Installer, bootstrapper, and executable signing for Windows (#4406)

* Added a codesigning script to pre and post build steps in the Windows installer CD job * Changed `windows_installer` job name to `installer_vs2019` * Added `installer-nightly` tag for `installer_vs2019` * Updated `build_config.json` to use an envvar for the installer url and bucket Signed-off-by: Mike Chang <changml@amazon.com>
2021-09-30 17:40:34 -07:00
parent e1c49e436d
commit 0b718d435c
5 changed files with 189 additions and 8 deletions
@@ -351,17 +351,21 @@
        "CMAKE_NATIVE_BUILD_ARGS": "/m /nologo"
    }
  },
-  "windows_installer": {
+  "installer_vs2019": {
    "TAGS": [
-      "nightly-clean"
+      "nightly-clean",
+      "nightly-installer"
    ],
+    "PIPELINE_ENV":{
+      "NODE_LABEL":"windows-packaging"
+    },
    "COMMAND": "build_installer_windows.cmd",
    "PARAMETERS": {
        "CONFIGURATION": "profile",
        "OUTPUT_DIRECTORY": "build\\windows_vs2019",
        "CMAKE_OPTIONS": "-G \"Visual Studio 16 2019\" -DCMAKE_SYSTEM_VERSION=10.0 -DLY_UNITY_BUILD=TRUE -DLY_DISABLE_TEST_MODULES=TRUE -DLY_VERSION_ENGINE_NAME=o3de-sdk -DLY_INSTALLER_WIX_ROOT=\"!WIX! \"",
-        "EXTRA_CMAKE_OPTIONS": "-DLY_INSTALLER_AUTO_GEN_TAG=ON -DLY_INSTALLER_DOWNLOAD_URL=https://www.o3debinaries.org -DLY_INSTALLER_LICENSE_URL=https://www.o3debinaries.org/license",
-        "CPACK_BUCKET": "spectra-prism-staging-us-west-2",
+        "EXTRA_CMAKE_OPTIONS": "-DLY_INSTALLER_AUTO_GEN_TAG=ON -DLY_INSTALLER_DOWNLOAD_URL=!INSTALLER_DOWNLOAD_URL! -DLY_INSTALLER_LICENSE_URL=!INSTALLER_DOWNLOAD_URL!/license",
+        "CPACK_BUCKET": "!INSTALLER_BUCKET!",
        "CMAKE_LY_PROJECTS": "",
        "CMAKE_TARGET": "ALL_BUILD",
        "CMAKE_NATIVE_BUILD_ARGS": "/m /nologo"
@@ -0,0 +1,99 @@
+#
+# Copyright (c) Contributors to the Open 3D Engine Project.
+# For complete copyright and license terms please see the LICENSE at the root of this distribution.
+#
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+#
+#
+
+param (
+    [String[]] $exePath,
+    [String[]] $packagePath,
+    [String[]] $bootstrapPath,
+    [String[]] $certificate
+)
+
+# Get prerequisites, certs, and paths ready
+$tempPath = [System.IO.Path]::GetTempPath() # Order of operations defined here: https://docs.microsoft.com/en-us/dotnet/api/system.io.path.gettemppath?view=net-5.0&tabs=windows#remarks
+$certThumbprint = Get-ChildItem -Path Cert:LocalMachine\MY -CodeSigningCert -ErrorAction Stop | Select-Object -ExpandProperty Thumbprint # Grab first certificate from local machine store
+
+if ($certificate) {
+    Write-Output "Checking certificate thumbprint $certificate"
+    Get-ChildItem -Path Cert:LocalMachine\MY -ErrorAction SilentlyContinue | Where-Object {$_.Thumbprint -eq $certificate} # Prints certificate Thumbprint and Subject if found
+    if($?) {
+        $certThumbprint = $certificate
+    }
+    else {
+        Write-Error "$certificate thumbprint not found, using $certThumbprint thumbprint instead"
+    }
+}
+
+Try { 
+    $signtoolPath = Resolve-Path "C:\Program Files*\Windows Kits\10\bin\*\x64\signtool.exe" -ErrorAction Stop | Select-Object -Last 1 -ExpandProperty Path
+    $insigniaPath = Resolve-Path "C:\Program Files*\WiX*\bin\insignia.exe" -ErrorAction Stop | Select-Object -Last 1 -ExpandProperty Path
+}
+Catch {
+    Write-Error "Signtool or Wix insignia not found! Exiting."
+}
+
+function Write-Signature {
+    param (
+        $signtool,
+        $thumbprint,
+        $filename
+    )
+
+    $attempts = 2
+    $sleepSec = 5
+
+    Do {
+        $attempts--
+        Try {
+            & $signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /sha1 $thumbprint /sm $filename
+            & $signtool verify /pa /v $filename
+            return
+        }
+        Catch {
+            Write-Error $_.Exception.InnerException.Message -ErrorAction Continue
+            Start-Sleep -Seconds $sleepSec
+        }
+    } while ($attempts -lt 0)
+
+    throw "Failed to sign $filename" # Bypassed in try block if the command is successful
+}
+
+# Looping through each path insteaad of globbing to prevent hitting maximum command string length limit
+if ($exePath) {
+    Write-Output "### Signing EXE files ###"
+    $files = @(Get-ChildItem $exePath -Recurse *.exe | % { $_.FullName })
+    foreach ($file in $files) {
+        Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
+    }
+}
+
+if ($packagePath) {
+    Write-Output "### Signing CAB files ###"
+    $files = @(Get-ChildItem $packagePath -Recurse *.cab | % { $_.FullName })
+    foreach ($file in $files) {
+        Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
+    }
+
+    Write-Output "### Signing MSI files ###"
+    $files = @(Get-ChildItem $packagePath -Recurse *.msi | % { $_.FullName })
+    foreach ($file in $files) {
+        & $insigniaPath -im $files
+        Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
+    }
+}
+
+if ($bootstrapPath) {
+    Write-Output "### Signing bootstrapper EXE ###"
+    $files = @(Get-ChildItem $bootstrapPath -Recurse *.exe | % { $_.FullName })
+    foreach ($file in $files) {
+        & $insigniaPath -ib $file -o $tempPath\engine.exe
+        Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $tempPath\engine.exe
+        & $insigniaPath -ab $tempPath\engine.exe $file -o $file
+        Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
+        Remove-Item -Force $tempPath\engine.exe
+    }
+}