fix: 4 runtime bugs — forge cancel (exec.CommandContext), config key (default_agent_config), sign on Linux (osslsigncode), garble on all platforms

server/internal/builder/sign_stub.go

@@ -2,12 +2,71 @@
 
 package builder
 
-import "fmt"
+import (
+	"fmt"
+	"log"
+	"os/exec"
+	"strings"
+)
 
+// shouldSignBuild returns true when signing is configured AND osslsigncode is available.
+// On Linux/macOS we can sign Windows PE files with osslsigncode + a PFX certificate.
+// Install: apt install osslsigncode  /  brew install osslsigncode
 func (h *Handler) shouldSignBuild(req *BuildRequest) bool {
-	return false
+	if !h.policy.Sign.Enabled || strings.TrimSpace(h.policy.Sign.CertThumbprint) == "" {
+		return false
+	}
+	if !req.SignBuild {
+		return false
+	}
+	_, err := exec.LookPath("osslsigncode")
+	if err != nil {
+		log.Printf("[Forge] sign requested but osslsigncode not found — install with: apt install osslsigncode  (or brew install osslsigncode)")
+		return false
+	}
+	return true
 }
 
+// signExecutable signs a Windows PE binary using osslsigncode.
+// Requires: osslsigncode on PATH and a PFX certificate file set in sign_tool_path.
+// The sign_cert_thumbprint field is repurposed as the path to the .pfx file on non-Windows.
 func (h *Handler) signExecutable(path string) error {
-	return fmt.Errorf("code signing requires building on Windows")
+	policy := h.policy.Sign
+
+	pfxPath := strings.TrimSpace(policy.CertThumbprint)
+	if pfxPath == "" {
+		return fmt.Errorf("sign_cert_thumbprint must contain the path to a .pfx certificate file on Linux/macOS")
+	}
+
+	tsURL := strings.TrimSpace(policy.TimestampURL)
+	if tsURL == "" {
+		tsURL = "http://timestamp.digicert.com"
+	}
+
+	// osslsigncode usage: osslsigncode sign -pkcs12 <pfx> -ts <url> -in <file> -out <file>
+	// We sign in-place by writing to a temp path then replacing.
+	tmpPath := path + ".signed"
+	args := []string{
+		"sign",
+		"-pkcs12", pfxPath,
+		"-ts", tsURL,
+		"-h", "sha2",
+		"-in", path,
+		"-out", tmpPath,
+	}
+
+	osslBin, _ := exec.LookPath("osslsigncode")
+	cmd := exec.Command(osslBin, args...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("osslsigncode: %w (%s)", err, strings.TrimSpace(string(out)))
+	}
+
+	// Replace the original with the signed copy
+	if err := exec.Command("mv", tmpPath, path).Run(); err != nil {
+		return fmt.Errorf("could not replace binary with signed version: %w", err)
+	}
+
+	log.Printf("[Forge] Signed %s via osslsigncode", path)
+	return nil
 }