app-builder-lib 26.15.3 → 27.0.0-alpha.0

package/dist/codeSign/mac/macCodeSign.js

@@ -0,0 +1,273 @@
+import { copyFile, exec, InvalidConfigurationError, isEmptyOrSpaces, isPullRequest, log, Logger, retry, unlinkIfExists } from "builder-util";
+import { createHash, randomBytes } from "crypto";
+import { rename } from "fs/promises";
+import { Lazy } from "lazy-val";
+import { homedir, tmpdir } from "os";
+import * as path from "path";
+import { getTempName } from "temp-file";
+import { dynamicImport } from "../../util/dynamicImport.js";
+import { isAutoDiscoveryCodeSignIdentity, isCscForPullRequest, isTravis } from "../../util/flags.js";
+import { importCertificate } from "../codesign.js";
+export const appleCertificatePrefixes = ["Developer ID Application:", "Developer ID Installer:", "3rd Party Mac Developer Application:", "3rd Party Mac Developer Installer:"];
+export function isSignAllowed(isPrintWarn = true) {
+    if (process.platform !== "darwin") {
+        if (isPrintWarn) {
+            log.warn({ reason: "supported only on macOS" }, "skipped macOS application code signing");
+        }
+        return false;
+    }
+    if (isPullRequest()) {
+        const buildForPrWarning = "There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)" +
+            "\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.";
+        if (isCscForPullRequest()) {
+            if (isPrintWarn) {
+                log.warn(buildForPrWarning);
+            }
+        }
+        else {
+            if (isPrintWarn) {
+                // https://github.com/electron-userland/electron-builder/issues/1524
+                log.warn("Current build is a part of pull request, code signing will be skipped." + "\nSet env CSC_FOR_PULL_REQUEST to true to force code signing." + `\n${buildForPrWarning}`);
+            }
+            return false;
+        }
+    }
+    return true;
+}
+export async function reportError(isMas, certificateTypes, qualifier, keychainFile, isForceCodeSigning) {
+    const logFields = {};
+    if (qualifier == null) {
+        logFields.reason = "";
+        if (isAutoDiscoveryCodeSignIdentity()) {
+            logFields.reason += `cannot find valid "${certificateTypes.join(", ")}" identity${isMas ? "" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`}`;
+        }
+        logFields.reason += ", see https://electron.build/code-signing";
+        if (!isAutoDiscoveryCodeSignIdentity()) {
+            logFields.CSC_IDENTITY_AUTO_DISCOVERY = false;
+        }
+    }
+    else {
+        logFields.reason = "Identity name is specified, but no valid identity with this name in the keychain";
+        logFields.identity = qualifier;
+    }
+    const args = ["find-identity"];
+    if (keychainFile != null) {
+        args.push(keychainFile);
+    }
+    if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {
+        logFields.allIdentities = (await exec("/usr/bin/security", args))
+            .trim()
+            .split("\n")
+            .filter(it => !(it.includes("Policy: X.509 Basic") || it.includes("Matching identities")))
+            .join("\n");
+    }
+    const skipMessage = "skipped macOS application code signing";
+    if (isMas || isForceCodeSigning) {
+        throw new Error(Logger.createMessage(skipMessage, logFields, "error", it => it));
+    }
+    else {
+        log.warn(logFields, skipMessage);
+    }
+}
+// "Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list."
+// but "security list-keychains" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list
+// "overly complicated and introduces a race condition."
+// https://github.com/electron-userland/electron-builder/issues/398
+const bundledCertKeychainAdded = new Lazy(async () => {
+    // copy to temp and then atomic rename to final path
+    const cacheDir = getCacheDirectory();
+    const tmpKeychainPath = path.join(cacheDir, getTempName("electron-builder-root-certs"));
+    const keychainPath = path.join(cacheDir, "electron-builder-root-certs.keychain");
+    const results = await Promise.all([
+        listUserKeychains(),
+        copyFile(path.join(import.meta.dirname, "..", "..", "certs", "root_certs.keychain"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),
+    ]);
+    const list = results[0];
+    if (!list.includes(keychainPath)) {
+        await exec("/usr/bin/security", ["list-keychains", "-d", "user", "-s", keychainPath].concat(list));
+    }
+});
+function getCacheDirectory() {
+    const env = process.env.ELECTRON_BUILDER_CACHE;
+    return isEmptyOrSpaces(env) ? path.join(homedir(), "Library", "Caches", "electron-builder") : path.resolve(env);
+}
+function listUserKeychains() {
+    return exec("/usr/bin/security", ["list-keychains", "-d", "user"]).then(it => it
+        .split("\n")
+        .map(it => {
+        const r = it.trim();
+        return r.substring(1, r.length - 1);
+    })
+        .filter(it => it.length > 0));
+}
+export function removeKeychain(keychainFile, printWarn = true) {
+    return exec("/usr/bin/security", ["delete-keychain", keychainFile]).catch((e) => {
+        if (printWarn) {
+            log.warn({ file: keychainFile, error: e.stack || e }, "cannot delete keychain");
+        }
+        return unlinkIfExists(keychainFile);
+    });
+}
+export async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }) {
+    // travis has correct AppleWWDRCA cert
+    if (!isTravis()) {
+        await bundledCertKeychainAdded.value;
+    }
+    // https://github.com/electron-userland/electron-builder/issues/3685
+    // use constant file
+    const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash("sha256").update(currentDir).update("app-builder").digest("hex")}.keychain`);
+    // noinspection JSUnusedLocalSymbols
+    await removeKeychain(keychainFile, false).catch(_ => {
+        /* ignore*/
+    });
+    const certLinks = [cscLink];
+    if (cscILink != null) {
+        certLinks.push(cscILink);
+    }
+    const certPaths = new Array(certLinks.length);
+    const keychainPassword = randomBytes(32).toString("base64");
+    const securityCommands = [
+        ["create-keychain", "-p", keychainPassword, keychainFile],
+        ["unlock-keychain", "-p", keychainPassword, keychainFile],
+        ["set-keychain-settings", keychainFile],
+    ];
+    // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored
+    // https://github.com/electron-userland/electron-builder/issues/1457
+    const list = await listUserKeychains();
+    if (!list.includes(keychainFile)) {
+        securityCommands.push(["list-keychains", "-d", "user", "-s", keychainFile].concat(list));
+    }
+    // Import all certs in parallel, then run security commands sequentially.
+    await Promise.all(certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))));
+    for (const cmd of securityCommands) {
+        await exec("/usr/bin/security", cmd);
+    }
+    const cscPasswords = [cscKeyPassword];
+    if (cscIKeyPassword != null) {
+        cscPasswords.push(cscIKeyPassword);
+    }
+    return await importCerts(keychainFile, certPaths, cscPasswords);
+}
+async function importCerts(keychainFile, paths, keyPasswords) {
+    for (let i = 0; i < paths.length; i++) {
+        const password = keyPasswords[i] ?? "";
+        await exec("/usr/bin/security", ["import", paths[i], "-k", keychainFile, "-T", "/usr/bin/codesign", "-T", "/usr/bin/productbuild", "-P", password]);
+        // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p
+        // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996
+        await exec("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]);
+    }
+    return {
+        keychainFile,
+    };
+}
+export async function sign(opts) {
+    const { signAsync } = await dynamicImport("@electron/osx-sign");
+    return retry(() => signAsync(opts), {
+        retries: 3,
+        interval: 5000,
+        backoff: 5000,
+    });
+}
+export let findIdentityRawResult = null;
+async function getValidIdentities(keychain) {
+    function addKeychain(args) {
+        if (keychain != null) {
+            args.push(keychain);
+        }
+        return args;
+    }
+    let result = findIdentityRawResult;
+    if (result == null || keychain != null) {
+        // https://github.com/electron-userland/electron-builder/issues/481
+        // https://github.com/electron-userland/electron-builder/issues/535
+        result = Promise.all([
+            exec("/usr/bin/security", addKeychain(["find-identity", "-v"])).then(it => it
+                .trim()
+                .split("\n")
+                .filter(it => {
+                for (const prefix of appleCertificatePrefixes) {
+                    if (it.includes(prefix)) {
+                        return true;
+                    }
+                }
+                return false;
+            })),
+            exec("/usr/bin/security", addKeychain(["find-identity", "-v", "-p", "codesigning"])).then(it => it.trim().split("\n")),
+        ]).then(it => {
+            const array = it[0]
+                .concat(it[1])
+                .filter(it => !it.includes("(Missing required extension)") && !it.includes("valid identities found") && !it.includes("iPhone ") && !it.includes("com.apple.idms.appleid.prd."))
+                // remove 1)
+                .map(it => it.substring(it.indexOf(")") + 1).trim());
+            return Array.from(new Set(array));
+        });
+        if (keychain == null) {
+            findIdentityRawResult = result;
+        }
+    }
+    return result;
+}
+async function _findIdentity(type, qualifier, keychain) {
+    // https://github.com/electron-userland/electron-builder/issues/484
+    //noinspection SpellCheckingInspection
+    const lines = await getValidIdentities(keychain);
+    const namePrefix = `${type}:`;
+    for (const line of lines) {
+        if (qualifier != null && !line.includes(qualifier)) {
+            continue;
+        }
+        if (line.includes(namePrefix)) {
+            return await parseIdentity(line);
+        }
+    }
+    if (type === "Developer ID Application") {
+        // find non-Apple certificate
+        // https://github.com/electron-userland/electron-builder/issues/458
+        l: for (const line of lines) {
+            if (qualifier != null && !line.includes(qualifier)) {
+                continue;
+            }
+            if (line.includes("Mac Developer:")) {
+                continue;
+            }
+            for (const prefix of appleCertificatePrefixes) {
+                if (line.includes(prefix)) {
+                    continue l;
+                }
+            }
+            return await parseIdentity(line);
+        }
+    }
+    return null;
+}
+async function parseIdentity(line) {
+    const firstQuoteIndex = line.indexOf('"');
+    const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('"'));
+    const hash = line.substring(0, firstQuoteIndex - 1);
+    const { Identity: IdentityClass } = await dynamicImport("@electron/osx-sign/dist/cjs/util-identities");
+    return new IdentityClass(name, hash);
+}
+export function findIdentity(certType, qualifier, keychain) {
+    let identity = qualifier || process.env.CSC_NAME;
+    if (isEmptyOrSpaces(identity)) {
+        if (isAutoDiscoveryCodeSignIdentity()) {
+            return _findIdentity(certType, null, keychain);
+        }
+        else {
+            return Promise.resolve(null);
+        }
+    }
+    else {
+        identity = identity.trim();
+        for (const prefix of appleCertificatePrefixes) {
+            checkPrefix(identity, prefix);
+        }
+        return _findIdentity(certType, identity, keychain);
+    }
+}
+function checkPrefix(name, prefix) {
+    if (name.startsWith(prefix)) {
+        throw new InvalidConfigurationError(`Please remove prefix "${prefix}" from the specified name — appropriate certificate will be chosen automatically`);
+    }
+}
+//# sourceMappingURL=macCodeSign.js.map

package/dist/codeSign/mac/macCodeSign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../../src/codeSign/mac/macCodeSign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAU,yBAAyB,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAU,cAAc,EAAE,MAAM,cAAc,CAAA;AAE5J,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AACpC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,MAAM,UAAU,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,MAAM,iBAAiB,GACrB,kKAAkK;YAClK,6LAA6L,CAAA;QAE/L,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,GAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,gBAA4B,EAAE,SAA2B,EAAE,YAA8B,EAAE,kBAA2B;IACtK,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,+BAA+B,EAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,+BAA+B,EAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAA;IAC5D,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,IAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KACxJ,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChB,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1H,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,CAAsC,oBAAoB,CAAC,CAAA;IACpG,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAClC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,IAAI,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,qBAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB;YAClC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACX,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;iBAChB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBACb,MAAM,CACL,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CACvK;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,qBAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AASD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,aAAa,CAA8D,6CAA6C,CAAC,CAAA;IACnK,OAAO,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import type { SignOptions } from \"@electron/osx-sign/dist/cjs/types\"\nimport { copyFile, exec, Fields, InvalidConfigurationError, isEmptyOrSpaces, isPullRequest, log, Logger, retry, TmpDir, unlinkIfExists } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { createHash, randomBytes } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { dynamicImport } from \"../../util/dynamicImport.js\"\nimport { isAutoDiscoveryCodeSignIdentity, isCscForPullRequest, isTravis } from \"../../util/flags.js\"\nimport { importCertificate } from \"../codesign.js\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  if (isPullRequest()) {\n    const buildForPrWarning =\n      \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n      \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n    if (isCscForPullRequest()) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n\n  return true\n}\n\nexport async function reportError(isMas: boolean, certificateTypes: CertType[], qualifier: string | Nullish, keychainFile: string | Nullish, isForceCodeSigning: boolean) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  const skipMessage = \"skipped macOS application code signing\"\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(skipMessage, logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, skipMessage)\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(import.meta.dirname, \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (!isTravis()) {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  // Import all certs in parallel, then run security commands sequentially.\n  await Promise.all(certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))))\n  for (const cmd of securityCommands) {\n    await exec(\"/usr/bin/security\", cmd)\n  }\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i] ?? \"\"\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  const { signAsync } = await dynamicImport<typeof import(\"@electron/osx-sign\")>(\"@electron/osx-sign\")\n  return retry(() => signAsync(opts), {\n    retries: 3,\n    interval: 5000,\n    backoff: 5000,\n  })\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    result = Promise.all<Array<string>>([\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]).then(it => {\n      const array = it[0]\n        .concat(it[1])\n        .filter(\n          it => !it.includes(\"(Missing required extension)\") && !it.includes(\"valid identities found\") && !it.includes(\"iPhone \") && !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return await parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return await parseIdentity(line)\n    }\n  }\n  return null\n}\n\nexport declare class Identity {\n  readonly name: string\n  readonly hash?: string\n\n  constructor(name: string, hash?: string)\n}\n\nasync function parseIdentity(line: string): Promise<Identity> {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  const { Identity: IdentityClass } = await dynamicImport<{ Identity: new (name: string, hash?: string) => Identity }>(\"@electron/osx-sign/dist/cjs/util-identities\")\n  return new IdentityClass(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}

package/dist/codeSign/signManager.d.ts

@@ -0,0 +1,14 @@
+import { MemoLazy, Nullish } from "builder-util-runtime";
+import { Lazy } from "lazy-val";
+import { Target } from "../core.js";
+import { WindowsConfiguration } from "../options/winOptions.js";
+import { WindowsSignOptions } from "./win/windowsCodeSign.js";
+import { CertificateFromStoreInfo, FileCodeSigningInfo } from "./win/windowsSignToolManager.js";
+export interface SignManager {
+    readonly computedPublisherName: Lazy<Array<string> | null>;
+    readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
+    computePublisherName(target: Target, publisherName: string | Nullish): Promise<string>;
+    initialize(): Promise<void>;
+    signFile(options: WindowsSignOptions): Promise<boolean>;
+}
+//# sourceMappingURL=signManager.d.ts.map

package/dist/codeSign/signManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signManager.d.ts","sourceRoot":"","sources":["../../src/codeSign/signManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAE/F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAA;IAC1D,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,IAAI,CAAC,CAAA;IACvG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACtF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD"}

package/dist/codeSign/signManager.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signManager.js.map

package/dist/codeSign/signManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signManager.js","sourceRoot":"","sources":["../../src/codeSign/signManager.ts"],"names":[],"mappings":"","sourcesContent":["import { MemoLazy, Nullish } from \"builder-util-runtime\"\nimport { Lazy } from \"lazy-val\"\nimport { Target } from \"../core.js\"\nimport { WindowsConfiguration } from \"../options/winOptions.js\"\nimport { WindowsSignOptions } from \"./win/windowsCodeSign.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./win/windowsSignToolManager.js\"\n\nexport interface SignManager {\n  readonly computedPublisherName: Lazy<Array<string> | null>\n  readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>\n  computePublisherName(target: Target, publisherName: string | Nullish): Promise<string>\n  initialize(): Promise<void>\n  signFile(options: WindowsSignOptions): Promise<boolean>\n}\n"]}

package/dist/codeSign/win/windowsCodeSign.d.ts

@@ -0,0 +1,8 @@
+import { WindowsConfiguration } from "../../options/winOptions.js";
+import { WinPackager } from "../../winPackager.js";
+export interface WindowsSignOptions {
+    readonly path: string;
+    readonly options: WindowsConfiguration;
+}
+export declare function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean>;
+//# sourceMappingURL=windowsCodeSign.d.ts.map

package/dist/codeSign/win/windowsCodeSign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsCodeSign.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsCodeSign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAElD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACvC;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAWtG"}

package/dist/codeSign/win/windowsCodeSign.js

@@ -0,0 +1,34 @@
+import { log, retry } from "builder-util";
+export async function signWindows(options, packager) {
+    if (options.options.azureSignOptions) {
+        if (options.options.signtoolOptions) {
+            log.warn(null, "ignoring signtool options, using Azure Trusted Signing; please only configure one");
+        }
+        log.info({ path: log.filePath(options.path) }, "signing with Azure Trusted Signing");
+    }
+    else {
+        log.info({ path: log.filePath(options.path) }, "signing with signtool.exe");
+    }
+    const packageManager = await packager.signingManager.value;
+    return signWithRetry(async () => packageManager.signFile(options));
+}
+function signWithRetry(signer) {
+    return retry(signer, {
+        retries: 3,
+        interval: 1000,
+        backoff: 1000,
+        shouldRetry: (e) => {
+            const message = e.message;
+            if (
+            // https://github.com/electron-userland/electron-builder/issues/1414
+            message?.includes("Couldn't resolve host name") ||
+                // https://github.com/electron-userland/electron-builder/issues/8615
+                message?.includes("being used by another process.")) {
+                log.warn({ error: message }, "attempt to sign failed, another attempt will be made");
+                return true;
+            }
+            return false;
+        },
+    });
+}
+//# sourceMappingURL=windowsCodeSign.js.map

package/dist/codeSign/win/windowsCodeSign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsCodeSign.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsCodeSign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AASzC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,QAAqB;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACpC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,mFAAmF,CAAC,CAAA;QACrG,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAA;IAC1D,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACnD,OAAO,KAAK,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;YACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACzB;YACE,oEAAoE;YACpE,OAAO,EAAE,QAAQ,CAAC,4BAA4B,CAAC;gBAC/C,oEAAoE;gBACpE,OAAO,EAAE,QAAQ,CAAC,gCAAgC,CAAC,EACnD,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,sDAAsD,CAAC,CAAA;gBACpF,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { log, retry } from \"builder-util\"\nimport { WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { WinPackager } from \"../../winPackager.js\"\n\nexport interface WindowsSignOptions {\n  readonly path: string\n  readonly options: WindowsConfiguration\n}\n\nexport async function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean> {\n  if (options.options.azureSignOptions) {\n    if (options.options.signtoolOptions) {\n      log.warn(null, \"ignoring signtool options, using Azure Trusted Signing; please only configure one\")\n    }\n    log.info({ path: log.filePath(options.path) }, \"signing with Azure Trusted Signing\")\n  } else {\n    log.info({ path: log.filePath(options.path) }, \"signing with signtool.exe\")\n  }\n  const packageManager = await packager.signingManager.value\n  return signWithRetry(async () => packageManager.signFile(options))\n}\n\nfunction signWithRetry(signer: () => Promise<boolean>): Promise<boolean> {\n  return retry(signer, {\n    retries: 3,\n    interval: 1000,\n    backoff: 1000,\n    shouldRetry: (e: any) => {\n      const message = e.message\n      if (\n        // https://github.com/electron-userland/electron-builder/issues/1414\n        message?.includes(\"Couldn't resolve host name\") ||\n        // https://github.com/electron-userland/electron-builder/issues/8615\n        message?.includes(\"being used by another process.\")\n      ) {\n        log.warn({ error: message }, \"attempt to sign failed, another attempt will be made\")\n        return true\n      }\n      return false\n    },\n  })\n}\n"]}

package/dist/codeSign/win/windowsSignAzureManager.d.ts

@@ -0,0 +1,18 @@
+import { MemoLazy } from "builder-util-runtime";
+import { Lazy } from "lazy-val";
+import { WindowsConfiguration } from "../../options/winOptions.js";
+import { WinPackager } from "../../winPackager.js";
+import { SignManager } from "../signManager.js";
+import { WindowsSignOptions } from "./windowsCodeSign.js";
+import { CertificateFromStoreInfo, FileCodeSigningInfo } from "./windowsSignToolManager.js";
+export declare class WindowsSignAzureManager implements SignManager {
+    private readonly packager;
+    private readonly platformOptions;
+    readonly computedPublisherName: Lazy<string[] | null>;
+    constructor(packager: WinPackager);
+    initialize(): Promise<void>;
+    computePublisherName(): Promise<string>;
+    readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
+    signFile(options: WindowsSignOptions): Promise<boolean>;
+}
+//# sourceMappingURL=windowsSignAzureManager.d.ts.map

package/dist/codeSign/win/windowsSignAzureManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsSignAzureManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAoC,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAE3F,qBAAa,uBAAwB,YAAW,WAAW;IAgB7C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAfrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IAEtD,QAAQ,CAAC,qBAAqB,wBAW5B;gBAE2B,QAAQ,EAAE,WAAW;IAI5C,UAAU;IAkBhB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAGvC,QAAQ,CAAC,OAAO,wFAGf;IAEK,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;CAmC9D"}

package/dist/codeSign/win/windowsSignAzureManager.js

@@ -0,0 +1,68 @@
+import { asArray, log } from "builder-util";
+import { MemoLazy } from "builder-util-runtime";
+import { Lazy } from "lazy-val";
+export class WindowsSignAzureManager {
+    constructor(packager) {
+        this.packager = packager;
+        this.computedPublisherName = new Lazy(() => {
+            const publisherName = this.platformOptions.azureSignOptions?.publisherName;
+            if (publisherName === null) {
+                return Promise.resolve(null);
+            }
+            else if (publisherName != null) {
+                return Promise.resolve(asArray(publisherName));
+            }
+            // TODO: Is there another way to automatically pull Publisher Name from AzureTrusted service?
+            // For now return null.
+            return Promise.resolve(null);
+        });
+        this.cscInfo = new MemoLazy(() => this.packager.platformOptions, _selected => Promise.resolve(null));
+        this.platformOptions = packager.platformOptions;
+    }
+    async initialize() {
+        const vm = await this.packager.vm.value;
+        const ps = await vm.powershellCommand.value;
+        log.info(null, "installing required module (TrustedSigning) with scope CurrentUser");
+        try {
+            await vm.exec(ps, ["-NoProfile", "-NonInteractive", "-Command", "Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser"]);
+        }
+        catch (error) {
+            // Might not be needed, seems GH runners already have NuGet set up.
+            // Logging to debug just in case users run into this. If NuGet isn't present, Install-Module -Name TrustedSigning will fail, so we'll get the logs at that point
+            log.debug({ message: error.message || error.stack }, "unable to install PackageProvider Nuget. Might be a false alarm though as some systems already have it installed");
+        }
+        await vm.exec(ps, ["-NoProfile", "-NonInteractive", "-Command", "Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser"]);
+        // If signing has been misconfigured it, the error from the TrustedSigning module should be descriptive enough to help them fix their configuration.
+        // Options: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition
+    }
+    computePublisherName() {
+        return Promise.resolve(this.packager.platformOptions.azureSignOptions.publisherName);
+    }
+    // prerequisite: requires `initializeProviderModules` to already have been executed
+    async signFile(options) {
+        const vm = await this.packager.vm.value;
+        const ps = await vm.powershellCommand.value;
+        const { publisherName: _publisher, // extract from `extraSigningArgs`
+        endpoint, certificateProfileName, codeSigningAccountName, fileDigest, timestampRfc3161, timestampDigest, ...extraSigningArgs } = options.options.azureSignOptions;
+        const params = {
+            ...extraSigningArgs,
+            Endpoint: endpoint,
+            CertificateProfileName: certificateProfileName,
+            CodeSigningAccountName: codeSigningAccountName,
+            TimestampRfc3161: timestampRfc3161 || "http://timestamp.acs.microsoft.com",
+            TimestampDigest: timestampDigest || "SHA256",
+            FileDigest: fileDigest || "SHA256",
+            Files: vm.toVmFile(options.path),
+        };
+        const paramsString = Object.entries(params)
+            .filter(([_, value]) => value != null)
+            .reduce((res, [field, value]) => {
+            const escapedValue = String(value).replace(/'/g, "''");
+            return [...res, `-${field}`, `'${escapedValue}'`];
+        }, [])
+            .join(" ");
+        await vm.exec(ps, ["-NoProfile", "-NonInteractive", "-Command", `Invoke-TrustedSigning ${paramsString}`]);
+        return true;
+    }
+}
+//# sourceMappingURL=windowsSignAzureManager.js.map

package/dist/codeSign/win/windowsSignAzureManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAO/B,MAAM,OAAO,uBAAuB;IAgBlC,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAbzC,0BAAqB,GAAG,IAAI,IAAI,CAAuB,GAAG,EAAE;YACnE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,aAAa,CAAA;YAC1E,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;YAChD,CAAC;YAED,6FAA6F;YAC7F,uBAAuB;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;QA2BO,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EACnC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QA3BC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,mEAAmE;YACnE,gKAAgK;YAChK,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kHAAkH,CAAC,CAAA;QAC1K,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC,CAAA;QAE7K,oJAAoJ;QACpJ,0HAA0H;IAC5H,CAAC;IAED,oBAAoB;QAClB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,gBAAiB,CAAC,aAAa,CAAC,CAAA;IACvF,CAAC;IAKD,mFAAmF;IACnF,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,MAAM,EACJ,aAAa,EAAE,UAAU,EAAE,kCAAkC;QAC7D,QAAQ,EACR,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,GAAG,gBAAgB,EACpB,GAAqC,OAAO,CAAC,OAAO,CAAC,gBAAiB,CAAA;QACvE,MAAM,MAAM,GAAG;YACb,GAAG,gBAAgB;YACnB,QAAQ,EAAE,QAAQ;YAClB,sBAAsB,EAAE,sBAAsB;YAC9C,sBAAsB,EAAE,sBAAsB;YAC9C,gBAAgB,EAAE,gBAAgB,IAAI,oCAAoC;YAC1E,eAAe,EAAE,eAAe,IAAI,QAAQ;YAC5C,UAAU,EAAE,UAAU,IAAI,QAAQ;YAClC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAA;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACrC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;YAC9B,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACtD,OAAO,CAAC,GAAG,GAAG,EAAE,IAAI,KAAK,EAAE,EAAE,IAAI,YAAY,GAAG,CAAC,CAAA;QACnD,CAAC,EAAE,EAAc,CAAC;aACjB,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yBAAyB,YAAY,EAAE,CAAC,CAAC,CAAA;QAEzG,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { asArray, log } from \"builder-util\"\nimport { MemoLazy } from \"builder-util-runtime\"\nimport { Lazy } from \"lazy-val\"\nimport { WindowsAzureSigningConfiguration, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignManager } from \"../signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager.js\"\n\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly platformOptions: WindowsConfiguration\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    const publisherName = this.platformOptions.azureSignOptions?.publisherName\n    if (publisherName === null) {\n      return Promise.resolve(null)\n    } else if (publisherName != null) {\n      return Promise.resolve(asArray(publisherName))\n    }\n\n    // TODO: Is there another way to automatically pull Publisher Name from AzureTrusted service?\n    // For now return null.\n    return Promise.resolve(null)\n  })\n\n  constructor(private readonly packager: WinPackager) {\n    this.platformOptions = packager.platformOptions\n  }\n\n  async initialize() {\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      // Might not be needed, seems GH runners already have NuGet set up.\n      // Logging to debug just in case users run into this. If NuGet isn't present, Install-Module -Name TrustedSigning will fail, so we'll get the logs at that point\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider Nuget. Might be a false alarm though as some systems already have it installed\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser\"])\n\n    // If signing has been misconfigured it, the error from the TrustedSigning module should be descriptive enough to help them fix their configuration.\n    // Options: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition\n  }\n\n  computePublisherName(): Promise<string> {\n    return Promise.resolve(this.packager.platformOptions.azureSignOptions!.publisherName)\n  }\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformOptions,\n    _selected => Promise.resolve(null)\n  )\n  // prerequisite: requires `initializeProviderModules` to already have been executed\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    const {\n      publisherName: _publisher, // extract from `extraSigningArgs`\n      endpoint,\n      certificateProfileName,\n      codeSigningAccountName,\n      fileDigest,\n      timestampRfc3161,\n      timestampDigest,\n      ...extraSigningArgs\n    }: WindowsAzureSigningConfiguration = options.options.azureSignOptions!\n    const params = {\n      ...extraSigningArgs,\n      Endpoint: endpoint,\n      CertificateProfileName: certificateProfileName,\n      CodeSigningAccountName: codeSigningAccountName,\n      TimestampRfc3161: timestampRfc3161 || \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: timestampDigest || \"SHA256\",\n      FileDigest: fileDigest || \"SHA256\",\n      Files: vm.toVmFile(options.path),\n    }\n    const paramsString = Object.entries(params)\n      .filter(([_, value]) => value != null)\n      .reduce((res, [field, value]) => {\n        const escapedValue = String(value).replace(/'/g, \"''\")\n        return [...res, `-${field}`, `'${escapedValue}'`]\n      }, [] as string[])\n      .join(\" \")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", `Invoke-TrustedSigning ${paramsString}`])\n\n    return true\n  }\n}\n"]}

package/dist/codeSign/win/windowsSignToolManager.d.ts

@@ -0,0 +1,59 @@
+import { MemoLazy } from "builder-util-runtime";
+import { Lazy } from "lazy-val";
+import { Target } from "../../core.js";
+import { WindowsConfiguration } from "../../options/winOptions.js";
+import { ToolInfo } from "../../util/bundledTool.js";
+import { VmManager } from "../../vm/vm.js";
+import { WinPackager } from "../../winPackager.js";
+import { SignManager } from "../signManager.js";
+import { WindowsSignOptions } from "./windowsCodeSign.js";
+export type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>;
+export interface WindowsSignToolOptions extends WindowsSignOptions {
+    readonly name: string;
+    readonly site: string | null;
+}
+export interface FileCodeSigningInfo {
+    readonly file: string;
+    readonly password: string | null;
+}
+export interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {
+    readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null;
+    resultOutputPath?: string;
+    hash: string;
+    isNest: boolean;
+}
+export interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {
+    computeSignToolArgs(isWin: boolean): Array<string>;
+}
+export interface CertificateInfo {
+    readonly commonName: string;
+    readonly bloodyMicrosoftSubjectDn: string;
+}
+export interface CertificateFromStoreInfo {
+    thumbprint: string;
+    subject: string;
+    store: string;
+    isLocalMachineStore: boolean;
+}
+export declare class WindowsSignToolManager implements SignManager {
+    private readonly packager;
+    private readonly platformOptions;
+    constructor(packager: WinPackager);
+    readonly computedPublisherName: Lazy<string[] | null>;
+    readonly lazyCertInfo: MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>;
+    readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
+    initialize(): Promise<void>;
+    computePublisherName(target: Target, publisherName: string): Promise<string>;
+    signFile(options: WindowsSignOptions): Promise<boolean>;
+    getCertInfo(file: string, password: string): Promise<CertificateInfo>;
+    computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm?: VmManager): Array<string>;
+    private computeWindowsSignArgs;
+    private computeOsslsigncodeArgs;
+    private addCertificateArgs;
+    private addCommonSigningArgs;
+    getOutputPath(inputPath: string, hash: string): string;
+    getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo>;
+    getToolPath(isWin?: boolean): Promise<ToolInfo>;
+    doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager): Promise<void>;
+}
+//# sourceMappingURL=windowsSignToolManager.d.ts.map

package/dist/codeSign/win/windowsSignToolManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsSignToolManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignToolManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAGlE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAGpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGlD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAGzD,MAAM,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;AAE3H,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,IAAI,CAAA;IAGvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,kCAAmC,SAAQ,4BAA4B;IACtF,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,mBAAmB,EAAE,OAAO,CAAA;CAC7B;AAQD,qBAAa,sBAAuB,YAAW,WAAW;IAG5C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAFrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;gBAEzB,QAAQ,EAAE,WAAW;IAIlD,QAAQ,CAAC,qBAAqB,wBAU5B;IAEF,QAAQ,CAAC,YAAY,0HAsBpB;IAED,QAAQ,CAAC,OAAO,wFAmDf;IAED,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;IAc1D,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiEvD,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAU3E,mBAAmB,CAAC,OAAO,EAAE,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAE,SAA2B,GAAG,KAAK,CAAC,MAAM,CAAC;IAI1H,OAAO,CAAC,sBAAsB;IA+C9B,OAAO,CAAC,uBAAuB;IA+B/B,OAAO,CAAC,kBAAkB;IA6B1B,OAAO,CAAC,oBAAoB;IAwB5B,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAKvC,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAqC5G,WAAW,CAAC,KAAK,UAA+B,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIpE,MAAM,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,EAAE,WAAW;CAmCtF"}