Windows signing fixes

- Sign zotero.exe in ZIP builds
- Re-sign xul.dll, which we modify in fetch_xulrunner
- Remove xul.dll.sig, a file for Widevine CDN that we don't need and
  that presumably doesn't match anymore
- Sign Word plugin DLL

https://forums.zotero.org/discussion/119766/tenable-invalid-signature-on-xul-dll

app/build.sh

@@ -716,11 +716,6 @@ if [ $BUILD_WIN == 1 ]; then
 				--set-product-version "$VERSION"
 		fi
 		
-		# Sign updater
-		if [ $SIGN -eq 1 ]; then
-			"$CALLDIR/win/codesign" "$APPDIR/updater.exe" "$SIGNATURE_DESC Updater"
-		fi
-		
 		# Copy app files
 		rsync -a "$base_dir/" "$APPDIR/"
 		#mv "$APPDIR/app/application.ini" "$APPDIR/"
@@ -768,6 +763,17 @@ if [ $BUILD_WIN == 1 ]; then
 		find "$APPDIR" \( -name .DS_Store -or -name '.git*' -or -name '.travis.yml' -or -name update.rdf -or -name '*.bak' \) -exec rm -f {} \;
 		find "$APPDIR" \( -name '*.exe' -or -name '*.dll' \) -exec chmod 755 {} \;
 		
+		if [[ $PACKAGE -eq 1 ]] && [[ $SIGN -eq 1 ]]; then
+			"$CALLDIR/win/codesign" "$APPDIR/zotero.exe" "$SIGNATURE_DESC"
+			sleep $SIGNTOOL_DELAY
+			"$CALLDIR/win/codesign" "$APPDIR/updater.exe" "$SIGNATURE_DESC Updater"
+			sleep $SIGNTOOL_DELAY
+			# Re-sign modified xul.dll
+			"$CALLDIR/win/codesign" "$APPDIR/xul.dll" "$SIGNATURE_DESC"
+			sleep $SIGNTOOL_DELAY
+			"$CALLDIR/win/codesign" "$APPDIR/integration/word-for-windows/libzoteroWinWordIntegration.dll" "$SIGNATURE_DESC Word Plugin"
+		fi
+		
 		# Copy over removed-files and make a precomplete file
 		pushd "$APPDIR"
 		cp "$CALLDIR/update-packaging/removed-files_$arch" removed-files
@@ -797,7 +803,6 @@ if [ $BUILD_WIN == 1 ]; then
 					sleep $SIGNTOOL_DELAY
 				fi
 				
-				
 				if [ "$arch" = "win32" ]; then
 					INSTALLER_PATH="$DIST_DIR/Zotero-${VERSION}_win32_setup.exe"
 				elif [ "$arch" = "win-x64" ]; then
@@ -806,11 +811,6 @@ if [ $BUILD_WIN == 1 ]; then
 					INSTALLER_PATH="$DIST_DIR/Zotero-${VERSION}_arm64_setup.exe"
 				fi
 				
-				if [ $SIGN -eq 1 ]; then
-					"$CALLDIR/win/codesign" "$APPDIR/zotero.exe" "$SIGNATURE_DESC"
-					sleep $SIGNTOOL_DELAY
-				fi
-				
 				# Stage installer
 				INSTALLER_STAGE_DIR="$BUILD_DIR/win_installer/staging"
 				rm -rf "$INSTALLER_STAGE_DIR"

app/scripts/fetch_xulrunner

@@ -530,6 +530,9 @@ if [ $BUILD_WIN == 1 ]; then
 		to=$(get_utf16_chars "Zotero" 38)
 		perl -pe "s/$from/$to/" < xul.dll > xul.dll.new
 		mv xul.dll.new xul.dll
+		# We re-sign DLL in build.sh, but presumably this file, which is for the Widevine CDM,
+		# isn't vaid anymore
+		rm xul.dll.sig
 		
 		# Check for UTF-16 "Zotero" in DLL
 		#