Use specific version of signtool

Default version of signtool in PATH does not work properly with our CKA.
We could also load an SDK's env batch file instead but setting this on the workflow
is more maintainable as we'll get a clear missing file error on GA Image change

.github/workflows/releaseNigthly.yml

@@ -92,6 +92,7 @@ jobs:
       run: |
         python .github\\scripts\\build_release_nightly.py
       env:
+        SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.22621.0/x86/signtool.exe"
         SSH_KEY: ${{ runner.temp }}/id_rsa
     - name: Upload failure logs
       if: failure()

scripts/package_kiwix-desktop_windows.py

@@ -52,7 +52,7 @@ if args.sign:
     # We assume here that signtool and certificate are properly configured.
     # Env var `SIGNTOOL_THUMBPRINT` must contain thumbprint of the certificate to use.
     command = [
-        "signtool.exe",
+        os.getenv("SIGNTOOL_PATH", "signtool.exe"),
         "sign",
         "/fd",
         "sha256",