diff --git a/docs/STUDIO_RELEASE.md b/docs/STUDIO_RELEASE.md index 4da7b2030f..f47d45f91d 100644 --- a/docs/STUDIO_RELEASE.md +++ b/docs/STUDIO_RELEASE.md @@ -242,7 +242,7 @@ What is signed: | File | Signed by | Why | | --- | --- | --- | | The release PE files | the project | Windows loads each one, and Smart App Control judges an unsigned DLL on its own reputation. | -| `d3dcompiler_47.dll`, `dxil.dll` | Microsoft, left as shipped | Verified to carry a trusted, timestamped signature from an `O=Microsoft Corporation` signer under a Microsoft PCA, chaining to Microsoft Root Certificate Authority 2010 by thumbprint. | +| `d3dcompiler_47.dll` | Microsoft, left as shipped | Verified to carry a trusted, timestamped signature from an `O=Microsoft Corporation` signer under a Microsoft PCA, chaining to Microsoft Root Certificate Authority 2010 by thumbprint. | | The installer | the project | Signed only after `windows-verify-package` has matched its contents. | | `resources/elevate.exe` | nobody | `windows-package` writes it after the payload is signed; its SHA-256 is pinned instead. | | The NSIS uninstaller | nobody | electron-builder signs it only through an in-process hook, which would put the session in the packaging job. | @@ -254,7 +254,7 @@ A bundle holding a PE file the list does not name fails with `studio-signing.und The release PE files: - `Reasonix Studio.exe`, `resources/bin/reasonix-studio-host.exe`, `resources/bin/cua-driver.exe` -- `dxcompiler.dll`, `ffmpeg.dll`, `vk_swiftshader.dll`, `vulkan-1.dll` +- `dxcompiler.dll`, `electron_wer.dll`, `ffmpeg.dll`, `vk_swiftshader.dll`, `vulkan-1.dll` | Rule | Detail | | --- | --- | diff --git a/scripts/windows-signing-lib.ps1 b/scripts/windows-signing-lib.ps1 index 2269220b3b..1de2ceb806 100644 --- a/scripts/windows-signing-lib.ps1 +++ b/scripts/windows-signing-lib.ps1 @@ -12,6 +12,7 @@ $script:PeExtensions = @(".exe", ".dll", ".node") $script:ReleaseSignedPe = @( "Reasonix Studio.exe", "dxcompiler.dll", + "electron_wer.dll", "ffmpeg.dll", "resources/bin/cua-driver.exe", "resources/bin/reasonix-studio-host.exe", @@ -20,8 +21,7 @@ $script:ReleaseSignedPe = @( ) # Shipped by Electron already signed by Microsoft, and kept that way. $script:MicrosoftSignedPe = @( - "d3dcompiler_47.dll", - "dxil.dll" + "d3dcompiler_47.dll" ) # Microsoft Root Certificate Authority 2010, the root their signer chains to. $script:MicrosoftRootThumbprint = "3B1EFD3A66EA28B16697394703A72CA340A05BD5"