/isos/actions/runs/15421074480/job/43396082763#step:8:556)", "content-type": "application/octet-stream", "server": "Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0", "date": "Tue, 03 Jun 2025 15:25:33 GMT", "<NOTICE>": "18 HEADERS ARE REDACTED"} }
       Debug [ureq_proto::client::flow] Flow<Cleanup>
       Debug [ureq::pool] Return to pool: PoolKey { scheme: "https", authority: objects.githubusercontent.com, proxy: None }
        Info [tauri_bundler::utils::http_utils] validating hash
        Info [tauri_bundler::bundle::windows::msi] extracting WIX
        Info [tauri_bundler::bundle::windows::msi] Target: x64
     Signing [tauri_bundler::bundle::windows::sign] D:\a\isos\isos\src-tauri\..\packages\runtime\dist\assets\index.css
     Signing [tauri_bundler::bundle::windows::sign] D:\a\isos\isos\src-tauri\..\packages\runtime\dist\assets\index.css with a custom signing command
     Running [tauri_bundler::utils] Command `trusted-signing-cli  -e https://weu.codesigning.azure.net/ -a *** -c *** D:\a\isos\isos\src-tauri\..\packages\runtime\dist\assets\index.css`
[
  {
    "cloudName": "AzureCloud",
    "homeTenantId": "***",
    "id": "125ecc14-76ae-4cae-918e-d8da5f3a4d51",
    "isDefault": true,
    "managedByTenants": [],
    "name": "Production",
    "state": "Enabled",
    "tenantId": "***",
    "user": {
      "name": "***",
      "type": "servicePrincipal"
    }
  }
]
Number of files successfully Signed: 0
Number of warnings: 0
Number of errors: 1
SignTool Error: This file format cannot be signed because it is not recognized.
SignTool Error: An error occurred while attempting to sign: D:\a\isos\isos\src-tauri\..\packages\runtime\dist\assets\index.css
The application signing was not successful.

It seems to want to sign the files that I have linked in tauri.conf.json under bundle.resources (and is failing on a .css file).

I haven't found anything on this while searching and unsure how to proceed.. should I be trying to exclude those files from the signing?

Thanks.

[FabianLars]

This issue is tracked here #13341 i hope i can get to it this week

[dmca-glasgow]

Ahh perfect, thanks.