From fff371073d634e23a23129b66eafd1941a4bb48c Mon Sep 17 00:00:00 2001
From: Felix Rieseberg <f@anthropic.com>
Date: Sun, 12 Apr 2026 17:49:01 -0700
Subject: [PATCH] Patch @electron/windows-sign to skip guest-tools when signing

VBMOUSE.EXE and friends are 16-bit DOS/Win9x binaries served to the guest over SMB; signtool refuses them with 'file format cannot be signed'. The patch skips any path under guest-tools/ during file collection.
---
 patches/@electron+windows-sign+1.2.2.patch | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 patches/@electron+windows-sign+1.2.2.patch

diff --git a/patches/@electron+windows-sign+1.2.2.patch b/patches/@electron+windows-sign+1.2.2.patch
new file mode 100644
index 0000000..a7db431
--- /dev/null
+++ b/patches/@electron+windows-sign+1.2.2.patch
@@ -0,0 +1,15 @@
+diff --git a/node_modules/@electron/windows-sign/dist/cjs/files.js b/node_modules/@electron/windows-sign/dist/cjs/files.js
+index 59a370e..27f9bbd 100644
+--- a/node_modules/@electron/windows-sign/dist/cjs/files.js
++++ b/node_modules/@electron/windows-sign/dist/cjs/files.js
+@@ -49,6 +49,10 @@ function getFilesToSign(options, dir) {
+     }
+     for (const file of files) {
+         const fullPath = path_1.default.resolve(dir, file);
++        // windows95 patch: skip 16-bit guest binaries that signtool can't sign
++        if (/[\\/]guest-tools[\\/]/i.test(fullPath)) {
++            continue;
++        }
+         if (fs_extra_1.default.statSync(fullPath).isDirectory()) {
+             // If it's a directory, recurse
+             result.push(...getFilesToSign(options, fullPath));