Installer, bootstrapper, and executable signing for Windows (#4406)
* Added a codesigning script to pre and post build steps in the Windows installer CD job * Changed `windows_installer` job name to `installer_vs2019` * Added `installer-nightly` tag for `installer_vs2019` * Updated `build_config.json` to use an envvar for the installer url and bucket Signed-off-by: Mike Chang <changml@amazon.com>monroegm-disable-blank-issue-2
Mike Chang
4 years ago
committed by
GitHub
parent
e1c49e436d
commit
0b718d435c
@ -0,0 +1,37 @@
|
||||
#
|
||||
# Copyright (c) Contributors to the Open 3D Engine Project.
|
||||
# For complete copyright and license terms please see the LICENSE at the root of this distribution.
|
||||
#
|
||||
# SPDX-License-Identifier: Apache-2.0 OR MIT
|
||||
#
|
||||
#
|
||||
|
||||
file(REAL_PATH "${CPACK_SOURCE_DIR}/.." _root_path)
|
||||
set(_cpack_wix_out_dir ${CPACK_TOPLEVEL_DIRECTORY})
|
||||
file(TO_NATIVE_PATH "${_root_path}/scripts/signer/Platform/Windows/signer.ps1" _sign_script)
|
||||
|
||||
set(_signing_command
|
||||
psexec.exe
|
||||
-accepteula
|
||||
-nobanner
|
||||
-s
|
||||
powershell.exe
|
||||
-NoLogo
|
||||
-ExecutionPolicy Bypass
|
||||
-File ${_sign_script}
|
||||
)
|
||||
|
||||
message(STATUS "Signing executable files in ${_cpack_wix_out_dir}")
|
||||
execute_process(
|
||||
COMMAND ${_signing_command} -exePath ${_cpack_wix_out_dir}
|
||||
RESULT_VARIABLE _signing_result
|
||||
ERROR_VARIABLE _signing_errors
|
||||
OUTPUT_VARIABLE _signing_output
|
||||
ECHO_OUTPUT_VARIABLE
|
||||
)
|
||||
|
||||
if(NOT ${_signing_result} EQUAL 0)
|
||||
message(FATAL_ERROR "An error occurred during signing executable files. ${_signing_errors}")
|
||||
endif()
|
||||
|
||||
message(STATUS "Signing exes complete!")
|
||||
@ -0,0 +1,99 @@
|
||||
#
|
||||
# Copyright (c) Contributors to the Open 3D Engine Project.
|
||||
# For complete copyright and license terms please see the LICENSE at the root of this distribution.
|
||||
#
|
||||
# SPDX-License-Identifier: Apache-2.0 OR MIT
|
||||
#
|
||||
#
|
||||
|
||||
param (
|
||||
[String[]] $exePath,
|
||||
[String[]] $packagePath,
|
||||
[String[]] $bootstrapPath,
|
||||
[String[]] $certificate
|
||||
)
|
||||
|
||||
# Get prerequisites, certs, and paths ready
|
||||
$tempPath = [System.IO.Path]::GetTempPath() # Order of operations defined here: https://docs.microsoft.com/en-us/dotnet/api/system.io.path.gettemppath?view=net-5.0&tabs=windows#remarks
|
||||
$certThumbprint = Get-ChildItem -Path Cert:LocalMachine\MY -CodeSigningCert -ErrorAction Stop | Select-Object -ExpandProperty Thumbprint # Grab first certificate from local machine store
|
||||
|
||||
if ($certificate) {
|
||||
Write-Output "Checking certificate thumbprint $certificate"
|
||||
Get-ChildItem -Path Cert:LocalMachine\MY -ErrorAction SilentlyContinue | Where-Object {$_.Thumbprint -eq $certificate} # Prints certificate Thumbprint and Subject if found
|
||||
if($?) {
|
||||
$certThumbprint = $certificate
|
||||
}
|
||||
else {
|
||||
Write-Error "$certificate thumbprint not found, using $certThumbprint thumbprint instead"
|
||||
}
|
||||
}
|
||||
|
||||
Try {
|
||||
$signtoolPath = Resolve-Path "C:\Program Files*\Windows Kits\10\bin\*\x64\signtool.exe" -ErrorAction Stop | Select-Object -Last 1 -ExpandProperty Path
|
||||
$insigniaPath = Resolve-Path "C:\Program Files*\WiX*\bin\insignia.exe" -ErrorAction Stop | Select-Object -Last 1 -ExpandProperty Path
|
||||
}
|
||||
Catch {
|
||||
Write-Error "Signtool or Wix insignia not found! Exiting."
|
||||
}
|
||||
|
||||
function Write-Signature {
|
||||
param (
|
||||
$signtool,
|
||||
$thumbprint,
|
||||
$filename
|
||||
)
|
||||
|
||||
$attempts = 2
|
||||
$sleepSec = 5
|
||||
|
||||
Do {
|
||||
$attempts--
|
||||
Try {
|
||||
& $signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /sha1 $thumbprint /sm $filename
|
||||
& $signtool verify /pa /v $filename
|
||||
return
|
||||
}
|
||||
Catch {
|
||||
Write-Error $_.Exception.InnerException.Message -ErrorAction Continue
|
||||
Start-Sleep -Seconds $sleepSec
|
||||
}
|
||||
} while ($attempts -lt 0)
|
||||
|
||||
throw "Failed to sign $filename" # Bypassed in try block if the command is successful
|
||||
}
|
||||
|
||||
# Looping through each path insteaad of globbing to prevent hitting maximum command string length limit
|
||||
if ($exePath) {
|
||||
Write-Output "### Signing EXE files ###"
|
||||
$files = @(Get-ChildItem $exePath -Recurse *.exe | % { $_.FullName })
|
||||
foreach ($file in $files) {
|
||||
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
|
||||
}
|
||||
}
|
||||
|
||||
if ($packagePath) {
|
||||
Write-Output "### Signing CAB files ###"
|
||||
$files = @(Get-ChildItem $packagePath -Recurse *.cab | % { $_.FullName })
|
||||
foreach ($file in $files) {
|
||||
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
|
||||
}
|
||||
|
||||
Write-Output "### Signing MSI files ###"
|
||||
$files = @(Get-ChildItem $packagePath -Recurse *.msi | % { $_.FullName })
|
||||
foreach ($file in $files) {
|
||||
& $insigniaPath -im $files
|
||||
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
|
||||
}
|
||||
}
|
||||
|
||||
if ($bootstrapPath) {
|
||||
Write-Output "### Signing bootstrapper EXE ###"
|
||||
$files = @(Get-ChildItem $bootstrapPath -Recurse *.exe | % { $_.FullName })
|
||||
foreach ($file in $files) {
|
||||
& $insigniaPath -ib $file -o $tempPath\engine.exe
|
||||
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $tempPath\engine.exe
|
||||
& $insigniaPath -ab $tempPath\engine.exe $file -o $file
|
||||
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
|
||||
Remove-Item -Force $tempPath\engine.exe
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue