fix(desktop): verify Windows updates

packages/desktop/electron-builder.config.test.ts

@@ -46,3 +46,10 @@ test("keeps a hidden prod launcher for old Linux pins", async () => {
   expect(desktop).toContain("StartupWMClass=ai.opencode.desktop")
   expect(desktop).toContain("NoDisplay=true")
 })
+
+test("verifies Windows update signatures", async () => {
+  const module = await import("./electron-builder.config.ts?signature=windows")
+  const config = module.default as Configuration
+
+  expect(config.win?.verifyUpdateCodeSignature).toBe(true)
+})

packages/desktop/electron-builder.config.ts

@@ -83,7 +83,7 @@ const getBase = (appId: string): Configuration => ({
       sign: signWindows,
     },
     target: ["nsis"],
-    verifyUpdateCodeSignature: false,
+    verifyUpdateCodeSignature: true,
   },
   nsis: {
     oneClick: true,