diff --git a/cmake/Packaging.cmake b/cmake/Packaging.cmake index d716efb225..4ba4e750de 100644 --- a/cmake/Packaging.cmake +++ b/cmake/Packaging.cmake @@ -111,6 +111,7 @@ set(CPACK_STRIP_FILES TRUE) # always strip symbols on packaging set(CPACK_PACKAGE_CHECKSUM SHA256) # Generate checksum file set(CPACK_PRE_BUILD_SCRIPTS ${pal_dir}/PackagingPreBuild_${PAL_HOST_PLATFORM_NAME_LOWERCASE}.cmake) set(CPACK_POST_BUILD_SCRIPTS ${pal_dir}/PackagingPostBuild_${PAL_HOST_PLATFORM_NAME_LOWERCASE}.cmake) +set(CPACK_CODESIGN_SCRIPT ${pal_dir}/PackagingCodeSign_${PAL_HOST_PLATFORM_NAME_LOWERCASE}.cmake) set(CPACK_LY_PYTHON_CMD ${LY_PYTHON_CMD}) # IMPORTANT: required to be included AFTER setting all property overrides diff --git a/cmake/Platform/Linux/PackagingCodeSign_linux.cmake b/cmake/Platform/Linux/PackagingCodeSign_linux.cmake new file mode 100644 index 0000000000..c4b6375385 --- /dev/null +++ b/cmake/Platform/Linux/PackagingCodeSign_linux.cmake @@ -0,0 +1,33 @@ +# +# Copyright (c) Contributors to the Open 3D Engine Project. +# For complete copyright and license terms please see the LICENSE at the root of this distribution. +# +# SPDX-License-Identifier: Apache-2.0 OR MIT +# +# + +function(ly_sign_binaries in_path) + message(STATUS "Executing package signing...") + file(REAL_PATH "${CPACK_SOURCE_DIR}/.." _root_path) + unset(_signing_command) + + cmake_path(SET _sign_script "${_root_path}/scripts/signer/Platform/Linux/signer.sh") + + list(APPEND _signing_command + ${_sign_script} + ) + message(STATUS "Signing package files in ${in_path}") + execute_process( + COMMAND ${_signing_command} ${in_path} + RESULT_VARIABLE _signing_result + ERROR_VARIABLE _signing_errors + OUTPUT_VARIABLE _signing_output + ECHO_OUTPUT_VARIABLE + ) + + if(NOT ${_signing_result} EQUAL 0) + message(FATAL_ERROR "An error occurred during signing files. ${_signing_errors}") + else() + message(STATUS "Signing complete!") + endif() +endfunction() diff --git a/cmake/Platform/Linux/PackagingPostBuild_linux.cmake b/cmake/Platform/Linux/PackagingPostBuild_linux.cmake index d92ee908fd..ebeefe3833 100644 --- a/cmake/Platform/Linux/PackagingPostBuild_linux.cmake +++ b/cmake/Platform/Linux/PackagingPostBuild_linux.cmake @@ -8,6 +8,7 @@ file(REAL_PATH "${CPACK_SOURCE_DIR}/.." LY_ROOT_FOLDER) include(${LY_ROOT_FOLDER}/cmake/Platform/Common/PackagingPostBuild_common.cmake) +include(${CPACK_CODESIGN_SCRIPT}) file(${CPACK_PACKAGE_CHECKSUM} ${CPACK_TOPLEVEL_DIRECTORY}/${CPACK_PACKAGE_FILE_NAME}.deb file_checksum) file(WRITE ${CPACK_TOPLEVEL_DIRECTORY}/${CPACK_PACKAGE_FILE_NAME}.deb.sha256 "${file_checksum} ${CPACK_PACKAGE_FILE_NAME}.deb") @@ -19,6 +20,10 @@ if(CPACK_UPLOAD_URL) set(CPACK_UPLOAD_DIRECTORY ${CPACK_PACKAGE_DIRECTORY}/CPackUploads) endif() + # Sign and regenerate checksum + ly_sign_binaries("${CPACK_TOPLEVEL_DIRECTORY}/*.deb" "") + file(WRITE ${CPACK_TOPLEVEL_DIRECTORY}/${CPACK_PACKAGE_FILE_NAME}.deb.sha256 "${file_checksum} ${CPACK_PACKAGE_FILE_NAME}.deb") + # Copy the artifacts intended to be uploaded to a remote server into the folder specified # through CPACK_UPLOAD_DIRECTORY. This mimics the same process cpack does natively for # some other frameworks that have built-in online installer support. @@ -27,14 +32,13 @@ if(CPACK_UPLOAD_URL) file(GLOB _artifacts "${CPACK_TOPLEVEL_DIRECTORY}/*.deb" "${CPACK_TOPLEVEL_DIRECTORY}/*.sha256" + "${LY_ROOT_FOLDER}/scripts/signer/Platform/Linux/*.gpg" ) file(COPY ${_artifacts} DESTINATION ${CPACK_UPLOAD_DIRECTORY} ) message(STATUS "Artifacts copied to ${CPACK_UPLOAD_DIRECTORY}") - # TODO: copy gpg file to CPACK_UPLOAD_DIRECTORY - ly_upload_to_url( ${CPACK_UPLOAD_URL} ${CPACK_UPLOAD_DIRECTORY} @@ -51,8 +55,6 @@ if(CPACK_UPLOAD_URL) ${latest_deb_package} ) ly_upload_to_latest(${CPACK_UPLOAD_URL} ${latest_deb_package}) - - # TODO: upload gpg file to latest # Generate a checksum file for latest and upload it set(latest_hash_file "${CPACK_UPLOAD_DIRECTORY}/${CPACK_PACKAGE_NAME}_latest.deb.sha256") diff --git a/cmake/Platform/Linux/PackagingPreBuild_linux.cmake b/cmake/Platform/Linux/PackagingPreBuild_linux.cmake index 31dc393307..39108355ea 100644 --- a/cmake/Platform/Linux/PackagingPreBuild_linux.cmake +++ b/cmake/Platform/Linux/PackagingPreBuild_linux.cmake @@ -9,8 +9,6 @@ file(REAL_PATH "${CPACK_SOURCE_DIR}/.." LY_ROOT_FOLDER) include(${LY_ROOT_FOLDER}/cmake/Platform/Common/PackagingPreBuild_common.cmake) -if(NOT CPACK_UPLOAD_URL) # Skip signing if we are not uploading the package +if(NOT CPACK_UPLOAD_URL) # Skip this step if we are not uploading the package return() endif() - -# TODO: do signing diff --git a/cmake/Platform/Linux/platform_linux_files.cmake b/cmake/Platform/Linux/platform_linux_files.cmake index d30959b8d2..dd10c47ca6 100644 --- a/cmake/Platform/Linux/platform_linux_files.cmake +++ b/cmake/Platform/Linux/platform_linux_files.cmake @@ -18,6 +18,7 @@ set(FILES LYTestWrappers_linux.cmake LYWrappers_linux.cmake Packaging_linux.cmake + PackagingCodeSign_linux.cmake PackagingPostBuild_linux.cmake PackagingPreBuild_linux.cmake PAL_linux.cmake diff --git a/cmake/Platform/Windows/PackagingCodeSign_windows.cmake b/cmake/Platform/Windows/PackagingCodeSign_windows.cmake new file mode 100644 index 0000000000..8ef7f79e40 --- /dev/null +++ b/cmake/Platform/Windows/PackagingCodeSign_windows.cmake @@ -0,0 +1,56 @@ +# +# Copyright (c) Contributors to the Open 3D Engine Project. +# For complete copyright and license terms please see the LICENSE at the root of this distribution. +# +# SPDX-License-Identifier: Apache-2.0 OR MIT +# +# + +function(ly_sign_binaries in_path in_path_type) + message(STATUS "Executing package signing...") + file(REAL_PATH "${CPACK_SOURCE_DIR}/.." _root_path) + unset(_signing_command) + + cmake_path(SET _sign_script "${_root_path}/scripts/signer/Platform/Windows/signer.ps1") + + find_program(_psiexec_path psexec.exe) + if(_psiexec_path) + list(APPEND _signing_command + ${_psiexec_path} + -accepteula + -nobanner + -s + ) + endif() + + find_program(_powershell_path powershell.exe REQUIRED) + list(APPEND _signing_command + ${_powershell_path} + -NoLogo + -ExecutionPolicy Bypass + -File ${_sign_script} + ) + + # This requires to have a valid local certificate. In continuous integration, these certificates are stored + # in the machine directly. + # You can generate a test certificate to be able to run this in a PowerShell elevated promp with: + # New-SelfSignedCertificate -DnsName foo.o3de.com -Type CodeSigning -CertStoreLocation Cert:\CurrentUser\My + # Export-Certificate -Cert (Get-ChildItem Cert:\CurrentUser\My\) -Filepath "c:\selfsigned.crt" + # Import-Certificate -FilePath "c:\selfsigned.crt" -Cert Cert:\CurrentUser\TrustedPublisher + # Import-Certificate -FilePath "c:\selfsigned.crt" -Cert Cert:\CurrentUser\Root + + message(STATUS "Signing ${in_path_type} files in ${in_path}") + execute_process( + COMMAND ${_signing_command} -${in_path_type} ${in_path} + RESULT_VARIABLE _signing_result + ERROR_VARIABLE _signing_errors + OUTPUT_VARIABLE _signing_output + ECHO_OUTPUT_VARIABLE + ) + + if(NOT ${_signing_result} EQUAL 0) + message(FATAL_ERROR "An error occurred during signing files for ${in_path_type}. ${_signing_errors}") + else() + message(STATUS "Signing complete!") + endif() +endfunction() diff --git a/cmake/Platform/Windows/PackagingPostBuild_windows.cmake b/cmake/Platform/Windows/PackagingPostBuild_windows.cmake index 0993135c23..10f0f902a3 100644 --- a/cmake/Platform/Windows/PackagingPostBuild_windows.cmake +++ b/cmake/Platform/Windows/PackagingPostBuild_windows.cmake @@ -8,6 +8,7 @@ file(REAL_PATH "${CPACK_SOURCE_DIR}/.." LY_ROOT_FOLDER) include(${LY_ROOT_FOLDER}/cmake/Platform/Common/PackagingPostBuild_common.cmake) +include(${CPACK_CODESIGN_SCRIPT}) # convert the path to a windows style path using string replace because TO_NATIVE_PATH # only works on real paths @@ -59,39 +60,7 @@ set(_light_command ) if(CPACK_UPLOAD_URL) # Skip signing if we are not uploading the package - file(TO_NATIVE_PATH "${LY_ROOT_FOLDER}/scripts/signer/Platform/Windows/signer.ps1" _sign_script) - - unset(_signing_command) - find_program(_psiexec_path psexec.exe) - if(_psiexec_path) - list(APPEND _signing_command - ${_psiexec_path} - -accepteula - -nobanner - -s - ) - endif() - - find_program(_powershell_path powershell.exe REQUIRED) - list(APPEND _signing_command - ${_powershell_path} - -NoLogo - -ExecutionPolicy Bypass - -File ${_sign_script} - ) - - message(STATUS "Signing package files in ${_cpack_wix_out_dir}") - execute_process( - COMMAND ${_signing_command} -packagePath ${_cpack_wix_out_dir} - RESULT_VARIABLE _signing_result - ERROR_VARIABLE _signing_errors - OUTPUT_VARIABLE _signing_output - ECHO_OUTPUT_VARIABLE - ) - - if(NOT ${_signing_result} EQUAL 0) - message(FATAL_ERROR "An error occurred during signing package files. ${_signing_errors}") - endif() + ly_sign_binaries("${_cpack_wix_out_dir}" "packagePath") endif() message(STATUS "Creating Bootstrap Installer...") @@ -116,18 +85,7 @@ endif() message(STATUS "Bootstrap installer generated to ${_bootstrap_output_file}") if(CPACK_UPLOAD_URL) # Skip signing if we are not uploading the package - message(STATUS "Signing bootstrap installer in ${_bootstrap_output_file}") - execute_process( - COMMAND ${_signing_command} -bootstrapPath ${_bootstrap_output_file} - RESULT_VARIABLE _signing_result - ERROR_VARIABLE _signing_errors - OUTPUT_VARIABLE _signing_output - ECHO_OUTPUT_VARIABLE - ) - - if(NOT ${_signing_result} EQUAL 0) - message(FATAL_ERROR "An error occurred during signing bootstrap installer. ${_signing_errors}") - endif() + ly_sign_binaries("${_bootstrap_output_file}" "bootstrapPath") endif() # use the internal default path if somehow not specified from cpack_configure_downloads diff --git a/cmake/Platform/Windows/PackagingPreBuild_windows.cmake b/cmake/Platform/Windows/PackagingPreBuild_windows.cmake index 29995518da..b6b5708a8c 100644 --- a/cmake/Platform/Windows/PackagingPreBuild_windows.cmake +++ b/cmake/Platform/Windows/PackagingPreBuild_windows.cmake @@ -8,53 +8,11 @@ file(REAL_PATH "${CPACK_SOURCE_DIR}/.." LY_ROOT_FOLDER) include(${LY_ROOT_FOLDER}/cmake/Platform/Common/PackagingPreBuild_common.cmake) +include(${CPACK_CODESIGN_SCRIPT}) if(NOT CPACK_UPLOAD_URL) # Skip signing if we are not uploading the package return() endif() -file(REAL_PATH "${CPACK_SOURCE_DIR}/.." _root_path) set(_cpack_wix_out_dir ${CPACK_TOPLEVEL_DIRECTORY}) -file(TO_NATIVE_PATH "${_root_path}/scripts/signer/Platform/Windows/signer.ps1" _sign_script) - -unset(_signing_command) -find_program(_psiexec_path psexec.exe) -if(_psiexec_path) - list(APPEND _signing_command - ${_psiexec_path} - -accepteula - -nobanner - -s - ) -endif() - -find_program(_powershell_path powershell.exe REQUIRED) -list(APPEND _signing_command - ${_powershell_path} - -NoLogo - -ExecutionPolicy Bypass - -File ${_sign_script} -) - -# This requires to have a valid local certificate. In continuous integration, these certificates are stored -# in the machine directly. -# You can generate a test certificate to be able to run this in a PowerShell elevated promp with: -# New-SelfSignedCertificate -DnsName foo.o3de.com -Type CodeSigning -CertStoreLocation Cert:\CurrentUser\My -# Export-Certificate -Cert (Get-ChildItem Cert:\CurrentUser\My\) -Filepath "c:\selfsigned.crt" -# Import-Certificate -FilePath "c:\selfsigned.crt" -Cert Cert:\CurrentUser\TrustedPublisher -# Import-Certificate -FilePath "c:\selfsigned.crt" -Cert Cert:\CurrentUser\Root - -message(STATUS "Signing executable files in ${_cpack_wix_out_dir}") -execute_process( - COMMAND ${_signing_command} -exePath ${_cpack_wix_out_dir} - RESULT_VARIABLE _signing_result - ERROR_VARIABLE _signing_errors - OUTPUT_VARIABLE _signing_output - ECHO_OUTPUT_VARIABLE -) - -if(NOT ${_signing_result} EQUAL 0) - message(FATAL_ERROR "An error occurred during signing executable files. ${_signing_errors}") -else() - message(STATUS "Signing exes complete!") -endif() +ly_sign_binaries("${_cpack_wix_out_dir}" "exePath") \ No newline at end of file diff --git a/cmake/Platform/Windows/platform_windows_files.cmake b/cmake/Platform/Windows/platform_windows_files.cmake index 984d985380..8ad242f842 100644 --- a/cmake/Platform/Windows/platform_windows_files.cmake +++ b/cmake/Platform/Windows/platform_windows_files.cmake @@ -25,6 +25,7 @@ set(FILES PALDetection_windows.cmake Install_windows.cmake Packaging_windows.cmake + PackagingCodeSign_windows.cmake PackagingPostBuild_windows.cmake PackagingPreBuild_windows.cmake Packaging/Bootstrapper.wxs diff --git a/scripts/build/Platform/Linux/build_config.json b/scripts/build/Platform/Linux/build_config.json index db9e2e7b8a..b6fcd5b0ba 100644 --- a/scripts/build/Platform/Linux/build_config.json +++ b/scripts/build/Platform/Linux/build_config.json @@ -230,6 +230,9 @@ "nightly-clean", "nightly-installer" ], + "PIPELINE_ENV":{ + "NODE_LABEL":"linux-707531fc7-packaging" + }, "COMMAND": "build_installer_linux.sh", "PARAMETERS": { "CONFIGURATION": "profile", diff --git a/scripts/signer/Platform/Linux/signer.sh b/scripts/signer/Platform/Linux/signer.sh old mode 100644 new mode 100755