> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/electron-userland/electron-builder/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows Configuration

> Configuration options for building Windows targets in electron-builder

The top-level `win` key contains set of options instructing electron-builder on how it should build Windows targets. These options are applicable for any Windows target.

## Common Questions

### How to delegate code signing?

Use the `sign` option. Please also see [why sign.js is called 8 times](https://github.com/electron-userland/electron-builder/issues/3995).

```json theme={null}
"win": {
  "signtoolOptions": {
    "sign": "./customSign.js"
  }
}
```

File `customSign.js` in the project root directory:

```js theme={null}
exports.default = async function(configuration) {
  // your custom code
}
```

### How to use a custom verify function to enable NSIS signature verification alternatives?

Use the `verifyUpdateCodeSignature` interface:

```js theme={null}
/**
 *  return null if verify signature succeed
 *  return error message if verify signature failed
 */
export type verifyUpdateCodeSignature = (publisherName: string[], path: string) => Promise<string | null>
```

Pass a custom verify function to the NSIS updater. For example, if you want to use a native verify function, you can use [win-verify-signature](https://github.com/beyondkmp/win-verify-trust).

```js theme={null}
import { NsisUpdater } from "electron-updater"
import { verifySignatureByPublishName } from "win-verify-signature"

export default class AppUpdater {
  constructor() {
    const options = {
      requestHeaders: {
        // Any request headers to include here
      },
      provider: 'generic',
      url: 'https://example.com/auto-updates'
    }

    const autoUpdater = new NsisUpdater(options)
    autoUpdater.verifyUpdateCodeSignature = (publisherName: string[], path: string) => {
      const result = verifySignatureByPublishName(path, publisherName);
      if(result.signed) return Promise.resolve(null);
      return Promise.resolve(result.message);
    }
    autoUpdater.addAuthHeader(`Bearer ${token}`)
    autoUpdater.checkForUpdatesAndNotify()
  }
}
```

### How to create Parallels Windows 10 Virtual Machine?

<Warning>
  If you use Parallels, you [must not use](https://github.com/electron-userland/electron-builder/issues/865#issuecomment-258105498) "Share Mac user folders with Windows" feature and must not run installers from such folders.
</Warning>

You don't need to have Windows 10 license. Free is provided (expire after 90 days, but it is not a problem because no additional setup is required).

1. Open Parallels Desktop.
2. File → New.
3. Select "Modern.IE" in the "Free Systems".
4. Continue, Continue, Accept software license agreement.
5. Select "Microsoft Edge on Windows 10".
6. The next steps are general, see [Installing Windows on your Mac using Parallels Desktop](http://kb.parallels.com/4729) from "Step 6: Specify a name and location".

Parallels Windows 10 VM will be used automatically to build AppX on macOS. No need even start VM — it will be started automatically on demand and suspended after build. No need to specify VM — it will be detected automatically (first Windows 10 VM will be used).

### How to create VirtualBox Windows 10 Virtual Machine?

If you are not on macOS or don't want to buy [Parallels Desktop](https://www.parallels.com/products/desktop/), you can use free [VirtualBox](https://www.virtualbox.org/wiki/Downloads).

1. Open [Download virtual machines](https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/).
2. Select "MSEdge on Win10 (x64) Stable".
3. Select "VirtualBox" platform.
4. Download. See [installation instructions](https://az792536.vo.msecnd.net/vms/release_notes_license_terms_8_1_15.pdf).

The password to your VM is `Passw0rd!`.

VirtualBox is not supported by electron-builder for now, so, you need to setup build environment on Windows if you want to use VirtualBox to build AppX (and other Windows-only tasks).

## Configuration

<ParamField path="target" type="string | TargetConfiguration" default="nsis">
  The target package type: list of `nsis`, `nsis-web` (Web installer), `portable` (portable app without installation), `appx`, `msi`, `msi-wrapped`, `squirrel`, `7z`, `zip`, `tar.xz`, `tar.lz`, `tar.gz`, `tar.bz2`, `dir`.

  AppX package can be built only on Windows 10.

  To use Squirrel.Windows please install `electron-builder-squirrel-windows` dependency.
</ParamField>

<ParamField path="icon" type="string" default="build/icon.ico">
  The path to application icon.
</ParamField>

<ParamField path="legalTrademarks" type="string">
  The trademarks and registered trademarks.
</ParamField>

<ParamField path="signtoolOptions" type="WindowsSigntoolConfiguration">
  Options for usage with signtool.exe. Cannot be used in conjunction with `azureSignOptions`, signing will default to Azure Trusted Signing.

  <Expandable title="WindowsSigntoolConfiguration">
    <ParamField path="sign" type="CustomWindowsSign | string">
      The custom function (or path to file or module id) to sign Windows executables.
    </ParamField>

    <ParamField path="signingHashAlgorithms" type="Array<'sha1' | 'sha256'>" default="['sha1', 'sha256']">
      Array of signing algorithms used. For AppX `sha256` is always used.
    </ParamField>

    <ParamField path="certificateFile" type="string">
      The path to the \*.pfx certificate you want to sign with. Please use it only if you cannot use env variable `CSC_LINK` (`WIN_CSC_LINK`) for some reason.
    </ParamField>

    <ParamField path="certificatePassword" type="string">
      The password to the certificate provided in `certificateFile`. Please use it only if you cannot use env variable `CSC_KEY_PASSWORD` (`WIN_CSC_KEY_PASSWORD`) for some reason.
    </ParamField>

    <ParamField path="certificateSubjectName" type="string">
      The name of the subject of the signing certificate, which is often labeled with the field name `issued to`. Required only for EV Code Signing and works only on Windows (or on macOS if Parallels Desktop Windows 10 virtual machines exits).
    </ParamField>

    <ParamField path="certificateSha1" type="string">
      The SHA1 hash of the signing certificate. The SHA1 hash is commonly specified when multiple certificates satisfy the criteria specified by the remaining switches. Works only on Windows (or on macOS if Parallels Desktop Windows 10 virtual machines exits).
    </ParamField>

    <ParamField path="additionalCertificateFile" type="string">
      The path to an additional certificate file you want to add to the signature block.
    </ParamField>

    <ParamField path="rfc3161TimeStampServer" type="string" default="http://timestamp.digicert.com">
      The URL of the RFC 3161 time stamp server.
    </ParamField>

    <ParamField path="timeStampServer" type="string" default="http://timestamp.digicert.com">
      The URL of the time stamp server.
    </ParamField>

    <ParamField path="publisherName" type="string | string[]">
      The publisher name, exactly as in your code signed certificate. Several names can be provided. Defaults to common name from your code signing certificate.
    </ParamField>
  </Expandable>
</ParamField>

<ParamField path="azureSignOptions" type="WindowsAzureSigningConfiguration">
  Options for usage of Azure Trusted Signing service. Cannot be used in conjunction with `signtoolOptions`, signing will default to Azure Trusted Signing.

  <Expandable title="WindowsAzureSigningConfiguration">
    <ParamField path="publisherName" type="string" required>
      The publisher name, exactly as in your code signed certificate. Several names can be provided.
    </ParamField>

    <ParamField path="endpoint" type="string" required>
      The Trusted Signing Account endpoint. The URI value must have a URI that aligns to the region your Trusted Signing Account and Certificate Profile you are specifying were created in during the setup of these resources.

      Requires one of environment variable configurations for authenticating to Microsoft Entra ID per [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition)
    </ParamField>

    <ParamField path="certificateProfileName" type="string" required>
      The Certificate Profile name.
    </ParamField>

    <ParamField path="codeSigningAccountName" type="string" required>
      The Code Signing Signing Account name.
    </ParamField>

    <ParamField path="fileDigest" type="string" default="SHA256">
      The File Digest for signing each file.
    </ParamField>

    <ParamField path="timestampRfc3161" type="string" default="http://timestamp.acs.microsoft.com">
      The Timestamp rfc3161 server.
    </ParamField>

    <ParamField path="timestampDigest" type="string" default="SHA256">
      The Timestamp Digest.
    </ParamField>
  </Expandable>
</ParamField>

<ParamField path="verifyUpdateCodeSignature" type="boolean" default="true">
  Whether to verify the signature of an available update before installation. The publisher name will be used for the signature verification.
</ParamField>

<ParamField path="requestedExecutionLevel" type="'asInvoker' | 'highestAvailable' | 'requireAdministrator'" default="asInvoker">
  The [security level](https://msdn.microsoft.com/en-us/library/6ad1fshk.aspx#Anchor_9) at which the application requests to be executed. Cannot be specified per target, allowed only in the `win`.
</ParamField>

<ParamField path="signAndEditExecutable" type="boolean" default="true">
  Whether to sign and add metadata to executable. Metadata includes information about the app name/description/version, publisher, copyright, etc. This property also is responsible for adding the app icon and setting execution level. (Advanced option leveraging `rcedit`)
</ParamField>

<ParamField path="signExts" type="string[]">
  Explicit file name/extensions (`str.endsWith`) to also sign. Advanced option. Supports negative patterns, e.g. example that excludes `.appx` files: `["somefilename", ".dll", "!.appx"]`.
</ParamField>

## Inherited Properties

The following properties are inherited from [Common Configuration](/configuration/common):

* `artifactName`
* `publish`
* `files`
* `extraResources`
* `extraFiles`
* `asarUnpack`
* `fileAssociations`
* `protocols`