@hakobu/hakobu 1.0.0

package/lib-es5/windows-sign.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * Windows Authenticode Signing
+ *
+ * Signs Windows PE executables (.exe) using Authenticode via signtool.exe
+ * (Windows SDK) or osslsigncode (cross-platform, for signing from
+ * macOS/Linux CI).
+ *
+ * Signing is opt-in: when no certificate is configured, Hakobu produces
+ * unsigned executables (which is the normal case for local development).
+ *
+ * Environment variables:
+ *   HAKOBU_WIN_CERT        - Path to .pfx/.p12 certificate file
+ *   HAKOBU_WIN_CERT_PASSWORD - Certificate password
+ *   HAKOBU_WIN_TIMESTAMP_URL - Timestamp server URL (default: http://timestamp.digicert.com)
+ *
+ * See docs/windows-signing.md for full setup instructions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signWindowsExecutable = exports.hasWindowsSigningCredentials = void 0;
+const child_process_1 = require("child_process");
+const log_1 = require("./log");
+// ─────────────────────────────────────────────────────────────────────
+// Configuration
+// ─────────────────────────────────────────────────────────────────────
+const DEFAULT_TIMESTAMP_URL = 'http://timestamp.digicert.com';
+// ─────────────────────────────────────────────────────────────────────
+// Signing
+// ─────────────────────────────────────────────────────────────────────
+/**
+ * Check whether Windows signing credentials are configured.
+ * Returns true if a certificate path is available (via option or env var).
+ */
+function hasWindowsSigningCredentials(certPath) {
+    return !!(certPath || process.env.HAKOBU_WIN_CERT);
+}
+exports.hasWindowsSigningCredentials = hasWindowsSigningCredentials;
+/**
+ * Sign a Windows PE executable with Authenticode.
+ *
+ * Tries signtool.exe first (available on Windows with Windows SDK),
+ * then falls back to osslsigncode (available cross-platform via
+ * brew/apt/choco).
+ *
+ * @throws If signing credentials are missing or both tools fail.
+ */
+function signWindowsExecutable(opts) {
+    const certPath = opts.certPath || process.env.HAKOBU_WIN_CERT;
+    const certPassword = opts.certPassword || process.env.HAKOBU_WIN_CERT_PASSWORD;
+    const timestampUrl = opts.timestampUrl || process.env.HAKOBU_WIN_TIMESTAMP_URL || DEFAULT_TIMESTAMP_URL;
+    if (!certPath) {
+        throw new Error('Cannot sign Windows executable: no certificate configured.\n' +
+            'Set HAKOBU_WIN_CERT to the path of your .pfx/.p12 file.\n' +
+            'See docs/windows-signing.md for setup instructions.');
+    }
+    // Try signtool.exe (Windows SDK)
+    if (trySigntool(opts.executable, certPath, certPassword, timestampUrl)) {
+        return;
+    }
+    // Fall back to osslsigncode (cross-platform)
+    if (tryOsslsigncode(opts.executable, certPath, certPassword, timestampUrl)) {
+        return;
+    }
+    throw new Error('Authenticode signing failed: neither signtool.exe nor osslsigncode found.\n' +
+        'On Windows: install Windows SDK (provides signtool.exe).\n' +
+        'On macOS/Linux: install osslsigncode (brew install osslsigncode / apt install osslsigncode).\n' +
+        'See docs/windows-signing.md for details.');
+}
+exports.signWindowsExecutable = signWindowsExecutable;
+/**
+ * Try signing with signtool.exe (Windows SDK).
+ * Returns true on success, false if signtool is not available.
+ */
+function trySigntool(executable, certPath, certPassword, timestampUrl) {
+    const args = [
+        'sign',
+        '/f', certPath,
+        '/fd', 'SHA256',
+        '/tr', timestampUrl,
+        '/td', 'SHA256',
+    ];
+    if (certPassword) {
+        args.push('/p', certPassword);
+    }
+    args.push(executable);
+    try {
+        (0, child_process_1.execFileSync)('signtool', args, { stdio: 'pipe' });
+        log_1.log.info(`Signed ${executable} with signtool (Authenticode SHA-256)`);
+        return true;
+    }
+    catch (err) {
+        // ENOENT means signtool not found — fall through to osslsigncode
+        if (err.code === 'ENOENT')
+            return false;
+        // signtool found but signing failed — throw
+        throw new Error(`signtool signing failed: ${err.message}\n` +
+            'Check that your certificate is valid and the password is correct.');
+    }
+}
+/**
+ * Try signing with osslsigncode (cross-platform Authenticode signing).
+ * Returns true on success, false if osslsigncode is not available.
+ */
+function tryOsslsigncode(executable, certPath, certPassword, timestampUrl) {
+    // osslsigncode signs in-place by writing to a temp file and replacing.
+    // Use -in and -out with the same file via a temp intermediate.
+    const tmpOut = executable + '.signed';
+    const args = [
+        'sign',
+        '-pkcs12', certPath,
+        '-h', 'sha256',
+        '-ts', timestampUrl,
+        '-in', executable,
+        '-out', tmpOut,
+    ];
+    if (certPassword) {
+        args.push('-pass', certPassword);
+    }
+    try {
+        (0, child_process_1.execFileSync)('osslsigncode', args, { stdio: 'pipe' });
+        // Replace original with signed version
+        const fs = require('fs');
+        fs.renameSync(tmpOut, executable);
+        log_1.log.info(`Signed ${executable} with osslsigncode (Authenticode SHA-256)`);
+        return true;
+    }
+    catch (err) {
+        // Clean up temp file on failure
+        try {
+            require('fs').unlinkSync(tmpOut);
+        }
+        catch { }
+        if (err.code === 'ENOENT')
+            return false;
+        throw new Error(`osslsigncode signing failed: ${err.message}\n` +
+            'Check that your certificate is valid and the password is correct.');
+    }
+}
+//# sourceMappingURL=windows-sign.js.map

package/package.json

@@ -0,0 +1,99 @@
+{
+  "name": "@hakobu/hakobu",
+  "version": "1.0.0",
+  "description": "Package your Node.js project into an executable",
+  "main": "lib-es5/index.js",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:hakobujs/hakobu.git",
+    "directory": "packages/hakobu"
+  },
+  "types": "lib-es5/index.d.ts",
+  "bin": {
+    "hakobu": "lib-es5/bin.js"
+  },
+  "files": [
+    "lib-es5/*.js",
+    "lib-es5/index.d.ts",
+    "dictionary/*.js",
+    "prelude/*.js"
+  ],
+  "prettier": {
+    "singleQuote": true
+  },
+  "dependencies": {
+    "@babel/generator": "^7.23.0",
+    "@babel/parser": "^7.23.0",
+    "@babel/traverse": "^7.23.0",
+    "@babel/types": "^7.23.0",
+    "esbuild": "^0.27.3",
+    "into-stream": "^9.1.0",
+    "minimist": "^1.2.6",
+    "multistream": "^4.1.0",
+    "picocolors": "^1.1.0",
+    "picomatch": "^4.0.2",
+    "prebuild-install": "^7.1.1",
+    "resedit": "^3.0.2",
+    "resolve": "^1.22.10",
+    "resolve.exports": "^2.0.3",
+    "stream-meter": "^1.0.4",
+    "tar": "^7.5.7",
+    "tinyglobby": "^0.2.11",
+    "unzipper": "^0.12.3",
+    "@hakobu/hakobu-fetch": "1.0.0"
+  },
+  "optionalDependencies": {
+    "rolldown": "^1.0.0-rc.1"
+  },
+  "devDependencies": {
+    "@release-it/conventional-changelog": "^10.0.5",
+    "@types/babel__generator": "^7.6.5",
+    "@types/babel__traverse": "^7.20.3",
+    "@types/minimist": "^1.2.2",
+    "@types/multistream": "^4.1.0",
+    "@types/node": "^20.0.0",
+    "@types/picomatch": "^3.0.1",
+    "@types/resolve": "^1.20.2",
+    "@types/stream-meter": "^0.0.22",
+    "@types/tar": "^6.1.13",
+    "@types/unzipper": "^0.10.10",
+    "@typescript-eslint/eslint-plugin": "^8.0.0",
+    "@typescript-eslint/parser": "^8.0.0",
+    "esbuild-register": "^3.6.0",
+    "eslint": "^9.0.0",
+    "eslint-config-airbnb-base": "^15.0.0",
+    "eslint-config-airbnb-typescript": "^18.0.0",
+    "eslint-config-prettier": "^10.0.0",
+    "eslint-plugin-import": "^2.31.0",
+    "globals": "^17.3.0",
+    "json-stable-stringify": "^1.0.1",
+    "lint-staged": "^15.0.0",
+    "prettier": "^3.0.3",
+    "release-it": "^19.2.4",
+    "rimraf": "^6.1.2",
+    "simple-git-hooks": "^2.11.1",
+    "typescript": "^4.7.2"
+  },
+  "lint-staged": {
+    "*.{js,css,md,json}": "prettier --write"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "scripts": {
+    "clean": "rimraf lib-es5",
+    "build": "npm run clean && tsc",
+    "start": "tsc --watch",
+    "lint": "npm run lint:style && npm run lint:code",
+    "lint:style": "prettier -c \"{lib,prelude,test}/**/*.{ts,js}\"",
+    "lint:code": "eslint lib prelude test",
+    "fix": "npm run lint:style -- -w && npm run lint:code -- --fix",
+    "test": "npm run build && npm run test:host && npm run test:24",
+    "test:24": "node test/test.js node24 no-npm",
+    "test:host": "node test/test.js host only-npm"
+  }
+}