fix(desktop): use a working Authenticode host

Signed-off-by: QCYTSN <2558348385@qq.com>

desktop/electron/scripts/build-review-installer.mjs

@@ -6,6 +6,7 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 const electronRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const signaturePowerShell = resolveSignaturePowerShell();
 const unsignedEnvironment = { ...process.env };
 for (const name of [
   "CSC_LINK",
@@ -86,7 +87,7 @@ function run(command, args, options = {}) {
 
 function signatureStatus(artifact) {
   const result = spawnSync(
-    "powershell.exe",
+    signaturePowerShell,
     [
       "-NoProfile",
       "-NonInteractive",
@@ -108,6 +109,32 @@ function signatureStatus(artifact) {
   return result.stdout.trim();
 }
 
+function resolveSignaturePowerShell() {
+  const candidates = [
+    process.env.ProgramFiles
+      ? path.join(process.env.ProgramFiles, "PowerShell", "7", "pwsh.exe")
+      : undefined,
+    "pwsh.exe",
+    "powershell.exe",
+  ].filter(Boolean);
+  const failures = [];
+  for (const candidate of new Set(candidates)) {
+    const probe = spawnSync(
+      candidate,
+      [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        "Get-Command Get-AuthenticodeSignature -ErrorAction Stop | Out-Null",
+      ],
+      { encoding: "utf8", windowsHide: true },
+    );
+    if (!probe.error && probe.status === 0) return candidate;
+    failures.push(`${candidate}: ${probe.error?.message ?? probe.stderr.trim()}`);
+  }
+  throw new Error(`No PowerShell host can load Get-AuthenticodeSignature.\n${failures.join("\n")}`);
+}
+
 async function sha256(file) {
   const hash = createHash("sha256");
   for await (const chunk of createReadStream(file)) hash.update(chunk);

desktop/electron/scripts/build-signed-installer.mjs

@@ -6,6 +6,7 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 const electronRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const signaturePowerShell = resolveSignaturePowerShell();
 const certificate = (process.env.WIN_CSC_LINK ?? process.env.CSC_LINK)?.trim();
 const password = process.env.WIN_CSC_KEY_PASSWORD ?? process.env.CSC_KEY_PASSWORD;
 
@@ -91,7 +92,7 @@ function run(command, args, options = {}) {
 
 function verifySignature(artifact) {
   const signatureCheck = spawnSync(
-    "powershell.exe",
+    signaturePowerShell,
     [
       "-NoProfile",
       "-NonInteractive",
@@ -119,6 +120,32 @@ function verifySignature(artifact) {
   return `${path.basename(artifact)} — ${signatureCheck.stdout.trim()}`;
 }
 
+function resolveSignaturePowerShell() {
+  const candidates = [
+    process.env.ProgramFiles
+      ? path.join(process.env.ProgramFiles, "PowerShell", "7", "pwsh.exe")
+      : undefined,
+    "pwsh.exe",
+    "powershell.exe",
+  ].filter(Boolean);
+  const failures = [];
+  for (const candidate of new Set(candidates)) {
+    const probe = spawnSync(
+      candidate,
+      [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        "Get-Command Get-AuthenticodeSignature -ErrorAction Stop | Out-Null",
+      ],
+      { encoding: "utf8", windowsHide: true },
+    );
+    if (!probe.error && probe.status === 0) return candidate;
+    failures.push(`${candidate}: ${probe.error?.message ?? probe.stderr.trim()}`);
+  }
+  throw new Error(`No PowerShell host can load Get-AuthenticodeSignature.\n${failures.join("\n")}`);
+}
+
 async function sha256(file) {
   const hash = createHash("sha256");
   for await (const chunk of createReadStream(file)) hash.update(chunk);