microsoft/typescript-go · error · Error

Unknown cert: ${cert}

Error message

Unknown cert: ${cert}

What it means

runSignNativePreviewPackages groups the built executables by their platform `cert` and switches over the three certificate names the ESRP tooling knows: "Microsoft400" (Windows), "LinuxSign" (default for Linux/BSD per the platforms table comment at Herebyfile.mjs:1548), and "MacDeveloperHarden" (macOS). Any other string reaches `default` and throws because no signing recipe exists for it.

Source

Thrown at Herebyfile.mjs:2104

                    const zip = new AdmZip();
                    zip.addLocalFile(p.path);
                    zip.writeZip(unsignedZipPath);

                    macZips.push({
                        path: p.path,
                        unsignedZipPath,
                        signedZipPath,
                        notarizedZipPath,
                    });
                }
                filelist.SignFileRecordList.push({
                    SignFileList: macZips.map(p => ({ SrcPath: p.unsignedZipPath, DstPath: p.signedZipPath })),
                    Certs: cert,
                    MacAppName: undefined, // MacAppName is only for notarization
                });
                break;
            default:
                throw new Error(`Unknown cert: ${cert}`);
        }
    }

    await sign(filelist);

    // All of the files have been signed in place / had signatures added.

    if (macZips.length) {
        // Now, notarize the Mac files.

        /** @type {DDSignFileList} */
        const notarizeFilelist = {
            SignFileRecordList: [
                {
                    SignFileList: macZips.map(p => ({ SrcPath: p.signedZipPath, DstPath: p.notarizedZipPath })),
                    Certs: "8020", // "MacNotarize" (friendly name not supported by the tooling)
                    MacAppName: "MicrosoftTypeScript",
                },

View on GitHub (pinned to 1bcfa18d79)

Solutions

1. Set `cert` to one of the three known values, matching the OS: Microsoft400 for win32, MacDeveloperHarden for darwin, LinuxSign otherwise
2. If the platform needs no special signing, omit `cert` entirely — the platform mapping defaults it to LinuxSign
3. If a genuinely new certificate is required, add a matching `case` to the switch in runSignNativePreviewPackages plus the ESRP configuration, then re-run

Example fix

// before
{ os: "win32", arch: "x64", vsix: true, cert: "MS400" },

// after
{ os: "win32", arch: "x64", vsix: true, cert: "Microsoft400" },

const knownCerts = ["Microsoft400", "LinuxSign", "MacDeveloperHarden"];
for (const p of platforms) {
  const cert = p.cert ?? "LinuxSign";
  if (!knownCerts.includes(cert)) throw new Error(`Invalid cert on ${p.os}-${p.arch}: ${cert}`);
}

const knownCerts = ["Microsoft400", "LinuxSign", "MacDeveloperHarden"] as const;
type Cert = typeof knownCerts[number];
function isKnownCert(c: string): c is Cert {
  return (knownCerts as readonly string[]).includes(c);
}

When it happens

Trigger: Adding or editing a Platform entry in the `platforms` array (Herebyfile.mjs:1551-1574) with a `cert` value that is not exactly "Microsoft400", "LinuxSign", or "MacDeveloperHarden" — e.g. a typo like "MS400" or a new cert name — then running the signing task.

Common situations: Contributing a new platform and guessing/typoing the cert name; renaming certs during ESRP config changes; forgetting that cert is optional and defaults to LinuxSign on non-Windows/non-Mac platforms.

Related errors

• This task should not be run in non-release builds.
• Source file does not exist: ${src}
• Destination directory does not exist: ${dstDir}
• Some files failed to sign:\n
• Signed file has no macOS entitlements: ${filePath}

AI-assisted analysis of microsoft/typescript-go@1bcfa18d79 (2026-08-16). Data as JSON: /api/errors/e0ae87de054fb8d0. Report an issue: GitHub.