doc: add steps about signing the binary in single-executable docs

[RaisinTen]

We didn't catch this in #45038 because the binary wasn't signed by default unlike the official Node.js binary, which is signed by the Node.js Foundation identity by default.

Refs: nodejs/postject#76 (macOS arm64 part only)
Fixes: nodejs/postject#75

cc @nodejs/single-executable @targos @ShenHongFei

[targos]

LGTM for the macOS part.

[RaisinTen]

@nodejs/platform-windows can someone please review the Windows part?

[tony-go]

Let me start my windows machine ^^

[tony-go]

LGTM for mac

Not able to test on my windows machine due to some reasons :/

[ShenHongFei]

@RaisinTen
For windows part, I tried it according to the process in the document, and I needed to change hello to hello.exe (executable programs on windows need a .exe suffix to run).

I executed the following command in powershell:

$ echo 'console.log(`Hello, ${process.argv[2]}!`);' > hello.js
$ cp e:/sdk/nodejs/node.exe hello.exe
$ &"C:/Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x64/signtool.exe" remove /s hello.exe
$ npx postject hello.exe NODE_JS_CODE hello.js --sentinel-fuse NODE_JS_FUSE_fce680ab2cc467b6e072b8b5df1996b2
$ &"C:/Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x64/signtool.exe" sign /fd SHA256 hello.exe

The last step went wrong:
SignTool Error: No certificates were found that met all the given criteria.

It may be that I don't have a local certificate that can be used for digital signatures, but the generated unsigned hello.exe can also run normally

Using signtools (https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool) in Windows system to remove node.exe signature, and to sign the final generated hello.exe, is not Required steps, and users need to manually install windows sdk (https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/)

I think it would be more convenient to inform users that they can ignore the warnings output by postject, or make the method of deleting and re-signing as an optional step, explaining how to obtain and use signtools to sign.

[mhdawson]

LGTM

[RaisinTen]

@ShenHongFei updated the docs to clarify that. PTAL reviewers.

[ovflowd]

Docs seem legit for me for both Windows and macOS :)

[ShenHongFei]

@ShenHongFei updated the docs to clarify that. PTAL reviewers.

LGTM 😄

[RaisinTen]

Landed in 4cde39e

[danielleadams]

Blocked by #45038