-
Notifications
You must be signed in to change notification settings - Fork 139
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
changes to support new code signing system
- Loading branch information
1 parent
4da1f4f
commit 8151cad
Showing
5 changed files
with
172 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -13,6 +13,7 @@ app/bundledPlugins | |
| attachments | ||
| sourcemaps | ||
| *.env | ||
| CodeSignTool* | ||
|
|
||
| # User-specific files | ||
| *.suo | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| param ( | ||
| [switch] $Sandbox | ||
| ) | ||
|
|
||
| Set-StrictMode -Version 'Latest' | ||
| $ErrorActionPreference = "Stop" | ||
| $ProgressPreference = 'SilentlyContinue' #'Continue | ||
|
|
||
| Write-Host "Sandbox = $Sandbox" | ||
|
|
||
| $rootDir = Resolve-Path "." | ||
| $downloadUrl = "https://www.ssl.com/download/codesigntool-for-windows/" | ||
| $downloadedFile = Join-Path $rootDir "CodeSignTool.zip" | ||
| $extractFolder = Join-Path $rootDir "CodeSignTool" | ||
| $configPath = "/conf/code_sign_tool.properties" | ||
|
|
||
| Write-Host "rootDir $rootDir" | ||
| Write-Host "downloadedFile $downloadedFile" | ||
| Write-Host "extractFolder $extractFolder" | ||
|
|
||
| # Remove extracted folder if exists, just in case (mainly used locally) | ||
| if(Test-Path $extractFolder) { | ||
| Remove-Item -Path $extractFolder -Recurse -Force | ||
| } | ||
|
|
||
| # Download (if it doesn't exist) | ||
| if(!(Test-Path $downloadedFile -PathType Leaf)) { | ||
| Invoke-WebRequest -OutFile $downloadedFile $downloadUrl | ||
| } | ||
|
|
||
| # Extract | ||
| Expand-Archive -Path $downloadedFile -DestinationPath $extractFolder -Force | ||
|
|
||
| # need to check for a nested single folder as 1.2.7 was packaged without this, all previous versions were not. | ||
|
|
||
| $folderCount = @(Get-ChildItem $extractFolder -Directory ).Count; | ||
|
|
||
| #if we have a single folder, then assume we have a nested folder that we need to fix | ||
| If ($folderCount -eq 1) { | ||
|
|
||
| # get nested folder path, there is only 1 at this point | ||
| $nestedFolderPath = (Get-ChildItem $extractFolder -Directory | Select-Object FullName)[0].FullName | ||
|
|
||
| Write-Host "nestedFolderPath $nestedFolderPath" | ||
|
|
||
| # move all child items from this nested folder to it's parent | ||
| Get-ChildItem -Path $nestedFolderPath -Recurse | Move-Item -Destination $extractFolder | ||
|
|
||
| # remove nested folder to keep it clean | ||
| Remove-Item -Path $nestedFolderPath -Force | ||
| } | ||
|
|
||
| # Set config to sandbox (only while testing) | ||
| if($Sandbox -eq $true) { | ||
|
|
||
| $codeSignToolPropertiesFile = Join-Path $extractFolder $configPath | ||
|
|
||
| $null = New-Item -Path $codeSignToolPropertiesFile -ItemType File -Force | ||
| Add-Content -Path $codeSignToolPropertiesFile -Value "CLIENT_ID=qOUeZCCzSqgA93acB3LYq6lBNjgZdiOxQc-KayC3UMw" | ||
| Add-Content -Path $codeSignToolPropertiesFile -Value "OAUTH2_ENDPOINT=https://oauth-sandbox.ssl.com/oauth2/token" | ||
| Add-Content -Path $codeSignToolPropertiesFile -Value "CSC_API_ENDPOINT=https://cs-try.ssl.com" | ||
| Add-Content -Path $codeSignToolPropertiesFile -Value "TSA_URL=http://ts.ssl.com" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| const path = require('path'); | ||
| const fs = require('fs'); | ||
| const childProcess = require('child_process'); | ||
| require('dotenv').config(); | ||
|
|
||
| const TEMP_DIR = path.join(__dirname, 'release', 'temp'); | ||
|
|
||
| if (!fs.existsSync(TEMP_DIR)) { | ||
| fs.mkdirSync(TEMP_DIR, { recursive: true }); | ||
| } | ||
|
|
||
| async function sign(configuration) { | ||
|
|
||
| // credentials from ssl.com | ||
| const ES_USERNAME = process.env.ES_USERNAME; | ||
| const ES_PASSWORD = process.env.ES_PASSWORD; | ||
| const ES_CREDENTIAL_ID = process.env.ES_CREDENTIAL_ID; | ||
| const ES_TOTP_SECRET = process.env.ES_TOTP_SECRET; | ||
|
|
||
| if (ES_USERNAME && ES_PASSWORD && ES_TOTP_SECRET && ES_CREDENTIAL_ID) { | ||
|
|
||
| console.log(`Signing ${configuration.path}`); | ||
|
|
||
| const { base, dir } = path.parse(configuration.path); | ||
| const tempFile = path.join(TEMP_DIR, base); | ||
|
|
||
| // CodeSignTool can't sign in place without verifying the overwrite with a | ||
| // y/m interaction so we are creating a new file in a temp directory and | ||
| // then replacing the original file with the signed file. | ||
|
|
||
| const setDir = `cd ./CodeSignTool`; | ||
| const signFile = `CodeSignTool sign -input_file_path="${configuration.path}" -output_dir_path="${TEMP_DIR}" -credential_id="${ES_CREDENTIAL_ID}" -username="${ES_USERNAME}" -password="${ES_PASSWORD}" -totp_secret="${ES_TOTP_SECRET}"`; | ||
| const moveFile = `move "${tempFile}" "${dir}"`; | ||
|
|
||
| childProcess.execSync(`${setDir} && ${signFile} && ${moveFile}`, { stdio: 'inherit' }); | ||
|
|
||
| } else { | ||
|
|
||
| console.warn(`sign.js - Can't sign file ${configuration.path}, missing value for: | ||
| ${ES_USERNAME ? '' : 'ES_USERNAME'} | ||
| ${ES_PASSWORD ? '' : 'ES_PASSWORD'} | ||
| ${ES_CREDENTIAL_ID ? '' : 'ES_CREDENTIAL_ID'} | ||
| ${ES_TOTP_SECRET ? '' : 'ES_TOTP_SECRET'} | ||
| `); | ||
|
|
||
| process.exit(1); | ||
|
|
||
| } | ||
| } | ||
|
|
||
| exports.default = sign; |