Prep for Azure Trusted Signing
Beq
parent
c998047f14
commit
db28566220
|
|
@ -302,6 +302,68 @@ jobs:
|
|||
autobuild configure -c ReleaseFS -A${addrsize} -- --package --chan ${{env.FS_RELEASE_CHAN}} ${{env.EXTRA_ARGS}} ${{env.FS_GRID}}
|
||||
echo "BUGSPLAT_DB=$BUGSPLAT_DB" >> $GITHUB_ENV
|
||||
shell: bash
|
||||
- name: Setup env for code signing on windows
|
||||
if: runner.os == 'Windows'
|
||||
run: |
|
||||
echo "FS_CERT=${{ secrets.FS_CERT }}" >> $GITHUB_ENV
|
||||
echo "FS_CERT_PASS=${{ secrets.FS_CERT_PASS }}" >> $GITHUB_ENV
|
||||
- name: Generate metadata.json
|
||||
run: |
|
||||
echo '{
|
||||
"Endpoint": "${{ secrets.AZURE_ENDPOINT }}",
|
||||
"CodeSigningAccountName": "${{ secrets.AZURE_CODE_SIGNING_NAME }}",
|
||||
"CertificateProfileName": "${{ secrets.AZURE_CERT_PROFILE_NAME }}",
|
||||
"ExcludeCredentials": [
|
||||
"ManagedIdentityCredential"
|
||||
]
|
||||
}' > ${{github.workspace}}/metadata.json
|
||||
- name: Prime the env for trusted code support
|
||||
if: runner.os == 'Windows'
|
||||
run: |
|
||||
echo "AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}" >> $GITHUB_ENV
|
||||
echo "AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}" >> $GITHUB_ENV
|
||||
echo "AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}" >> $GITHUB_ENV
|
||||
echo "CODESIGNING_METADATA_PATH=${{github.workspace}}/metadata.json" >> $GITHUB_ENV
|
||||
- name: Validate Windows 10 SDK version and find signtool.exe
|
||||
- name: locate signtool
|
||||
if: runner.os == 'Windows'
|
||||
id: validate-sdk
|
||||
run: |
|
||||
$sdkPath = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Directory | Sort-Object Name -Descending | Select-Object -First 1).FullName
|
||||
if (-not $sdkPath) {
|
||||
Write-Error "Required Windows 10 SDK version not installed."
|
||||
exit 1
|
||||
}
|
||||
$signtoolPath = Join-Path $sdkPath "x64\signtool.exe"
|
||||
if (-not (Test-Path $signtoolPath)) {
|
||||
Write-Error "signtool.exe not found in the SDK path."
|
||||
exit 1
|
||||
}
|
||||
echo "SIGNSDK_PATH=$sdkPath" >> $env:GITHUB_ENV
|
||||
echo "SIGNTOOL_PATH=$signtoolPath" >> $env:GITHUB_ENV
|
||||
shell: pwsh
|
||||
- name: Install nuget.exe
|
||||
if: runner.os == 'Windows'
|
||||
run: |
|
||||
Invoke-WebRequest -Uri https://dist.nuget.org/win-x86-commandline/latest/nuget.exe -OutFile nuget.exe
|
||||
shell: pwsh
|
||||
|
||||
- name: Install Microsoft.Trusted.Signing.Client
|
||||
if: runner.os == 'Windows'
|
||||
run: |
|
||||
.\nuget.exe install Microsoft.Trusted.Signing.Client -Version 1.0.53 -OutputDirectory .
|
||||
shell: pwsh
|
||||
|
||||
- name: Locate Azure.CodeSigning.Dlib.dll
|
||||
if: runner.os == 'Windows'
|
||||
run: |
|
||||
$dllPath = (Get-ChildItem ".\Microsoft.Trusted.Signing.Client.1.0.53\bin\x64\Azure.CodeSigning.Dlib.dll" -Recurse -File | Select-Object -First 1).FullName
|
||||
if (-not $dllPath) {
|
||||
Write-Error "Azure.CodeSigning.Dlib.dll not found."
|
||||
exit 1
|
||||
}
|
||||
echo "CODESIGNING_DLIB_PATH=$dllPath" >> $env:GITHUB_ENV
|
||||
shell: pwsh
|
||||
- name: build
|
||||
id: build
|
||||
run: autobuild build -c ReleaseFS -A${addrsize} --no-configure
|
||||
|
|
|
|||
|
|
@ -59,25 +59,51 @@ class FSViewerManifest:
|
|||
def fs_channel_unique(self):
|
||||
return self.channel().replace("Firestorm", "").strip()
|
||||
|
||||
def fs_sign_win_binaries( self ):
|
||||
try:
|
||||
subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com","/t","http://timestamp.verisign.com/scripts/timstamp.dll",self.args['configuration']+"\\firestorm-bin.exe"],
|
||||
stderr=subprocess.PIPE,stdout=subprocess.PIPE)
|
||||
subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com","/t","http://timestamp.verisign.com/scripts/timstamp.dll",self.args['configuration']+"\\slplugin.exe"],
|
||||
stderr=subprocess.PIPE,stdout=subprocess.PIPE)
|
||||
subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com","/t","http://timestamp.verisign.com/scripts/timstamp.dll",self.args['configuration']+"\\SLVoice.exe"],
|
||||
stderr=subprocess.PIPE,stdout=subprocess.PIPE)
|
||||
subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com","/t","http://timestamp.verisign.com/scripts/timstamp.dll",self.args['configuration']+"\\"+self.final_exe()],
|
||||
stderr=subprocess.PIPE,stdout=subprocess.PIPE)
|
||||
except Exception as e:
|
||||
print("Couldn't sign final binary. Tried to sign %s" % self.args['configuration']+"\\"+self.final_exe())
|
||||
def fs_sign_win_binaries(self):
|
||||
signtool_path = os.getenv('SIGNTOOL_PATH')
|
||||
codesigning_dlib_path = os.getenv('CODESIGNING_DLIB_PATH')
|
||||
metadata_file = os.getenv("CODESIGNING_METADATA_PATH")
|
||||
executable_paths = [
|
||||
self.args['configuration'] + "\\firestorm-bin.exe",
|
||||
self.args['configuration'] + "\\slplugin.exe",
|
||||
self.args['configuration'] + "\\SLVoice.exe",
|
||||
self.args['configuration'] + "\\" + self.final_exe()
|
||||
]
|
||||
|
||||
if not signtool_path or not codesigning_dlib_path:
|
||||
print("Signing configuration is missing. Skipping signing process.")
|
||||
return
|
||||
|
||||
print("Signing executables.")
|
||||
for exe_path in executable_paths:
|
||||
try:
|
||||
subprocess.check_call([
|
||||
signtool_path, "sign", "/v", "/debug", "/fd", "SHA256",
|
||||
"/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256",
|
||||
"/dlib", codesigning_dlib_path, "/dmdf", metadata_file, exe_path
|
||||
], stderr=subprocess.PIPE, stdout=subprocess.PIPE)
|
||||
except Exception as e:
|
||||
print(f"Couldn't sign binary: {exe_path}. Error: {e}")
|
||||
|
||||
def fs_sign_win_installer(self, substitution_strings):
|
||||
signtool_path = os.getenv('SIGNTOOL_PATH')
|
||||
codesigning_dlib_path = os.getenv('CODESIGNING_DLIB_PATH')
|
||||
metadata_file = os.getenv("CODESIGNING_METADATA_PATH")
|
||||
installer_path = self.args['configuration'] + "\\" + substitution_strings['installer_file']
|
||||
|
||||
if not signtool_path or not codesigning_dlib_path:
|
||||
print("Signing configuration is missing. Skipping signing process.")
|
||||
return
|
||||
print("Signing installer.")
|
||||
|
||||
def fs_sign_win_installer( self, substitution_strings ):
|
||||
try:
|
||||
subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com",self.args['configuration']+"\\"+substitution_strings['installer_file']],stderr=subprocess.PIPE,stdout=subprocess.PIPE)
|
||||
subprocess.check_call([
|
||||
signtool_path, "sign", "/v", "/debug", "/fd", "SHA256",
|
||||
"/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256",
|
||||
"/dlib", codesigning_dlib_path, "/dmdf", metadata_file, installer_path
|
||||
], stderr=subprocess.PIPE, stdout=subprocess.PIPE)
|
||||
except Exception as e:
|
||||
print("Working directory: %s" % os.getcwd())
|
||||
print("Couldn't sign windows installer. Tried to sign %s" % self.args['configuration']+"\\"+substitution_strings['installer_file'])
|
||||
print(f"Couldn't sign windows installer: {installer_path}. Error: {e}")
|
||||
|
||||
def fs_delete_linux_symbols( self ):
|
||||
debugDir = os.path.join( self.get_dst_prefix(), "bin", ".debug" )
|
||||
|
|
|
|||
Loading…
Reference in New Issue