birkeh/o3de
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add platform specific codesign script and modifications for Linux and Windows installer packaging (#5893)

Browse Source 
Signed-off-by: Mike Chang <changml@amazon.com>
This commit is contained in:
Mike Chang
2021-12-01 17:14:00 -08:00
committed by GitHub
parent 9edbe4d541
commit 8b3c76d8b8
11 changed files with 107 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmake/Packaging.cmake
+1
View File
@@ -111,6 +111,7 @@ set(CPACK_STRIP_FILES TRUE) # always strip symbols on packaging
set(CPACK_PACKAGE_CHECKSUM SHA256) # Generate checksum file
set(CPACK_PRE_BUILD_SCRIPTS ${pal_dir}/PackagingPreBuild_${PAL_HOST_PLATFORM_NAME_LOWERCASE}.cmake)
set(CPACK_POST_BUILD_SCRIPTS ${pal_dir}/PackagingPostBuild_${PAL_HOST_PLATFORM_NAME_LOWERCASE}.cmake)
set(CPACK_CODESIGN_SCRIPT ${pal_dir}/PackagingCodeSign_${PAL_HOST_PLATFORM_NAME_LOWERCASE}.cmake)
set(CPACK_LY_PYTHON_CMD ${LY_PYTHON_CMD})
# IMPORTANT: required to be included AFTER setting all property overrides
cmake/Platform/Linux/PackagingCodeSign_linux.cmake
+33
View File
@@ -0,0 +1,33 @@
#
# Copyright (c) Contributors to the Open 3D Engine Project.
# For complete copyright and license terms please see the LICENSE at the root of this distribution.
#
# SPDX-License-Identifier: Apache-2.0 OR MIT
#
#
function(ly_sign_binaries in_path)
message(STATUS "Executing package signing...")
file(REAL_PATH "${CPACK_SOURCE_DIR}/.." _root_path)
unset(_signing_command)
cmake_path(SET _sign_script "${_root_path}/scripts/signer/Platform/Linux/signer.sh")
list(APPEND _signing_command
${_sign_script}
)
message(STATUS "Signing package files in ${in_path}")
execute_process(
COMMAND ${_signing_command} ${in_path}
RESULT_VARIABLE _signing_result
ERROR_VARIABLE _signing_errors
OUTPUT_VARIABLE _signing_output
ECHO_OUTPUT_VARIABLE
)
if(NOT ${_signing_result} EQUAL 0)
message(FATAL_ERROR "An error occurred during signing files. ${_signing_errors}")
else()
message(STATUS "Signing complete!")
endif()
endfunction()
cmake/Platform/Linux/PackagingPostBuild_linux.cmake
+6 -4
View File
@@ -8,6 +8,7 @@
file(REAL_PATH "${CPACK_SOURCE_DIR}/.." LY_ROOT_FOLDER)
include(${LY_ROOT_FOLDER}/cmake/Platform/Common/PackagingPostBuild_common.cmake)
include(${CPACK_CODESIGN_SCRIPT})
file(${CPACK_PACKAGE_CHECKSUM} ${CPACK_TOPLEVEL_DIRECTORY}/${CPACK_PACKAGE_FILE_NAME}.deb file_checksum)
file(WRITE ${CPACK_TOPLEVEL_DIRECTORY}/${CPACK_PACKAGE_FILE_NAME}.deb.sha256 "${file_checksum} ${CPACK_PACKAGE_FILE_NAME}.deb")
@@ -19,6 +20,10 @@ if(CPACK_UPLOAD_URL)
set(CPACK_UPLOAD_DIRECTORY ${CPACK_PACKAGE_DIRECTORY}/CPackUploads)
endif()
# Sign and regenerate checksum
ly_sign_binaries("${CPACK_TOPLEVEL_DIRECTORY}/*.deb" "")
file(WRITE ${CPACK_TOPLEVEL_DIRECTORY}/${CPACK_PACKAGE_FILE_NAME}.deb.sha256 "${file_checksum} ${CPACK_PACKAGE_FILE_NAME}.deb")
# Copy the artifacts intended to be uploaded to a remote server into the folder specified
# through CPACK_UPLOAD_DIRECTORY. This mimics the same process cpack does natively for
# some other frameworks that have built-in online installer support.
@@ -27,14 +32,13 @@ if(CPACK_UPLOAD_URL)
file(GLOB _artifacts
"${CPACK_TOPLEVEL_DIRECTORY}/*.deb"
"${CPACK_TOPLEVEL_DIRECTORY}/*.sha256"
"${LY_ROOT_FOLDER}/scripts/signer/Platform/Linux/*.gpg"
)
file(COPY ${_artifacts}
DESTINATION ${CPACK_UPLOAD_DIRECTORY}
)
message(STATUS "Artifacts copied to ${CPACK_UPLOAD_DIRECTORY}")
# TODO: copy gpg file to CPACK_UPLOAD_DIRECTORY
ly_upload_to_url(
${CPACK_UPLOAD_URL}
${CPACK_UPLOAD_DIRECTORY}
@@ -51,8 +55,6 @@ if(CPACK_UPLOAD_URL)
${latest_deb_package}
)
ly_upload_to_latest(${CPACK_UPLOAD_URL} ${latest_deb_package})
# TODO: upload gpg file to latest
# Generate a checksum file for latest and upload it
set(latest_hash_file "${CPACK_UPLOAD_DIRECTORY}/${CPACK_PACKAGE_NAME}_latest.deb.sha256")
cmake/Platform/Linux/PackagingPreBuild_linux.cmake
+1 -3
View File
@@ -9,8 +9,6 @@
file(REAL_PATH "${CPACK_SOURCE_DIR}/.." LY_ROOT_FOLDER)
include(${LY_ROOT_FOLDER}/cmake/Platform/Common/PackagingPreBuild_common.cmake)
if(NOT CPACK_UPLOAD_URL) # Skip signing if we are not uploading the package
if(NOT CPACK_UPLOAD_URL) # Skip this step if we are not uploading the package
return()
endif()
# TODO: do signing
cmake/Platform/Linux/platform_linux_files.cmake
+1
View File
@@ -18,6 +18,7 @@ set(FILES
LYTestWrappers_linux.cmake
LYWrappers_linux.cmake
Packaging_linux.cmake
PackagingCodeSign_linux.cmake
PackagingPostBuild_linux.cmake
PackagingPreBuild_linux.cmake
PAL_linux.cmake
cmake/Platform/Windows/PackagingCodeSign_windows.cmake
+56
View File
@@ -0,0 +1,56 @@
#
# Copyright (c) Contributors to the Open 3D Engine Project.
# For complete copyright and license terms please see the LICENSE at the root of this distribution.
#
# SPDX-License-Identifier: Apache-2.0 OR MIT
#
#
function(ly_sign_binaries in_path in_path_type)
message(STATUS "Executing package signing...")
file(REAL_PATH "${CPACK_SOURCE_DIR}/.." _root_path)
unset(_signing_command)
cmake_path(SET _sign_script "${_root_path}/scripts/signer/Platform/Windows/signer.ps1")
find_program(_psiexec_path psexec.exe)
if(_psiexec_path)
list(APPEND _signing_command
${_psiexec_path}
-accepteula
-nobanner
-s
)
endif()
find_program(_powershell_path powershell.exe REQUIRED)
list(APPEND _signing_command
${_powershell_path}
-NoLogo
-ExecutionPolicy Bypass
-File ${_sign_script}
)
# This requires to have a valid local certificate. In continuous integration, these certificates are stored
# in the machine directly.
# You can generate a test certificate to be able to run this in a PowerShell elevated promp with:
# New-SelfSignedCertificate -DnsName foo.o3de.com -Type CodeSigning -CertStoreLocation Cert:\CurrentUser\My
# Export-Certificate -Cert (Get-ChildItem Cert:\CurrentUser\My\<cert thumbprint>) -Filepath "c:\selfsigned.crt"
# Import-Certificate -FilePath "c:\selfsigned.crt" -Cert Cert:\CurrentUser\TrustedPublisher
# Import-Certificate -FilePath "c:\selfsigned.crt" -Cert Cert:\CurrentUser\Root
message(STATUS "Signing ${in_path_type} files in ${in_path}")
execute_process(
COMMAND ${_signing_command} -${in_path_type} ${in_path}
RESULT_VARIABLE _signing_result
ERROR_VARIABLE _signing_errors
OUTPUT_VARIABLE _signing_output
ECHO_OUTPUT_VARIABLE
)
if(NOT ${_signing_result} EQUAL 0)
message(FATAL_ERROR "An error occurred during signing files for ${in_path_type}. ${_signing_errors}")
else()
message(STATUS "Signing complete!")
endif()
endfunction()
cmake/Platform/Windows/PackagingPostBuild_windows.cmake
+3 -45
View File
@@ -8,6 +8,7 @@
file(REAL_PATH "${CPACK_SOURCE_DIR}/.." LY_ROOT_FOLDER)
include(${LY_ROOT_FOLDER}/cmake/Platform/Common/PackagingPostBuild_common.cmake)
include(${CPACK_CODESIGN_SCRIPT})
# convert the path to a windows style path using string replace because TO_NATIVE_PATH
# only works on real paths
@@ -59,39 +60,7 @@ set(_light_command
)
if(CPACK_UPLOAD_URL) # Skip signing if we are not uploading the package
file(TO_NATIVE_PATH "${LY_ROOT_FOLDER}/scripts/signer/Platform/Windows/signer.ps1" _sign_script)
unset(_signing_command)
find_program(_psiexec_path psexec.exe)
if(_psiexec_path)
list(APPEND _signing_command
${_psiexec_path}
-accepteula
-nobanner
-s
)
endif()
find_program(_powershell_path powershell.exe REQUIRED)
list(APPEND _signing_command
${_powershell_path}
-NoLogo
-ExecutionPolicy Bypass
-File ${_sign_script}
)
message(STATUS "Signing package files in ${_cpack_wix_out_dir}")
execute_process(
COMMAND ${_signing_command} -packagePath ${_cpack_wix_out_dir}
RESULT_VARIABLE _signing_result
ERROR_VARIABLE _signing_errors
OUTPUT_VARIABLE _signing_output
ECHO_OUTPUT_VARIABLE
)
if(NOT ${_signing_result} EQUAL 0)
message(FATAL_ERROR "An error occurred during signing package files. ${_signing_errors}")
endif()
ly_sign_binaries("${_cpack_wix_out_dir}" "packagePath")
endif()
message(STATUS "Creating Bootstrap Installer...")
@@ -116,18 +85,7 @@ endif()
message(STATUS "Bootstrap installer generated to ${_bootstrap_output_file}")
if(CPACK_UPLOAD_URL) # Skip signing if we are not uploading the package
message(STATUS "Signing bootstrap installer in ${_bootstrap_output_file}")
execute_process(
COMMAND ${_signing_command} -bootstrapPath ${_bootstrap_output_file}
RESULT_VARIABLE _signing_result
ERROR_VARIABLE _signing_errors
OUTPUT_VARIABLE _signing_output
ECHO_OUTPUT_VARIABLE
)
if(NOT ${_signing_result} EQUAL 0)
message(FATAL_ERROR "An error occurred during signing bootstrap installer. ${_signing_errors}")
endif()
ly_sign_binaries("${_bootstrap_output_file}" "bootstrapPath")
endif()
# use the internal default path if somehow not specified from cpack_configure_downloads
cmake/Platform/Windows/PackagingPreBuild_windows.cmake
+2 -44
View File
@@ -8,53 +8,11 @@
file(REAL_PATH "${CPACK_SOURCE_DIR}/.." LY_ROOT_FOLDER)
include(${LY_ROOT_FOLDER}/cmake/Platform/Common/PackagingPreBuild_common.cmake)
include(${CPACK_CODESIGN_SCRIPT})
if(NOT CPACK_UPLOAD_URL) # Skip signing if we are not uploading the package
return()
endif()
file(REAL_PATH "${CPACK_SOURCE_DIR}/.." _root_path)
set(_cpack_wix_out_dir ${CPACK_TOPLEVEL_DIRECTORY})
file(TO_NATIVE_PATH "${_root_path}/scripts/signer/Platform/Windows/signer.ps1" _sign_script)
unset(_signing_command)
find_program(_psiexec_path psexec.exe)
if(_psiexec_path)
list(APPEND _signing_command
${_psiexec_path}
-accepteula
-nobanner
-s
)
endif()
find_program(_powershell_path powershell.exe REQUIRED)
list(APPEND _signing_command
${_powershell_path}
-NoLogo
-ExecutionPolicy Bypass
-File ${_sign_script}
)
# This requires to have a valid local certificate. In continuous integration, these certificates are stored
# in the machine directly.
# You can generate a test certificate to be able to run this in a PowerShell elevated promp with:
# New-SelfSignedCertificate -DnsName foo.o3de.com -Type CodeSigning -CertStoreLocation Cert:\CurrentUser\My
# Export-Certificate -Cert (Get-ChildItem Cert:\CurrentUser\My\<cert thumbprint>) -Filepath "c:\selfsigned.crt"
# Import-Certificate -FilePath "c:\selfsigned.crt" -Cert Cert:\CurrentUser\TrustedPublisher
# Import-Certificate -FilePath "c:\selfsigned.crt" -Cert Cert:\CurrentUser\Root
message(STATUS "Signing executable files in ${_cpack_wix_out_dir}")
execute_process(
COMMAND ${_signing_command} -exePath ${_cpack_wix_out_dir}
RESULT_VARIABLE _signing_result
ERROR_VARIABLE _signing_errors
OUTPUT_VARIABLE _signing_output
ECHO_OUTPUT_VARIABLE
)
if(NOT ${_signing_result} EQUAL 0)
message(FATAL_ERROR "An error occurred during signing executable files. ${_signing_errors}")
else()
message(STATUS "Signing exes complete!")
endif()
ly_sign_binaries("${_cpack_wix_out_dir}" "exePath")
cmake/Platform/Windows/platform_windows_files.cmake
+1
View File
@@ -25,6 +25,7 @@ set(FILES
PALDetection_windows.cmake
Install_windows.cmake
Packaging_windows.cmake
PackagingCodeSign_windows.cmake
PackagingPostBuild_windows.cmake
PackagingPreBuild_windows.cmake
Packaging/Bootstrapper.wxs
scripts/build/Platform/Linux/build_config.json
+3
View File
@@ -230,6 +230,9 @@
"nightly-clean",
"nightly-installer"
],
"PIPELINE_ENV":{
"NODE_LABEL":"linux-707531fc7-packaging"
},
"COMMAND": "build_installer_linux.sh",
"PARAMETERS": {
"CONFIGURATION": "profile",
scripts/signer/Platform/Linux/signer.sh
Regular → Executable
View File