optionally sign windows setup

fixes #59697

build/gulpfile.vscode.win32.js

@@ -31,12 +31,15 @@ function packageInnoSetup(iss, options, cb) {
 	options = options || {};
 
 	const definitions = options.definitions || {};
-	const debug = process.argv.some(arg => arg === '--debug-inno');
 
-	if (debug) {
+	if (process.argv.some(arg => arg === '--debug-inno')) {
 		definitions['Debug'] = 'true';
 	}
 
+	if (process.argv.some(arg => arg === '--sign')) {
+		definitions['Sign'] = 'true';
+	}
+
 	const keys = Object.keys(definitions);
 
 	keys.forEach(key => assert(typeof definitions[key] === 'string', `Missing value for '${key}' in Inno Setup package step`));

build/tfs/win32/product-build-win32.yml

@@ -143,7 +143,7 @@ steps:
 - powershell: |
     . build/tfs/win32/exec.ps1
     $ErrorActionPreference = "Stop"
-    exec { npm run gulp -- "vscode-win32-$(VSCODE_ARCH)-archive" "vscode-win32-$(VSCODE_ARCH)-system-setup" "vscode-win32-$(VSCODE_ARCH)-user-setup" }
+    exec { npm run gulp -- "vscode-win32-$(VSCODE_ARCH)-archive" "vscode-win32-$(VSCODE_ARCH)-system-setup" "vscode-win32-$(VSCODE_ARCH)-user-setup" --sign }
 
     $Repo = "$(pwd)"
     $Root = "$Repo\.."

build/win32/code.iss

@@ -32,7 +32,10 @@ VersionInfoVersion={#RawVersion}
 ShowLanguageDialog=auto
 ArchitecturesAllowed={#ArchitecturesAllowed}
 ArchitecturesInstallIn64BitMode={#ArchitecturesInstallIn64BitMode}
+
+#ifdef Sign
 SignTool=esrp
+#endif
 
 #if "user" == InstallTarget
 DefaultDirName={userpf}\{#DirName}