app-builder-lib 26.15.3 → 27.0.0-alpha.0

package/dist/codeSign/win/windowsSignToolManager.js

@@ -0,0 +1,364 @@
+import { asArray, InvalidConfigurationError, log, retry } from "builder-util";
+import { MemoLazy, parseDn } from "builder-util-runtime";
+import _fsExtra from "fs-extra";
+import { Lazy } from "lazy-val";
+import * as path from "path";
+import AppXTarget from "../../targets/win/AppxTarget.js";
+import { getSignToolPath } from "../../toolsets/winCodeSign.js";
+import { isOfflineModeEnabled } from "../../util/flags.js";
+import { resolveFunction } from "../../util/resolve.js";
+import { VmManager } from "../../vm/vm.js";
+import { readCertInfo } from "../certInfo.js";
+import { importCertificate } from "../codesign.js";
+const { rename } = _fsExtra;
+export class WindowsSignToolManager {
+    constructor(packager) {
+        this.packager = packager;
+        this.computedPublisherName = new Lazy(async () => {
+            const publisherName = this.platformOptions.signtoolOptions?.publisherName;
+            if (publisherName === null) {
+                return null;
+            }
+            else if (publisherName != null) {
+                return asArray(publisherName);
+            }
+            const certInfo = await this.lazyCertInfo.value;
+            return certInfo == null ? null : [certInfo.commonName];
+        });
+        this.lazyCertInfo = new MemoLazy(() => this.cscInfo, async (csc) => {
+            const cscInfo = await csc.value;
+            if (cscInfo == null) {
+                return null;
+            }
+            if ("subject" in cscInfo) {
+                const bloodyMicrosoftSubjectDn = cscInfo.subject;
+                return {
+                    commonName: parseDn(bloodyMicrosoftSubjectDn).get("CN"),
+                    bloodyMicrosoftSubjectDn,
+                };
+            }
+            const cscFile = cscInfo.file;
+            if (cscFile == null) {
+                return null;
+            }
+            return await this.getCertInfo(cscFile, cscInfo.password || "");
+        });
+        this.cscInfo = new MemoLazy(() => this.platformOptions, platformSpecificBuildOptions => {
+            const subjectName = platformSpecificBuildOptions.signtoolOptions?.certificateSubjectName;
+            const shaType = platformSpecificBuildOptions.signtoolOptions?.certificateSha1;
+            if (subjectName != null || shaType != null) {
+                return this.packager.vm.value
+                    .then(vm => this.getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))
+                    .catch((e) => {
+                    // https://github.com/electron-userland/electron-builder/pull/2397
+                    if (platformSpecificBuildOptions.signtoolOptions?.sign == null) {
+                        throw e;
+                    }
+                    else {
+                        log.debug({ error: e }, "getCertificateFromStoreInfo error");
+                        return null;
+                    }
+                });
+            }
+            const certificateFile = platformSpecificBuildOptions.signtoolOptions?.certificateFile;
+            if (certificateFile != null) {
+                const certificatePassword = this.packager.getCscPassword();
+                return Promise.resolve({
+                    file: certificateFile,
+                    password: certificatePassword == null ? null : certificatePassword.trim(),
+                });
+            }
+            const cscLink = this.packager.getCscLink("WIN_CSC_LINK");
+            if (cscLink == null || cscLink === "") {
+                return Promise.resolve(null);
+            }
+            return (importCertificate(cscLink, this.packager.tempDirManager, this.packager.projectDir)
+                // before then
+                .catch((e) => {
+                if (e instanceof InvalidConfigurationError) {
+                    throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`);
+                }
+                else {
+                    throw e;
+                }
+            })
+                .then(path => {
+                return {
+                    file: path,
+                    password: this.packager.getCscPassword(),
+                };
+            }));
+        });
+        this.platformOptions = packager.platformOptions;
+    }
+    initialize() {
+        return Promise.resolve();
+    }
+    // https://github.com/electron-userland/electron-builder/issues/2108#issuecomment-333200711
+    async computePublisherName(target, publisherName) {
+        if (target instanceof AppXTarget && (await this.cscInfo.value) == null) {
+            log.info({ reason: "Windows Store only build" }, "AppX is not signed");
+            return publisherName || "CN=ms";
+        }
+        const certInfo = await this.lazyCertInfo.value;
+        const publisher = publisherName || (certInfo == null ? null : certInfo.bloodyMicrosoftSubjectDn);
+        if (publisher == null) {
+            throw new Error("Internal error: cannot compute subject using certificate info");
+        }
+        return publisher;
+    }
+    async signFile(options) {
+        let hashes = options.options.signtoolOptions?.signingHashAlgorithms;
+        // msi does not support dual-signing
+        if (options.path.endsWith(".msi")) {
+            hashes = [hashes != null && !hashes.includes("sha1") ? "sha256" : "sha1"];
+        }
+        else if (options.path.endsWith(".appx")) {
+            hashes = ["sha256"];
+        }
+        else if (hashes == null) {
+            hashes = ["sha1", "sha256"];
+        }
+        else {
+            hashes = Array.isArray(hashes) ? hashes : [hashes];
+        }
+        const name = this.packager.appInfo.productName;
+        const site = await this.packager.appInfo.computePackageUrl();
+        const customSign = await resolveFunction(this.packager.appInfo.type, options.options.signtoolOptions?.sign, "sign", await this.packager.getWorkspaceRoot());
+        const cscInfo = await this.cscInfo.value;
+        if (cscInfo) {
+            let logInfo = {
+                file: log.filePath(options.path),
+            };
+            if ("file" in cscInfo) {
+                logInfo = {
+                    ...logInfo,
+                    certificateFile: cscInfo.file,
+                };
+            }
+            else {
+                logInfo = {
+                    ...logInfo,
+                    subject: cscInfo.subject,
+                    thumbprint: cscInfo.thumbprint,
+                    store: cscInfo.store,
+                    user: cscInfo.isLocalMachineStore ? "local machine" : "current user",
+                };
+            }
+            log.info(logInfo, "signing");
+        }
+        else if (!customSign) {
+            log.debug({ signHook: !!customSign, cscInfo }, "no signing info identified, signing is skipped");
+            return false;
+        }
+        const executor = customSign || ((config, packager) => this.doSign(config, packager));
+        let isNest = false;
+        for (const hash of hashes) {
+            const taskConfiguration = { ...options, name, site, cscInfo, hash, isNest };
+            await Promise.resolve(executor({
+                ...taskConfiguration,
+                computeSignToolArgs: isWin => this.computeSignToolArgs(taskConfiguration, isWin),
+            }, this.packager));
+            isNest = true;
+            if (taskConfiguration.resultOutputPath != null) {
+                await rename(taskConfiguration.resultOutputPath, options.path);
+            }
+        }
+        return true;
+    }
+    async getCertInfo(file, password) {
+        const errorMessagePrefix = "Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: ";
+        try {
+            return await readCertInfo(file, password);
+        }
+        catch (e) {
+            throw new InvalidConfigurationError(`${errorMessagePrefix}${e.message || e}`);
+        }
+    }
+    // on windows be aware of http://stackoverflow.com/a/32640183/1910191
+    computeSignToolArgs(options, isWin, vm = new VmManager()) {
+        return isWin ? this.computeWindowsSignArgs(options, vm) : this.computeOsslsigncodeArgs(options, vm);
+    }
+    computeWindowsSignArgs(options, vm) {
+        const inputFile = vm.toVmFile(options.path);
+        const args = ["sign"];
+        // Timestamping
+        if (!isOfflineModeEnabled()) {
+            const isRfc3161 = options.isNest || options.hash === "sha256";
+            args.push(isRfc3161 ? "/tr" : "/t");
+            const timestampUrl = isRfc3161
+                ? options.options.signtoolOptions?.rfc3161TimeStampServer || "http://timestamp.digicert.com"
+                : options.options.signtoolOptions?.timeStampServer || "http://timestamp.digicert.com";
+            args.push(timestampUrl);
+        }
+        // Certificate
+        this.addCertificateArgs(args, options, vm, true);
+        // Hash algorithm
+        const isLegacyToolset = this.packager.config.toolsets?.winCodeSign === "0.0.0";
+        if (isLegacyToolset) {
+            // Legacy || v0.0.0: Only add /fd for non-SHA1 (original behavior)
+            if (options.hash !== "sha1") {
+                args.push("/fd", options.hash);
+                if (!isOfflineModeEnabled()) {
+                    args.push("/td", "sha256");
+                }
+            }
+        }
+        else {
+            // Modern: Always add /fd (required by new Windows Kits)
+            args.push("/fd", options.hash.toLowerCase());
+            // Only add /td for RFC3161 timestamps (incompatible with /t)
+            if (!isOfflineModeEnabled() && (options.isNest || options.hash === "sha256")) {
+                args.push("/td", "sha256");
+            }
+        }
+        // Optional parameters
+        this.addCommonSigningArgs(args, options, vm, true);
+        // Windows-specific
+        args.push("/debug");
+        args.push(inputFile); // Must be last
+        return args;
+    }
+    computeOsslsigncodeArgs(options, vm) {
+        const inputFile = vm.toVmFile(options.path);
+        const outputPath = this.getOutputPath(inputFile, options.hash);
+        options.resultOutputPath = outputPath;
+        const args = ["sign", "-in", inputFile, "-out", outputPath];
+        // Timestamping
+        if (!isOfflineModeEnabled()) {
+            const timestampUrl = options.options.signtoolOptions?.timeStampServer || "http://timestamp.digicert.com";
+            args.push("-t", timestampUrl);
+        }
+        // Certificate
+        this.addCertificateArgs(args, options, vm, false);
+        // Hash algorithm
+        args.push("-h", options.hash.toLowerCase());
+        // Optional parameters
+        this.addCommonSigningArgs(args, options, vm, false);
+        // Proxy support
+        const httpsProxy = process.env.HTTPS_PROXY;
+        if (httpsProxy?.length) {
+            args.push("-p", httpsProxy);
+        }
+        return args;
+    }
+    addCertificateArgs(args, options, vm, isWin) {
+        if (options.cscInfo == null) {
+            throw new Error("No code signing certificate configured. Provide certificateFile, certificateSha1, or certificateSubjectName.");
+        }
+        const certificateFile = options.cscInfo.file;
+        if (certificateFile == null) {
+            // Certificate from store (Windows only)
+            if (!isWin) {
+                throw new Error("certificateSha1/certificateSubjectName supported only on Windows");
+            }
+            const cscInfo = options.cscInfo;
+            args.push("/sha1", cscInfo.thumbprint);
+            args.push("/s", cscInfo.store);
+            if (cscInfo.isLocalMachineStore) {
+                args.push("/sm");
+            }
+        }
+        else {
+            // Certificate file
+            const certExtension = path.extname(certificateFile);
+            if (certExtension === ".p12" || certExtension === ".pfx") {
+                args.push(isWin ? "/f" : "-pkcs12", vm.toVmFile(certificateFile));
+            }
+            else {
+                throw new Error(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`);
+            }
+        }
+    }
+    addCommonSigningArgs(args, options, vm, isWin) {
+        if (options.name) {
+            args.push(isWin ? "/d" : "-n", options.name);
+        }
+        if (options.site) {
+            args.push(isWin ? "/du" : "-i", options.site);
+        }
+        if (options.isNest) {
+            args.push(isWin ? "/as" : "-nest");
+        }
+        const password = options.cscInfo?.password;
+        if (password) {
+            args.push(isWin ? "/p" : "-pass", password);
+        }
+        const additionalCert = options.options.signtoolOptions?.additionalCertificateFile;
+        if (additionalCert) {
+            args.push(isWin ? "/ac" : "-ac", vm.toVmFile(additionalCert));
+        }
+    }
+    getOutputPath(inputPath, hash) {
+        const extension = path.extname(inputPath);
+        return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`);
+    }
+    async getCertificateFromStoreInfo(options, vm) {
+        const certificateSubjectName = options.signtoolOptions?.certificateSubjectName;
+        const certificateSha1 = options.signtoolOptions?.certificateSha1?.toUpperCase();
+        const ps = await vm.powershellCommand.value;
+        const rawResult = await vm.exec(ps, [
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            "Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress",
+        ]);
+        const certList = rawResult.length === 0 ? [] : asArray(JSON.parse(rawResult));
+        for (const certInfo of certList) {
+            if ((certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||
+                (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)) {
+                continue;
+            }
+            const parentPath = certInfo.PSParentPath;
+            const store = parentPath.substring(parentPath.lastIndexOf("\\") + 1);
+            log.debug({ store, PSParentPath: parentPath }, "auto-detect certificate store");
+            // https://github.com/electron-userland/electron-builder/issues/1717
+            const isLocalMachineStore = parentPath.includes("Certificate::LocalMachine");
+            log.debug(null, "auto-detect using of LocalMachine store");
+            return {
+                thumbprint: certInfo.Thumbprint,
+                subject: certInfo.Subject,
+                store,
+                isLocalMachineStore,
+            };
+        }
+        throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`);
+    }
+    async getToolPath(isWin = process.platform === "win32") {
+        return getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir);
+    }
+    async doSign(configuration, packager) {
+        // https://github.com/electron-userland/electron-builder/pull/1944
+        const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT, 10) || 10 * 60 * 1000;
+        // decide runtime argument by cases
+        let args;
+        let vm;
+        const useVmIfNotOnWin = configuration.path.endsWith(".appx") || !("file" in configuration.cscInfo); /* certificateSubjectName and other such options */
+        const isWin = process.platform === "win32" || useVmIfNotOnWin;
+        const toolInfo = await getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir);
+        const tool = toolInfo.path;
+        if (useVmIfNotOnWin) {
+            vm = await packager.vm.value;
+            args = this.computeSignToolArgs(configuration, isWin, vm);
+        }
+        else {
+            vm = new VmManager();
+            args = configuration.computeSignToolArgs(isWin);
+        }
+        await retry(() => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || {}) } }), {
+            retries: 2,
+            interval: 15000,
+            backoff: 10000,
+            shouldRetry: (e) => {
+                if (e.message.includes("The file is being used by another process") ||
+                    e.message.includes("The specified timestamp server either could not be reached") ||
+                    e.message.includes("No certificates were found that met all the given criteria.")) {
+                    log.warn(`Attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`);
+                    return true;
+                }
+                return false;
+            },
+        });
+    }
+}
+//# sourceMappingURL=windowsSignToolManager.js.map

package/dist/codeSign/win/windowsSignToolManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowsSignToolManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignToolManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAG5B,OAAO,UAAU,MAAM,iCAAiC,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGlD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;AA8C3B,MAAM,OAAO,sBAAsB;IAGjC,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAIzC,0BAAqB,GAAG,IAAI,IAAI,CAAuB,KAAK,IAAI,EAAE;YACzE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,aAAa,CAAA;YACzE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAA;YACb,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,OAAO,OAAO,CAAC,aAAa,CAAC,CAAA;YAC/B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;YAC9C,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEO,iBAAY,GAAG,IAAI,QAAQ,CAClC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAClB,KAAK,EAAC,GAAG,EAAC,EAAE;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAA;gBAChD,OAAO;oBACL,UAAU,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAE;oBACxD,wBAAwB;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAA;YAC5B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QAChE,CAAC,CACF,CAAA;QAEQ,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAC1B,4BAA4B,CAAC,EAAE;YAC7B,MAAM,WAAW,GAAG,4BAA4B,CAAC,eAAe,EAAE,sBAAsB,CAAA;YACxF,MAAM,OAAO,GAAG,4BAA4B,CAAC,eAAe,EAAE,eAAe,CAAA;YAC7E,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK;qBAC1B,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;qBAC9E,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,kEAAkE;oBAClE,IAAI,4BAA4B,CAAC,eAAe,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;wBAC/D,MAAM,CAAC,CAAA;oBACT,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;wBAC5D,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC,CAAC,CAAA;YACN,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,CAAC,eAAe,EAAE,eAAe,CAAA;YACrF,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;gBAC5B,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAA;gBAC1D,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;YACxD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACtC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;YAED,OAAO,CACL,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAChF,cAAc;iBACb,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;gBAChB,IAAI,CAAC,YAAY,yBAAyB,EAAE,CAAC;oBAC3C,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtG,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,CAAA;gBACT,CAAC;YACH,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,EAAE;gBACX,OAAO;oBACL,IAAI,EAAE,IAAI;oBACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;iBACzC,CAAA;YACH,CAAC,CAAC,CACL,CAAA;QACH,CAAC,CACF,CAAA;QA1FC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAA;IACjD,CAAC;IA2FD,UAAU;QACR,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAAqB;QAC9D,IAAI,MAAM,YAAY,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,oBAAoB,CAAC,CAAA;YACtE,OAAO,aAAa,IAAI,OAAO,CAAA;QACjC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;QAC9C,MAAM,SAAS,GAAG,aAAa,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAA;QAChG,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,qBAAqB,CAAA;QACnE,oCAAoC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC3E,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAA;QAE5D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAE3J,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QACxC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,GAAQ;gBACjB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAA;YACD,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,eAAe,EAAE,OAAO,CAAC,IAAI;iBAC9B,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;iBACrE,CAAA;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC9B,CAAC;aAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,gDAAgD,CAAC,CAAA;YAChG,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,MAA0C,EAAE,QAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrI,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,iBAAiB,GAAiC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzG,MAAM,OAAO,CAAC,OAAO,CACnB,QAAQ,CACN;gBACE,GAAG,iBAAiB;gBACpB,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC;aACjF,EACD,IAAI,CAAC,QAAQ,CACd,CACF,CAAA;YACD,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;gBAC/C,MAAM,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,kBAAkB,GAAG,4GAA4G,CAAA;QACvI,IAAI,CAAC;YACH,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAyB,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mBAAmB,CAAC,OAAqC,EAAE,KAAc,EAAE,KAAgB,IAAI,SAAS,EAAE;QACxG,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC;IAEO,sBAAsB,CAAC,OAAqC,EAAE,EAAa;QACjF,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAErB,eAAe;QACf,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAEnC,MAAM,YAAY,GAAG,SAAS;gBAC5B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,sBAAsB,IAAI,+BAA+B;gBAC5F,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,eAAe,IAAI,+BAA+B,CAAA;YACvF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzB,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAEhD,iBAAiB;QACjB,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAA;QAC9E,IAAI,eAAe,EAAE,CAAC;YACpB,kEAAkE;YAClE,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;oBAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5C,6DAA6D;YAC7D,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAElD,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,eAAe;QAEpC,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,uBAAuB,CAAC,OAAqC,EAAE,EAAa;QAClF,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAA;QAErC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAE3D,eAAe;QACf,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC5B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,eAAe,IAAI,+BAA+B,CAAA;YACxG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAC/B,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEjD,iBAAiB;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAE3C,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEnD,gBAAgB;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QAC1C,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,kBAAkB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;QAClH,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAA;QACjI,CAAC;QACD,MAAM,eAAe,GAAI,OAAO,CAAC,OAA+B,CAAC,IAAI,CAAA;QAErE,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,wCAAwC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAmC,CAAA;YAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,mBAAmB;YACnB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;YACnD,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YACnE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,eAAe,iBAAiB,CAAC,CAAA;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;QACpH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,QAAQ,GAAI,OAAO,CAAC,OAA+B,EAAE,QAAQ,CAAA;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAA;QACjF,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG,SAAS,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,OAA6B,EAAE,EAAa;QAC5E,MAAM,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,sBAAsB,CAAA;QAC9E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;QAE/E,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAClC,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,oIAAoI;SACrI,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACvF,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAChC,IACE,CAAC,sBAAsB,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACtF,CAAC,eAAe,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAClF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACpE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC/E,oEAAoE;YACpE,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;YAC5E,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAA;YAC1D,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK;gBACL,mBAAmB;aACpB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,sBAAsB,IAAI,eAAe,gBAAgB,SAAS,EAAE,CAAC,CAAA;IAClH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QACpD,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAC5G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAiD,EAAE,QAAqB;QACnF,kEAAkE;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAuB,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACnF,mCAAmC;QACnC,IAAI,IAAmB,CAAA;QACvB,IAAI,EAAa,CAAA;QACjB,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,OAAQ,CAAC,CAAA,CAAC,mDAAmD;QACvJ,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAC1H,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;YAC5B,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,IAAI,SAAS,EAAE,CAAA;YACpB,IAAI,GAAG,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE;YACpG,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;gBACtB,IACE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC;oBAC/D,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4DAA4D,CAAC;oBAChF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,6DAA6D,CAAC,EACjF,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACjG,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;CACF","sourcesContent":["import { asArray, InvalidConfigurationError, log, retry } from \"builder-util\"\nimport { MemoLazy, parseDn } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport { WindowsConfiguration } from \"../../options/winOptions.js\"\nimport AppXTarget from \"../../targets/win/AppxTarget.js\"\nimport { getSignToolPath } from \"../../toolsets/winCodeSign.js\"\nimport { ToolInfo } from \"../../util/bundledTool.js\"\nimport { isOfflineModeEnabled } from \"../../util/flags.js\"\nimport { resolveFunction } from \"../../util/resolve.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { readCertInfo } from \"../certInfo.js\"\nimport { importCertificate } from \"../codesign.js\"\nimport { SignManager } from \"../signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nconst { rename } = _fsExtra\n\nexport type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>\n\nexport interface WindowsSignToolOptions extends WindowsSignOptions {\n  readonly name: string\n  readonly site: string | null\n}\n\nexport interface FileCodeSigningInfo {\n  readonly file: string\n  readonly password: string | null\n}\n\nexport interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {\n  readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null\n\n  // set if output path differs from input (e.g. osslsigncode cannot sign file in-place)\n  resultOutputPath?: string\n\n  hash: string\n  isNest: boolean\n}\n\nexport interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {\n  computeSignToolArgs(isWin: boolean): Array<string>\n}\n\nexport interface CertificateInfo {\n  readonly commonName: string\n  readonly bloodyMicrosoftSubjectDn: string\n}\n\nexport interface CertificateFromStoreInfo {\n  thumbprint: string\n  subject: string\n  store: string\n  isLocalMachineStore: boolean\n}\n\ninterface CertInfo {\n  Subject: string\n  Thumbprint: string\n  PSParentPath: string\n}\n\nexport class WindowsSignToolManager implements SignManager {\n  private readonly platformOptions: WindowsConfiguration\n\n  constructor(private readonly packager: WinPackager) {\n    this.platformOptions = packager.platformOptions\n  }\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(async () => {\n    const publisherName = this.platformOptions.signtoolOptions?.publisherName\n    if (publisherName === null) {\n      return null\n    } else if (publisherName != null) {\n      return asArray(publisherName)\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    return certInfo == null ? null : [certInfo.commonName]\n  })\n\n  readonly lazyCertInfo = new MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>(\n    () => this.cscInfo,\n    async csc => {\n      const cscInfo = await csc.value\n      if (cscInfo == null) {\n        return null\n      }\n\n      if (\"subject\" in cscInfo) {\n        const bloodyMicrosoftSubjectDn = cscInfo.subject\n        return {\n          commonName: parseDn(bloodyMicrosoftSubjectDn).get(\"CN\")!,\n          bloodyMicrosoftSubjectDn,\n        }\n      }\n\n      const cscFile = cscInfo.file\n      if (cscFile == null) {\n        return null\n      }\n      return await this.getCertInfo(cscFile, cscInfo.password || \"\")\n    }\n  )\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.platformOptions,\n    platformSpecificBuildOptions => {\n      const subjectName = platformSpecificBuildOptions.signtoolOptions?.certificateSubjectName\n      const shaType = platformSpecificBuildOptions.signtoolOptions?.certificateSha1\n      if (subjectName != null || shaType != null) {\n        return this.packager.vm.value\n          .then(vm => this.getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))\n          .catch((e: any) => {\n            // https://github.com/electron-userland/electron-builder/pull/2397\n            if (platformSpecificBuildOptions.signtoolOptions?.sign == null) {\n              throw e\n            } else {\n              log.debug({ error: e }, \"getCertificateFromStoreInfo error\")\n              return null\n            }\n          })\n      }\n\n      const certificateFile = platformSpecificBuildOptions.signtoolOptions?.certificateFile\n      if (certificateFile != null) {\n        const certificatePassword = this.packager.getCscPassword()\n        return Promise.resolve({\n          file: certificateFile,\n          password: certificatePassword == null ? null : certificatePassword.trim(),\n        })\n      }\n\n      const cscLink = this.packager.getCscLink(\"WIN_CSC_LINK\")\n      if (cscLink == null || cscLink === \"\") {\n        return Promise.resolve(null)\n      }\n\n      return (\n        importCertificate(cscLink, this.packager.tempDirManager, this.packager.projectDir)\n          // before then\n          .catch((e: any) => {\n            if (e instanceof InvalidConfigurationError) {\n              throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)\n            } else {\n              throw e\n            }\n          })\n          .then(path => {\n            return {\n              file: path,\n              password: this.packager.getCscPassword(),\n            }\n          })\n      )\n    }\n  )\n\n  initialize(): Promise<void> {\n    return Promise.resolve()\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/2108#issuecomment-333200711\n  async computePublisherName(target: Target, publisherName: string) {\n    if (target instanceof AppXTarget && (await this.cscInfo.value) == null) {\n      log.info({ reason: \"Windows Store only build\" }, \"AppX is not signed\")\n      return publisherName || \"CN=ms\"\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    const publisher = publisherName || (certInfo == null ? null : certInfo.bloodyMicrosoftSubjectDn)\n    if (publisher == null) {\n      throw new Error(\"Internal error: cannot compute subject using certificate info\")\n    }\n    return publisher\n  }\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    let hashes = options.options.signtoolOptions?.signingHashAlgorithms\n    // msi does not support dual-signing\n    if (options.path.endsWith(\".msi\")) {\n      hashes = [hashes != null && !hashes.includes(\"sha1\") ? \"sha256\" : \"sha1\"]\n    } else if (options.path.endsWith(\".appx\")) {\n      hashes = [\"sha256\"]\n    } else if (hashes == null) {\n      hashes = [\"sha1\", \"sha256\"]\n    } else {\n      hashes = Array.isArray(hashes) ? hashes : [hashes]\n    }\n\n    const name = this.packager.appInfo.productName\n    const site = await this.packager.appInfo.computePackageUrl()\n\n    const customSign = await resolveFunction(this.packager.appInfo.type, options.options.signtoolOptions?.sign, \"sign\", await this.packager.getWorkspaceRoot())\n\n    const cscInfo = await this.cscInfo.value\n    if (cscInfo) {\n      let logInfo: any = {\n        file: log.filePath(options.path),\n      }\n      if (\"file\" in cscInfo) {\n        logInfo = {\n          ...logInfo,\n          certificateFile: cscInfo.file,\n        }\n      } else {\n        logInfo = {\n          ...logInfo,\n          subject: cscInfo.subject,\n          thumbprint: cscInfo.thumbprint,\n          store: cscInfo.store,\n          user: cscInfo.isLocalMachineStore ? \"local machine\" : \"current user\",\n        }\n      }\n      log.info(logInfo, \"signing\")\n    } else if (!customSign) {\n      log.debug({ signHook: !!customSign, cscInfo }, \"no signing info identified, signing is skipped\")\n      return false\n    }\n\n    const executor = customSign || ((config: CustomWindowsSignTaskConfiguration, packager: WinPackager) => this.doSign(config, packager))\n    let isNest = false\n    for (const hash of hashes) {\n      const taskConfiguration: WindowsSignTaskConfiguration = { ...options, name, site, cscInfo, hash, isNest }\n      await Promise.resolve(\n        executor(\n          {\n            ...taskConfiguration,\n            computeSignToolArgs: isWin => this.computeSignToolArgs(taskConfiguration, isWin),\n          },\n          this.packager\n        )\n      )\n      isNest = true\n      if (taskConfiguration.resultOutputPath != null) {\n        await rename(taskConfiguration.resultOutputPath, options.path)\n      }\n    }\n\n    return true\n  }\n\n  async getCertInfo(file: string, password: string): Promise<CertificateInfo> {\n    const errorMessagePrefix = \"Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: \"\n    try {\n      return await readCertInfo(file, password)\n    } catch (e: any) {\n      throw new InvalidConfigurationError(`${errorMessagePrefix}${e.message || e}`)\n    }\n  }\n\n  // on windows be aware of http://stackoverflow.com/a/32640183/1910191\n  computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm: VmManager = new VmManager()): Array<string> {\n    return isWin ? this.computeWindowsSignArgs(options, vm) : this.computeOsslsigncodeArgs(options, vm)\n  }\n\n  private computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const inputFile = vm.toVmFile(options.path)\n    const args = [\"sign\"]\n\n    // Timestamping\n    if (!isOfflineModeEnabled()) {\n      const isRfc3161 = options.isNest || options.hash === \"sha256\"\n      args.push(isRfc3161 ? \"/tr\" : \"/t\")\n\n      const timestampUrl = isRfc3161\n        ? options.options.signtoolOptions?.rfc3161TimeStampServer || \"http://timestamp.digicert.com\"\n        : options.options.signtoolOptions?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, true)\n\n    // Hash algorithm\n    const isLegacyToolset = this.packager.config.toolsets?.winCodeSign === \"0.0.0\"\n    if (isLegacyToolset) {\n      // Legacy || v0.0.0: Only add /fd for non-SHA1 (original behavior)\n      if (options.hash !== \"sha1\") {\n        args.push(\"/fd\", options.hash)\n        if (!isOfflineModeEnabled()) {\n          args.push(\"/td\", \"sha256\")\n        }\n      }\n    } else {\n      // Modern: Always add /fd (required by new Windows Kits)\n      args.push(\"/fd\", options.hash.toLowerCase())\n      // Only add /td for RFC3161 timestamps (incompatible with /t)\n      if (!isOfflineModeEnabled() && (options.isNest || options.hash === \"sha256\")) {\n        args.push(\"/td\", \"sha256\")\n      }\n    }\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, true)\n\n    // Windows-specific\n    args.push(\"/debug\")\n    args.push(inputFile) // Must be last\n\n    return args\n  }\n\n  private computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const inputFile = vm.toVmFile(options.path)\n    const outputPath = this.getOutputPath(inputFile, options.hash)\n    options.resultOutputPath = outputPath\n\n    const args = [\"sign\", \"-in\", inputFile, \"-out\", outputPath]\n\n    // Timestamping\n    if (!isOfflineModeEnabled()) {\n      const timestampUrl = options.options.signtoolOptions?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(\"-t\", timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, false)\n\n    // Hash algorithm\n    args.push(\"-h\", options.hash.toLowerCase())\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, false)\n\n    // Proxy support\n    const httpsProxy = process.env.HTTPS_PROXY\n    if (httpsProxy?.length) {\n      args.push(\"-p\", httpsProxy)\n    }\n\n    return args\n  }\n\n  private addCertificateArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.cscInfo == null) {\n      throw new Error(\"No code signing certificate configured. Provide certificateFile, certificateSha1, or certificateSubjectName.\")\n    }\n    const certificateFile = (options.cscInfo as FileCodeSigningInfo).file\n\n    if (certificateFile == null) {\n      // Certificate from store (Windows only)\n      if (!isWin) {\n        throw new Error(\"certificateSha1/certificateSubjectName supported only on Windows\")\n      }\n\n      const cscInfo = options.cscInfo as CertificateFromStoreInfo\n      args.push(\"/sha1\", cscInfo.thumbprint)\n      args.push(\"/s\", cscInfo.store)\n      if (cscInfo.isLocalMachineStore) {\n        args.push(\"/sm\")\n      }\n    } else {\n      // Certificate file\n      const certExtension = path.extname(certificateFile)\n      if (certExtension === \".p12\" || certExtension === \".pfx\") {\n        args.push(isWin ? \"/f\" : \"-pkcs12\", vm.toVmFile(certificateFile))\n      } else {\n        throw new Error(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`)\n      }\n    }\n  }\n\n  private addCommonSigningArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.name) {\n      args.push(isWin ? \"/d\" : \"-n\", options.name)\n    }\n\n    if (options.site) {\n      args.push(isWin ? \"/du\" : \"-i\", options.site)\n    }\n\n    if (options.isNest) {\n      args.push(isWin ? \"/as\" : \"-nest\")\n    }\n\n    const password = (options.cscInfo as FileCodeSigningInfo)?.password\n    if (password) {\n      args.push(isWin ? \"/p\" : \"-pass\", password)\n    }\n\n    const additionalCert = options.options.signtoolOptions?.additionalCertificateFile\n    if (additionalCert) {\n      args.push(isWin ? \"/ac\" : \"-ac\", vm.toVmFile(additionalCert))\n    }\n  }\n\n  getOutputPath(inputPath: string, hash: string) {\n    const extension = path.extname(inputPath)\n    return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`)\n  }\n\n  async getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo> {\n    const certificateSubjectName = options.signtoolOptions?.certificateSubjectName\n    const certificateSha1 = options.signtoolOptions?.certificateSha1?.toUpperCase()\n\n    const ps = await vm.powershellCommand.value\n    const rawResult = await vm.exec(ps, [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-Command\",\n      \"Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress\",\n    ])\n    const certList = rawResult.length === 0 ? [] : asArray<CertInfo>(JSON.parse(rawResult))\n    for (const certInfo of certList) {\n      if (\n        (certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||\n        (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)\n      ) {\n        continue\n      }\n\n      const parentPath = certInfo.PSParentPath\n      const store = parentPath.substring(parentPath.lastIndexOf(\"\\\\\") + 1)\n      log.debug({ store, PSParentPath: parentPath }, \"auto-detect certificate store\")\n      // https://github.com/electron-userland/electron-builder/issues/1717\n      const isLocalMachineStore = parentPath.includes(\"Certificate::LocalMachine\")\n      log.debug(null, \"auto-detect using of LocalMachine store\")\n      return {\n        thumbprint: certInfo.Thumbprint,\n        subject: certInfo.Subject,\n        store,\n        isLocalMachineStore,\n      }\n    }\n\n    throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`)\n  }\n\n  async getToolPath(isWin = process.platform === \"win32\"): Promise<ToolInfo> {\n    return getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n  }\n\n  async doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager) {\n    // https://github.com/electron-userland/electron-builder/pull/1944\n    const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT as any, 10) || 10 * 60 * 1000\n    // decide runtime argument by cases\n    let args: Array<string>\n    let vm: VmManager\n    const useVmIfNotOnWin = configuration.path.endsWith(\".appx\") || !(\"file\" in configuration.cscInfo!) /* certificateSubjectName and other such options */\n    const isWin = process.platform === \"win32\" || useVmIfNotOnWin\n    const toolInfo = await getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n    const tool = toolInfo.path\n    if (useVmIfNotOnWin) {\n      vm = await packager.vm.value\n      args = this.computeSignToolArgs(configuration, isWin, vm)\n    } else {\n      vm = new VmManager()\n      args = configuration.computeSignToolArgs(isWin)\n    }\n\n    await retry(() => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || {}) } }), {\n      retries: 2,\n      interval: 15000,\n      backoff: 10000,\n      shouldRetry: (e: any) => {\n        if (\n          e.message.includes(\"The file is being used by another process\") ||\n          e.message.includes(\"The specified timestamp server either could not be reached\") ||\n          e.message.includes(\"No certificates were found that met all the given criteria.\")\n        ) {\n          log.warn(`Attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`)\n          return true\n        }\n        return false\n      },\n    })\n  }\n}\n"]}