add win-from-mac job, disable osslsigncode in debian

Debian trixie "lost" the osslsigncode package.

.github/workflows/build.yml

@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: MIT
 ---
 # https://docs.github.com/actions/learn-github-actions
+# https://github.com/actions/upload-artifact
 name: build
 on:
  push:
@@ -543,6 +544,33 @@ jobs:
  *-*-macos*.*
  urls.txt
 
+ win-llvm-from-mac:
+ runs-on: macos-latest
+ timeout-minutes: 30
+ steps:
+ - uses: actions/checkout@v4
+ with:
+ fetch-depth: 8
+ - name: 'build'
+ env:
+ CW_LLVM_MINGW_DL: '1'
+ CW_LLVM_MINGW_ONLY: '0'
+ run: |
+ export CW_CONFIG='${{ github.ref_name }}-win'
+ export CW_REVISION='${{ github.sha }}'
+ . ./_versions.sh
+ sh -c ./_ci-mac-homebrew.sh
+
+ - name: 'list dependencies'
+ run: cat urls.txt
+ - uses: actions/upload-artifact@v4
+ with:
+ name: 'curl-windows-llvm-from-mac'
+ retention-days: 5
+ path: |
+ *-*-mingw*.*
+ urls.txt
+
  win-llvm:
  runs-on: ubuntu-latest
  timeout-minutes: 30
@@ -569,7 +597,6 @@ jobs:
 
  - name: 'list dependencies'
  run: cat urls.txt
- # https://github.com/actions/upload-artifact
  - uses: actions/upload-artifact@v4
  with:
  name: 'curl-windows-llvm'
@@ -604,7 +631,6 @@ jobs:
 
  - name: 'list dependencies'
  run: cat urls.txt
- # https://github.com/actions/upload-artifact
  - uses: actions/upload-artifact@v4
  with:
  name: 'curl-windows-gcc-noarm64'

_build.sh

@@ -452,7 +452,12 @@ fi
 
 if [ "${_OS}" = 'win' ] && \
  [ -s "${SIGN_CODE_KEY}" ]; then
- osslsigncode --version # We need 2.2 or newer
+ if command -v osslsigncode >/dev/null 2>&1; then
+ osslsigncode --version # We need 2.2 or newer
+ elif [ -n "${SIGN_PKG_KEY_PASS:+1}" ]; then
+ unset SIGN_CODE_KEY_PASS
+ echo "! WARNING: osslsigncode not found, code signing disabled."
+ fi
 fi
 
 _ori_path="${PATH}"

_ci-linux-debian.sh

@@ -21,7 +21,8 @@ fi
 [[ "${CW_CONFIG:-}" = *'boringssl'* ]] && extra+=' golang'
 
 if [[ "${CW_CONFIG:-}" = *'win'* ]]; then
- extra+=' mingw-w64 osslsigncode wine64'
+ extra+=' mingw-w64 wine64'
+# extra+=' osslsigncode'
  if [[ "${CW_CONFIG:-}" = *'boringssl'* ]]; then
  extra+=' nasm'
  fi