From db28566220d0654b8f63ffe8bb6b7a231458dfb3 Mon Sep 17 00:00:00 2001 From: Beq Date: Thu, 23 Jan 2025 14:42:05 +0000 Subject: [PATCH] Prep for Azure Trusted Signing --- .github/workflows/build_viewer.yml | 62 +++++++++++++++++++++++++++++ indra/newview/fs_viewer_manifest.py | 58 +++++++++++++++++++-------- 2 files changed, 104 insertions(+), 16 deletions(-) diff --git a/.github/workflows/build_viewer.yml b/.github/workflows/build_viewer.yml index 45d6a297e7..fdd8ceafa7 100644 --- a/.github/workflows/build_viewer.yml +++ b/.github/workflows/build_viewer.yml @@ -302,6 +302,68 @@ jobs: autobuild configure -c ReleaseFS -A${addrsize} -- --package --chan ${{env.FS_RELEASE_CHAN}} ${{env.EXTRA_ARGS}} ${{env.FS_GRID}} echo "BUGSPLAT_DB=$BUGSPLAT_DB" >> $GITHUB_ENV shell: bash + - name: Setup env for code signing on windows + if: runner.os == 'Windows' + run: | + echo "FS_CERT=${{ secrets.FS_CERT }}" >> $GITHUB_ENV + echo "FS_CERT_PASS=${{ secrets.FS_CERT_PASS }}" >> $GITHUB_ENV + - name: Generate metadata.json + run: | + echo '{ + "Endpoint": "${{ secrets.AZURE_ENDPOINT }}", + "CodeSigningAccountName": "${{ secrets.AZURE_CODE_SIGNING_NAME }}", + "CertificateProfileName": "${{ secrets.AZURE_CERT_PROFILE_NAME }}", + "ExcludeCredentials": [ + "ManagedIdentityCredential" + ] + }' > ${{github.workspace}}/metadata.json + - name: Prime the env for trusted code support + if: runner.os == 'Windows' + run: | + echo "AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}" >> $GITHUB_ENV + echo "AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}" >> $GITHUB_ENV + echo "AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}" >> $GITHUB_ENV + echo "CODESIGNING_METADATA_PATH=${{github.workspace}}/metadata.json" >> $GITHUB_ENV + - name: Validate Windows 10 SDK version and find signtool.exe + - name: locate signtool + if: runner.os == 'Windows' + id: validate-sdk + run: | + $sdkPath = (Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin" -Recurse -Directory | Sort-Object Name -Descending | Select-Object -First 1).FullName + if (-not $sdkPath) { + Write-Error "Required Windows 10 SDK version not installed." + exit 1 + } + $signtoolPath = Join-Path $sdkPath "x64\signtool.exe" + if (-not (Test-Path $signtoolPath)) { + Write-Error "signtool.exe not found in the SDK path." + exit 1 + } + echo "SIGNSDK_PATH=$sdkPath" >> $env:GITHUB_ENV + echo "SIGNTOOL_PATH=$signtoolPath" >> $env:GITHUB_ENV + shell: pwsh + - name: Install nuget.exe + if: runner.os == 'Windows' + run: | + Invoke-WebRequest -Uri https://dist.nuget.org/win-x86-commandline/latest/nuget.exe -OutFile nuget.exe + shell: pwsh + + - name: Install Microsoft.Trusted.Signing.Client + if: runner.os == 'Windows' + run: | + .\nuget.exe install Microsoft.Trusted.Signing.Client -Version 1.0.53 -OutputDirectory . + shell: pwsh + + - name: Locate Azure.CodeSigning.Dlib.dll + if: runner.os == 'Windows' + run: | + $dllPath = (Get-ChildItem ".\Microsoft.Trusted.Signing.Client.1.0.53\bin\x64\Azure.CodeSigning.Dlib.dll" -Recurse -File | Select-Object -First 1).FullName + if (-not $dllPath) { + Write-Error "Azure.CodeSigning.Dlib.dll not found." + exit 1 + } + echo "CODESIGNING_DLIB_PATH=$dllPath" >> $env:GITHUB_ENV + shell: pwsh - name: build id: build run: autobuild build -c ReleaseFS -A${addrsize} --no-configure diff --git a/indra/newview/fs_viewer_manifest.py b/indra/newview/fs_viewer_manifest.py index 8093f9d3f6..8b5d354618 100644 --- a/indra/newview/fs_viewer_manifest.py +++ b/indra/newview/fs_viewer_manifest.py @@ -59,25 +59,51 @@ class FSViewerManifest: def fs_channel_unique(self): return self.channel().replace("Firestorm", "").strip() - def fs_sign_win_binaries( self ): - try: - subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com","/t","http://timestamp.verisign.com/scripts/timstamp.dll",self.args['configuration']+"\\firestorm-bin.exe"], - stderr=subprocess.PIPE,stdout=subprocess.PIPE) - subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com","/t","http://timestamp.verisign.com/scripts/timstamp.dll",self.args['configuration']+"\\slplugin.exe"], - stderr=subprocess.PIPE,stdout=subprocess.PIPE) - subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com","/t","http://timestamp.verisign.com/scripts/timstamp.dll",self.args['configuration']+"\\SLVoice.exe"], - stderr=subprocess.PIPE,stdout=subprocess.PIPE) - subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com","/t","http://timestamp.verisign.com/scripts/timstamp.dll",self.args['configuration']+"\\"+self.final_exe()], - stderr=subprocess.PIPE,stdout=subprocess.PIPE) - except Exception as e: - print("Couldn't sign final binary. Tried to sign %s" % self.args['configuration']+"\\"+self.final_exe()) + def fs_sign_win_binaries(self): + signtool_path = os.getenv('SIGNTOOL_PATH') + codesigning_dlib_path = os.getenv('CODESIGNING_DLIB_PATH') + metadata_file = os.getenv("CODESIGNING_METADATA_PATH") + executable_paths = [ + self.args['configuration'] + "\\firestorm-bin.exe", + self.args['configuration'] + "\\slplugin.exe", + self.args['configuration'] + "\\SLVoice.exe", + self.args['configuration'] + "\\" + self.final_exe() + ] + + if not signtool_path or not codesigning_dlib_path: + print("Signing configuration is missing. Skipping signing process.") + return + + print("Signing executables.") + for exe_path in executable_paths: + try: + subprocess.check_call([ + signtool_path, "sign", "/v", "/debug", "/fd", "SHA256", + "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256", + "/dlib", codesigning_dlib_path, "/dmdf", metadata_file, exe_path + ], stderr=subprocess.PIPE, stdout=subprocess.PIPE) + except Exception as e: + print(f"Couldn't sign binary: {exe_path}. Error: {e}") + + def fs_sign_win_installer(self, substitution_strings): + signtool_path = os.getenv('SIGNTOOL_PATH') + codesigning_dlib_path = os.getenv('CODESIGNING_DLIB_PATH') + metadata_file = os.getenv("CODESIGNING_METADATA_PATH") + installer_path = self.args['configuration'] + "\\" + substitution_strings['installer_file'] + + if not signtool_path or not codesigning_dlib_path: + print("Signing configuration is missing. Skipping signing process.") + return + print("Signing installer.") - def fs_sign_win_installer( self, substitution_strings ): try: - subprocess.check_call(["signtool.exe","sign","/n","Phoenix","/d","Firestorm","/du","http://www.phoenixviewer.com",self.args['configuration']+"\\"+substitution_strings['installer_file']],stderr=subprocess.PIPE,stdout=subprocess.PIPE) + subprocess.check_call([ + signtool_path, "sign", "/v", "/debug", "/fd", "SHA256", + "/tr", "http://timestamp.acs.microsoft.com", "/td", "SHA256", + "/dlib", codesigning_dlib_path, "/dmdf", metadata_file, installer_path + ], stderr=subprocess.PIPE, stdout=subprocess.PIPE) except Exception as e: - print("Working directory: %s" % os.getcwd()) - print("Couldn't sign windows installer. Tried to sign %s" % self.args['configuration']+"\\"+substitution_strings['installer_file']) + print(f"Couldn't sign windows installer: {installer_path}. Error: {e}") def fs_delete_linux_symbols( self ): debugDir = os.path.join( self.get_dst_prefix(), "bin", ".debug" )