Two statements in the docs say a Windows package can only be signed on Windows. Both contradict the Cross Platform Signing section on the same page, which already documents JSign on Linux/macOS via --signTemplate.

cross-compiling.mdx — "The standard --signParams / --signTemplate path relies on signtool.exe, which only runs on Windows." --signTemplate doesn't; it runs whatever command it's given.

signing.mdx — "Signing relies on signtool.exe which is only supported on Windows. If you are using a different operating system, you will need to sign your binaries on a Windows machine before deploying them."

Why the corrected version is right

In WindowsPackCommand.cs, --signParams and --azureTrustedSignFile are registered inside if (VelopackRuntimeInfo.IsWindows), while --signTemplate is registered unconditionally — so on Linux the signtool-backed flags aren't even offered, and vpk [win] pack --help lists only --signTemplate.

In WindowsPackCommandRunner.cs the template runs before the platform guard:

if (!string.IsNullOrEmpty(signTemplate)) {
    helper.Sign(filePaths, signTemplate, signParallel, progress, true);
}
// signtool.exe does not work if we're not on windows.
if (!VelopackRuntimeInfo.IsWindows) return;

Confirmed empirically on Ubuntu — vpk [win] pack ... --signTemplate "..." reported "Code-signed 5/5 files" for the app payload and "Code-signed 1/1 files" for the setup bundle. MyApp-win-Setup.exe, Squirrel.exe, MyApp_ExecutionStub.exe, MyApp.exe and MyApp.dll all came out with a populated certificate table whose digest matches the file.

Changes

Both notes are scoped to the signtool-backed options and link to the existing Cross Platform Signing section. No new tools are recommended; the JSign section is unchanged.

Translated copies weren't touched.

Disclosure: I maintain a cross-platform signing tool that works via --signTemplate, which is how I ran into this. I've deliberately left it out of the changes — this is a correction, not a placement. Happy to add it next to JSign if you'd want a .NET-native option there, but that's your call and not part of this PR.