add win-from-mac job, disable osslsigncode in debian

Debian trixie "lost" the osslsigncode package.

.github/workflows/build.yml

@@ -543,6 +543,34 @@ jobs:
             *-*-macos*.*
             urls.txt
 
+  win-llvm-from-mac:
+    runs-on: mac-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 8
+      - name: 'build'
+        env:
+          CW_LLVM_MINGW_DL: '1'
+          CW_LLVM_MINGW_ONLY: '0'
+        run: |
+          export CW_CONFIG='${{ github.ref_name }}-win'
+          export CW_REVISION='${{ github.sha }}'
+          . ./_versions.sh
+          sh -c ./_ci-mac-homebrew.sh
+
+      - name: 'list dependencies'
+        run: cat urls.txt
+      # https://github.com/actions/upload-artifact
+      - uses: actions/upload-artifact@v4
+        with:
+          name: 'curl-windows-llvm-from-mac'
+          retention-days: 5
+          path: |
+            *-*-mingw*.*
+            urls.txt
+
   win-llvm:
     runs-on: ubuntu-latest
     timeout-minutes: 30

_build.sh

@@ -452,7 +452,11 @@ fi
 
 if [ "${_OS}" = 'win' ] && \
    [ -s "${SIGN_CODE_KEY}" ]; then
-  osslsigncode --version  # We need 2.2 or newer
+  if command -v osslsigncode >/dev/null 2>&1; then
+    osslsigncode --version  # We need 2.2 or newer
+  else
+    unset SIGN_CODE_KEY_PASS
+  fi
 fi
 
 _ori_path="${PATH}"

_ci-linux-debian.sh

@@ -21,7 +21,8 @@ fi
 [[ "${CW_CONFIG:-}" = *'boringssl'* ]] && extra+=' golang'
 
 if [[ "${CW_CONFIG:-}" = *'win'* ]]; then
-  extra+=' mingw-w64 osslsigncode wine64'
+  extra+=' mingw-w64 wine64'
+# extra+=' osslsigncode'
   if [[ "${CW_CONFIG:-}" = *'boringssl'* ]]; then
     extra+=' nasm'
   fi