app-builder-lib 25.0.6 → 25.1.2

package/out/codeSign/windowsCodeSign.d.ts

@@ -1,38 +1,9 @@
 import { WindowsConfiguration } from "../options/winOptions";
 import { VmManager } from "../vm/vm";
 import { WinPackager } from "../winPackager";
-export declare function getSignVendorPath(): Promise<string>;
-export type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>;
 export interface WindowsSignOptions {
     readonly path: string;
-    readonly name?: string | null;
-    readonly cscInfo?: FileCodeSigningInfo | CertificateFromStoreInfo | null;
-    readonly site?: string | null;
     readonly options: WindowsConfiguration;
 }
-export interface WindowsSignTaskConfiguration extends WindowsSignOptions {
-    resultOutputPath?: string;
-    hash: string;
-    isNest: boolean;
-}
-export interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {
-    computeSignToolArgs(isWin: boolean): Array<string>;
-}
-export declare function sign(options: WindowsSignOptions, packager: WinPackager): Promise<boolean>;
-export interface FileCodeSigningInfo {
-    readonly file: string;
-    readonly password: string | null;
-}
-export declare function getCertInfo(file: string, password: string): Promise<CertificateInfo>;
-export interface CertificateInfo {
-    readonly commonName: string;
-    readonly bloodyMicrosoftSubjectDn: string;
-}
-export interface CertificateFromStoreInfo {
-    thumbprint: string;
-    subject: string;
-    store: string;
-    isLocalMachineStore: boolean;
-}
-export declare function getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo>;
-export declare function doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager): Promise<void>;
+export declare function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean>;
+export declare function getPSCmd(vm: VmManager): Promise<string>;

package/out/codeSign/windowsCodeSign.js

@@ -1,252 +1,34 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSignVendorPath = getSignVendorPath;
-exports.sign = sign;
-exports.getCertInfo = getCertInfo;
-exports.getCertificateFromStoreInfo = getCertificateFromStoreInfo;
-exports.doSign = doSign;
-exports.isOldWin6 = isOldWin6;
+exports.signWindows = signWindows;
+exports.getPSCmd = getPSCmd;
 const builder_util_1 = require("builder-util");
-const binDownload_1 = require("../binDownload");
-const appBuilder_1 = require("../util/appBuilder");
-const bundledTool_1 = require("../util/bundledTool");
-const fs_extra_1 = require("fs-extra");
-const os = require("os");
-const path = require("path");
-const resolve_1 = require("../util/resolve");
-const flags_1 = require("../util/flags");
-const vm_1 = require("../vm/vm");
-function getSignVendorPath() {
-    return (0, binDownload_1.getBin)("winCodeSign");
-}
-async function sign(options, packager) {
-    let hashes = options.options.signingHashAlgorithms;
-    // msi does not support dual-signing
-    if (options.path.endsWith(".msi")) {
-        hashes = [hashes != null && !hashes.includes("sha1") ? "sha256" : "sha1"];
-    }
-    else if (options.path.endsWith(".appx")) {
-        hashes = ["sha256"];
-    }
-    else if (hashes == null) {
-        hashes = ["sha1", "sha256"];
-    }
-    else {
-        hashes = Array.isArray(hashes) ? hashes : [hashes];
-    }
-    const executor = (await (0, resolve_1.resolveFunction)(packager.appInfo.type, options.options.sign, "sign")) || doSign;
-    let isNest = false;
-    for (const hash of hashes) {
-        const taskConfiguration = { ...options, hash, isNest };
-        await Promise.resolve(executor({
-            ...taskConfiguration,
-            computeSignToolArgs: isWin => computeSignToolArgs(taskConfiguration, isWin),
-        }, packager));
-        isNest = true;
-        if (taskConfiguration.resultOutputPath != null) {
-            await (0, fs_extra_1.rename)(taskConfiguration.resultOutputPath, options.path);
-        }
-    }
-    return true;
-}
-async function getCertInfo(file, password) {
-    let result = null;
-    const errorMessagePrefix = "Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: ";
-    try {
-        result = await (0, appBuilder_1.executeAppBuilderAsJson)(["certificate-info", "--input", file, "--password", password]);
-    }
-    catch (e) {
-        throw new Error(`${errorMessagePrefix}${e.stack || e}`);
-    }
-    if (result.error != null) {
-        // noinspection ExceptionCaughtLocallyJS
-        throw new builder_util_1.InvalidConfigurationError(`${errorMessagePrefix}${result.error}`);
-    }
-    return result;
-}
-async function getCertificateFromStoreInfo(options, vm) {
-    const certificateSubjectName = options.certificateSubjectName;
-    const certificateSha1 = options.certificateSha1 ? options.certificateSha1.toUpperCase() : options.certificateSha1;
-    const ps = await getPSCmd(vm);
-    const rawResult = await vm.exec(ps, [
-        "-NoProfile",
-        "-NonInteractive",
-        "-Command",
-        "Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress",
-    ]);
-    const certList = rawResult.length === 0 ? [] : (0, builder_util_1.asArray)(JSON.parse(rawResult));
-    for (const certInfo of certList) {
-        if ((certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||
-            (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)) {
-            continue;
-        }
-        const parentPath = certInfo.PSParentPath;
-        const store = parentPath.substring(parentPath.lastIndexOf("\\") + 1);
-        builder_util_1.log.debug({ store, PSParentPath: parentPath }, "auto-detect certificate store");
-        // https://github.com/electron-userland/electron-builder/issues/1717
-        const isLocalMachineStore = parentPath.includes("Certificate::LocalMachine");
-        builder_util_1.log.debug(null, "auto-detect using of LocalMachine store");
-        return {
-            thumbprint: certInfo.Thumbprint,
-            subject: certInfo.Subject,
-            store,
-            isLocalMachineStore,
-        };
-    }
-    throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`);
-}
-async function doSign(configuration, packager) {
-    // https://github.com/electron-userland/electron-builder/pull/1944
-    const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT, 10) || 10 * 60 * 1000;
-    // decide runtime argument by cases
-    let args;
-    let env = process.env;
-    let vm;
-    const vmRequired = configuration.path.endsWith(".appx") || !("file" in configuration.cscInfo); /* certificateSubjectName and other such options */
-    const isWin = process.platform === "win32" || vmRequired;
-    const toolInfo = await getToolPath(isWin);
-    const tool = toolInfo.path;
-    if (vmRequired) {
-        vm = await packager.vm.value;
-        args = computeSignToolArgs(configuration, isWin, vm);
-    }
-    else {
-        vm = new vm_1.VmManager();
-        args = configuration.computeSignToolArgs(isWin);
-        if (toolInfo.env != null) {
-            env = toolInfo.env;
-        }
-    }
-    try {
-        await vm.exec(tool, args, { timeout, env });
-    }
-    catch (e) {
-        if (e.message.includes("The file is being used by another process") || e.message.includes("The specified timestamp server either could not be reached")) {
-            builder_util_1.log.warn(`First attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`);
-            await new Promise((resolve, reject) => {
-                setTimeout(() => {
-                    vm.exec(tool, args, { timeout, env }).then(resolve).catch(reject);
-                }, 15000);
-            });
-        }
-        throw e;
-    }
-}
-// on windows be aware of http://stackoverflow.com/a/32640183/1910191
-function computeSignToolArgs(options, isWin, vm = new vm_1.VmManager()) {
-    const inputFile = vm.toVmFile(options.path);
-    const outputPath = isWin ? inputFile : getOutputPath(inputFile, options.hash);
-    if (!isWin) {
-        options.resultOutputPath = outputPath;
-    }
-    const args = isWin ? ["sign"] : ["-in", inputFile, "-out", outputPath];
-    if (process.env.ELECTRON_BUILDER_OFFLINE !== "true") {
-        const timestampingServiceUrl = options.options.timeStampServer || "http://timestamp.digicert.com";
-        if (isWin) {
-            args.push(options.isNest || options.hash === "sha256" ? "/tr" : "/t", options.isNest || options.hash === "sha256" ? options.options.rfc3161TimeStampServer || "http://timestamp.digicert.com" : timestampingServiceUrl);
-        }
-        else {
-            args.push("-t", timestampingServiceUrl);
-        }
-    }
-    const certificateFile = options.cscInfo.file;
-    if (certificateFile == null) {
-        const cscInfo = options.cscInfo;
-        const subjectName = cscInfo.thumbprint;
-        if (!isWin) {
-            throw new Error(`${subjectName == null ? "certificateSha1" : "certificateSubjectName"} supported only on Windows`);
-        }
-        args.push("/sha1", cscInfo.thumbprint);
-        args.push("/s", cscInfo.store);
-        if (cscInfo.isLocalMachineStore) {
-            args.push("/sm");
-        }
-    }
-    else {
-        const certExtension = path.extname(certificateFile);
-        if (certExtension === ".p12" || certExtension === ".pfx") {
-            args.push(isWin ? "/f" : "-pkcs12", vm.toVmFile(certificateFile));
-        }
-        else {
-            throw new Error(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`);
-        }
-    }
-    if (!isWin || options.hash !== "sha1") {
-        args.push(isWin ? "/fd" : "-h", options.hash);
-        if (isWin && process.env.ELECTRON_BUILDER_OFFLINE !== "true") {
-            args.push("/td", "sha256");
-        }
-    }
-    if (options.name) {
-        args.push(isWin ? "/d" : "-n", options.name);
-    }
-    if (options.site) {
-        args.push(isWin ? "/du" : "-i", options.site);
-    }
-    // msi does not support dual-signing
-    if (options.isNest) {
-        args.push(isWin ? "/as" : "-nest");
-    }
-    const password = options.cscInfo == null ? null : options.cscInfo.password;
-    if (password) {
-        args.push(isWin ? "/p" : "-pass", password);
-    }
-    if (options.options.additionalCertificateFile) {
-        args.push(isWin ? "/ac" : "-ac", vm.toVmFile(options.options.additionalCertificateFile));
-    }
-    const httpsProxyFromEnv = process.env.HTTPS_PROXY;
-    if (!isWin && httpsProxyFromEnv != null && httpsProxyFromEnv.length) {
-        args.push("-p", httpsProxyFromEnv);
-    }
-    if (isWin) {
-        // https://github.com/electron-userland/electron-builder/issues/2875#issuecomment-387233610
-        args.push("/debug");
-        // must be last argument
-        args.push(inputFile);
-    }
-    return args;
-}
-function getOutputPath(inputPath, hash) {
-    const extension = path.extname(inputPath);
-    return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`);
-}
-/** @internal */
-function isOldWin6() {
-    const winVersion = os.release();
-    return winVersion.startsWith("6.") && !winVersion.startsWith("6.3");
-}
-function getWinSignTool(vendorPath) {
-    // use modern signtool on Windows Server 2012 R2 to be able to sign AppX
-    if (isOldWin6()) {
-        return path.join(vendorPath, "windows-6", "signtool.exe");
-    }
-    else {
-        return path.join(vendorPath, "windows-10", process.arch, "signtool.exe");
-    }
-}
-async function getToolPath(isWin = process.platform === "win32") {
-    if ((0, flags_1.isUseSystemSigncode)()) {
-        return { path: "osslsigncode" };
-    }
-    const result = process.env.SIGNTOOL_PATH;
-    if (result) {
-        return { path: result };
-    }
-    const vendorPath = await getSignVendorPath();
-    if (isWin) {
-        // use modern signtool on Windows Server 2012 R2 to be able to sign AppX
-        return { path: getWinSignTool(vendorPath) };
-    }
-    else if (process.platform === "darwin") {
-        const toolDirPath = path.join(vendorPath, process.platform, "10.12");
-        return {
-            path: path.join(toolDirPath, "osslsigncode"),
-            env: (0, bundledTool_1.computeToolEnv)([path.join(toolDirPath, "lib")]),
-        };
-    }
-    else {
-        return { path: path.join(vendorPath, process.platform, "osslsigncode") };
-    }
+async function signWindows(options, packager) {
+    if (options.options.azureSignOptions) {
+        builder_util_1.log.info({ path: builder_util_1.log.filePath(options.path) }, "signing with Azure Trusted Signing (beta)");
+        return (await packager.azureSignManager.value).signUsingAzureTrustedSigning(options);
+    }
+    builder_util_1.log.info({ path: builder_util_1.log.filePath(options.path) }, "signing with signtool.exe");
+    const deprecatedFields = {
+        sign: options.options.sign,
+        signDlls: options.options.signDlls,
+        signingHashAlgorithms: options.options.signingHashAlgorithms,
+        certificateFile: options.options.certificateFile,
+        certificatePassword: options.options.certificatePassword,
+        certificateSha1: options.options.certificateSha1,
+        certificateSubjectName: options.options.certificateSubjectName,
+        additionalCertificateFile: options.options.additionalCertificateFile,
+        rfc3161TimeStampServer: options.options.rfc3161TimeStampServer,
+        timeStampServer: options.options.timeStampServer,
+        publisherName: options.options.publisherName,
+    };
+    const fields = Object.entries(deprecatedFields)
+        .filter(([, value]) => !!value)
+        .map(([field]) => field);
+    if (fields.length) {
+        builder_util_1.log.warn({ fields, reason: "please move to win.signtoolOptions.<field_name>" }, `deprecated field`);
+    }
+    return (await packager.signtoolManager.value).signUsingSigntool(options);
 }
 async function getPSCmd(vm) {
     return await vm

package/out/codeSign/windowsCodeSign.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/windowsCodeSign.ts"],"names":[],"mappings":";;AAaA,8CAEC;AA0BD,oBAiCC;AAOD,kCAcC;AAcD,kEAmCC;AAED,wBAmCC;AAsGD,8BAGC;AA9RD,+CAAsE;AACtE,gDAAuC;AAEvC,mDAA4D;AAC5D,qDAA8D;AAC9D,uCAAiC;AACjC,yBAAwB;AACxB,6BAA4B;AAC5B,6CAAiD;AACjD,yCAAmD;AACnD,iCAAoC;AAGpC,SAAgB,iBAAiB;IAC/B,OAAO,IAAA,oBAAM,EAAC,aAAa,CAAC,CAAA;AAC9B,CAAC;AA0BM,KAAK,UAAU,IAAI,CAAC,OAA2B,EAAE,QAAqB;IAC3E,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAA;IAClD,oCAAoC;IACpC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrB,CAAC;SAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAA,yBAAe,EAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,MAAM,CAAA;IACvG,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,iBAAiB,GAAiC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACpF,MAAM,OAAO,CAAC,OAAO,CACnB,QAAQ,CACN;YACE,GAAG,iBAAiB;YACpB,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC;SAC5E,EACD,QAAQ,CACT,CACF,CAAA;QACD,MAAM,GAAG,IAAI,CAAA;QACb,IAAI,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;YAC/C,MAAM,IAAA,iBAAM,EAAC,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAOM,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB;IAC9D,IAAI,MAAM,GAAQ,IAAI,CAAA;IACtB,MAAM,kBAAkB,GAAG,4GAA4G,CAAA;IACvI,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAA,oCAAuB,EAAM,CAAC,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC5G,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,wCAAwC;QACxC,MAAM,IAAI,wCAAyB,CAAC,GAAG,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAcM,KAAK,UAAU,2BAA2B,CAAC,OAA6B,EAAE,EAAa;IAC5F,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAA;IAC7D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAA;IAEjH,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC7B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;QAClC,YAAY;QACZ,iBAAiB;QACjB,UAAU;QACV,oIAAoI;KACrI,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,sBAAO,EAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;IACvF,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,IACE,CAAC,sBAAsB,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACtF,CAAC,eAAe,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAClF,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACpE,kBAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAA;QAC/E,oEAAoE;QACpE,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;QAC5E,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAA;QAC1D,OAAO;YACL,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,KAAK;YACL,mBAAmB;SACpB,CAAA;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,sBAAsB,IAAI,eAAe,gBAAgB,SAAS,EAAE,CAAC,CAAA;AAClH,CAAC;AAEM,KAAK,UAAU,MAAM,CAAC,aAAiD,EAAE,QAAqB;IACnG,kEAAkE;IAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAuB,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IACnF,mCAAmC;IACnC,IAAI,IAAmB,CAAA;IACvB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACrB,IAAI,EAAa,CAAA;IACjB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,OAAQ,CAAC,CAAA,CAAC,mDAAmD;IAClJ,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAA;IACxD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC1B,IAAI,UAAU,EAAE,CAAC;QACf,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QAC5B,IAAI,GAAG,mBAAmB,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IACtD,CAAC;SAAM,CAAC;QACN,EAAE,GAAG,IAAI,cAAS,EAAE,CAAA;QACpB,IAAI,GAAG,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC/C,IAAI,QAAQ,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACzB,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAA;QACpB,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4DAA4D,CAAC,EAAE,CAAC;YACxJ,kBAAG,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;YACvG,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACpC,UAAU,CAAC,GAAG,EAAE;oBACd,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACnE,CAAC,EAAE,KAAK,CAAC,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC;AAQD,qEAAqE;AACrE,SAAS,mBAAmB,CAAC,OAAqC,EAAE,KAAc,EAAE,KAAgB,IAAI,cAAS,EAAE;IACjH,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAA;IACvC,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IAEtE,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;QACpD,MAAM,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,IAAI,+BAA+B,CAAA;QACjG,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CACP,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAC1D,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,IAAI,+BAA+B,CAAC,CAAC,CAAC,sBAAsB,CACjJ,CAAA;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAI,OAAO,CAAC,OAA+B,CAAC,IAAI,CAAA;IACrE,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAmC,CAAA;QAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAA;QACtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,wBAAwB,4BAA4B,CAAC,CAAA;QACpH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QACnD,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,eAAe,iBAAiB,CAAC,CAAA;QAC9F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC;IAED,oCAAoC;IACpC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,OAAO,CAAC,OAA+B,CAAC,QAAQ,CAAA;IACnG,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC7C,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACjD,IAAI,CAAC,KAAK,IAAI,iBAAiB,IAAI,IAAI,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;IACpC,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,2FAA2F;QAC3F,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnB,wBAAwB;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACtB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,IAAY;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG,SAAS,EAAE,CAAC,CAAA;AAChH,CAAC;AAED,gBAAgB;AAChB,SAAgB,SAAS;IACvB,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;IAC/B,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,wEAAwE;IACxE,IAAI,SAAS,EAAE,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC,CAAA;IAC3D,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;IAC7D,IAAI,IAAA,2BAAmB,GAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,wEAAwE;QACxE,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,CAAA;IAC7C,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACpE,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC;YAC5C,GAAG,EAAE,IAAA,4BAAc,EAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;SACrD,CAAA;IACH,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAA;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,EAAa;IACnC,OAAO,MAAM,EAAE;SACZ,IAAI,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;SAC7F,IAAI,CAAC,GAAG,EAAE;QACT,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,gDAAgD,CAAC,CAAA;QACjE,OAAO,UAAU,CAAA;IACnB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yDAAyD,CAAC,CAAA;QAC1E,OAAO,gBAAgB,CAAA;IACzB,CAAC,CAAC,CAAA;AACN,CAAC","sourcesContent":["import { InvalidConfigurationError, asArray, log } from \"builder-util\"\nimport { getBin } from \"../binDownload\"\nimport { WindowsConfiguration } from \"../options/winOptions\"\nimport { executeAppBuilderAsJson } from \"../util/appBuilder\"\nimport { computeToolEnv, ToolInfo } from \"../util/bundledTool\"\nimport { rename } from \"fs-extra\"\nimport * as os from \"os\"\nimport * as path from \"path\"\nimport { resolveFunction } from \"../util/resolve\"\nimport { isUseSystemSigncode } from \"../util/flags\"\nimport { VmManager } from \"../vm/vm\"\nimport { WinPackager } from \"../winPackager\"\n\nexport function getSignVendorPath() {\n  return getBin(\"winCodeSign\")\n}\n\nexport type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>\n\nexport interface WindowsSignOptions {\n  readonly path: string\n\n  readonly name?: string | null\n  readonly cscInfo?: FileCodeSigningInfo | CertificateFromStoreInfo | null\n  readonly site?: string | null\n\n  readonly options: WindowsConfiguration\n}\n\nexport interface WindowsSignTaskConfiguration extends WindowsSignOptions {\n  // set if output path differs from input (e.g. osslsigncode cannot sign file in-place)\n  resultOutputPath?: string\n\n  hash: string\n  isNest: boolean\n}\n\nexport interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {\n  computeSignToolArgs(isWin: boolean): Array<string>\n}\n\nexport async function sign(options: WindowsSignOptions, packager: WinPackager): Promise<boolean> {\n  let hashes = options.options.signingHashAlgorithms\n  // msi does not support dual-signing\n  if (options.path.endsWith(\".msi\")) {\n    hashes = [hashes != null && !hashes.includes(\"sha1\") ? \"sha256\" : \"sha1\"]\n  } else if (options.path.endsWith(\".appx\")) {\n    hashes = [\"sha256\"]\n  } else if (hashes == null) {\n    hashes = [\"sha1\", \"sha256\"]\n  } else {\n    hashes = Array.isArray(hashes) ? hashes : [hashes]\n  }\n\n  const executor = (await resolveFunction(packager.appInfo.type, options.options.sign, \"sign\")) || doSign\n  let isNest = false\n  for (const hash of hashes) {\n    const taskConfiguration: WindowsSignTaskConfiguration = { ...options, hash, isNest }\n    await Promise.resolve(\n      executor(\n        {\n          ...taskConfiguration,\n          computeSignToolArgs: isWin => computeSignToolArgs(taskConfiguration, isWin),\n        },\n        packager\n      )\n    )\n    isNest = true\n    if (taskConfiguration.resultOutputPath != null) {\n      await rename(taskConfiguration.resultOutputPath, options.path)\n    }\n  }\n\n  return true\n}\n\nexport interface FileCodeSigningInfo {\n  readonly file: string\n  readonly password: string | null\n}\n\nexport async function getCertInfo(file: string, password: string): Promise<CertificateInfo> {\n  let result: any = null\n  const errorMessagePrefix = \"Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: \"\n  try {\n    result = await executeAppBuilderAsJson<any>([\"certificate-info\", \"--input\", file, \"--password\", password])\n  } catch (e: any) {\n    throw new Error(`${errorMessagePrefix}${e.stack || e}`)\n  }\n\n  if (result.error != null) {\n    // noinspection ExceptionCaughtLocallyJS\n    throw new InvalidConfigurationError(`${errorMessagePrefix}${result.error}`)\n  }\n  return result\n}\n\nexport interface CertificateInfo {\n  readonly commonName: string\n  readonly bloodyMicrosoftSubjectDn: string\n}\n\nexport interface CertificateFromStoreInfo {\n  thumbprint: string\n  subject: string\n  store: string\n  isLocalMachineStore: boolean\n}\n\nexport async function getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo> {\n  const certificateSubjectName = options.certificateSubjectName\n  const certificateSha1 = options.certificateSha1 ? options.certificateSha1.toUpperCase() : options.certificateSha1\n\n  const ps = await getPSCmd(vm)\n  const rawResult = await vm.exec(ps, [\n    \"-NoProfile\",\n    \"-NonInteractive\",\n    \"-Command\",\n    \"Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress\",\n  ])\n  const certList = rawResult.length === 0 ? [] : asArray<CertInfo>(JSON.parse(rawResult))\n  for (const certInfo of certList) {\n    if (\n      (certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||\n      (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)\n    ) {\n      continue\n    }\n\n    const parentPath = certInfo.PSParentPath\n    const store = parentPath.substring(parentPath.lastIndexOf(\"\\\\\") + 1)\n    log.debug({ store, PSParentPath: parentPath }, \"auto-detect certificate store\")\n    // https://github.com/electron-userland/electron-builder/issues/1717\n    const isLocalMachineStore = parentPath.includes(\"Certificate::LocalMachine\")\n    log.debug(null, \"auto-detect using of LocalMachine store\")\n    return {\n      thumbprint: certInfo.Thumbprint,\n      subject: certInfo.Subject,\n      store,\n      isLocalMachineStore,\n    }\n  }\n\n  throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`)\n}\n\nexport async function doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager) {\n  // https://github.com/electron-userland/electron-builder/pull/1944\n  const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT as any, 10) || 10 * 60 * 1000\n  // decide runtime argument by cases\n  let args: Array<string>\n  let env = process.env\n  let vm: VmManager\n  const vmRequired = configuration.path.endsWith(\".appx\") || !(\"file\" in configuration.cscInfo!) /* certificateSubjectName and other such options */\n  const isWin = process.platform === \"win32\" || vmRequired\n  const toolInfo = await getToolPath(isWin)\n  const tool = toolInfo.path\n  if (vmRequired) {\n    vm = await packager.vm.value\n    args = computeSignToolArgs(configuration, isWin, vm)\n  } else {\n    vm = new VmManager()\n    args = configuration.computeSignToolArgs(isWin)\n    if (toolInfo.env != null) {\n      env = toolInfo.env\n    }\n  }\n\n  try {\n    await vm.exec(tool, args, { timeout, env })\n  } catch (e: any) {\n    if (e.message.includes(\"The file is being used by another process\") || e.message.includes(\"The specified timestamp server either could not be reached\")) {\n      log.warn(`First attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`)\n      await new Promise((resolve, reject) => {\n        setTimeout(() => {\n          vm.exec(tool, args, { timeout, env }).then(resolve).catch(reject)\n        }, 15000)\n      })\n    }\n    throw e\n  }\n}\n\ninterface CertInfo {\n  Subject: string\n  Thumbprint: string\n  PSParentPath: string\n}\n\n// on windows be aware of http://stackoverflow.com/a/32640183/1910191\nfunction computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm: VmManager = new VmManager()): Array<string> {\n  const inputFile = vm.toVmFile(options.path)\n  const outputPath = isWin ? inputFile : getOutputPath(inputFile, options.hash)\n  if (!isWin) {\n    options.resultOutputPath = outputPath\n  }\n\n  const args = isWin ? [\"sign\"] : [\"-in\", inputFile, \"-out\", outputPath]\n\n  if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n    const timestampingServiceUrl = options.options.timeStampServer || \"http://timestamp.digicert.com\"\n    if (isWin) {\n      args.push(\n        options.isNest || options.hash === \"sha256\" ? \"/tr\" : \"/t\",\n        options.isNest || options.hash === \"sha256\" ? options.options.rfc3161TimeStampServer || \"http://timestamp.digicert.com\" : timestampingServiceUrl\n      )\n    } else {\n      args.push(\"-t\", timestampingServiceUrl)\n    }\n  }\n\n  const certificateFile = (options.cscInfo as FileCodeSigningInfo).file\n  if (certificateFile == null) {\n    const cscInfo = options.cscInfo as CertificateFromStoreInfo\n    const subjectName = cscInfo.thumbprint\n    if (!isWin) {\n      throw new Error(`${subjectName == null ? \"certificateSha1\" : \"certificateSubjectName\"} supported only on Windows`)\n    }\n\n    args.push(\"/sha1\", cscInfo.thumbprint)\n    args.push(\"/s\", cscInfo.store)\n    if (cscInfo.isLocalMachineStore) {\n      args.push(\"/sm\")\n    }\n  } else {\n    const certExtension = path.extname(certificateFile)\n    if (certExtension === \".p12\" || certExtension === \".pfx\") {\n      args.push(isWin ? \"/f\" : \"-pkcs12\", vm.toVmFile(certificateFile))\n    } else {\n      throw new Error(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`)\n    }\n  }\n\n  if (!isWin || options.hash !== \"sha1\") {\n    args.push(isWin ? \"/fd\" : \"-h\", options.hash)\n    if (isWin && process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      args.push(\"/td\", \"sha256\")\n    }\n  }\n\n  if (options.name) {\n    args.push(isWin ? \"/d\" : \"-n\", options.name)\n  }\n\n  if (options.site) {\n    args.push(isWin ? \"/du\" : \"-i\", options.site)\n  }\n\n  // msi does not support dual-signing\n  if (options.isNest) {\n    args.push(isWin ? \"/as\" : \"-nest\")\n  }\n\n  const password = options.cscInfo == null ? null : (options.cscInfo as FileCodeSigningInfo).password\n  if (password) {\n    args.push(isWin ? \"/p\" : \"-pass\", password)\n  }\n\n  if (options.options.additionalCertificateFile) {\n    args.push(isWin ? \"/ac\" : \"-ac\", vm.toVmFile(options.options.additionalCertificateFile))\n  }\n\n  const httpsProxyFromEnv = process.env.HTTPS_PROXY\n  if (!isWin && httpsProxyFromEnv != null && httpsProxyFromEnv.length) {\n    args.push(\"-p\", httpsProxyFromEnv)\n  }\n\n  if (isWin) {\n    // https://github.com/electron-userland/electron-builder/issues/2875#issuecomment-387233610\n    args.push(\"/debug\")\n    // must be last argument\n    args.push(inputFile)\n  }\n\n  return args\n}\n\nfunction getOutputPath(inputPath: string, hash: string) {\n  const extension = path.extname(inputPath)\n  return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`)\n}\n\n/** @internal */\nexport function isOldWin6() {\n  const winVersion = os.release()\n  return winVersion.startsWith(\"6.\") && !winVersion.startsWith(\"6.3\")\n}\n\nfunction getWinSignTool(vendorPath: string): string {\n  // use modern signtool on Windows Server 2012 R2 to be able to sign AppX\n  if (isOldWin6()) {\n    return path.join(vendorPath, \"windows-6\", \"signtool.exe\")\n  } else {\n    return path.join(vendorPath, \"windows-10\", process.arch, \"signtool.exe\")\n  }\n}\n\nasync function getToolPath(isWin = process.platform === \"win32\"): Promise<ToolInfo> {\n  if (isUseSystemSigncode()) {\n    return { path: \"osslsigncode\" }\n  }\n\n  const result = process.env.SIGNTOOL_PATH\n  if (result) {\n    return { path: result }\n  }\n\n  const vendorPath = await getSignVendorPath()\n  if (isWin) {\n    // use modern signtool on Windows Server 2012 R2 to be able to sign AppX\n    return { path: getWinSignTool(vendorPath) }\n  } else if (process.platform === \"darwin\") {\n    const toolDirPath = path.join(vendorPath, process.platform, \"10.12\")\n    return {\n      path: path.join(toolDirPath, \"osslsigncode\"),\n      env: computeToolEnv([path.join(toolDirPath, \"lib\")]),\n    }\n  } else {\n    return { path: path.join(vendorPath, process.platform, \"osslsigncode\") }\n  }\n}\n\nasync function getPSCmd(vm: VmManager): Promise<string> {\n  return await vm\n    .exec(\"powershell.exe\", [\"-NoProfile\", \"-NonInteractive\", \"-Command\", `Get-Command pwsh.exe`])\n    .then(() => {\n      log.debug(null, \"identified pwsh.exe for executing code signing\")\n      return \"pwsh.exe\"\n    })\n    .catch(() => {\n      log.debug(null, \"unable to find pwsh.exe, falling back to powershell.exe\")\n      return \"powershell.exe\"\n    })\n}\n"]}
+{"version":3,"file":"windowsCodeSign.js","sourceRoot":"","sources":["../../src/codeSign/windowsCodeSign.ts"],"names":[],"mappings":";;AAUA,kCA2BC;AAED,4BAWC;AAlDD,+CAAkC;AAU3B,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,QAAqB;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACrC,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2CAA2C,CAAC,CAAA;QAC3F,OAAO,CAAC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAA;IACtF,CAAC;IAED,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC3E,MAAM,gBAAgB,GAAG;QACvB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;QAClC,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,qBAAqB;QAC5D,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;QAChD,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,mBAAmB;QACxD,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;QAChD,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB;QAC9D,yBAAyB,EAAE,OAAO,CAAC,OAAO,CAAC,yBAAyB;QACpE,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,sBAAsB;QAC9D,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;QAChD,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;KAC7C,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,kBAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,iDAAiD,EAAE,EAAE,kBAAkB,CAAC,CAAA;IACrG,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;AAC1E,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,EAAa;IAC1C,OAAO,MAAM,EAAE;SACZ,IAAI,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;SAC7F,IAAI,CAAC,GAAG,EAAE;QACT,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,gDAAgD,CAAC,CAAA;QACjE,OAAO,UAAU,CAAA;IACnB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yDAAyD,CAAC,CAAA;QAC1E,OAAO,gBAAgB,CAAA;IACzB,CAAC,CAAC,CAAA;AACN,CAAC","sourcesContent":["import { log } from \"builder-util\"\nimport { WindowsConfiguration } from \"../options/winOptions\"\nimport { VmManager } from \"../vm/vm\"\nimport { WinPackager } from \"../winPackager\"\n\nexport interface WindowsSignOptions {\n  readonly path: string\n  readonly options: WindowsConfiguration\n}\n\nexport async function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean> {\n  if (options.options.azureSignOptions) {\n    log.info({ path: log.filePath(options.path) }, \"signing with Azure Trusted Signing (beta)\")\n    return (await packager.azureSignManager.value).signUsingAzureTrustedSigning(options)\n  }\n\n  log.info({ path: log.filePath(options.path) }, \"signing with signtool.exe\")\n  const deprecatedFields = {\n    sign: options.options.sign,\n    signDlls: options.options.signDlls,\n    signingHashAlgorithms: options.options.signingHashAlgorithms,\n    certificateFile: options.options.certificateFile,\n    certificatePassword: options.options.certificatePassword,\n    certificateSha1: options.options.certificateSha1,\n    certificateSubjectName: options.options.certificateSubjectName,\n    additionalCertificateFile: options.options.additionalCertificateFile,\n    rfc3161TimeStampServer: options.options.rfc3161TimeStampServer,\n    timeStampServer: options.options.timeStampServer,\n    publisherName: options.options.publisherName,\n  }\n  const fields = Object.entries(deprecatedFields)\n    .filter(([, value]) => !!value)\n    .map(([field]) => field)\n  if (fields.length) {\n    log.warn({ fields, reason: \"please move to win.signtoolOptions.<field_name>\" }, `deprecated field`)\n  }\n  return (await packager.signtoolManager.value).signUsingSigntool(options)\n}\n\nexport async function getPSCmd(vm: VmManager): Promise<string> {\n  return await vm\n    .exec(\"powershell.exe\", [\"-NoProfile\", \"-NonInteractive\", \"-Command\", `Get-Command pwsh.exe`])\n    .then(() => {\n      log.debug(null, \"identified pwsh.exe for executing code signing\")\n      return \"pwsh.exe\"\n    })\n    .catch(() => {\n      log.debug(null, \"unable to find pwsh.exe, falling back to powershell.exe\")\n      return \"powershell.exe\"\n    })\n}\n"]}

package/out/codeSign/windowsSignAzureManager.d.ts

@@ -0,0 +1,12 @@
+import { WinPackager } from "../winPackager";
+import { WindowsSignOptions } from "./windowsCodeSign";
+export declare class WindowsSignAzureManager {
+    private readonly packager;
+    constructor(packager: WinPackager);
+    initializeProviderModules(): Promise<void>;
+    verifyRequiredEnvVars(): void;
+    verifyPrincipleSecretEnv(): boolean;
+    verifyPrincipleCertificateEnv(): boolean;
+    verifyUsernamePasswordEnv(): boolean;
+    signUsingAzureTrustedSigning(options: WindowsSignOptions): Promise<boolean>;
+}

package/out/codeSign/windowsSignAzureManager.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WindowsSignAzureManager = void 0;
+const builder_util_1 = require("builder-util");
+const windowsCodeSign_1 = require("./windowsCodeSign");
+class WindowsSignAzureManager {
+    constructor(packager) {
+        this.packager = packager;
+    }
+    async initializeProviderModules() {
+        const vm = await this.packager.vm.value;
+        const ps = await (0, windowsCodeSign_1.getPSCmd)(vm);
+        builder_util_1.log.debug(null, "installing required package provider (NuGet) and module (TrustedSigning) with scope CurrentUser");
+        await vm.exec(ps, ["Install-PackageProvider", "-Name", "NuGet", "-MinimumVersion", "2.8.5.201", "-Force", "-Scope", "CurrentUser"]);
+        await vm.exec(ps, ["Install-Module", "-Name", "TrustedSigning", "-RequiredVersion", "0.4.1", "-Force", "-Repository", "PSGallery", "-Scope", "CurrentUser"]);
+        // Preemptively check env vars once during initialization
+        // Options: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition
+        builder_util_1.log.info(null, "verifying env vars for authenticating to Microsoft Entra ID");
+        this.verifyRequiredEnvVars();
+        if (!(this.verifyPrincipleSecretEnv() || this.verifyPrincipleCertificateEnv() || this.verifyUsernamePasswordEnv())) {
+            throw new builder_util_1.InvalidConfigurationError(`Unable to find valid azure env configuration for signing. Missing field(s) can be debugged via "DEBUG=electron-builder". Please refer to: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition`);
+        }
+    }
+    verifyRequiredEnvVars() {
+        ;
+        ["AZURE_TENANT_ID", "AZURE_CLIENT_ID"].forEach(field => {
+            if (!process.env[field]) {
+                throw new builder_util_1.InvalidConfigurationError(`Unable to find valid azure env field ${field} for signing. Please refer to: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition`);
+            }
+        });
+    }
+    verifyPrincipleSecretEnv() {
+        if (!process.env.AZURE_CLIENT_SECRET) {
+            builder_util_1.log.debug({ envVar: "AZURE_CLIENT_SECRET" }, "no secret found for authenticating to Microsoft Entra ID");
+            return false;
+        }
+        return true;
+    }
+    verifyPrincipleCertificateEnv() {
+        if (!process.env.AZURE_CLIENT_CERTIFICATE_PATH) {
+            builder_util_1.log.debug({ envVar: "AZURE_CLIENT_CERTIFICATE_PATH" }, "no path found for signing certificate for authenticating to Microsoft Entra ID");
+            return false;
+        }
+        if (!process.env.AZURE_CLIENT_CERTIFICATE_PASSWORD) {
+            builder_util_1.log.debug({ envVar: "AZURE_CLIENT_CERTIFICATE_PASSWORD" }, "(optional) certificate password not found, assuming no password");
+        }
+        if (!process.env.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN) {
+            builder_util_1.log.debug({ envVar: "AZURE_CLIENT_SEND_CERTIFICATE_CHAIN" }, "(optional) certificate chain not found");
+        }
+        return true;
+    }
+    verifyUsernamePasswordEnv() {
+        if (!process.env.AZURE_USERNAME) {
+            builder_util_1.log.debug({ envVar: "AZURE_USERNAME" }, "no username found for authenticating to Microsoft Entra ID");
+            if (!process.env.AZURE_PASSWORD) {
+                builder_util_1.log.debug({ envVar: "AZURE_PASSWORD" }, "no password found for authenticating to Microsoft Entra ID");
+            }
+            return false;
+        }
+        return true;
+    }
+    // prerequisite: requires `initializeProviderModules` to already have been executed
+    async signUsingAzureTrustedSigning(options) {
+        const vm = await this.packager.vm.value;
+        const ps = await (0, windowsCodeSign_1.getPSCmd)(vm);
+        const { endpoint, certificateProfileName, ...extraSigningArgs } = options.options.azureSignOptions;
+        const params = {
+            ...extraSigningArgs,
+            Endpoint: endpoint,
+            CertificateProfileName: certificateProfileName,
+            Files: options.path,
+        };
+        const paramsString = Object.entries(params).reduce((res, [field, value]) => {
+            return [...res, `-${field}`, value];
+        }, []);
+        await vm.exec(ps, ["Invoke-TrustedSigning", ...paramsString]);
+        return true;
+    }
+}
+exports.WindowsSignAzureManager = WindowsSignAzureManager;
+//# sourceMappingURL=windowsSignAzureManager.js.map

package/out/codeSign/windowsSignAzureManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../src/codeSign/windowsSignAzureManager.ts"],"names":[],"mappings":";;;AAAA,+CAA6D;AAG7D,uDAAgE;AAEhE,MAAa,uBAAuB;IAClC,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;IAAG,CAAC;IAEtD,KAAK,CAAC,yBAAyB;QAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,IAAA,0BAAQ,EAAC,EAAE,CAAC,CAAA;QAE7B,kBAAG,CAAC,KAAK,CAAC,IAAI,EAAE,iGAAiG,CAAC,CAAA;QAClH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAA;QACnI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAA;QAE5J,yDAAyD;QACzD,0HAA0H;QAC1H,kBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,6DAA6D,CAAC,CAAA;QAC7E,IAAI,CAAC,qBAAqB,EAAE,CAAA;QAC5B,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,IAAI,CAAC,6BAA6B,EAAE,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC,EAAE,CAAC;YACnH,MAAM,IAAI,wCAAyB,CACjC,0PAA0P,CAC3P,CAAA;QACH,CAAC;IACH,CAAC;IAED,qBAAqB;QACnB,CAAC;QAAA,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,wCAAyB,CACjC,wCAAwC,KAAK,+IAA+I,CAC7L,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,wBAAwB;QACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACrC,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,0DAA0D,CAAC,CAAA;YACxG,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6BAA6B;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC;YAC/C,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,EAAE,gFAAgF,CAAC,CAAA;YACxI,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,CAAC;YACnD,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,EAAE,iEAAiE,CAAC,CAAA;QAC/H,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC;YACrD,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE,EAAE,wCAAwC,CAAC,CAAA;QACxG,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yBAAyB;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAChC,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,4DAA4D,CAAC,CAAA;YACrG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;gBAChC,kBAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,4DAA4D,CAAC,CAAA;YACvG,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,4BAA4B,CAAC,OAA2B;QAC5D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,IAAA,0BAAQ,EAAC,EAAE,CAAC,CAAA;QAE7B,MAAM,EAAE,QAAQ,EAAE,sBAAsB,EAAE,GAAG,gBAAgB,EAAE,GAAqC,OAAO,CAAC,OAAO,CAAC,gBAAiB,CAAA;QACrI,MAAM,MAAM,GAAG;YACb,GAAG,gBAAgB;YACnB,QAAQ,EAAE,QAAQ;YAClB,sBAAsB,EAAE,sBAAsB;YAC9C,KAAK,EAAE,OAAO,CAAC,IAAI;SACpB,CAAA;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;YACzE,OAAO,CAAC,GAAG,GAAG,EAAE,IAAI,KAAK,EAAE,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC,EAAE,EAAc,CAAC,CAAA;QAClB,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,uBAAuB,EAAE,GAAG,YAAY,CAAC,CAAC,CAAA;QAE7D,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AApFD,0DAoFC","sourcesContent":["import { InvalidConfigurationError, log } from \"builder-util\"\nimport { WindowsAzureSigningConfiguration } from \"../options/winOptions\"\nimport { WinPackager } from \"../winPackager\"\nimport { getPSCmd, WindowsSignOptions } from \"./windowsCodeSign\"\n\nexport class WindowsSignAzureManager {\n  constructor(private readonly packager: WinPackager) {}\n\n  async initializeProviderModules() {\n    const vm = await this.packager.vm.value\n    const ps = await getPSCmd(vm)\n\n    log.debug(null, \"installing required package provider (NuGet) and module (TrustedSigning) with scope CurrentUser\")\n    await vm.exec(ps, [\"Install-PackageProvider\", \"-Name\", \"NuGet\", \"-MinimumVersion\", \"2.8.5.201\", \"-Force\", \"-Scope\", \"CurrentUser\"])\n    await vm.exec(ps, [\"Install-Module\", \"-Name\", \"TrustedSigning\", \"-RequiredVersion\", \"0.4.1\", \"-Force\", \"-Repository\", \"PSGallery\", \"-Scope\", \"CurrentUser\"])\n\n    // Preemptively check env vars once during initialization\n    // Options: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition\n    log.info(null, \"verifying env vars for authenticating to Microsoft Entra ID\")\n    this.verifyRequiredEnvVars()\n    if (!(this.verifyPrincipleSecretEnv() || this.verifyPrincipleCertificateEnv() || this.verifyUsernamePasswordEnv())) {\n      throw new InvalidConfigurationError(\n        `Unable to find valid azure env configuration for signing. Missing field(s) can be debugged via \"DEBUG=electron-builder\". Please refer to: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition`\n      )\n    }\n  }\n\n  verifyRequiredEnvVars() {\n    ;[\"AZURE_TENANT_ID\", \"AZURE_CLIENT_ID\"].forEach(field => {\n      if (!process.env[field]) {\n        throw new InvalidConfigurationError(\n          `Unable to find valid azure env field ${field} for signing. Please refer to: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition`\n        )\n      }\n    })\n  }\n\n  verifyPrincipleSecretEnv() {\n    if (!process.env.AZURE_CLIENT_SECRET) {\n      log.debug({ envVar: \"AZURE_CLIENT_SECRET\" }, \"no secret found for authenticating to Microsoft Entra ID\")\n      return false\n    }\n    return true\n  }\n\n  verifyPrincipleCertificateEnv() {\n    if (!process.env.AZURE_CLIENT_CERTIFICATE_PATH) {\n      log.debug({ envVar: \"AZURE_CLIENT_CERTIFICATE_PATH\" }, \"no path found for signing certificate for authenticating to Microsoft Entra ID\")\n      return false\n    }\n    if (!process.env.AZURE_CLIENT_CERTIFICATE_PASSWORD) {\n      log.debug({ envVar: \"AZURE_CLIENT_CERTIFICATE_PASSWORD\" }, \"(optional) certificate password not found, assuming no password\")\n    }\n    if (!process.env.AZURE_CLIENT_SEND_CERTIFICATE_CHAIN) {\n      log.debug({ envVar: \"AZURE_CLIENT_SEND_CERTIFICATE_CHAIN\" }, \"(optional) certificate chain not found\")\n    }\n    return true\n  }\n\n  verifyUsernamePasswordEnv() {\n    if (!process.env.AZURE_USERNAME) {\n      log.debug({ envVar: \"AZURE_USERNAME\" }, \"no username found for authenticating to Microsoft Entra ID\")\n      if (!process.env.AZURE_PASSWORD) {\n        log.debug({ envVar: \"AZURE_PASSWORD\" }, \"no password found for authenticating to Microsoft Entra ID\")\n      }\n      return false\n    }\n    return true\n  }\n\n  // prerequisite: requires `initializeProviderModules` to already have been executed\n  async signUsingAzureTrustedSigning(options: WindowsSignOptions): Promise<boolean> {\n    const vm = await this.packager.vm.value\n    const ps = await getPSCmd(vm)\n\n    const { endpoint, certificateProfileName, ...extraSigningArgs }: WindowsAzureSigningConfiguration = options.options.azureSignOptions!\n    const params = {\n      ...extraSigningArgs,\n      Endpoint: endpoint,\n      CertificateProfileName: certificateProfileName,\n      Files: options.path,\n    }\n    const paramsString = Object.entries(params).reduce((res, [field, value]) => {\n      return [...res, `-${field}`, value]\n    }, [] as string[])\n    await vm.exec(ps, [\"Invoke-TrustedSigning\", ...paramsString])\n\n    return true\n  }\n}\n"]}

package/out/codeSign/windowsSignToolManager.d.ts

@@ -0,0 +1,53 @@
+import { WindowsConfiguration } from "../options/winOptions";
+import { ToolInfo } from "../util/bundledTool";
+import { VmManager } from "../vm/vm";
+import { WinPackager } from "../winPackager";
+import { WindowsSignOptions } from "./windowsCodeSign";
+import { MemoLazy } from "builder-util-runtime";
+import { Lazy } from "lazy-val";
+export declare function getSignVendorPath(): Promise<string>;
+export type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>;
+export interface WindowsSignToolOptions extends WindowsSignOptions {
+    readonly name: string;
+    readonly site: string | null;
+}
+export interface FileCodeSigningInfo {
+    readonly file: string;
+    readonly password: string | null;
+}
+export interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {
+    readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null;
+    resultOutputPath?: string;
+    hash: string;
+    isNest: boolean;
+}
+export interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {
+    computeSignToolArgs(isWin: boolean): Array<string>;
+}
+export interface CertificateInfo {
+    readonly commonName: string;
+    readonly bloodyMicrosoftSubjectDn: string;
+}
+export interface CertificateFromStoreInfo {
+    thumbprint: string;
+    subject: string;
+    store: string;
+    isLocalMachineStore: boolean;
+}
+export declare class WindowsSignToolManager {
+    private readonly packager;
+    private readonly platformSpecificBuildOptions;
+    constructor(packager: WinPackager);
+    readonly computedPublisherName: Lazy<string[] | null>;
+    readonly lazyCertInfo: MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>;
+    readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
+    signUsingSigntool(options: WindowsSignOptions): Promise<boolean>;
+    getCertInfo(file: string, password: string): Promise<CertificateInfo>;
+    computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm?: VmManager): Array<string>;
+    getOutputPath(inputPath: string, hash: string): string;
+    getWinSignTool(vendorPath: string): string;
+    getToolPath(isWin?: boolean): Promise<ToolInfo>;
+    getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo>;
+    doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager): Promise<void>;
+}
+export declare function isOldWin6(): boolean;