From 2ef6f2674c2bc22165ffb1884e58f0b53524760f Mon Sep 17 00:00:00 2001
From: Steve Dower <steve.dower@python.org>
Date: Mon, 4 May 2026 15:25:02 +0100
Subject: [PATCH] Fix real publishing steps for Windows releases

---
 windows-release/merge-and-upload.py | 6 ++++++
 windows-release/msi-steps.yml       | 6 ++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/windows-release/merge-and-upload.py b/windows-release/merge-and-upload.py
index 0565748f..e58306dc 100644
--- a/windows-release/merge-and-upload.py
+++ b/windows-release/merge-and-upload.py
@@ -278,6 +278,12 @@ def install_sortkey(install):
 
 
 def find_missing_from_index(url, installs):
+    if not UPLOAD_HOST:
+        print("Skipping check for upload race because UPLOAD_HOST is missing")
+        return []
+    if NO_UPLOAD:
+        print("Skipping check for upload race because NO_UPLOAD is set")
+        return []
     with urlopen(url) as r:
         x = {install_sortkey(i) for i in json.load(r)["versions"]}
     y = {install_sortkey(i) for i in installs} - x
diff --git a/windows-release/msi-steps.yml b/windows-release/msi-steps.yml
index 41f42961..12adc977 100644
--- a/windows-release/msi-steps.yml
+++ b/windows-release/msi-steps.yml
@@ -77,10 +77,8 @@ steps:
         Include: ''
         ExportCommand: SignCommand
         SigningCertificate: ${{ parameters.SigningCertificate }}
-        # WiX is struggling with WIF authentication and sign.exe right now,
-        # so we still rely on the client secret for legacy builds.
-        # We disable the service connection here to skip the login steps.
-        AzureServiceConnectionName: ''
+        # WiX never moved on from signtool.exe, so we'll use that here
+        InstallLegacyTool: true
 
     - powershell: |
         $cmd = $env:SignCommand -replace '"', '\"'