Installer, bootstrapper, and executable signing for Windows (#4406)
* Added a codesigning script to pre and post build steps in the Windows installer CD job * Changed `windows_installer` job name to `installer_vs2019` * Added `installer-nightly` tag for `installer_vs2019` * Updated `build_config.json` to use an envvar for the installer url and bucket Signed-off-by: Mike Chang <changml@amazon.com>monroegm-disable-blank-issue-2
Mike Chang
4 years ago
committed by
GitHub
parent
e1c49e436d
commit
0b718d435c
@ -0,0 +1,37 @@
|
|||||||
|
#
|
||||||
|
# Copyright (c) Contributors to the Open 3D Engine Project.
|
||||||
|
# For complete copyright and license terms please see the LICENSE at the root of this distribution.
|
||||||
|
#
|
||||||
|
# SPDX-License-Identifier: Apache-2.0 OR MIT
|
||||||
|
#
|
||||||
|
#
|
||||||
|
|
||||||
|
file(REAL_PATH "${CPACK_SOURCE_DIR}/.." _root_path)
|
||||||
|
set(_cpack_wix_out_dir ${CPACK_TOPLEVEL_DIRECTORY})
|
||||||
|
file(TO_NATIVE_PATH "${_root_path}/scripts/signer/Platform/Windows/signer.ps1" _sign_script)
|
||||||
|
|
||||||
|
set(_signing_command
|
||||||
|
psexec.exe
|
||||||
|
-accepteula
|
||||||
|
-nobanner
|
||||||
|
-s
|
||||||
|
powershell.exe
|
||||||
|
-NoLogo
|
||||||
|
-ExecutionPolicy Bypass
|
||||||
|
-File ${_sign_script}
|
||||||
|
)
|
||||||
|
|
||||||
|
message(STATUS "Signing executable files in ${_cpack_wix_out_dir}")
|
||||||
|
execute_process(
|
||||||
|
COMMAND ${_signing_command} -exePath ${_cpack_wix_out_dir}
|
||||||
|
RESULT_VARIABLE _signing_result
|
||||||
|
ERROR_VARIABLE _signing_errors
|
||||||
|
OUTPUT_VARIABLE _signing_output
|
||||||
|
ECHO_OUTPUT_VARIABLE
|
||||||
|
)
|
||||||
|
|
||||||
|
if(NOT ${_signing_result} EQUAL 0)
|
||||||
|
message(FATAL_ERROR "An error occurred during signing executable files. ${_signing_errors}")
|
||||||
|
endif()
|
||||||
|
|
||||||
|
message(STATUS "Signing exes complete!")
|
||||||
@ -0,0 +1,99 @@
|
|||||||
|
#
|
||||||
|
# Copyright (c) Contributors to the Open 3D Engine Project.
|
||||||
|
# For complete copyright and license terms please see the LICENSE at the root of this distribution.
|
||||||
|
#
|
||||||
|
# SPDX-License-Identifier: Apache-2.0 OR MIT
|
||||||
|
#
|
||||||
|
#
|
||||||
|
|
||||||
|
param (
|
||||||
|
[String[]] $exePath,
|
||||||
|
[String[]] $packagePath,
|
||||||
|
[String[]] $bootstrapPath,
|
||||||
|
[String[]] $certificate
|
||||||
|
)
|
||||||
|
|
||||||
|
# Get prerequisites, certs, and paths ready
|
||||||
|
$tempPath = [System.IO.Path]::GetTempPath() # Order of operations defined here: https://docs.microsoft.com/en-us/dotnet/api/system.io.path.gettemppath?view=net-5.0&tabs=windows#remarks
|
||||||
|
$certThumbprint = Get-ChildItem -Path Cert:LocalMachine\MY -CodeSigningCert -ErrorAction Stop | Select-Object -ExpandProperty Thumbprint # Grab first certificate from local machine store
|
||||||
|
|
||||||
|
if ($certificate) {
|
||||||
|
Write-Output "Checking certificate thumbprint $certificate"
|
||||||
|
Get-ChildItem -Path Cert:LocalMachine\MY -ErrorAction SilentlyContinue | Where-Object {$_.Thumbprint -eq $certificate} # Prints certificate Thumbprint and Subject if found
|
||||||
|
if($?) {
|
||||||
|
$certThumbprint = $certificate
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
Write-Error "$certificate thumbprint not found, using $certThumbprint thumbprint instead"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Try {
|
||||||
|
$signtoolPath = Resolve-Path "C:\Program Files*\Windows Kits\10\bin\*\x64\signtool.exe" -ErrorAction Stop | Select-Object -Last 1 -ExpandProperty Path
|
||||||
|
$insigniaPath = Resolve-Path "C:\Program Files*\WiX*\bin\insignia.exe" -ErrorAction Stop | Select-Object -Last 1 -ExpandProperty Path
|
||||||
|
}
|
||||||
|
Catch {
|
||||||
|
Write-Error "Signtool or Wix insignia not found! Exiting."
|
||||||
|
}
|
||||||
|
|
||||||
|
function Write-Signature {
|
||||||
|
param (
|
||||||
|
$signtool,
|
||||||
|
$thumbprint,
|
||||||
|
$filename
|
||||||
|
)
|
||||||
|
|
||||||
|
$attempts = 2
|
||||||
|
$sleepSec = 5
|
||||||
|
|
||||||
|
Do {
|
||||||
|
$attempts--
|
||||||
|
Try {
|
||||||
|
& $signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /sha1 $thumbprint /sm $filename
|
||||||
|
& $signtool verify /pa /v $filename
|
||||||
|
return
|
||||||
|
}
|
||||||
|
Catch {
|
||||||
|
Write-Error $_.Exception.InnerException.Message -ErrorAction Continue
|
||||||
|
Start-Sleep -Seconds $sleepSec
|
||||||
|
}
|
||||||
|
} while ($attempts -lt 0)
|
||||||
|
|
||||||
|
throw "Failed to sign $filename" # Bypassed in try block if the command is successful
|
||||||
|
}
|
||||||
|
|
||||||
|
# Looping through each path insteaad of globbing to prevent hitting maximum command string length limit
|
||||||
|
if ($exePath) {
|
||||||
|
Write-Output "### Signing EXE files ###"
|
||||||
|
$files = @(Get-ChildItem $exePath -Recurse *.exe | % { $_.FullName })
|
||||||
|
foreach ($file in $files) {
|
||||||
|
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($packagePath) {
|
||||||
|
Write-Output "### Signing CAB files ###"
|
||||||
|
$files = @(Get-ChildItem $packagePath -Recurse *.cab | % { $_.FullName })
|
||||||
|
foreach ($file in $files) {
|
||||||
|
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
|
||||||
|
}
|
||||||
|
|
||||||
|
Write-Output "### Signing MSI files ###"
|
||||||
|
$files = @(Get-ChildItem $packagePath -Recurse *.msi | % { $_.FullName })
|
||||||
|
foreach ($file in $files) {
|
||||||
|
& $insigniaPath -im $files
|
||||||
|
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($bootstrapPath) {
|
||||||
|
Write-Output "### Signing bootstrapper EXE ###"
|
||||||
|
$files = @(Get-ChildItem $bootstrapPath -Recurse *.exe | % { $_.FullName })
|
||||||
|
foreach ($file in $files) {
|
||||||
|
& $insigniaPath -ib $file -o $tempPath\engine.exe
|
||||||
|
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $tempPath\engine.exe
|
||||||
|
& $insigniaPath -ab $tempPath\engine.exe $file -o $file
|
||||||
|
Write-Signature -signtool $signtoolPath -thumbprint $certThumbprint -filename $file
|
||||||
|
Remove-Item -Force $tempPath\engine.exe
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue