app-builder-lib 27.0.0-alpha.2 → 27.0.0-alpha.4

package/dist/codeSign/win/windowsSignAzureManager.js

@@ -1,25 +1,51 @@
-import { asArray, log } from "builder-util";
-import { MemoLazy } from "builder-util-runtime";
+import { Arch, isEmptyOrSpaces, log, sanitizeDirPath } from "builder-util";
+import { asArray, MemoLazy } from "builder-util-runtime";
+import _fsExtra from "fs-extra";
 import { Lazy } from "lazy-val";
+import * as path from "path";
+import { resolveWindowsSigningConfiguration } from "../../options/winOptions.js";
+import { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle } from "../../toolsets/winCodeSign.js";
+import { VmManager } from "../../vm/vm.js";
+import { WineVmManager } from "../../vm/WineVm.js";
+import semver from "semver";
+const minimumWinCodeSignVersionForDlib = "1.3.0";
 export class WindowsSignAzureManager {
+    get publisherName() {
+        const result = this.signing.publisherName;
+        if (isEmptyOrSpaces(result)) {
+            throw new Error("Azure Trusted Signing requires 'publisherName' in win.sign config (no local certificate to derive it from)");
+        }
+        return result;
+    }
     constructor(packager) {
         this.packager = packager;
+        // signtool.exe is a Windows PE binary; use Wine on non-Windows (same pattern as MsiTarget).
+        this.vm = process.platform === "win32" ? new VmManager() : new WineVmManager(this.packager.config.toolsets?.wine, this.packager.buildResourcesDir);
         this.computedPublisherName = new Lazy(() => {
-            const publisherName = this.platformOptions.azureSignOptions?.publisherName;
-            if (publisherName === null) {
-                return Promise.resolve(null);
-            }
-            else if (publisherName != null) {
-                return Promise.resolve(asArray(publisherName));
-            }
-            // TODO: Is there another way to automatically pull Publisher Name from AzureTrusted service?
-            // For now return null.
-            return Promise.resolve(null);
+            return Promise.resolve(asArray(this.publisherName));
         });
         this.cscInfo = new MemoLazy(() => this.packager.platformOptions, _selected => Promise.resolve(null));
-        this.platformOptions = packager.platformOptions;
+        const signing = resolveWindowsSigningConfiguration(packager.platformOptions);
+        if (signing?.type !== "azure") {
+            throw new Error(`WindowsSignAzureManager requires signing.type = "azure", got: ${signing?.type}`);
+        }
+        this.signing = signing;
+    }
+    isLegacyMode() {
+        const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {};
+        if (typeof wcs === "string") {
+            return semver.lt(wcs, minimumWinCodeSignVersionForDlib);
+        }
+        // null = built-in toolset not configured → legacy; ToolsetCustom object = user-managed → not legacy
+        return wcs == null;
     }
     async initialize() {
+        if (!this.isLegacyMode()) {
+            return;
+        }
+        const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {};
+        const reason = typeof wcs === "string" ? `toolsets.winCodeSign "${wcs}" is below the minimum "${minimumWinCodeSignVersionForDlib}"` : `toolsets.winCodeSign is not set`;
+        log.info({ reason, guidance: `set toolsets.winCodeSign to "${minimumWinCodeSignVersionForDlib}" to use the faster signtool /dlib integration` }, `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`);
         const vm = await this.packager.vm.value;
         const ps = await vm.powershellCommand.value;
         log.info(null, "installing required module (TrustedSigning) with scope CurrentUser");
@@ -27,41 +53,109 @@ export class WindowsSignAzureManager {
             await vm.exec(ps, ["-NoProfile", "-NonInteractive", "-Command", "Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser"]);
         }
         catch (error) {
-            // Might not be needed, seems GH runners already have NuGet set up.
-            // Logging to debug just in case users run into this. If NuGet isn't present, Install-Module -Name TrustedSigning will fail, so we'll get the logs at that point
-            log.debug({ message: error.message || error.stack }, "unable to install PackageProvider Nuget. Might be a false alarm though as some systems already have it installed");
+            log.debug({ message: error.message || error.stack }, "unable to install PackageProvider NuGet — may already be present");
         }
         await vm.exec(ps, ["-NoProfile", "-NonInteractive", "-Command", "Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser"]);
-        // If signing has been misconfigured it, the error from the TrustedSigning module should be descriptive enough to help them fix their configuration.
-        // Options: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition
     }
-    computePublisherName() {
-        return Promise.resolve(this.packager.platformOptions.azureSignOptions.publisherName);
+    computePublisherName(_target, publisherName) {
+        return Promise.resolve(this.publisherName ?? publisherName);
     }
-    // prerequisite: requires `initializeProviderModules` to already have been executed
     async signFile(options) {
+        return this.isLegacyMode() ? this.signFileLegacy(options) : this.signFileWithDlib(options);
+    }
+    async signFileLegacy(options) {
+        const { signing } = this;
         const vm = await this.packager.vm.value;
         const ps = await vm.powershellCommand.value;
-        const { publisherName: _publisher, // extract from `extraSigningArgs`
-        endpoint, certificateProfileName, codeSigningAccountName, fileDigest, timestampRfc3161, timestampDigest, ...extraSigningArgs } = options.options.azureSignOptions;
+        // Validate additionalMetadata keys before embedding as PS parameter names.
+        // Keys flow directly into `-${field} '...'` in the command string; a key
+        // containing semicolons or quotes would be PowerShell injection.
+        const PS_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+        for (const key of Object.keys(signing.additionalMetadata ?? {})) {
+            if (!PS_PARAM_NAME.test(key)) {
+                throw new Error(`additionalMetadata key "${key}" is not a valid PowerShell parameter name. Keys must match /^[A-Za-z_][A-Za-z0-9_]*$/ (e.g. "ExcludeCredentials", "CorrelationId").`);
+            }
+        }
         const params = {
-            ...extraSigningArgs,
-            Endpoint: endpoint,
-            CertificateProfileName: certificateProfileName,
-            CodeSigningAccountName: codeSigningAccountName,
-            TimestampRfc3161: timestampRfc3161 || "http://timestamp.acs.microsoft.com",
-            TimestampDigest: timestampDigest || "SHA256",
-            FileDigest: fileDigest || "SHA256",
+            Endpoint: signing.endpoint,
+            CertificateProfileName: signing.certificateProfileName,
+            CodeSigningAccountName: signing.codeSigningAccountName,
+            TimestampRfc3161: signing.timestampRfc3161 ?? "http://timestamp.acs.microsoft.com",
+            TimestampDigest: signing.timestampDigest ?? "SHA256",
+            FileDigest: signing.fileDigest ?? "SHA256",
+            ...signing.additionalMetadata,
             Files: vm.toVmFile(options.path),
         };
         const paramsString = Object.entries(params)
-            .filter(([_, value]) => value != null)
-            .reduce((res, [field, value]) => {
-            const escapedValue = String(value).replace(/'/g, "''");
-            return [...res, `-${field}`, `'${escapedValue}'`];
-        }, [])
+            .filter(([, value]) => value != null)
+            .map(([field, value]) => `-${field} '${String(value).replace(/'/g, "''")}'`)
             .join(" ");
-        await vm.exec(ps, ["-NoProfile", "-NonInteractive", "-Command", `Invoke-TrustedSigning ${paramsString}`]);
+        // Use -EncodedCommand (Base64 UTF-16LE) so the command string is opaque to any
+        // intermediate shell or argument parser — no cmd.exe / ConHost escaping needed.
+        // PowerShell still parses the decoded string, so PS-level single-quote escaping above is retained.
+        const psCommand = `Invoke-TrustedSigning ${paramsString}`;
+        const encodedCommand = Buffer.from(psCommand, "utf16le").toString("base64");
+        await vm.exec(ps, ["-NoProfile", "-NonInteractive", "-EncodedCommand", encodedCommand]);
+        return true;
+    }
+    async signFileWithDlib(options) {
+        const { signing } = this;
+        const winCodeSign = this.packager.config.toolsets.winCodeSign;
+        // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64
+        // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under
+        // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.
+        const arch = process.arch === "ia32" ? Arch.ia32 : Arch.x64;
+        const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, arch, resourcesDir: this.packager.buildResourcesDir });
+        // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.
+        // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).
+        const safeKitDir = sanitizeDirPath(kitDir, typeof winCodeSign === "object" ? this.packager.buildResourcesDir : undefined);
+        const signtoolPath = path.join(safeKitDir, "signtool.exe");
+        let dlibPath;
+        let dotnetRootPath = null;
+        if (typeof winCodeSign === "string") {
+            // 1.3.0+: dlib ships in a separate ats-bundle with its full native dependency closure
+            // (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is in a separate dotnet-runtime
+            // bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll → shared framework.
+            const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(winCodeSign));
+            dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? "x86" : "x64", "Azure.CodeSigning.Dlib.dll");
+            dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(winCodeSign));
+        }
+        else {
+            // Custom toolset: user provides the dlib alongside signtool in the kit dir.
+            dlibPath = path.join(safeKitDir, "Azure.CodeSigning.Dlib.dll");
+        }
+        const metadataPath = await this.packager.getTempFile(".json");
+        await _fsExtra.writeJson(metadataPath, {
+            Endpoint: signing.endpoint,
+            CodeSigningAccountName: signing.codeSigningAccountName,
+            CertificateProfileName: signing.certificateProfileName,
+            ...signing.additionalMetadata,
+        });
+        const args = [
+            "sign",
+            "/fd",
+            (signing.fileDigest ?? "SHA256").toUpperCase(),
+            "/tr",
+            signing.timestampRfc3161 ?? "http://timestamp.acs.microsoft.com",
+            "/td",
+            (signing.timestampDigest ?? "SHA256").toUpperCase(),
+            "/dlib",
+            this.vm.toVmFile(dlibPath),
+            "/dmdf",
+            this.vm.toVmFile(metadataPath),
+            this.vm.toVmFile(options.path),
+        ];
+        log.info({
+            file: log.filePath(options.path),
+            endpoint: signing.endpoint,
+            account: signing.codeSigningAccountName,
+            profile: signing.certificateProfileName,
+        }, "signing with Azure Trusted Signing (signtool /dlib)");
+        // DOTNET_ROOT: Ijwhost.dll (shipped in the ats-bundle) reads this env var to locate
+        // hostfxr.dll. On Wine, toVmFile converts the host path to a Z:\ path that Wine resolves
+        // back to the same location on the host filesystem.
+        const execOptions = dotnetRootPath != null ? { env: { DOTNET_ROOT: this.vm.toVmFile(dotnetRootPath) } } : undefined;
+        await this.vm.exec(signtoolPath, args, execOptions);
         return true;
     }
 }

package/dist/codeSign/win/windowsSignAzureManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAO/B,MAAM,OAAO,uBAAuB;IAgBlC,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAbzC,0BAAqB,GAAG,IAAI,IAAI,CAAuB,GAAG,EAAE;YACnE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,aAAa,CAAA;YAC1E,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC9B,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;YAChD,CAAC;YAED,6FAA6F;YAC7F,uBAAuB;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,CAAC,CAAA;QA2BO,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EACnC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QA3BC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,mEAAmE;YACnE,gKAAgK;YAChK,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kHAAkH,CAAC,CAAA;QAC1K,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC,CAAA;QAE7K,oJAAoJ;QACpJ,0HAA0H;IAC5H,CAAC;IAED,oBAAoB;QAClB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,gBAAiB,CAAC,aAAa,CAAC,CAAA;IACvF,CAAC;IAKD,mFAAmF;IACnF,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,MAAM,EACJ,aAAa,EAAE,UAAU,EAAE,kCAAkC;QAC7D,QAAQ,EACR,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,GAAG,gBAAgB,EACpB,GAAqC,OAAO,CAAC,OAAO,CAAC,gBAAiB,CAAA;QACvE,MAAM,MAAM,GAAG;YACb,GAAG,gBAAgB;YACnB,QAAQ,EAAE,QAAQ;YAClB,sBAAsB,EAAE,sBAAsB;YAC9C,sBAAsB,EAAE,sBAAsB;YAC9C,gBAAgB,EAAE,gBAAgB,IAAI,oCAAoC;YAC1E,eAAe,EAAE,eAAe,IAAI,QAAQ;YAC5C,UAAU,EAAE,UAAU,IAAI,QAAQ;YAClC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAA;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACrC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;YAC9B,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACtD,OAAO,CAAC,GAAG,GAAG,EAAE,IAAI,KAAK,EAAE,EAAE,IAAI,YAAY,GAAG,CAAC,CAAA;QACnD,CAAC,EAAE,EAAc,CAAC;aACjB,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yBAAyB,YAAY,EAAE,CAAC,CAAC,CAAA;QAEzG,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { asArray, log } from \"builder-util\"\nimport { MemoLazy } from \"builder-util-runtime\"\nimport { Lazy } from \"lazy-val\"\nimport { WindowsAzureSigningConfiguration, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignManager } from \"../signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager.js\"\n\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly platformOptions: WindowsConfiguration\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    const publisherName = this.platformOptions.azureSignOptions?.publisherName\n    if (publisherName === null) {\n      return Promise.resolve(null)\n    } else if (publisherName != null) {\n      return Promise.resolve(asArray(publisherName))\n    }\n\n    // TODO: Is there another way to automatically pull Publisher Name from AzureTrusted service?\n    // For now return null.\n    return Promise.resolve(null)\n  })\n\n  constructor(private readonly packager: WinPackager) {\n    this.platformOptions = packager.platformOptions\n  }\n\n  async initialize() {\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      // Might not be needed, seems GH runners already have NuGet set up.\n      // Logging to debug just in case users run into this. If NuGet isn't present, Install-Module -Name TrustedSigning will fail, so we'll get the logs at that point\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider Nuget. Might be a false alarm though as some systems already have it installed\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser\"])\n\n    // If signing has been misconfigured it, the error from the TrustedSigning module should be descriptive enough to help them fix their configuration.\n    // Options: https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet#definition\n  }\n\n  computePublisherName(): Promise<string> {\n    return Promise.resolve(this.packager.platformOptions.azureSignOptions!.publisherName)\n  }\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformOptions,\n    _selected => Promise.resolve(null)\n  )\n  // prerequisite: requires `initializeProviderModules` to already have been executed\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    const {\n      publisherName: _publisher, // extract from `extraSigningArgs`\n      endpoint,\n      certificateProfileName,\n      codeSigningAccountName,\n      fileDigest,\n      timestampRfc3161,\n      timestampDigest,\n      ...extraSigningArgs\n    }: WindowsAzureSigningConfiguration = options.options.azureSignOptions!\n    const params = {\n      ...extraSigningArgs,\n      Endpoint: endpoint,\n      CertificateProfileName: certificateProfileName,\n      CodeSigningAccountName: codeSigningAccountName,\n      TimestampRfc3161: timestampRfc3161 || \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: timestampDigest || \"SHA256\",\n      FileDigest: fileDigest || \"SHA256\",\n      Files: vm.toVmFile(options.path),\n    }\n    const paramsString = Object.entries(params)\n      .filter(([_, value]) => value != null)\n      .reduce((res, [field, value]) => {\n        const escapedValue = String(value).replace(/'/g, \"''\")\n        return [...res, `-${field}`, `'${escapedValue}'`]\n      }, [] as string[])\n      .join(\" \")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", `Invoke-TrustedSigning ${paramsString}`])\n\n    return true\n  }\n}\n"]}
+{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,kCAAkC,EAAmD,MAAM,6BAA6B,CAAA;AACjI,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAC1G,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKlD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,MAAM,gCAAgC,GAAG,OAAO,CAAA;AAChD,MAAM,OAAO,uBAAuB;IAUlC,IAAY,aAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAA;QACzC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;QAC/H,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAflD,4FAA4F;QAC3E,OAAE,GAAc,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAEhK,0BAAqB,GAAG,IAAI,IAAI,CAAuB,GAAG,EAAE;YACnE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QAsDO,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EACnC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QA9CC,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iEAAiE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEO,YAAY;QAClB,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;QACvE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAA;QACzD,CAAC;QACD,oGAAoG;QACpG,OAAO,GAAG,IAAI,IAAI,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;QACvE,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,GAAG,2BAA2B,gCAAgC,GAAG,CAAC,CAAC,CAAC,iCAAiC,CAAA;QACvK,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,QAAQ,EAAE,gCAAgC,gCAAgC,gDAAgD,EAAE,EACtI,kFAAkF,CACnF,CAAA;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kEAAkE,CAAC,CAAA;QAC1H,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC,CAAA;IAC/K,CAAC;IAED,oBAAoB,CAAC,OAAe,EAAE,aAA4B;QAChE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,CAAA;IAC7D,CAAC;IAOD,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA2B;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,aAAa,GAAG,0BAA0B,CAAA;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,sIAAsI,CACrK,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAuC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAClF,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ;YACpD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;YAC1C,GAAG,OAAO,CAAC,kBAAkB;YAC7B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAA;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;aAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,+EAA+E;QAC/E,gFAAgF;QAChF,mGAAmG;QACnG,MAAM,SAAS,GAAG,yBAAyB,YAAY,EAAE,CAAA;QACzD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAA2B;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAS,CAAC,WAAY,CAAA;QAE/D,yFAAyF;QACzF,wFAAwF;QACxF,wEAAwE;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;QACxH,uFAAuF;QACvF,2FAA2F;QAC3F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACzH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;QAE1D,IAAI,QAAgB,CAAA;QACpB,IAAI,cAAc,GAAkB,IAAI,CAAA;QAExC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,sFAAsF;YACtF,0FAA0F;YAC1F,kFAAkF;YAClF,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;YACtE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAA;YAClG,cAAc,GAAG,eAAe,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAA;QAC1E,CAAC;aAAM,CAAC;YACN,4EAA4E;YAC5E,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,GAAG,OAAO,CAAC,kBAAkB;SAC9B,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG;YACX,MAAM;YACN,KAAK;YACL,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YAC9C,KAAK;YACL,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAChE,KAAK;YACL,CAAC,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YACnD,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/B,CAAA;QAED,GAAG,CAAC,IAAI,CACN;YACE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,sBAAsB;YACvC,OAAO,EAAE,OAAO,CAAC,sBAAsB;SACxC,EACD,qDAAqD,CACtD,CAAA;QAED,oFAAoF;QACpF,yFAAyF;QACzF,oDAAoD;QACpD,MAAM,WAAW,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACnH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { Arch, isEmptyOrSpaces, log, sanitizeDirPath } from \"builder-util\"\nimport { asArray, MemoLazy } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport { resolveWindowsSigningConfiguration, WindowsAzureSigningConfig, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle } from \"../../toolsets/winCodeSign.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport { WineVmManager } from \"../../vm/WineVm.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager.js\"\nimport semver from \"semver\"\n\nconst minimumWinCodeSignVersionForDlib = \"1.3.0\"\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly signing: WindowsAzureSigningConfig\n\n  // signtool.exe is a Windows PE binary; use Wine on non-Windows (same pattern as MsiTarget).\n  private readonly vm: VmManager = process.platform === \"win32\" ? new VmManager() : new WineVmManager(this.packager.config.toolsets?.wine, this.packager.buildResourcesDir)\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    return Promise.resolve(asArray(this.publisherName))\n  })\n\n  private get publisherName(): string {\n    const result = this.signing.publisherName\n    if (isEmptyOrSpaces(result)) {\n      throw new Error(\"Azure Trusted Signing requires 'publisherName' in win.sign config (no local certificate to derive it from)\")\n    }\n    return result\n  }\n\n  constructor(private readonly packager: WinPackager) {\n    const signing = resolveWindowsSigningConfiguration(packager.platformOptions)\n    if (signing?.type !== \"azure\") {\n      throw new Error(`WindowsSignAzureManager requires signing.type = \"azure\", got: ${signing?.type}`)\n    }\n    this.signing = signing\n  }\n\n  private isLegacyMode(): boolean {\n    const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {}\n    if (typeof wcs === \"string\") {\n      return semver.lt(wcs, minimumWinCodeSignVersionForDlib)\n    }\n    // null = built-in toolset not configured → legacy; ToolsetCustom object = user-managed → not legacy\n    return wcs == null\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.isLegacyMode()) {\n      return\n    }\n\n    const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {}\n    const reason = typeof wcs === \"string\" ? `toolsets.winCodeSign \"${wcs}\" is below the minimum \"${minimumWinCodeSignVersionForDlib}\"` : `toolsets.winCodeSign is not set`\n    log.info(\n      { reason, guidance: `set toolsets.winCodeSign to \"${minimumWinCodeSignVersionForDlib}\" to use the faster signtool /dlib integration` },\n      `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`\n    )\n\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider NuGet — may already be present\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser\"])\n  }\n\n  computePublisherName(_target: Target, publisherName: string | null): Promise<string> {\n    return Promise.resolve(this.publisherName ?? publisherName)\n  }\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformOptions,\n    _selected => Promise.resolve(null)\n  )\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    return this.isLegacyMode() ? this.signFileLegacy(options) : this.signFileWithDlib(options)\n  }\n\n  private async signFileLegacy(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    // Validate additionalMetadata keys before embedding as PS parameter names.\n    // Keys flow directly into `-${field} '...'` in the command string; a key\n    // containing semicolons or quotes would be PowerShell injection.\n    const PS_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/\n    for (const key of Object.keys(signing.additionalMetadata ?? {})) {\n      if (!PS_PARAM_NAME.test(key)) {\n        throw new Error(\n          `additionalMetadata key \"${key}\" is not a valid PowerShell parameter name. Keys must match /^[A-Za-z_][A-Za-z0-9_]*$/ (e.g. \"ExcludeCredentials\", \"CorrelationId\").`\n        )\n      }\n    }\n\n    const params: Record<string, string | undefined> = {\n      Endpoint: signing.endpoint,\n      CertificateProfileName: signing.certificateProfileName,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      TimestampRfc3161: signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: signing.timestampDigest ?? \"SHA256\",\n      FileDigest: signing.fileDigest ?? \"SHA256\",\n      ...signing.additionalMetadata,\n      Files: vm.toVmFile(options.path),\n    }\n\n    const paramsString = Object.entries(params)\n      .filter(([, value]) => value != null)\n      .map(([field, value]) => `-${field} '${String(value).replace(/'/g, \"''\")}'`)\n      .join(\" \")\n\n    // Use -EncodedCommand (Base64 UTF-16LE) so the command string is opaque to any\n    // intermediate shell or argument parser — no cmd.exe / ConHost escaping needed.\n    // PowerShell still parses the decoded string, so PS-level single-quote escaping above is retained.\n    const psCommand = `Invoke-TrustedSigning ${paramsString}`\n    const encodedCommand = Buffer.from(psCommand, \"utf16le\").toString(\"base64\")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encodedCommand])\n    return true\n  }\n\n  private async signFileWithDlib(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const winCodeSign = this.packager.config.toolsets!.winCodeSign!\n\n    // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64\n    // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under\n    // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.\n    const arch = process.arch === \"ia32\" ? Arch.ia32 : Arch.x64\n    const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, arch, resourcesDir: this.packager.buildResourcesDir })\n    // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.\n    // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).\n    const safeKitDir = sanitizeDirPath(kitDir, typeof winCodeSign === \"object\" ? this.packager.buildResourcesDir : undefined)\n    const signtoolPath = path.join(safeKitDir, \"signtool.exe\")\n\n    let dlibPath: string\n    let dotnetRootPath: string | null = null\n\n    if (typeof winCodeSign === \"string\") {\n      // 1.3.0+: dlib ships in a separate ats-bundle with its full native dependency closure\n      // (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is in a separate dotnet-runtime\n      // bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll → shared framework.\n      const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(winCodeSign))\n      dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? \"x86\" : \"x64\", \"Azure.CodeSigning.Dlib.dll\")\n      dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(winCodeSign))\n    } else {\n      // Custom toolset: user provides the dlib alongside signtool in the kit dir.\n      dlibPath = path.join(safeKitDir, \"Azure.CodeSigning.Dlib.dll\")\n    }\n\n    const metadataPath = await this.packager.getTempFile(\".json\")\n    await _fsExtra.writeJson(metadataPath, {\n      Endpoint: signing.endpoint,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      CertificateProfileName: signing.certificateProfileName,\n      ...signing.additionalMetadata,\n    })\n\n    const args = [\n      \"sign\",\n      \"/fd\",\n      (signing.fileDigest ?? \"SHA256\").toUpperCase(),\n      \"/tr\",\n      signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      \"/td\",\n      (signing.timestampDigest ?? \"SHA256\").toUpperCase(),\n      \"/dlib\",\n      this.vm.toVmFile(dlibPath),\n      \"/dmdf\",\n      this.vm.toVmFile(metadataPath),\n      this.vm.toVmFile(options.path),\n    ]\n\n    log.info(\n      {\n        file: log.filePath(options.path),\n        endpoint: signing.endpoint,\n        account: signing.codeSigningAccountName,\n        profile: signing.certificateProfileName,\n      },\n      \"signing with Azure Trusted Signing (signtool /dlib)\"\n    )\n\n    // DOTNET_ROOT: Ijwhost.dll (shipped in the ats-bundle) reads this env var to locate\n    // hostfxr.dll. On Wine, toVmFile converts the host path to a Z:\\ path that Wine resolves\n    // back to the same location on the host filesystem.\n    const execOptions = dotnetRootPath != null ? { env: { DOTNET_ROOT: this.vm.toVmFile(dotnetRootPath) } } : undefined\n    await this.vm.exec(signtoolPath, args, execOptions)\n    return true\n  }\n}\n"]}

package/dist/codeSign/win/windowsSignToolManager.d.ts

@@ -1,59 +1,2 @@
-import { MemoLazy } from "builder-util-runtime";
-import { Lazy } from "lazy-val";
-import { Target } from "../../core.js";
-import { WindowsConfiguration } from "../../options/winOptions.js";
-import { ToolInfo } from "../../util/bundledTool.js";
-import { VmManager } from "../../vm/vm.js";
-import { WinPackager } from "../../winPackager.js";
-import { SignManager } from "../signManager.js";
-import { WindowsSignOptions } from "./windowsCodeSign.js";
-export type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>;
-export interface WindowsSignToolOptions extends WindowsSignOptions {
-    readonly name: string;
-    readonly site: string | null;
-}
-export interface FileCodeSigningInfo {
-    readonly file: string;
-    readonly password: string | null;
-}
-export interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {
-    readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null;
-    resultOutputPath?: string;
-    hash: string;
-    isNest: boolean;
-}
-export interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {
-    computeSignToolArgs(isWin: boolean): Array<string>;
-}
-export interface CertificateInfo {
-    readonly commonName: string;
-    readonly bloodyMicrosoftSubjectDn: string;
-}
-export interface CertificateFromStoreInfo {
-    thumbprint: string;
-    subject: string;
-    store: string;
-    isLocalMachineStore: boolean;
-}
-export declare class WindowsSignToolManager implements SignManager {
-    private readonly packager;
-    private readonly platformOptions;
-    constructor(packager: WinPackager);
-    readonly computedPublisherName: Lazy<string[] | null>;
-    readonly lazyCertInfo: MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>;
-    readonly cscInfo: MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>;
-    initialize(): Promise<void>;
-    computePublisherName(target: Target, publisherName: string): Promise<string>;
-    signFile(options: WindowsSignOptions): Promise<boolean>;
-    getCertInfo(file: string, password: string): Promise<CertificateInfo>;
-    computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm?: VmManager): Array<string>;
-    private computeWindowsSignArgs;
-    private computeOsslsigncodeArgs;
-    private addCertificateArgs;
-    private addCommonSigningArgs;
-    getOutputPath(inputPath: string, hash: string): string;
-    getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo>;
-    getToolPath(isWin?: boolean): Promise<ToolInfo>;
-    doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager): Promise<void>;
-}
+export { CertificateFromStoreInfo, CertificateInfo, CustomWindowsSign, CustomWindowsSignTaskConfiguration, FileCodeSigningInfo, getSigntoolFamilyConfig, SigntoolSignManager as WindowsSignToolManager, WindowsSignTaskConfiguration, WindowsSignToolOptions, } from "./signtoolBaseSignManager.js";
 //# sourceMappingURL=windowsSignToolManager.d.ts.map

package/dist/codeSign/win/windowsSignToolManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"windowsSignToolManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignToolManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAGlE,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAGpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGlD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAGzD,MAAM,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;AAE3H,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,IAAI,CAAA;IAGvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,kCAAmC,SAAQ,4BAA4B;IACtF,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,mBAAmB,EAAE,OAAO,CAAA;CAC7B;AAQD,qBAAa,sBAAuB,YAAW,WAAW;IAG5C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAFrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;gBAEzB,QAAQ,EAAE,WAAW;IAIlD,QAAQ,CAAC,qBAAqB,wBAU5B;IAEF,QAAQ,CAAC,YAAY,0HAsBpB;IAED,QAAQ,CAAC,OAAO,wFAmDf;IAED,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;IAc1D,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiEvD,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAU3E,mBAAmB,CAAC,OAAO,EAAE,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAE,SAA2B,GAAG,KAAK,CAAC,MAAM,CAAC;IAI1H,OAAO,CAAC,sBAAsB;IA+C9B,OAAO,CAAC,uBAAuB;IA+B/B,OAAO,CAAC,kBAAkB;IA6B1B,OAAO,CAAC,oBAAoB;IAwB5B,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAKvC,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAqC5G,WAAW,CAAC,KAAK,UAA+B,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIpE,MAAM,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,EAAE,WAAW;CAmCtF"}
+{"version":3,"file":"windowsSignToolManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignToolManager.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,kCAAkC,EAClC,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,IAAI,sBAAsB,EAC7C,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,8BAA8B,CAAA"}