feat: support skipping SHA1 signing

README.md

@@ -66,6 +66,8 @@ description = "My content"
 website = "https://mywebsite.com"
 // If enabled, attempt to sign .js JavaScript files. Disabled by default
 signJavaScript = true
+// If unspecified, both sha1 and sha256 signatures will be appended. Will be passed to signtool.exe as the /fd option.
+hashes = ["sha256"]
 ```
 
 ## With a custom signtool.exe or custom parameters

src/sign-with-signtool.ts

@@ -119,6 +119,15 @@ export async function signWithSignTool(options: InternalSignOptions) {
     website
   };
 
-  await execute({ ...internalOptions, hash: HASHES.sha1 });
-  await execute({ ...internalOptions, hash: HASHES.sha256, appendSignature: true });
+  const hashes =
+    options.hashes == null || options.hashes.length === 0
+      ? [HASHES.sha1, HASHES.sha256]
+      : options.hashes;
+
+  if (hashes.includes(HASHES.sha1)) {
+    await execute({ ...internalOptions, hash: HASHES.sha1 });
+  }
+  if (hashes.includes(HASHES.sha256)) {
+    await execute({ ...internalOptions, hash: HASHES.sha256, appendSignature: true });
+  }
 }

src/types.ts

@@ -113,6 +113,10 @@ export interface OptionalSignToolOptions {
    * @defaultValue false
    */
   signJavaScript?: boolean;
+  /**
+   * Hash algorithms to use for signing.
+   */
+  hashes?: HASHES[];
 }
 
 /**