Windows release jobs spend 83 to 135 s signing files one call at a time #21379

What happened

Each Windows desktop release job signs every executable, .node and .dll with a separate Azure Trusted Signing call. In the last three nightly release runs this took 83 to 95 s on Windows x64 (36 calls) and 108 to 135 s on Windows arm64 (30 calls). Windows arm64 is the longest job in the release run, so this time adds directly to every nightly and stable release.

Diagnosis

electron-builder signs one file per call: with azureSignOptions set, it starts PowerShell and runs Invoke-TrustedSigning once for each file that matches signExts. Since #8206 added .node and .dll to signExts (needed for Smart App Control, #8373), the number of files grew to 36 on x64 and 30 on arm64. Each call costs 2.6 to 4.5 s on average, mostly fixed start-up and service round-trip time, so the total grows with the file count rather than with the bytes signed.

Steps to reproduce

1. Open release run 39167169140 (nightly v0.1.1-nightly.20261018.3331).
2. In the Windows x64 and Windows arm64 jobs, count the Invoke-TrustedSigning calls in the build step and sum their durations from the timestamps.
3. Compare with runs 39132626595 and 39158470933.

Version

v0.1.1-nightly.20261018.3331 (eb7b35a)

Environment

GitHub Actions release workflow, Windows x64 and Windows arm64 runners, electron-builder 26.15.6 with Azure Trusted Signing

Evidence

| Run | x64 calls | x64 signing time | arm64 calls | arm64 signing time |
| --- | --- | --- | --- | --- |
| 39132626595 | 36 | 83 s | 30 | 115 s |
| 39158470933 | 36 | 91 s | 30 | 108 s |
| 39167169140 | 36 | 95 s | 30 | 135 s |

In run 39167169140, signing was about 95 s of the 131 s x64 packaging step. The arm64 job ran from 115 s to 808 s of the 1,049 s run and was the last desktop job to finish.

Related issues

#8206, #8373, #18573

Fix applied or workaround

None applied. I can open a pull request for this once triage confirms the direction. Not written yet; the options I would measure are signing all files in one Invoke-TrustedSigning call (it accepts a list of files) through a custom electron-builder sign hook, and removing the duplicate binaries in the Windows package (filed separately), which cuts the x64 call count by 11.

Filed by

Claude Code, Claude Opus 5.5