Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(win): implement Azure Trusted Signing #8458

Merged
merged 29 commits into from
Sep 13, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
bc6a0c5
initial work on migrating signtool.exe-related config to `signtoolOpt…
mmaietta Sep 9, 2024
0d24b78
cleanup
mmaietta Sep 9, 2024
bd899c3
Update to use `File` field for corresponding file path
mmaietta Sep 9, 2024
7d45cf7
moving `publisherName` and adding install for `Install-PackageProvide…
mmaietta Sep 9, 2024
832a064
move signtool to separate class logic to cleanup WindowsCodeSign.ts
mmaietta Sep 10, 2024
cd43b91
tmp save
mmaietta Sep 10, 2024
a1f1765
fix compilation issues
mmaietta Sep 10, 2024
4dfffd7
rename SignTool file to have Manager suffix
mmaietta Sep 10, 2024
7b1c7b7
migrate signtool and azure signing managers to Lazy so that `azureSig…
mmaietta Sep 10, 2024
a5b9d23
regen docs and prettier
mmaietta Sep 10, 2024
cbf08d0
update docs and follow camelcase var nomenclature
mmaietta Sep 10, 2024
615e0c6
move lazy vars out of constructor to top level
mmaietta Sep 10, 2024
950095f
verify correct env vars specified via https://learn.microsoft.com/en-…
mmaietta Sep 10, 2024
37229ba
update docs specifying env vars required
mmaietta Sep 10, 2024
3f1551b
Merge commit 'a5b2f483fc63dd2f4240f57c026a674c423abebb' into azure-si…
mmaietta Sep 10, 2024
3154489
update test and move CSC password logic into winPackager
mmaietta Sep 11, 2024
e3cc84a
small refactor
mmaietta Sep 11, 2024
e5f0cce
Merge commit 'c081df8e04494645028c4160bcc1376f029cbca5' into azure-si…
mmaietta Sep 11, 2024
52df060
fix destructuring of cmd line args
mmaietta Sep 11, 2024
9f62b8a
update docs conversion script to render WindowsSigntoolConfiguration …
mmaietta Sep 11, 2024
946d9ec
add additional doc rendering
mmaietta Sep 11, 2024
d1d2d2b
Merge branch 'master' into azure-signing
mmaietta Sep 12, 2024
a20b34b
pin versions to base range to prevent major semver bump
mmaietta Sep 12, 2024
f0504e1
update lockfile
mmaietta Sep 12, 2024
fd0d2a9
Merge branch 'master' into azure-signing
mmaietta Sep 13, 2024
f8daa77
reset workspace dependency versions
mmaietta Sep 13, 2024
99128d6
update docs with better description
mmaietta Sep 13, 2024
31eee78
use @link jsdoc syntax
mmaietta Sep 13, 2024
4f52977
allow retry for signtool when fails to find certificate (signtool.exe…
mmaietta Sep 13, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
update docs conversion script to render WindowsSigntoolConfiguration …
…and WindowsAzureSigningConfiguration subobjects
  • Loading branch information
mmaietta committed Sep 11, 2024
commit 9f62b8aa1c9ace88f3c37459343d2187139d0069
11 changes: 6 additions & 5 deletions docs/api/electron-builder.md
Original file line number Diff line number Diff line change
Expand Up @@ -245,6 +245,7 @@ Developer API only. See [Configuration](../configuration/configuration.md) for u
<li><a href="#WinPackager">.WinPackager</a> ⇐ <code><a href="#PlatformPackager">PlatformPackager</a></code>
<ul>
<li><a href="#module_app-builder-lib.WinPackager+createTargets"><code>.createTargets(targets, mapper)</code></a></li>
<li><a href="#module_app-builder-lib.WinPackager+doGetCscPassword"><code>.doGetCscPassword()</code></a> ⇒ <code>undefined</code> | <code>null</code> | <code>String</code></li>
<li><a href="#module_app-builder-lib.WinPackager+getIconPath"><code>.getIconPath()</code></a> ⇒ <code>Promise&lt; | String&gt;</code></li>
<li><a href="#module_app-builder-lib.WinPackager+sign"><code>.sign(file, logMessagePrefix)</code></a> ⇒ <code>Promise&lt;Boolean&gt;</code></li>
<li><a href="#module_app-builder-lib.WinPackager+signAndEditResources"><code>.signAndEditResources(file, arch, outDir, internalName, requestedExecutionLevel)</code></a> ⇒ <code>Promise&lt;void&gt;</code></li>
Expand All @@ -254,7 +255,6 @@ Developer API only. See [Configuration](../configuration/configuration.md) for u
<li><a href="#module_app-builder-lib.PlatformPackager+getCscPassword"><code>.getCscPassword()</code></a> ⇒ <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+getDefaultFrameworkIcon"><code>.getDefaultFrameworkIcon()</code></a> ⇒ <code>null</code> | <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+dispatchArtifactCreated"><code>.dispatchArtifactCreated(file, target, arch, safeArtifactName)</code></a> ⇒ <code>Promise&lt;void&gt;</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+doGetCscPassword"><code>.doGetCscPassword()</code></a> ⇒ <code>undefined</code> | <code>null</code> | <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+getElectronDestinationDir"><code>.getElectronDestinationDir(appOutDir)</code></a> ⇒ <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+getElectronSrcDir"><code>.getElectronSrcDir(dist)</code></a> ⇒ <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+expandArtifactBeautyNamePattern"><code>.expandArtifactBeautyNamePattern(targetSpecificOptions, ext, arch)</code></a> ⇒ <code>String</code></li>
Expand Down Expand Up @@ -2343,6 +2343,7 @@ return manager
<li><a href="#WinPackager">.WinPackager</a> ⇐ <code><a href="#PlatformPackager">PlatformPackager</a></code>
<ul>
<li><a href="#module_app-builder-lib.WinPackager+createTargets"><code>.createTargets(targets, mapper)</code></a></li>
<li><a href="#module_app-builder-lib.WinPackager+doGetCscPassword"><code>.doGetCscPassword()</code></a> ⇒ <code>undefined</code> | <code>null</code> | <code>String</code></li>
<li><a href="#module_app-builder-lib.WinPackager+getIconPath"><code>.getIconPath()</code></a> ⇒ <code>Promise&lt; | String&gt;</code></li>
<li><a href="#module_app-builder-lib.WinPackager+sign"><code>.sign(file, logMessagePrefix)</code></a> ⇒ <code>Promise&lt;Boolean&gt;</code></li>
<li><a href="#module_app-builder-lib.WinPackager+signAndEditResources"><code>.signAndEditResources(file, arch, outDir, internalName, requestedExecutionLevel)</code></a> ⇒ <code>Promise&lt;void&gt;</code></li>
Expand All @@ -2352,7 +2353,6 @@ return manager
<li><a href="#module_app-builder-lib.PlatformPackager+getCscPassword"><code>.getCscPassword()</code></a> ⇒ <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+getDefaultFrameworkIcon"><code>.getDefaultFrameworkIcon()</code></a> ⇒ <code>null</code> | <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+dispatchArtifactCreated"><code>.dispatchArtifactCreated(file, target, arch, safeArtifactName)</code></a> ⇒ <code>Promise&lt;void&gt;</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+doGetCscPassword"><code>.doGetCscPassword()</code></a> ⇒ <code>undefined</code> | <code>null</code> | <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+getElectronDestinationDir"><code>.getElectronDestinationDir(appOutDir)</code></a> ⇒ <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+getElectronSrcDir"><code>.getElectronSrcDir(dist)</code></a> ⇒ <code>String</code></li>
<li><a href="#module_app-builder-lib.PlatformPackager+expandArtifactBeautyNamePattern"><code>.expandArtifactBeautyNamePattern(targetSpecificOptions, ext, arch)</code></a> ⇒ <code>String</code></li>
Expand Down Expand Up @@ -2389,7 +2389,10 @@ return manager
</tr>
</tbody>
</table>
<p><a name="module_app-builder-lib.WinPackager+getIconPath"></a></p>
<p><a name="module_app-builder-lib.WinPackager+doGetCscPassword"></a></p>
<h3 id="winpackager.dogetcscpassword()-%E2%87%92-undefined-%7C-null-%7C-string"><code>winPackager.doGetCscPassword()</code> ⇒ <code>undefined</code> | <code>null</code> | <code>String</code></h3>
<p><strong>Overrides</strong>: <a href="#module_app-builder-lib.PlatformPackager+doGetCscPassword"><code>doGetCscPassword</code></a><br>
<a name="module_app-builder-lib.WinPackager+getIconPath"></a></p>
<h3 id="winpackager.geticonpath()-%E2%87%92-promise%3C-%7C-string%3E"><code>winPackager.getIconPath()</code> ⇒ <code>Promise&lt; | String&gt;</code></h3>
<p><strong>Overrides</strong>: <a href="#module_app-builder-lib.PlatformPackager+getIconPath"><code>getIconPath</code></a><br>
<a name="module_app-builder-lib.WinPackager+sign"></a></p>
Expand Down Expand Up @@ -2548,8 +2551,6 @@ return manager
</tr>
</tbody>
</table>
<p><a name="module_app-builder-lib.PlatformPackager+doGetCscPassword"></a></p>
<h3 id="winpackager.dogetcscpassword()-%E2%87%92-undefined-%7C-null-%7C-string"><code>winPackager.doGetCscPassword()</code> ⇒ <code>undefined</code> | <code>null</code> | <code>String</code></h3>
<p><a name="module_app-builder-lib.PlatformPackager+getElectronDestinationDir"></a></p>
<h3 id="winpackager.getelectrondestinationdir(appoutdir)-%E2%87%92-string"><code>winPackager.getElectronDestinationDir(appOutDir)</code> ⇒ <code>String</code></h3>
<table>
Expand Down
36 changes: 34 additions & 2 deletions docs/configuration/win.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,14 +28,46 @@ The top-level [win](configuration.md#Configuration-win) key contains set of opti
<hr>
<ul>
<li tag.description=""><code id="WindowsConfiguration-publisherName">publisherName</code> String | Array&lt;String&gt; | “undefined” - <a href="https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073">The publisher name</a>, exactly as in your code signed certificate. Several names can be provided. Defaults to common name from your code signing certificate. Deprecated:</li>
<li><code id="WindowsConfiguration-signtoolOptions">signtoolOptions</code> module:app-builder-lib/out/options/winOptions.WindowsSigntoolConfiguration | “undefined” - Options for usage with signtool.exe</li>
<li><code id="WindowsConfiguration-azureSignOptions">azureSignOptions</code> module:app-builder-lib/out/options/winOptions.WindowsAzureSigningConfiguration | “undefined” - Options for usage of Azure Trusted Signing (beta)</li>
<li><code id="WindowsConfiguration-signtoolOptions">signtoolOptions</code> <a href="#WindowsSigntoolConfiguration">WindowsSigntoolConfiguration</a> | “undefined” - Options for usage with signtool.exe</li>
<li><code id="WindowsConfiguration-azureSignOptions">azureSignOptions</code> <a href="#WindowsAzureSigningConfiguration">WindowsAzureSigningConfiguration</a> | “undefined” - Options for usage of Azure Trusted Signing (beta)</li>
<li><code id="WindowsConfiguration-verifyUpdateCodeSignature">verifyUpdateCodeSignature</code> = <code>true</code> Boolean - Whether to verify the signature of an available update before installation. The <a href="#publisherName">publisher name</a> will be used for the signature verification.</li>
<li><code id="WindowsConfiguration-requestedExecutionLevel">requestedExecutionLevel</code> = <code>asInvoker</code> “asInvoker” | “highestAvailable” | “requireAdministrator” | “undefined” - The <a href="https://msdn.microsoft.com/en-us/library/6ad1fshk.aspx#Anchor_9">security level</a> at which the application requests to be executed. Cannot be specified per target, allowed only in the <code>win</code>.</li>
<li><code id="WindowsConfiguration-signAndEditExecutable">signAndEditExecutable</code> = <code>true</code> Boolean - Whether to sign and add metadata to executable. Advanced option.</li>
<li tag.description=""><code id="WindowsConfiguration-signDlls">signDlls</code> = <code>false</code> Boolean - Whether to sign DLL files. Advanced option. See: <a href="https://github.com/electron-userland/electron-builder/issues/3101#issuecomment-404212384">https://github.com/electron-userland/electron-builder/issues/3101#issuecomment-404212384</a> Deprecated:</li>
<li><code id="WindowsConfiguration-signExts">signExts</code> Array&lt;String&gt; | “undefined” - Explicit file extensions to also sign. Advanced option. See: <a href="https://github.com/electron-userland/electron-builder/issues/7329">https://github.com/electron-userland/electron-builder/issues/7329</a></li>
</ul>
<h2 id="windowsazuresigningconfiguration">WindowsAzureSigningConfiguration</h2>
<p>undefined</p>
<ul>
<li>
<p><strong><code id="WindowsAzureSigningConfiguration-endpoint">endpoint</code></strong> String - The Trusted Signing Account endpoint. The URI value must have a URI that aligns to the region your Trusted Signing Account and Certificate Profile you are specifying were created in during the setup of these resources.</p>
<p>Translates to field: Endpoint</p>
<p>Requires one of environment variable configurations for authenticating to Microsoft Entra ID per <a href="https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition">Microsoft’s documentation</a></p>
</li>
<li>
<p><strong><code id="WindowsAzureSigningConfiguration-certificateProfileName">certificateProfileName</code></strong> String - The Certificate Profile name. Translates to field: CertificateProfileName</p>
</li>
</ul>
<h2 id="windowssigntoolconfiguration">WindowsSigntoolConfiguration</h2>
<p>undefined</p>
<ul>
<li><code id="WindowsSigntoolConfiguration-sign">sign</code> module:app-builder-lib/out/codeSign/windowsSignToolManager.__type | String | “undefined” - The custom function (or path to file or module id) to sign Windows executables</li>
</ul>
<hr>
<ul>
<li><code id="WindowsSigntoolConfiguration-signingHashAlgorithms">signingHashAlgorithms</code> = <code>['sha1', 'sha256']</code> Array&lt;“sha256” | “sha1”&gt; | “undefined” - Array of signing algorithms used. For AppX <code>sha256</code> is always used.</li>
<li><code id="WindowsSigntoolConfiguration-certificateFile">certificateFile</code> String | “undefined” - The path to the *.pfx certificate you want to sign with. Please use it only if you cannot use env variable <code>CSC_LINK</code> (<code>WIN_CSC_LINK</code>) for some reason. Please see <a href="/code-signing">Code Signing</a>.</li>
<li><code id="WindowsSigntoolConfiguration-certificatePassword">certificatePassword</code> String | “undefined” - The password to the certificate provided in <code>certificateFile</code>. Please use it only if you cannot use env variable <code>CSC_KEY_PASSWORD</code> (<code>WIN_CSC_KEY_PASSWORD</code>) for some reason. Please see <a href="/code-signing">Code Signing</a>.</li>
<li><code id="WindowsSigntoolConfiguration-certificateSubjectName">certificateSubjectName</code> String | “undefined” - The name of the subject of the signing certificate, which is often labeled with the field name <code>issued to</code>. Required only for EV Code Signing and works only on Windows (or on macOS if <a href="https://www.parallels.com/products/desktop/">Parallels Desktop</a> Windows 10 virtual machines exits).</li>
<li><code id="WindowsSigntoolConfiguration-certificateSha1">certificateSha1</code> String | “undefined” - The SHA1 hash of the signing certificate. The SHA1 hash is commonly specified when multiple certificates satisfy the criteria specified by the remaining switches. Works only on Windows (or on macOS if <a href="https://www.parallels.com/products/desktop/">Parallels Desktop</a> Windows 10 virtual machines exits).</li>
<li><code id="WindowsSigntoolConfiguration-additionalCertificateFile">additionalCertificateFile</code> String | “undefined” - The path to an additional certificate file you want to add to the signature block.</li>
<li><code id="WindowsSigntoolConfiguration-rfc3161TimeStampServer">rfc3161TimeStampServer</code> = <code>http://timestamp.digicert.com</code> String | “undefined” - The URL of the RFC 3161 time stamp server.</li>
<li><code id="WindowsSigntoolConfiguration-timeStampServer">timeStampServer</code> = <code>http://timestamp.digicert.com</code> String | “undefined” - The URL of the time stamp server.</li>
</ul>
<hr>
<ul>
<li><code id="WindowsSigntoolConfiguration-publisherName">publisherName</code> String | Array&lt;String&gt; | “undefined” - <a href="https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073">The publisher name</a>, exactly as in your code signed certificate. Several names can be provided. Defaults to common name from your code signing certificate.</li>
</ul>

<!-- end of generated block -->

Expand Down
2 changes: 1 addition & 1 deletion packages/app-builder-lib/scheme.json
Original file line number Diff line number Diff line change
Expand Up @@ -5969,7 +5969,7 @@
"type": "string"
},
"endpoint": {
"description": "The Trusted Signing Account endpoint. The URI value must have a URI that aligns to the\nregion your Trusted Signing Account and Certificate Profile you are specifying were created\nin during the setup of these resources.\n\nTranslates to field: Endpoint\n\nRequires the following environment variables to be set:\nAZURE_TENANT_ID\nAZURE_CLIENT_ID\nAZURE_CLIENT_SECRET\nAZURE_CLIENT_CERTIFICATE_PATH\nAZURE_CLIENT_SEND_CERTIFICATE_CHAIN\nAZURE_USERNAME\nAZURE_PASSWORD",
"description": "The Trusted Signing Account endpoint. The URI value must have a URI that aligns to the\nregion your Trusted Signing Account and Certificate Profile you are specifying were created\nin during the setup of these resources.\n\nTranslates to field: Endpoint\n\nRequires one of environment variable configurations for authenticating to Microsoft Entra ID per [Microsoft's documentation](https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition)",
"type": "string"
}
},
Expand Down
2 changes: 1 addition & 1 deletion packages/app-builder-lib/src/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ export { PlatformSpecificBuildOptions, AsarOptions, FileSet, Protocol, ReleaseIn
export { FileAssociation } from "./options/FileAssociation"
export { MacConfiguration, DmgOptions, MasConfiguration, MacOsTargetName, DmgContent, DmgWindow, NotarizeNotaryOptions } from "./options/macOptions"
export { PkgOptions, PkgBackgroundOptions, BackgroundAlignment, BackgroundScaling } from "./options/pkgOptions"
export { WindowsConfiguration } from "./options/winOptions"
export { WindowsConfiguration, WindowsAzureSigningConfiguration, WindowsSigntoolConfiguration } from "./options/winOptions"
export { AppXOptions } from "./options/AppXOptions"
export { MsiOptions } from "./options/MsiOptions"
export { MsiWrappedOptions } from "./options/MsiWrappedOptions"
Expand Down
5 changes: 4 additions & 1 deletion scripts/jsdoc2md2html.js
Original file line number Diff line number Diff line change
Expand Up @@ -216,7 +216,10 @@ async function render2(files, jsdoc2MdOptions) {
new Page("configuration/mas.md", "MasConfiguration"),
new Page("configuration/pkg.md", "PkgOptions"),

new Page("configuration/win.md", "WindowsConfiguration"),
new Page("configuration/win.md", "WindowsConfiguration", {
"WindowsAzureSigningConfiguration" : "",
"WindowsSigntoolConfiguration": ""
}),
new Page("configuration/msi-wrapped.md", "MsiWrappedOptions"),
new Page("configuration/msi.md", "MsiOptions"),
new Page("configuration/appx.md", "AppXOptions"),
Expand Down