app-builder-lib 27.0.0-alpha.4 → 27.0.0-alpha.5

package/dist/codeSign/mac/macCodeSign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"macCodeSign.d.ts","sourceRoot":"","sources":["../../../src/codeSign/mac/macCodeSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAyG,MAAM,EAAkB,MAAM,cAAc,CAAA;AAC5J,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAU9C,eAAO,MAAM,wBAAwB,UAAyI,CAAA;AAE9K,MAAM,MAAM,QAAQ,GAChB,0BAA0B,GAC1B,wBAAwB,GACxB,qCAAqC,GACrC,mCAAmC,GACnC,eAAe,GACf,mBAAmB,GACnB,oBAAoB,CAAA;AAExB,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,wBAAgB,aAAa,CAAC,WAAW,UAAO,GAAG,OAAO,CA6BzD;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,EAAE,kBAAkB,EAAE,OAAO,iBAqCvK;AAsCD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,UAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAOnF;AAED,wBAAsB,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6ChK;AAiBD,wBAAsB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3D;AAED,eAAO,IAAI,qBAAqB,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,IAAW,CAAA;AAiHtE,qBAAa,QAAQ;IAEjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBADb,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,YAAA;CAEzB;AASD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAe9H"}
+{"version":3,"file":"macCodeSign.d.ts","sourceRoot":"","sources":["../../../src/codeSign/mac/macCodeSign.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAyG,MAAM,EAAkB,MAAM,cAAc,CAAA;AAC5J,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAW9C,eAAO,MAAM,wBAAwB,UAAyI,CAAA;AAE9K,MAAM,MAAM,QAAQ,GAChB,0BAA0B,GAC1B,wBAAwB,GACxB,qCAAqC,GACrC,mCAAmC,GACnC,eAAe,GACf,mBAAmB,GACnB,oBAAoB,CAAA;AAExB,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,wBAAgB,aAAa,CAAC,WAAW,UAAO,GAAG,OAAO,CA6BzD;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,EAAE,kBAAkB,EAAE,OAAO,iBAqCvK;AAiCD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,UAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAOnF;AAED,wBAAsB,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6ChK;AAiBD,wBAAsB,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3D;AAED,eAAO,IAAI,qBAAqB,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,IAAW,CAAA;AAiHtE,qBAAa,QAAQ;IAEjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBADb,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,YAAA;CAEzB;AASD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAe9H"}

package/dist/codeSign/mac/macCodeSign.js

@@ -3,11 +3,12 @@ import { copyFile, exec, InvalidConfigurationError, isEmptyOrSpaces, isPullReque
 import { createHash, randomBytes } from "crypto";
 import { rename } from "fs/promises";
 import { Lazy } from "lazy-val";
-import { homedir, tmpdir } from "os";
+import { tmpdir } from "os";
 import * as path from "path";
 import { getTempName } from "temp-file";
 import { isAutoDiscoveryCodeSignIdentity, isCscForPullRequest, isTravis } from "../../util/flags.js";
 import { importCertificate } from "../codesign.js";
+import { cacheDirectoryOverrideAllowed } from "../../util/electronGet.js";
 export const appleCertificatePrefixes = ["Developer ID Application:", "Developer ID Installer:", "3rd Party Mac Developer Application:", "3rd Party Mac Developer Installer:"];
 export function isSignAllowed(isPrintWarn = true) {
     if (process.platform !== "darwin") {
@@ -75,7 +76,7 @@ export async function reportError(isMas, certificateTypes, qualifier, keychainFi
 // https://github.com/electron-userland/electron-builder/issues/398
 const bundledCertKeychainAdded = new Lazy(async () => {
     // copy to temp and then atomic rename to final path
-    const cacheDir = getCacheDirectory();
+    const cacheDir = await cacheDirectoryOverrideAllowed.value;
     const tmpKeychainPath = path.join(cacheDir, getTempName("electron-builder-root-certs"));
     const keychainPath = path.join(cacheDir, "electron-builder-root-certs.keychain");
     const results = await Promise.all([
@@ -87,10 +88,6 @@ const bundledCertKeychainAdded = new Lazy(async () => {
         await exec("/usr/bin/security", ["list-keychains", "-d", "user", "-s", keychainPath].concat(list));
     }
 });
-function getCacheDirectory() {
-    const env = process.env.ELECTRON_BUILDER_CACHE;
-    return isEmptyOrSpaces(env) ? path.join(homedir(), "Library", "Caches", "electron-builder") : path.resolve(env);
-}
 function listUserKeychains() {
     return exec("/usr/bin/security", ["list-keychains", "-d", "user"]).then(it => it
         .split("\n")

package/dist/codeSign/mac/macCodeSign.js.map

@@ -1 +1 @@
-{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../../src/codeSign/mac/macCodeSign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,IAAI,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAU,yBAAyB,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAU,cAAc,EAAE,MAAM,cAAc,CAAA;AAE5J,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AACpC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,MAAM,UAAU,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,MAAM,iBAAiB,GACrB,kKAAkK;YAClK,6LAA6L,CAAA;QAE/L,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,GAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,gBAA4B,EAAE,SAA2B,EAAE,YAA8B,EAAE,kBAA2B;IACtK,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,+BAA+B,EAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,+BAA+B,EAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAA;IAC5D,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,IAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAA;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KAC9J,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAA;IAC9C,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChB,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1H,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;QAC9B,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,IAAI,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,4GAA4G;AAC5G,uGAAuG;AACvG,sGAAsG;AACtG,2GAA2G;AAC3G,IAAI,gCAAgC,GAAG,KAAK,CAAA;AAE5C,wHAAwH;AACxH,MAAM,UAAU,6CAA6C,CAAC,KAAc;IAC1E,gCAAgC,GAAG,KAAK,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,qBAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,QAAQ,GAAG;YACf,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAA;QAED,yGAAyG;QACzG,wGAAwG;QACxG,IAAI,gCAAgC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC5G,CAAC;QAED,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACtD,MAAM,KAAK,GAAG,EAAE;iBACb,IAAI,EAAE;iBACN,MAAM,CACL,EAAE,CAAC,EAAE,CACH,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;gBAC5C,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAChC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACnC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACnC,CAAC,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBACrC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACvB,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAC9C;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,qBAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,wIAAwI;AACxI,MAAM,OAAO,QAAQ;IACnB,YACW,IAAY,EACZ,IAAa;QADb,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAS;IACrB,CAAC;CACL;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import type { SignOptions } from \"@electron/osx-sign\"\nimport { sign as _sign } from \"@electron/osx-sign\"\nimport { copyFile, exec, Fields, InvalidConfigurationError, isEmptyOrSpaces, isPullRequest, log, Logger, retry, TmpDir, unlinkIfExists } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { createHash, randomBytes } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { homedir, tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { isAutoDiscoveryCodeSignIdentity, isCscForPullRequest, isTravis } from \"../../util/flags.js\"\nimport { importCertificate } from \"../codesign.js\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  if (isPullRequest()) {\n    const buildForPrWarning =\n      \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n      \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n    if (isCscForPullRequest()) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n\n  return true\n}\n\nexport async function reportError(isMas: boolean, certificateTypes: CertType[], qualifier: string | Nullish, keychainFile: string | Nullish, isForceCodeSigning: boolean) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  const skipMessage = \"skipped macOS application code signing\"\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(skipMessage, logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, skipMessage)\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = getCacheDirectory()\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(import.meta.dirname, \"..\", \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction getCacheDirectory(): string {\n  const env = process.env.ELECTRON_BUILDER_CACHE\n  return isEmptyOrSpaces(env) ? path.join(homedir(), \"Library\", \"Caches\", \"electron-builder\") : path.resolve(env)\n}\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (!isTravis()) {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  // Import all certs in parallel, then run security commands sequentially.\n  await Promise.all(certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))))\n  for (const cmd of securityCommands) {\n    await exec(\"/usr/bin/security\", cmd)\n  }\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i] ?? \"\"\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  return retry(() => _sign(opts), {\n    retries: 3,\n    interval: 5000,\n    backoff: 5000,\n  })\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\n// Discovery of untrusted self-signed identities is OFF in production, and there is intentionally NO env var\n// or build-config option to enable it: an untrusted identity must never be silently accepted in a real\n// build. This in-process flag exists solely as a seam for electron-builder's own signing tests, which\n// provision an ephemeral self-signed cert and flip it via setAllowUntrustedSelfSignedIdentityForTesting().\nlet allowUntrustedSelfSignedIdentity = false\n\n/** @internal Test-only. Enables discovery of untrusted self-signed code-signing identities. Never use in production. */\nexport function setAllowUntrustedSelfSignedIdentityForTesting(value: boolean): void {\n  allowUntrustedSelfSignedIdentity = value\n}\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    const commands = [\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]\n\n    // Test-only seam: also accept untrusted self-signed identities. `find-identity` without `-v` lists them;\n    // trusted identities discovered above still take precedence (they appear first and dupes are de-duped).\n    if (allowUntrustedSelfSignedIdentity) {\n      commands.push(exec(\"/usr/bin/security\", addKeychain([\"find-identity\"])).then(it => it.trim().split(\"\\n\")))\n    }\n\n    result = Promise.all<Array<string>>(commands).then(it => {\n      const array = it\n        .flat()\n        .filter(\n          it =>\n            !it.includes(\"(Missing required extension)\") &&\n            !it.includes(\"identities found\") &&\n            !it.includes(\"Policy: X.509 Basic\") &&\n            !it.includes(\"Matching identities\") &&\n            !it.includes(\"Valid identities only\") &&\n            !it.includes(\"iPhone \") &&\n            !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return parseIdentity(line)\n    }\n  }\n  return null\n}\n\n// @electron/osx-sign v2 no longer exposes its `Identity` class via the package's public exports, so we own this lightweight equivalent.\nexport class Identity {\n  constructor(\n    readonly name: string,\n    readonly hash?: string\n  ) {}\n}\n\nfunction parseIdentity(line: string): Identity {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  return new Identity(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}
+{"version":3,"file":"macCodeSign.js","sourceRoot":"","sources":["../../../src/codeSign/mac/macCodeSign.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,IAAI,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAU,yBAAyB,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAU,cAAc,EAAE,MAAM,cAAc,CAAA;AAE5J,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAA;AAEzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,2BAA2B,EAAE,yBAAyB,EAAE,sCAAsC,EAAE,oCAAoC,CAAC,CAAA;AAe9K,MAAM,UAAU,aAAa,CAAC,WAAW,GAAG,IAAI;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,wCAAwC,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,MAAM,iBAAiB,GACrB,kKAAkK;YAClK,6LAA6L,CAAA;QAE/L,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,WAAW,EAAE,CAAC;gBAChB,oEAAoE;gBACpE,GAAG,CAAC,IAAI,CACN,wEAAwE,GAAG,+DAA+D,GAAG,KAAK,iBAAiB,EAAE,CACtK,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,gBAA4B,EAAE,SAA2B,EAAE,YAA8B,EAAE,kBAA2B;IACtK,MAAM,SAAS,GAAW,EAAE,CAAA;IAC5B,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE,CAAA;QACrB,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,SAAS,CAAC,MAAM,IAAI,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,aACnE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sIACf,EAAE,CAAA;QACJ,CAAC;QACD,SAAS,CAAC,MAAM,IAAI,2CAA2C,CAAA;QAC/D,IAAI,CAAC,+BAA+B,EAAE,EAAE,CAAC;YACvC,SAAS,CAAC,2BAA2B,GAAG,KAAK,CAAA;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,MAAM,GAAG,kFAAkF,CAAA;QACrG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAA;IAChC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,IAAI,+BAA+B,EAAE,EAAE,CAAC;QAC3D,SAAS,CAAC,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;aAC9D,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC;aACzF,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAA;IAC5D,IAAI,KAAK,IAAI,kBAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAED,sJAAsJ;AACtJ,+LAA+L;AAC/L,wDAAwD;AACxD,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,IAAI,IAAI,CAAO,KAAK,IAAI,EAAE;IACzD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAA;IAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAA;IAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAM;QACrC,iBAAiB,EAAE;QACnB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;KAC9J,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAC3E,EAAE;SACC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,EAAE,CAAC,EAAE;QACR,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;QACnB,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC;SACD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAA;AACH,CAAC;AAWD,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,SAAS,GAAG,IAAI;IACnE,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;QACnF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,cAAc,CAAC,YAAY,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAyB;IACpI,sCAAsC;IACtC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChB,MAAM,wBAAwB,CAAC,KAAK,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,oBAAoB;IACpB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACtK,oCAAoC;IAEpC,MAAM,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClD,WAAW;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,gBAAgB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC3D,MAAM,gBAAgB,GAAG;QACvB,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,CAAC;QACzD,CAAC,uBAAuB,EAAE,YAAY,CAAC;KACxC,CAAA;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1H,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,YAAY,GAAkB,CAAC,cAAc,CAAC,CAAA;IACpD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,KAAoB,EAAE,YAA2B;IAChG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAEnJ,6HAA6H;QAC7H,2FAA2F;QAC3F,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,wBAAwB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAC7H,CAAC;IAED,OAAO;QACL,YAAY;KACb,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAiB;IAC1C,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;QAC9B,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,IAAI,qBAAqB,GAAkC,IAAI,CAAA;AAEtE,4GAA4G;AAC5G,uGAAuG;AACvG,sGAAsG;AACtG,2GAA2G;AAC3G,IAAI,gCAAgC,GAAG,KAAK,CAAA;AAE5C,wHAAwH;AACxH,MAAM,UAAU,6CAA6C,CAAC,KAAc;IAC1E,gCAAgC,GAAG,KAAK,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAwB;IACxD,SAAS,WAAW,CAAC,IAAmB;QACtC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAM,GAAG,qBAAqB,CAAA;IAClC,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvC,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,QAAQ,GAAG;YACf,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CACxE,EAAE;iBACC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,EAAE,CAAC,EAAE;gBACX,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;oBAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxB,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CACL;YACD,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SACvH,CAAA;QAED,yGAAyG;QACzG,wGAAwG;QACxG,IAAI,gCAAgC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC5G,CAAC;QAED,MAAM,GAAG,OAAO,CAAC,GAAG,CAAgB,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YACtD,MAAM,KAAK,GAAG,EAAE;iBACb,IAAI,EAAE;iBACN,MAAM,CACL,EAAE,CAAC,EAAE,CACH,CAAC,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;gBAC5C,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAChC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACnC,CAAC,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACnC,CAAC,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gBACrC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACvB,CAAC,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAC9C;gBACD,YAAY;iBACX,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QAEF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,qBAAqB,GAAG,MAAM,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAyB,EAAE,QAAwB;IAC9F,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,SAAQ;QACV,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,6BAA6B;QAC7B,mEAAmE;QACnE,CAAC,EAAE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,SAAQ;YACV,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACpC,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,SAAS,CAAC,CAAA;gBACZ,CAAC;YACH,CAAC;YAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,wIAAwI;AACxI,MAAM,OAAO,QAAQ;IACnB,YACW,IAAY,EACZ,IAAa;QADb,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAS;IACrB,CAAC;CACL;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,SAAyB,EAAE,QAAwB;IAClG,IAAI,QAAQ,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAChD,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,IAAI,+BAA+B,EAAE,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;YAC9C,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,CAAC;QACD,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,MAAM,kFAAkF,CAAC,CAAA;IACxJ,CAAC;AACH,CAAC","sourcesContent":["import type { SignOptions } from \"@electron/osx-sign\"\nimport { sign as _sign } from \"@electron/osx-sign\"\nimport { copyFile, exec, Fields, InvalidConfigurationError, isEmptyOrSpaces, isPullRequest, log, Logger, retry, TmpDir, unlinkIfExists } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { createHash, randomBytes } from \"crypto\"\nimport { rename } from \"fs/promises\"\nimport { Lazy } from \"lazy-val\"\nimport { tmpdir } from \"os\"\nimport * as path from \"path\"\nimport { getTempName } from \"temp-file\"\nimport { isAutoDiscoveryCodeSignIdentity, isCscForPullRequest, isTravis } from \"../../util/flags.js\"\nimport { importCertificate } from \"../codesign.js\"\nimport { cacheDirectoryOverrideAllowed } from \"../../util/electronGet.js\"\n\nexport const appleCertificatePrefixes = [\"Developer ID Application:\", \"Developer ID Installer:\", \"3rd Party Mac Developer Application:\", \"3rd Party Mac Developer Installer:\"]\n\nexport type CertType =\n  | \"Developer ID Application\"\n  | \"Developer ID Installer\"\n  | \"3rd Party Mac Developer Application\"\n  | \"3rd Party Mac Developer Installer\"\n  | \"Mac Developer\"\n  | \"Apple Development\"\n  | \"Apple Distribution\"\n\nexport interface CodeSigningInfo {\n  keychainFile?: string | null\n}\n\nexport function isSignAllowed(isPrintWarn = true): boolean {\n  if (process.platform !== \"darwin\") {\n    if (isPrintWarn) {\n      log.warn({ reason: \"supported only on macOS\" }, \"skipped macOS application code signing\")\n    }\n    return false\n  }\n\n  if (isPullRequest()) {\n    const buildForPrWarning =\n      \"There are serious security concerns with CSC_FOR_PULL_REQUEST=true (see the  CircleCI documentation (https://circleci.com/docs/1.0/fork-pr-builds/) for details)\" +\n      \"\\nIf you have SSH keys, sensitive env vars or AWS credentials stored in your project settings and untrusted forks can make pull requests against your repo, then this option isn't for you.\"\n\n    if (isCscForPullRequest()) {\n      if (isPrintWarn) {\n        log.warn(buildForPrWarning)\n      }\n    } else {\n      if (isPrintWarn) {\n        // https://github.com/electron-userland/electron-builder/issues/1524\n        log.warn(\n          \"Current build is a part of pull request, code signing will be skipped.\" + \"\\nSet env CSC_FOR_PULL_REQUEST to true to force code signing.\" + `\\n${buildForPrWarning}`\n        )\n      }\n      return false\n    }\n  }\n\n  return true\n}\n\nexport async function reportError(isMas: boolean, certificateTypes: CertType[], qualifier: string | Nullish, keychainFile: string | Nullish, isForceCodeSigning: boolean) {\n  const logFields: Fields = {}\n  if (qualifier == null) {\n    logFields.reason = \"\"\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      logFields.reason += `cannot find valid \"${certificateTypes.join(\", \")}\" identity${\n        isMas ? \"\" : ` or custom non-Apple code signing certificate, it could cause some undefined behaviour, e.g. macOS localized description not visible`\n      }`\n    }\n    logFields.reason += \", see https://electron.build/code-signing\"\n    if (!isAutoDiscoveryCodeSignIdentity()) {\n      logFields.CSC_IDENTITY_AUTO_DISCOVERY = false\n    }\n  } else {\n    logFields.reason = \"Identity name is specified, but no valid identity with this name in the keychain\"\n    logFields.identity = qualifier\n  }\n\n  const args = [\"find-identity\"]\n  if (keychainFile != null) {\n    args.push(keychainFile)\n  }\n\n  if (qualifier != null || isAutoDiscoveryCodeSignIdentity()) {\n    logFields.allIdentities = (await exec(\"/usr/bin/security\", args))\n      .trim()\n      .split(\"\\n\")\n      .filter(it => !(it.includes(\"Policy: X.509 Basic\") || it.includes(\"Matching identities\")))\n      .join(\"\\n\")\n  }\n\n  const skipMessage = \"skipped macOS application code signing\"\n  if (isMas || isForceCodeSigning) {\n    throw new Error(Logger.createMessage(skipMessage, logFields, \"error\", it => it))\n  } else {\n    log.warn(logFields, skipMessage)\n  }\n}\n\n// \"Note that filename will not be searched to resolve the signing identity's certificate chain unless it is also on the user's keychain search list.\"\n// but \"security list-keychains\" doesn't support add - we should 1) get current list 2) set new list - it is very bad http://stackoverflow.com/questions/10538942/add-a-keychain-to-search-list\n// \"overly complicated and introduces a race condition.\"\n// https://github.com/electron-userland/electron-builder/issues/398\nconst bundledCertKeychainAdded = new Lazy<void>(async () => {\n  // copy to temp and then atomic rename to final path\n  const cacheDir = await cacheDirectoryOverrideAllowed.value\n  const tmpKeychainPath = path.join(cacheDir, getTempName(\"electron-builder-root-certs\"))\n  const keychainPath = path.join(cacheDir, \"electron-builder-root-certs.keychain\")\n  const results = await Promise.all<any>([\n    listUserKeychains(),\n    copyFile(path.join(import.meta.dirname, \"..\", \"..\", \"..\", \"certs\", \"root_certs.keychain\"), tmpKeychainPath).then(() => rename(tmpKeychainPath, keychainPath)),\n  ])\n  const list = results[0]\n  if (!list.includes(keychainPath)) {\n    await exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\", \"-s\", keychainPath].concat(list))\n  }\n})\n\nfunction listUserKeychains(): Promise<Array<string>> {\n  return exec(\"/usr/bin/security\", [\"list-keychains\", \"-d\", \"user\"]).then(it =>\n    it\n      .split(\"\\n\")\n      .map(it => {\n        const r = it.trim()\n        return r.substring(1, r.length - 1)\n      })\n      .filter(it => it.length > 0)\n  )\n}\n\nexport interface CreateKeychainOptions {\n  tmpDir: TmpDir\n  cscLink: string\n  cscKeyPassword: string\n  cscILink?: string | null\n  cscIKeyPassword?: string | null\n  currentDir: string\n}\n\nexport function removeKeychain(keychainFile: string, printWarn = true): Promise<any> {\n  return exec(\"/usr/bin/security\", [\"delete-keychain\", keychainFile]).catch((e: any) => {\n    if (printWarn) {\n      log.warn({ file: keychainFile, error: e.stack || e }, \"cannot delete keychain\")\n    }\n    return unlinkIfExists(keychainFile)\n  })\n}\n\nexport async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir }: CreateKeychainOptions): Promise<CodeSigningInfo> {\n  // travis has correct AppleWWDRCA cert\n  if (!isTravis()) {\n    await bundledCertKeychainAdded.value\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/3685\n  // use constant file\n  const keychainFile = path.join(process.env.APP_BUILDER_TMP_DIR || tmpdir(), `${createHash(\"sha256\").update(currentDir).update(\"app-builder\").digest(\"hex\")}.keychain`)\n  // noinspection JSUnusedLocalSymbols\n\n  await removeKeychain(keychainFile, false).catch(_ => {\n    /* ignore*/\n  })\n\n  const certLinks = [cscLink]\n  if (cscILink != null) {\n    certLinks.push(cscILink)\n  }\n\n  const certPaths = new Array(certLinks.length)\n  const keychainPassword = randomBytes(32).toString(\"base64\")\n  const securityCommands = [\n    [\"create-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"unlock-keychain\", \"-p\", keychainPassword, keychainFile],\n    [\"set-keychain-settings\", keychainFile],\n  ]\n\n  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored\n  // https://github.com/electron-userland/electron-builder/issues/1457\n  const list = await listUserKeychains()\n  if (!list.includes(keychainFile)) {\n    securityCommands.push([\"list-keychains\", \"-d\", \"user\", \"-s\", keychainFile].concat(list))\n  }\n\n  // Import all certs in parallel, then run security commands sequentially.\n  await Promise.all(certLinks.map((link, i) => importCertificate(link, tmpDir, currentDir).then(it => (certPaths[i] = it))))\n  for (const cmd of securityCommands) {\n    await exec(\"/usr/bin/security\", cmd)\n  }\n  const cscPasswords: Array<string> = [cscKeyPassword]\n  if (cscIKeyPassword != null) {\n    cscPasswords.push(cscIKeyPassword)\n  }\n  return await importCerts(keychainFile, certPaths, cscPasswords)\n}\n\nasync function importCerts(keychainFile: string, paths: Array<string>, keyPasswords: Array<string>): Promise<CodeSigningInfo> {\n  for (let i = 0; i < paths.length; i++) {\n    const password = keyPasswords[i] ?? \"\"\n    await exec(\"/usr/bin/security\", [\"import\", paths[i], \"-k\", keychainFile, \"-T\", \"/usr/bin/codesign\", \"-T\", \"/usr/bin/productbuild\", \"-P\", password])\n\n    // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p\n    // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996\n    await exec(\"/usr/bin/security\", [\"set-key-partition-list\", \"-S\", \"apple-tool:,apple:\", \"-s\", \"-k\", password, keychainFile])\n  }\n\n  return {\n    keychainFile,\n  }\n}\n\nexport async function sign(opts: SignOptions): Promise<void> {\n  return retry(() => _sign(opts), {\n    retries: 3,\n    interval: 5000,\n    backoff: 5000,\n  })\n}\n\nexport let findIdentityRawResult: Promise<Array<string>> | null = null\n\n// Discovery of untrusted self-signed identities is OFF in production, and there is intentionally NO env var\n// or build-config option to enable it: an untrusted identity must never be silently accepted in a real\n// build. This in-process flag exists solely as a seam for electron-builder's own signing tests, which\n// provision an ephemeral self-signed cert and flip it via setAllowUntrustedSelfSignedIdentityForTesting().\nlet allowUntrustedSelfSignedIdentity = false\n\n/** @internal Test-only. Enables discovery of untrusted self-signed code-signing identities. Never use in production. */\nexport function setAllowUntrustedSelfSignedIdentityForTesting(value: boolean): void {\n  allowUntrustedSelfSignedIdentity = value\n}\n\nasync function getValidIdentities(keychain?: string | null): Promise<Array<string>> {\n  function addKeychain(args: Array<string>) {\n    if (keychain != null) {\n      args.push(keychain)\n    }\n    return args\n  }\n\n  let result = findIdentityRawResult\n  if (result == null || keychain != null) {\n    // https://github.com/electron-userland/electron-builder/issues/481\n    // https://github.com/electron-userland/electron-builder/issues/535\n    const commands = [\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\"])).then(it =>\n        it\n          .trim()\n          .split(\"\\n\")\n          .filter(it => {\n            for (const prefix of appleCertificatePrefixes) {\n              if (it.includes(prefix)) {\n                return true\n              }\n            }\n            return false\n          })\n      ),\n      exec(\"/usr/bin/security\", addKeychain([\"find-identity\", \"-v\", \"-p\", \"codesigning\"])).then(it => it.trim().split(\"\\n\")),\n    ]\n\n    // Test-only seam: also accept untrusted self-signed identities. `find-identity` without `-v` lists them;\n    // trusted identities discovered above still take precedence (they appear first and dupes are de-duped).\n    if (allowUntrustedSelfSignedIdentity) {\n      commands.push(exec(\"/usr/bin/security\", addKeychain([\"find-identity\"])).then(it => it.trim().split(\"\\n\")))\n    }\n\n    result = Promise.all<Array<string>>(commands).then(it => {\n      const array = it\n        .flat()\n        .filter(\n          it =>\n            !it.includes(\"(Missing required extension)\") &&\n            !it.includes(\"identities found\") &&\n            !it.includes(\"Policy: X.509 Basic\") &&\n            !it.includes(\"Matching identities\") &&\n            !it.includes(\"Valid identities only\") &&\n            !it.includes(\"iPhone \") &&\n            !it.includes(\"com.apple.idms.appleid.prd.\")\n        )\n        // remove 1)\n        .map(it => it.substring(it.indexOf(\")\") + 1).trim())\n      return Array.from(new Set(array))\n    })\n\n    if (keychain == null) {\n      findIdentityRawResult = result\n    }\n  }\n  return result\n}\n\nasync function _findIdentity(type: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  // https://github.com/electron-userland/electron-builder/issues/484\n  //noinspection SpellCheckingInspection\n  const lines = await getValidIdentities(keychain)\n  const namePrefix = `${type}:`\n  for (const line of lines) {\n    if (qualifier != null && !line.includes(qualifier)) {\n      continue\n    }\n\n    if (line.includes(namePrefix)) {\n      return parseIdentity(line)\n    }\n  }\n\n  if (type === \"Developer ID Application\") {\n    // find non-Apple certificate\n    // https://github.com/electron-userland/electron-builder/issues/458\n    l: for (const line of lines) {\n      if (qualifier != null && !line.includes(qualifier)) {\n        continue\n      }\n\n      if (line.includes(\"Mac Developer:\")) {\n        continue\n      }\n\n      for (const prefix of appleCertificatePrefixes) {\n        if (line.includes(prefix)) {\n          continue l\n        }\n      }\n\n      return parseIdentity(line)\n    }\n  }\n  return null\n}\n\n// @electron/osx-sign v2 no longer exposes its `Identity` class via the package's public exports, so we own this lightweight equivalent.\nexport class Identity {\n  constructor(\n    readonly name: string,\n    readonly hash?: string\n  ) {}\n}\n\nfunction parseIdentity(line: string): Identity {\n  const firstQuoteIndex = line.indexOf('\"')\n  const name = line.substring(firstQuoteIndex + 1, line.lastIndexOf('\"'))\n  const hash = line.substring(0, firstQuoteIndex - 1)\n  return new Identity(name, hash)\n}\n\nexport function findIdentity(certType: CertType, qualifier?: string | null, keychain?: string | null): Promise<Identity | null> {\n  let identity = qualifier || process.env.CSC_NAME\n  if (isEmptyOrSpaces(identity)) {\n    if (isAutoDiscoveryCodeSignIdentity()) {\n      return _findIdentity(certType, null, keychain)\n    } else {\n      return Promise.resolve(null)\n    }\n  } else {\n    identity = identity.trim()\n    for (const prefix of appleCertificatePrefixes) {\n      checkPrefix(identity, prefix)\n    }\n    return _findIdentity(certType, identity, keychain)\n  }\n}\n\nfunction checkPrefix(name: string, prefix: string) {\n  if (name.startsWith(prefix)) {\n    throw new InvalidConfigurationError(`Please remove prefix \"${prefix}\" from the specified name — appropriate certificate will be chosen automatically`)\n  }\n}\n"]}

package/dist/codeSign/win/signtoolBaseSignManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signtoolBaseSignManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/signtoolBaseSignManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAEL,oBAAoB,EAEpB,2BAA2B,EAE5B,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAIpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAGzD,MAAM,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;AAE3H,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,IAAI,CAAA;IAGvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,kCAAmC,SAAQ,4BAA4B;IACtF,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,mBAAmB,EAAE,OAAO,CAAA;CAC7B;AAQD,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,2BAA2B,GAAG,IAAI,CAMxG;AAED,8BAAsB,uBAAwB,YAAW,WAAW;IAGtD,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW;IAFpD,SAAS,CAAC,QAAQ,CAAC,4BAA4B,EAAE,oBAAoB,CAAA;gBAEtC,QAAQ,EAAE,WAAW;IAIpD,QAAQ,CAAC,qBAAqB,wBAW5B;IAEF,QAAQ,CAAC,YAAY,0HA6BpB;IAED,QAAQ,CAAC,OAAO,wFA0Df;IAED,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAkBvE;;;OAGG;IACH,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAIzF,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgEvD,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAU3E,mBAAmB,CAAC,OAAO,EAAE,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAE,SAA2B,GAAG,KAAK,CAAC,MAAM,CAAC;IAI1H,SAAS,CAAC,eAAe,IAAI,OAAO;IAKpC,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9G,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAG/G,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,UAAQ,GAAG,IAAI;IA+BhJ,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAyB/H,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAKvC,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAsC5G,WAAW,CAAC,KAAK,UAA+B,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIpE,MAAM,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,EAAE,WAAW;CA2CtF;AAED,qBAAa,mBAAoB,SAAQ,uBAAuB;IAC9D,SAAS,CAAC,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IA6CrG,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;CAgCvG"}
+{"version":3,"file":"signtoolBaseSignManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/signtoolBaseSignManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAW,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAEL,oBAAoB,EAEpB,2BAA2B,EAE5B,MAAM,6BAA6B,CAAA;AAGpC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAIpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAGzD,MAAM,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;AAE3H,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,QAAQ,CAAC,OAAO,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,IAAI,CAAA;IAGvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,kCAAmC,SAAQ,4BAA4B;IACtF,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,mBAAmB,EAAE,OAAO,CAAA;CAC7B;AAQD,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,2BAA2B,GAAG,IAAI,CAMxG;AAED,8BAAsB,uBAAwB,YAAW,WAAW;IAGtD,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW;IAFpD,SAAS,CAAC,QAAQ,CAAC,4BAA4B,EAAE,oBAAoB,CAAA;gBAEtC,QAAQ,EAAE,WAAW;IAIpD,QAAQ,CAAC,qBAAqB,wBAW5B;IAEF,QAAQ,CAAC,YAAY,0HA6BpB;IAED,QAAQ,CAAC,OAAO,wFA0Df;IAED,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAkBvE;;;OAGG;IACH,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAIzF,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgEvD,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAU3E,mBAAmB,CAAC,OAAO,EAAE,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAE,SAA2B,GAAG,KAAK,CAAC,MAAM,CAAC;IAI1H,SAAS,CAAC,eAAe,IAAI,OAAO;IAMpC,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9G,SAAS,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAG/G,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,UAAQ,GAAG,IAAI;IA+BhJ,SAAS,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAyB/H,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAKvC,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAsC5G,WAAW,CAAC,KAAK,UAA+B,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIpE,MAAM,CAAC,aAAa,EAAE,kCAAkC,EAAE,QAAQ,EAAE,WAAW;CA2CtF;AAED,qBAAa,mBAAoB,SAAQ,uBAAuB;IAC9D,SAAS,CAAC,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IA6CrG,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;CAgCvG"}

package/dist/codeSign/win/signtoolBaseSignManager.js

@@ -213,7 +213,8 @@ export class SigntoolBaseSignManager {
     }
     isLegacyToolset() {
         const v = this.packager.config.toolsets?.winCodeSign;
-        return v == null || v === "0.0.0";
+        // Only an explicit "0.0.0" pin is legacy; unset / null / "latest" / custom now resolve to a modern bundle.
+        return v === "0.0.0";
     }
     // allowX509: set to true by HsmSignManager to permit .crt/.cer (public chain only, key is in HSM).
     addCertificateArgs(args, options, vm, isWin, allowX509 = false) {

package/dist/codeSign/win/signtoolBaseSignManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"signtoolBaseSignManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/signtoolBaseSignManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EACL,kCAAkC,GAKnC,MAAM,6BAA6B,CAAA;AACpC,OAAO,UAAU,MAAM,iCAAiC,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGlD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;AA8C3B,yGAAyG;AACzG,MAAM,UAAU,uBAAuB,CAAC,MAA4B;IAClE,MAAM,CAAC,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAA;IACpD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,OAAgB,uBAAuB;IAG3C,YAA+B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAI3C,0BAAqB,GAAG,IAAI,IAAI,CAAuB,KAAK,IAAI,EAAE;YACzE,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;YAC1E,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAA;YAC5C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAA;YACb,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,OAAO,OAAO,CAAC,aAAa,CAAC,CAAA;YAC/B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;YAC9C,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEO,iBAAY,GAAG,IAAI,QAAQ,CAClC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAClB,KAAK,EAAC,GAAG,EAAC,EAAE;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAA;gBAChD,OAAO;oBACL,UAAU,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAE;oBACxD,wBAAwB;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAA;YAC5B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;YACnD,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC7C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;YAChE,CAAC;YACD,uDAAuD;YACvD,iFAAiF;YACjF,OAAO,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC,CACF,CAAA;QAEQ,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,4BAA4B,EACvC,4BAA4B,CAAC,EAAE;YAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,4BAA4B,CAAC,CAAA;YACrE,qFAAqF;YACrF,4FAA4F;YAC5F,MAAM,UAAU,GAAG,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,CAAA;YAEjE,kDAAkD;YAClD,MAAM,WAAW,GAAI,OAAyE,EAAE,sBAAsB,CAAA;YACtH,MAAM,OAAO,GAAI,OAAyE,EAAE,eAAe,CAAA;YAC3G,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK;qBAC1B,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;qBAC9E,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,kEAAkE;oBAClE,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,CAAC,CAAA;oBACT,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;wBAC5D,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC,CAAC,CAAA;YACN,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;YAChD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;gBAC5B,2FAA2F;gBAC3F,MAAM,mBAAmB,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;gBAC9E,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,yFAAyF;YACzF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;gBACxD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;oBACtC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;gBAED,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;qBACtF,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,IAAI,CAAC,YAAY,yBAAyB,EAAE,CAAC;wBAC3C,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACtG,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,CAAA;oBACT,CAAC;gBACH,CAAC,CAAC;qBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACV,IAAI,EAAE,CAAC;oBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;iBACzC,CAAC,CAAC,CAAA;YACP,CAAC;YAED,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,CACF,CAAA;QAzGC,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,eAAe,CAAA;IAC9D,CAAC;IA0GD,UAAU;QACR,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAA4B;QACrE,IAAI,MAAM,YAAY,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,oBAAoB,CAAC,CAAA;YACtE,OAAO,aAAa,IAAI,OAAO,CAAA;QACjC,CAAC;QAED,wFAAwF;QACxF,4FAA4F;QAC5F,8FAA8F;QAC9F,qDAAqD;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;QAC9C,MAAM,SAAS,GAAG,aAAa,IAAI,QAAQ,EAAE,wBAAwB,IAAI,IAAI,CAAA;QAC7E,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;OAGG;IACO,iBAAiB,CAAC,UAAyD;QACnF,OAAO,CAAC,UAAU,CAAA,CAAC,qDAAqD;IAC1E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,IAAI,MAAM,GAAG,OAAO,EAAE,qBAAqB,CAAA;QAC3C,oCAAoC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC3E,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAA;QAE5D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEnI,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,GAAQ;gBACjB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAA;YACD,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;iBACrE,CAAA;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC9B,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,gDAAgD,CAAC,CAAA;YAChG,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,MAA0C,EAAE,QAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrI,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,iBAAiB,GAAiC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzG,MAAM,OAAO,CAAC,OAAO,CACnB,QAAQ,CACN;gBACE,GAAG,iBAAiB;gBACpB,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC;aACjF,EACD,IAAI,CAAC,QAAQ,CACd,CACF,CAAA;YACD,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;gBAC/C,MAAM,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,kBAAkB,GAAG,4GAA4G,CAAA;QACvI,IAAI,CAAC;YACH,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAyB,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mBAAmB,CAAC,OAAqC,EAAE,KAAc,EAAE,KAAgB,IAAI,SAAS,EAAE;QACxG,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC;IAES,eAAe;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACpD,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,OAAO,CAAA;IACnC,CAAC;IAKD,mGAAmG;IACzF,kBAAkB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc,EAAE,SAAS,GAAG,KAAK;QACvI,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAA;QACjI,CAAC;QACD,MAAM,eAAe,GAAI,OAAO,CAAC,OAA+B,CAAC,IAAI,CAAA;QAErE,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,wCAAwC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAmC,CAAA;YAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAA;YAEjE,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YACnE,CAAC;iBAAM,IAAI,KAAK,IAAI,SAAS,IAAI,CAAC,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,yBAAyB,CAAC,2CAA2C,eAAe,iBAAiB,CAAC,CAAA;YAClH,CAAC;QACH,CAAC;IACH,CAAC;IAES,oBAAoB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;QACtH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,QAAQ,GAAI,OAAO,CAAC,OAA+B,EAAE,QAAQ,CAAA;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,cAAc,GAAG,OAAO,EAAE,yBAAyB,CAAA;QACzD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG,SAAS,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,OAA6B,EAAE,EAAa;QAC5E,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAkE,CAAA;QACjH,MAAM,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,CAAA;QAC9D,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;QAE/D,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAClC,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,oIAAoI;SACrI,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACvF,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAChC,IACE,CAAC,sBAAsB,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACtF,CAAC,eAAe,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAClF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACpE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC/E,oEAAoE;YACpE,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;YAC5E,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAA;YAC1D,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK;gBACL,mBAAmB;aACpB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,sBAAsB,IAAI,eAAe,gBAAgB,SAAS,EAAE,CAAC,CAAA;IAClH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QACpD,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAC5G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAiD,EAAE,QAAqB;QACnF,kEAAkE;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAuB,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACnF,IAAI,IAAmB,CAAA;QACvB,IAAI,EAAa,CAAA;QACjB,iFAAiF;QACjF,6FAA6F;QAC7F,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;QACrC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAA;QACzG,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAC1H,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;YAC5B,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,IAAI,SAAS,EAAE,CAAA;YACpB,IAAI,GAAG,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,sGAAsG;QACtG,0GAA0G;QAC1G,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QACzG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE;YACnE,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;gBACtB,IACE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC;oBAC/D,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4DAA4D,CAAC;oBAChF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,6DAA6D,CAAC;oBACjF,+FAA+F;oBAC/F,qGAAqG;oBACrG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,oEAAoE,CAAC,EACxF,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACjG,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,uBAAuB;IACpD,sBAAsB,CAAC,OAAqC,EAAE,EAAa;QACnF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAExD,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAErB,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACnC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,sBAAsB,IAAI,+BAA+B,CAAC,CAAC,CAAC,OAAO,EAAE,eAAe,IAAI,+BAA+B,CAAA;YACjK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzB,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAEhD,iBAAiB;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;oBACpD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5C,6DAA6D;YAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAElD,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,eAAe;QAEpC,OAAO,IAAI,CAAA;IACb,CAAC;IAES,uBAAuB,CAAC,OAAqC,EAAE,EAAa;QACpF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAExD,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAA;QAErC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAE3D,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,YAAY,GAAG,OAAO,EAAE,eAAe,IAAI,+BAA+B,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAC/B,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEjD,iBAAiB;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAE3C,mEAAmE;QACnE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEnD,gBAAgB;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QAC1C,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { asArray, InvalidConfigurationError, log, retry } from \"builder-util\"\nimport { MemoLazy, parseDn } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport {\n  resolveWindowsSigningConfiguration,\n  WindowsConfiguration,\n  WindowsHsmSigningConfig,\n  WindowsSigntoolFamilyConfig,\n  WindowsSigntoolSigningConfig,\n} from \"../../options/winOptions.js\"\nimport AppXTarget from \"../../targets/win/AppxTarget.js\"\nimport { getSignToolPath } from \"../../toolsets/winCodeSign.js\"\nimport { ToolInfo } from \"../../util/bundledTool.js\"\nimport { resolveFunction } from \"../../util/resolve.js\"\nimport { withSigntoolLock } from \"../../util/toolsetLock.js\"\nimport { readCertInfo, readCertInfoFromX509 } from \"../certInfo.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport type { WinPackager } from \"../../winPackager.js\"\nimport { importCertificate } from \"../codesign.js\"\nimport type { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nconst { rename } = _fsExtra\n\nexport type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>\n\nexport interface WindowsSignToolOptions extends WindowsSignOptions {\n  readonly name: string\n  readonly site: string | null\n}\n\nexport interface FileCodeSigningInfo {\n  readonly file: string\n  readonly password: string | null\n}\n\nexport interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {\n  readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null\n\n  // set if output path differs from input (e.g. osslsigncode cannot sign file in-place)\n  resultOutputPath?: string\n\n  hash: string\n  isNest: boolean\n}\n\nexport interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {\n  computeSignToolArgs(isWin: boolean): Array<string>\n}\n\nexport interface CertificateInfo {\n  readonly commonName: string\n  readonly bloodyMicrosoftSubjectDn: string\n}\n\nexport interface CertificateFromStoreInfo {\n  thumbprint: string\n  subject: string\n  store: string\n  isLocalMachineStore: boolean\n}\n\ninterface CertInfo {\n  Subject: string\n  Thumbprint: string\n  PSParentPath: string\n}\n\n/** Extracts the non-Azure signing config from WindowsConfiguration, or null for Azure/unset/disabled. */\nexport function getSigntoolFamilyConfig(config: WindowsConfiguration): WindowsSigntoolFamilyConfig | null {\n  const s = resolveWindowsSigningConfiguration(config)\n  if (s == null || s.type === \"azure\") {\n    return null\n  }\n  return s\n}\n\nexport abstract class SigntoolBaseSignManager implements SignManager {\n  protected readonly platformSpecificBuildOptions: WindowsConfiguration\n\n  constructor(protected readonly packager: WinPackager) {\n    this.platformSpecificBuildOptions = packager.platformOptions\n  }\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(async () => {\n    const signing = getSigntoolFamilyConfig(this.platformSpecificBuildOptions)\n    const publisherName = signing?.publisherName\n    if (publisherName === null) {\n      return null\n    } else if (publisherName != null) {\n      return asArray(publisherName)\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    return certInfo == null ? null : [certInfo.commonName]\n  })\n\n  readonly lazyCertInfo = new MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>(\n    () => this.cscInfo,\n    async csc => {\n      const cscInfo = await csc.value\n      if (cscInfo == null) {\n        return null\n      }\n\n      if (\"subject\" in cscInfo) {\n        const bloodyMicrosoftSubjectDn = cscInfo.subject\n        return {\n          commonName: parseDn(bloodyMicrosoftSubjectDn).get(\"CN\")!,\n          bloodyMicrosoftSubjectDn,\n        }\n      }\n\n      const cscFile = cscInfo.file\n      if (cscFile == null) {\n        return null\n      }\n\n      const certExt = path.extname(cscFile).toLowerCase()\n      if (certExt === \".p12\" || certExt === \".pfx\") {\n        return await this.getCertInfo(cscFile, cscInfo.password || \"\")\n      }\n      // Non-PKCS12 files (.crt, .cer): parse as plain X.509.\n      // Returns null when the CN is absent — caller must set publisherName explicitly.\n      return await readCertInfoFromX509(cscFile)\n    }\n  )\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.platformSpecificBuildOptions,\n    platformSpecificBuildOptions => {\n      const signing = getSigntoolFamilyConfig(platformSpecificBuildOptions)\n      // signtool is the implicit default when win.sign is unset, so an absent config still\n      // honours the WIN_CSC_LINK/cscLink fallback below (hsm/pkcs11 set signing.type explicitly).\n      const isSigntool = signing == null || signing.type === \"signtool\"\n\n      // signtool + hsm: store-based cert takes priority\n      const subjectName = (signing as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null)?.certificateSubjectName\n      const shaType = (signing as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null)?.certificateSha1\n      if (subjectName != null || shaType != null) {\n        return this.packager.vm.value\n          .then(vm => this.getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))\n          .catch((e: any) => {\n            // https://github.com/electron-userland/electron-builder/pull/2397\n            if (signing?.sign == null) {\n              throw e\n            } else {\n              log.debug({ error: e }, \"getCertificateFromStoreInfo error\")\n              return null\n            }\n          })\n      }\n\n      const certificateFile = signing?.certificateFile\n      if (certificateFile != null) {\n        // Only signtool mode uses a password (HSM private key lives in the HSM, not the cert file)\n        const certificatePassword = isSigntool ? this.packager.getCscPassword() : null\n        return Promise.resolve({\n          file: certificateFile,\n          password: certificatePassword == null ? null : certificatePassword.trim(),\n        })\n      }\n\n      // WIN_CSC_LINK env var fallback: only for signtool mode (including the implicit default)\n      if (isSigntool) {\n        const cscLink = this.packager.getCscLink(\"WIN_CSC_LINK\")\n        if (cscLink == null || cscLink === \"\") {\n          return Promise.resolve(null)\n        }\n\n        return importCertificate(cscLink, this.packager.tempDirManager, this.packager.projectDir)\n          .catch((e: any) => {\n            if (e instanceof InvalidConfigurationError) {\n              throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)\n            } else {\n              throw e\n            }\n          })\n          .then(p => ({\n            file: p,\n            password: this.packager.getCscPassword(),\n          }))\n      }\n\n      return Promise.resolve(null)\n    }\n  )\n\n  initialize(): Promise<void> {\n    return Promise.resolve()\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/2108#issuecomment-333200711\n  async computePublisherName(target: Target, publisherName: string | null) {\n    if (target instanceof AppXTarget && (await this.cscInfo.value) == null) {\n      log.info({ reason: \"Windows Store only build\" }, \"AppX is not signed\")\n      return publisherName ?? \"CN=ms\"\n    }\n\n    // When a signing cert is available, the cert's subject MUST be used so the APPX package\n    // Publisher attribute matches the certificate — any mismatch causes SignerSign to fail with\n    // ERROR_BAD_FORMAT. Only honour a user-supplied publisherName if it was explicitly configured\n    // (non-null); otherwise derive from the certificate.\n    const certInfo = await this.lazyCertInfo.value\n    const publisher = publisherName ?? certInfo?.bloodyMicrosoftSubjectDn ?? null\n    if (publisher == null) {\n      throw new Error(\"Internal error: cannot compute subject using certificate info\")\n    }\n    return publisher\n  }\n\n  /**\n   * Called when cscInfo is null. Returns true to skip signing, false to proceed, or throws.\n   * Override in subclasses with different null-cert behaviour (HSM throws, PKCS#11 proceeds).\n   */\n  protected handleNullCscInfo(customSign: CustomWindowsSign | string | null | undefined): boolean {\n    return !customSign // default: skip when no cert and no custom sign hook\n  }\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    const signing = getSigntoolFamilyConfig(options.options)\n    let hashes = signing?.signingHashAlgorithms\n    // msi does not support dual-signing\n    if (options.path.endsWith(\".msi\")) {\n      hashes = [hashes != null && !hashes.includes(\"sha1\") ? \"sha256\" : \"sha1\"]\n    } else if (options.path.endsWith(\".appx\")) {\n      hashes = [\"sha256\"]\n    } else if (hashes == null) {\n      hashes = [\"sha1\", \"sha256\"]\n    } else {\n      hashes = Array.isArray(hashes) ? hashes : [hashes]\n    }\n\n    const name = this.packager.appInfo.productName\n    const site = await this.packager.appInfo.computePackageUrl()\n\n    const customSign = await resolveFunction(this.packager.appInfo.type, signing?.sign, \"sign\", await this.packager.getWorkspaceRoot())\n\n    const cscInfo = await this.cscInfo.value\n\n    if (cscInfo) {\n      let logInfo: any = {\n        file: log.filePath(options.path),\n      }\n      if (\"file\" in cscInfo) {\n        logInfo = { ...logInfo, certificateFile: cscInfo.file }\n      } else {\n        logInfo = {\n          ...logInfo,\n          subject: cscInfo.subject,\n          thumbprint: cscInfo.thumbprint,\n          store: cscInfo.store,\n          user: cscInfo.isLocalMachineStore ? \"local machine\" : \"current user\",\n        }\n      }\n      log.info(logInfo, \"signing\")\n    } else if (this.handleNullCscInfo(customSign)) {\n      log.debug({ signHook: !!customSign, cscInfo }, \"no signing info identified, signing is skipped\")\n      return false\n    }\n\n    const executor = customSign || ((config: CustomWindowsSignTaskConfiguration, packager: WinPackager) => this.doSign(config, packager))\n    let isNest = false\n    for (const hash of hashes) {\n      const taskConfiguration: WindowsSignTaskConfiguration = { ...options, name, site, cscInfo, hash, isNest }\n      await Promise.resolve(\n        executor(\n          {\n            ...taskConfiguration,\n            computeSignToolArgs: isWin => this.computeSignToolArgs(taskConfiguration, isWin),\n          },\n          this.packager\n        )\n      )\n      isNest = true\n      if (taskConfiguration.resultOutputPath != null) {\n        await rename(taskConfiguration.resultOutputPath, options.path)\n      }\n    }\n\n    return true\n  }\n\n  async getCertInfo(file: string, password: string): Promise<CertificateInfo> {\n    const errorMessagePrefix = \"Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: \"\n    try {\n      return await readCertInfo(file, password)\n    } catch (e: any) {\n      throw new InvalidConfigurationError(`${errorMessagePrefix}${e.message || e}`)\n    }\n  }\n\n  // on windows be aware of http://stackoverflow.com/a/32640183/1910191\n  computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm: VmManager = new VmManager()): Array<string> {\n    return isWin ? this.computeWindowsSignArgs(options, vm) : this.computeOsslsigncodeArgs(options, vm)\n  }\n\n  protected isLegacyToolset(): boolean {\n    const v = this.packager.config.toolsets?.winCodeSign\n    return v == null || v === \"0.0.0\"\n  }\n\n  protected abstract computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>\n  protected abstract computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>\n\n  // allowX509: set to true by HsmSignManager to permit .crt/.cer (public chain only, key is in HSM).\n  protected addCertificateArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean, allowX509 = false): void {\n    if (options.cscInfo == null) {\n      throw new Error(\"No code signing certificate configured. Provide certificateFile, certificateSha1, or certificateSubjectName.\")\n    }\n    const certificateFile = (options.cscInfo as FileCodeSigningInfo).file\n\n    if (certificateFile == null) {\n      // Certificate from store (Windows only)\n      if (!isWin) {\n        throw new Error(\"certificateSha1/certificateSubjectName supported only on Windows\")\n      }\n\n      const cscInfo = options.cscInfo as CertificateFromStoreInfo\n      args.push(\"/sha1\", cscInfo.thumbprint)\n      args.push(\"/s\", cscInfo.store)\n      if (cscInfo.isLocalMachineStore) {\n        args.push(\"/sm\")\n      }\n    } else {\n      const certExtension = path.extname(certificateFile).toLowerCase()\n\n      if (certExtension === \".p12\" || certExtension === \".pfx\") {\n        args.push(isWin ? \"/f\" : \"-pkcs12\", vm.toVmFile(certificateFile))\n      } else if (isWin && allowX509 && (certExtension === \".crt\" || certExtension === \".cer\")) {\n        args.push(\"/f\", vm.toVmFile(certificateFile))\n      } else {\n        throw new InvalidConfigurationError(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`)\n      }\n    }\n  }\n\n  protected addCommonSigningArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.name) {\n      args.push(isWin ? \"/d\" : \"-n\", options.name)\n    }\n\n    if (options.site) {\n      args.push(isWin ? \"/du\" : \"-i\", options.site)\n    }\n\n    if (options.isNest) {\n      args.push(isWin ? \"/as\" : \"-nest\")\n    }\n\n    const password = (options.cscInfo as FileCodeSigningInfo)?.password\n    if (password) {\n      args.push(isWin ? \"/p\" : \"-pass\", password)\n    }\n\n    const signing = getSigntoolFamilyConfig(options.options)\n    const additionalCert = signing?.additionalCertificateFile\n    if (additionalCert) {\n      args.push(isWin ? \"/ac\" : \"-ac\", vm.toVmFile(additionalCert))\n    }\n  }\n\n  getOutputPath(inputPath: string, hash: string) {\n    const extension = path.extname(inputPath)\n    return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`)\n  }\n\n  async getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo> {\n    const signing = getSigntoolFamilyConfig(options) as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null\n    const certificateSubjectName = signing?.certificateSubjectName\n    const certificateSha1 = signing?.certificateSha1?.toUpperCase()\n\n    const ps = await vm.powershellCommand.value\n    const rawResult = await vm.exec(ps, [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-Command\",\n      \"Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress\",\n    ])\n    const certList = rawResult.length === 0 ? [] : asArray<CertInfo>(JSON.parse(rawResult))\n    for (const certInfo of certList) {\n      if (\n        (certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||\n        (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)\n      ) {\n        continue\n      }\n\n      const parentPath = certInfo.PSParentPath\n      const store = parentPath.substring(parentPath.lastIndexOf(\"\\\\\") + 1)\n      log.debug({ store, PSParentPath: parentPath }, \"auto-detect certificate store\")\n      // https://github.com/electron-userland/electron-builder/issues/1717\n      const isLocalMachineStore = parentPath.includes(\"Certificate::LocalMachine\")\n      log.debug(null, \"auto-detect using of LocalMachine store\")\n      return {\n        thumbprint: certInfo.Thumbprint,\n        subject: certInfo.Subject,\n        store,\n        isLocalMachineStore,\n      }\n    }\n\n    throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`)\n  }\n\n  async getToolPath(isWin = process.platform === \"win32\"): Promise<ToolInfo> {\n    return getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n  }\n\n  async doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager) {\n    // https://github.com/electron-userland/electron-builder/pull/1944\n    const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT as any, 10) || 10 * 60 * 1000\n    let args: Array<string>\n    let vm: VmManager\n    // cscInfo can be null (e.g. PKCS#11 with no cert file); guard before using `in`.\n    // CertificateFromStoreInfo (no `file` property) requires a Windows VM for cert-store lookup.\n    const cscInfo = configuration.cscInfo\n    const useVmIfNotOnWin = configuration.path.endsWith(\".appx\") || (cscInfo != null && !(\"file\" in cscInfo))\n    const isWin = process.platform === \"win32\" || useVmIfNotOnWin\n    const toolInfo = await getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n    const tool = toolInfo.path\n    if (useVmIfNotOnWin) {\n      vm = await packager.vm.value\n      args = this.computeSignToolArgs(configuration, isWin, vm)\n    } else {\n      vm = new VmManager()\n      args = configuration.computeSignToolArgs(isWin)\n    }\n\n    // signtool.exe (`/f`) is not safe to run concurrently — it races on the shared per-user crypto store.\n    // Serialize real-Windows signtool invocations across processes; osslsigncode (`!isWin`) is file-isolated.\n    const execSign = () => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || {}) } })\n    await retry(() => (isWin ? withSigntoolLock(execSign) : execSign()), {\n      retries: 2,\n      interval: 15000,\n      backoff: 10000,\n      shouldRetry: (e: any) => {\n        if (\n          e.message.includes(\"The file is being used by another process\") ||\n          e.message.includes(\"The specified timestamp server either could not be reached\") ||\n          e.message.includes(\"No certificates were found that met all the given criteria.\") ||\n          // Transient failure of SignerSignEx after cert selection, typically a concurrent-signtool race\n          // on the per-user crypto store; the cross-process lock above makes this rare, retry covers the rest.\n          e.message.includes(\"An error occurred while attempting to load the signing certificate\")\n        ) {\n          log.warn(`Attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`)\n          return true\n        }\n        return false\n      },\n    })\n  }\n}\n\nexport class SigntoolSignManager extends SigntoolBaseSignManager {\n  protected computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const signing = getSigntoolFamilyConfig(options.options)\n\n    const inputFile = vm.toVmFile(options.path)\n    const args = [\"sign\"]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const isRfc3161 = options.isNest || options.hash === \"sha256\"\n      args.push(isRfc3161 ? \"/tr\" : \"/t\")\n      const timestampUrl = isRfc3161 ? signing?.rfc3161TimeStampServer || \"http://timestamp.digicert.com\" : signing?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, true)\n\n    // Hash algorithm\n    if (this.isLegacyToolset()) {\n      // Legacy v0.0.0: Only add /fd for non-SHA1 (original behavior)\n      if (options.hash !== \"sha1\") {\n        args.push(\"/fd\", options.hash)\n        if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n          args.push(\"/td\", \"sha256\")\n        }\n      }\n    } else {\n      // Modern: Always add /fd (required by new Windows Kits)\n      args.push(\"/fd\", options.hash.toLowerCase())\n      // Only add /td for RFC3161 timestamps (incompatible with /t)\n      if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\" && (options.isNest || options.hash === \"sha256\")) {\n        args.push(\"/td\", \"sha256\")\n      }\n    }\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, true)\n\n    // Windows-specific\n    args.push(\"/debug\")\n    args.push(inputFile) // Must be last\n\n    return args\n  }\n\n  protected computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const signing = getSigntoolFamilyConfig(options.options)\n\n    const inputFile = vm.toVmFile(options.path)\n    const outputPath = this.getOutputPath(inputFile, options.hash)\n    options.resultOutputPath = outputPath\n\n    const args = [\"sign\", \"-in\", inputFile, \"-out\", outputPath]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const timestampUrl = signing?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(\"-t\", timestampUrl)\n    }\n\n    // Certificate file\n    this.addCertificateArgs(args, options, vm, false)\n\n    // Hash algorithm\n    args.push(\"-h\", options.hash.toLowerCase())\n\n    // Optional parameters (name, site, nest, password, additionalCert)\n    this.addCommonSigningArgs(args, options, vm, false)\n\n    // Proxy support\n    const httpsProxy = process.env.HTTPS_PROXY\n    if (httpsProxy?.length) {\n      args.push(\"-p\", httpsProxy)\n    }\n\n    return args\n  }\n}\n"]}
+{"version":3,"file":"signtoolBaseSignManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/signtoolBaseSignManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EACL,kCAAkC,GAKnC,MAAM,6BAA6B,CAAA;AACpC,OAAO,UAAU,MAAM,iCAAiC,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGlD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;AA8C3B,yGAAyG;AACzG,MAAM,UAAU,uBAAuB,CAAC,MAA4B;IAClE,MAAM,CAAC,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAA;IACpD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,OAAgB,uBAAuB;IAG3C,YAA+B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAI3C,0BAAqB,GAAG,IAAI,IAAI,CAAuB,KAAK,IAAI,EAAE;YACzE,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;YAC1E,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAA;YAC5C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAA;YACb,CAAC;iBAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBACjC,OAAO,OAAO,CAAC,aAAa,CAAC,CAAA;YAC/B,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;YAC9C,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEO,iBAAY,GAAG,IAAI,QAAQ,CAClC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAClB,KAAK,EAAC,GAAG,EAAC,EAAE;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAA;YAC/B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,wBAAwB,GAAG,OAAO,CAAC,OAAO,CAAA;gBAChD,OAAO;oBACL,UAAU,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAE;oBACxD,wBAAwB;iBACzB,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAA;YAC5B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;YACnD,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC7C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;YAChE,CAAC;YACD,uDAAuD;YACvD,iFAAiF;YACjF,OAAO,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAA;QAC5C,CAAC,CACF,CAAA;QAEQ,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,4BAA4B,EACvC,4BAA4B,CAAC,EAAE;YAC7B,MAAM,OAAO,GAAG,uBAAuB,CAAC,4BAA4B,CAAC,CAAA;YACrE,qFAAqF;YACrF,4FAA4F;YAC5F,MAAM,UAAU,GAAG,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,CAAA;YAEjE,kDAAkD;YAClD,MAAM,WAAW,GAAI,OAAyE,EAAE,sBAAsB,CAAA;YACtH,MAAM,OAAO,GAAI,OAAyE,EAAE,eAAe,CAAA;YAC3G,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK;qBAC1B,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;qBAC9E,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,kEAAkE;oBAClE,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,CAAC,CAAA;oBACT,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAA;wBAC5D,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC,CAAC,CAAA;YACN,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;YAChD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;gBAC5B,2FAA2F;gBAC3F,MAAM,mBAAmB,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;gBAC9E,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,IAAI,EAAE,eAAe;oBACrB,QAAQ,EAAE,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,yFAAyF;YACzF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAA;gBACxD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;oBACtC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,CAAC;gBAED,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;qBACtF,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE;oBAChB,IAAI,CAAC,YAAY,yBAAyB,EAAE,CAAC;wBAC3C,MAAM,IAAI,yBAAyB,CAAC,oDAAoD,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACtG,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,CAAA;oBACT,CAAC;gBACH,CAAC,CAAC;qBACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACV,IAAI,EAAE,CAAC;oBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;iBACzC,CAAC,CAAC,CAAA;YACP,CAAC;YAED,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,CACF,CAAA;QAzGC,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,eAAe,CAAA;IAC9D,CAAC;IA0GD,UAAU;QACR,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAA4B;QACrE,IAAI,MAAM,YAAY,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,oBAAoB,CAAC,CAAA;YACtE,OAAO,aAAa,IAAI,OAAO,CAAA;QACjC,CAAC;QAED,wFAAwF;QACxF,4FAA4F;QAC5F,8FAA8F;QAC9F,qDAAqD;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;QAC9C,MAAM,SAAS,GAAG,aAAa,IAAI,QAAQ,EAAE,wBAAwB,IAAI,IAAI,CAAA;QAC7E,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;OAGG;IACO,iBAAiB,CAAC,UAAyD;QACnF,OAAO,CAAC,UAAU,CAAA,CAAC,qDAAqD;IAC1E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,IAAI,MAAM,GAAG,OAAO,EAAE,qBAAqB,CAAA;QAC3C,oCAAoC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC3E,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAA;QAE5D,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEnI,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;QAExC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,GAAQ;gBACjB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAA;YACD,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;gBACtB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;YACzD,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG;oBACR,GAAG,OAAO;oBACV,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;iBACrE,CAAA;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC9B,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,gDAAgD,CAAC,CAAA;YAChG,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,MAA0C,EAAE,QAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrI,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,iBAAiB,GAAiC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACzG,MAAM,OAAO,CAAC,OAAO,CACnB,QAAQ,CACN;gBACE,GAAG,iBAAiB;gBACpB,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC;aACjF,EACD,IAAI,CAAC,QAAQ,CACd,CACF,CAAA;YACD,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,iBAAiB,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;gBAC/C,MAAM,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YAChE,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,QAAgB;QAC9C,MAAM,kBAAkB,GAAG,4GAA4G,CAAA;QACvI,IAAI,CAAC;YACH,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAyB,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mBAAmB,CAAC,OAAqC,EAAE,KAAc,EAAE,KAAgB,IAAI,SAAS,EAAE;QACxG,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC;IAES,eAAe;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACpD,2GAA2G;QAC3G,OAAO,CAAC,KAAK,OAAO,CAAA;IACtB,CAAC;IAKD,mGAAmG;IACzF,kBAAkB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc,EAAE,SAAS,GAAG,KAAK;QACvI,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8GAA8G,CAAC,CAAA;QACjI,CAAC;QACD,MAAM,eAAe,GAAI,OAAO,CAAC,OAA+B,CAAC,IAAI,CAAA;QAErE,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,wCAAwC;YACxC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAmC,CAAA;YAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAA;YAEjE,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YACnE,CAAC;iBAAM,IAAI,KAAK,IAAI,SAAS,IAAI,CAAC,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,yBAAyB,CAAC,2CAA2C,eAAe,iBAAiB,CAAC,CAAA;YAClH,CAAC;QACH,CAAC;IACH,CAAC;IAES,oBAAoB,CAAC,IAAmB,EAAE,OAAqC,EAAE,EAAa,EAAE,KAAc;QACtH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QAED,MAAM,QAAQ,GAAI,OAAO,CAAC,OAA+B,EAAE,QAAQ,CAAA;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,cAAc,GAAG,OAAO,EAAE,yBAAyB,CAAA;QACzD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG,SAAS,EAAE,CAAC,CAAA;IAChH,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,OAA6B,EAAE,EAAa;QAC5E,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAkE,CAAA;QACjH,MAAM,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,CAAA;QAC9D,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;QAE/D,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAClC,YAAY;YACZ,iBAAiB;YACjB,UAAU;YACV,oIAAoI;SACrI,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAW,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACvF,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAChC,IACE,CAAC,sBAAsB,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBACtF,CAAC,eAAe,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAClF,CAAC;gBACD,SAAQ;YACV,CAAC;YAED,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACpE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,+BAA+B,CAAC,CAAA;YAC/E,oEAAoE;YACpE,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAA;YAC5E,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAA;YAC1D,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK;gBACL,mBAAmB;aACpB,CAAA;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,sBAAsB,IAAI,eAAe,gBAAgB,SAAS,EAAE,CAAC,CAAA;IAClH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;QACpD,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IAC5G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAiD,EAAE,QAAqB;QACnF,kEAAkE;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAuB,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACnF,IAAI,IAAmB,CAAA;QACvB,IAAI,EAAa,CAAA;QACjB,iFAAiF;QACjF,6FAA6F;QAC7F,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAA;QACrC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAA;QACzG,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAC1H,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC1B,IAAI,eAAe,EAAE,CAAC;YACpB,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;YAC5B,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAC3D,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,IAAI,SAAS,EAAE,CAAA;YACpB,IAAI,GAAG,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;QAED,sGAAsG;QACtG,0GAA0G;QAC1G,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QACzG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE;YACnE,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,CAAC,CAAM,EAAE,EAAE;gBACtB,IACE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC;oBAC/D,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4DAA4D,CAAC;oBAChF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,6DAA6D,CAAC;oBACjF,+FAA+F;oBAC/F,qGAAqG;oBACrG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,oEAAoE,CAAC,EACxF,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;oBACjG,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,uBAAuB;IACpD,sBAAsB,CAAC,OAAqC,EAAE,EAAa;QACnF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAExD,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAErB,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAA;YAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACnC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,sBAAsB,IAAI,+BAA+B,CAAC,CAAC,CAAC,OAAO,EAAE,eAAe,IAAI,+BAA+B,CAAA;YACjK,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzB,CAAC;QAED,cAAc;QACd,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAEhD,iBAAiB;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;oBACpD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YAC5C,6DAA6D;YAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACrG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAElD,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,eAAe;QAEpC,OAAO,IAAI,CAAA;IACb,CAAC;IAES,uBAAuB,CAAC,OAAqC,EAAE,EAAa;QACpF,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAExD,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9D,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAA;QAErC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAE3D,eAAe;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YACpD,MAAM,YAAY,GAAG,OAAO,EAAE,eAAe,IAAI,+BAA+B,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QAC/B,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEjD,iBAAiB;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;QAE3C,mEAAmE;QACnE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAEnD,gBAAgB;QAChB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;QAC1C,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { asArray, InvalidConfigurationError, log, retry } from \"builder-util\"\nimport { MemoLazy, parseDn } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport {\n  resolveWindowsSigningConfiguration,\n  WindowsConfiguration,\n  WindowsHsmSigningConfig,\n  WindowsSigntoolFamilyConfig,\n  WindowsSigntoolSigningConfig,\n} from \"../../options/winOptions.js\"\nimport AppXTarget from \"../../targets/win/AppxTarget.js\"\nimport { getSignToolPath } from \"../../toolsets/winCodeSign.js\"\nimport { ToolInfo } from \"../../util/bundledTool.js\"\nimport { resolveFunction } from \"../../util/resolve.js\"\nimport { withSigntoolLock } from \"../../util/toolsetLock.js\"\nimport { readCertInfo, readCertInfoFromX509 } from \"../certInfo.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport type { WinPackager } from \"../../winPackager.js\"\nimport { importCertificate } from \"../codesign.js\"\nimport type { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nconst { rename } = _fsExtra\n\nexport type CustomWindowsSign = (configuration: CustomWindowsSignTaskConfiguration, packager?: WinPackager) => Promise<any>\n\nexport interface WindowsSignToolOptions extends WindowsSignOptions {\n  readonly name: string\n  readonly site: string | null\n}\n\nexport interface FileCodeSigningInfo {\n  readonly file: string\n  readonly password: string | null\n}\n\nexport interface WindowsSignTaskConfiguration extends WindowsSignToolOptions {\n  readonly cscInfo: FileCodeSigningInfo | CertificateFromStoreInfo | null\n\n  // set if output path differs from input (e.g. osslsigncode cannot sign file in-place)\n  resultOutputPath?: string\n\n  hash: string\n  isNest: boolean\n}\n\nexport interface CustomWindowsSignTaskConfiguration extends WindowsSignTaskConfiguration {\n  computeSignToolArgs(isWin: boolean): Array<string>\n}\n\nexport interface CertificateInfo {\n  readonly commonName: string\n  readonly bloodyMicrosoftSubjectDn: string\n}\n\nexport interface CertificateFromStoreInfo {\n  thumbprint: string\n  subject: string\n  store: string\n  isLocalMachineStore: boolean\n}\n\ninterface CertInfo {\n  Subject: string\n  Thumbprint: string\n  PSParentPath: string\n}\n\n/** Extracts the non-Azure signing config from WindowsConfiguration, or null for Azure/unset/disabled. */\nexport function getSigntoolFamilyConfig(config: WindowsConfiguration): WindowsSigntoolFamilyConfig | null {\n  const s = resolveWindowsSigningConfiguration(config)\n  if (s == null || s.type === \"azure\") {\n    return null\n  }\n  return s\n}\n\nexport abstract class SigntoolBaseSignManager implements SignManager {\n  protected readonly platformSpecificBuildOptions: WindowsConfiguration\n\n  constructor(protected readonly packager: WinPackager) {\n    this.platformSpecificBuildOptions = packager.platformOptions\n  }\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(async () => {\n    const signing = getSigntoolFamilyConfig(this.platformSpecificBuildOptions)\n    const publisherName = signing?.publisherName\n    if (publisherName === null) {\n      return null\n    } else if (publisherName != null) {\n      return asArray(publisherName)\n    }\n\n    const certInfo = await this.lazyCertInfo.value\n    return certInfo == null ? null : [certInfo.commonName]\n  })\n\n  readonly lazyCertInfo = new MemoLazy<MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>, CertificateInfo | null>(\n    () => this.cscInfo,\n    async csc => {\n      const cscInfo = await csc.value\n      if (cscInfo == null) {\n        return null\n      }\n\n      if (\"subject\" in cscInfo) {\n        const bloodyMicrosoftSubjectDn = cscInfo.subject\n        return {\n          commonName: parseDn(bloodyMicrosoftSubjectDn).get(\"CN\")!,\n          bloodyMicrosoftSubjectDn,\n        }\n      }\n\n      const cscFile = cscInfo.file\n      if (cscFile == null) {\n        return null\n      }\n\n      const certExt = path.extname(cscFile).toLowerCase()\n      if (certExt === \".p12\" || certExt === \".pfx\") {\n        return await this.getCertInfo(cscFile, cscInfo.password || \"\")\n      }\n      // Non-PKCS12 files (.crt, .cer): parse as plain X.509.\n      // Returns null when the CN is absent — caller must set publisherName explicitly.\n      return await readCertInfoFromX509(cscFile)\n    }\n  )\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.platformSpecificBuildOptions,\n    platformSpecificBuildOptions => {\n      const signing = getSigntoolFamilyConfig(platformSpecificBuildOptions)\n      // signtool is the implicit default when win.sign is unset, so an absent config still\n      // honours the WIN_CSC_LINK/cscLink fallback below (hsm/pkcs11 set signing.type explicitly).\n      const isSigntool = signing == null || signing.type === \"signtool\"\n\n      // signtool + hsm: store-based cert takes priority\n      const subjectName = (signing as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null)?.certificateSubjectName\n      const shaType = (signing as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null)?.certificateSha1\n      if (subjectName != null || shaType != null) {\n        return this.packager.vm.value\n          .then(vm => this.getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))\n          .catch((e: any) => {\n            // https://github.com/electron-userland/electron-builder/pull/2397\n            if (signing?.sign == null) {\n              throw e\n            } else {\n              log.debug({ error: e }, \"getCertificateFromStoreInfo error\")\n              return null\n            }\n          })\n      }\n\n      const certificateFile = signing?.certificateFile\n      if (certificateFile != null) {\n        // Only signtool mode uses a password (HSM private key lives in the HSM, not the cert file)\n        const certificatePassword = isSigntool ? this.packager.getCscPassword() : null\n        return Promise.resolve({\n          file: certificateFile,\n          password: certificatePassword == null ? null : certificatePassword.trim(),\n        })\n      }\n\n      // WIN_CSC_LINK env var fallback: only for signtool mode (including the implicit default)\n      if (isSigntool) {\n        const cscLink = this.packager.getCscLink(\"WIN_CSC_LINK\")\n        if (cscLink == null || cscLink === \"\") {\n          return Promise.resolve(null)\n        }\n\n        return importCertificate(cscLink, this.packager.tempDirManager, this.packager.projectDir)\n          .catch((e: any) => {\n            if (e instanceof InvalidConfigurationError) {\n              throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)\n            } else {\n              throw e\n            }\n          })\n          .then(p => ({\n            file: p,\n            password: this.packager.getCscPassword(),\n          }))\n      }\n\n      return Promise.resolve(null)\n    }\n  )\n\n  initialize(): Promise<void> {\n    return Promise.resolve()\n  }\n\n  // https://github.com/electron-userland/electron-builder/issues/2108#issuecomment-333200711\n  async computePublisherName(target: Target, publisherName: string | null) {\n    if (target instanceof AppXTarget && (await this.cscInfo.value) == null) {\n      log.info({ reason: \"Windows Store only build\" }, \"AppX is not signed\")\n      return publisherName ?? \"CN=ms\"\n    }\n\n    // When a signing cert is available, the cert's subject MUST be used so the APPX package\n    // Publisher attribute matches the certificate — any mismatch causes SignerSign to fail with\n    // ERROR_BAD_FORMAT. Only honour a user-supplied publisherName if it was explicitly configured\n    // (non-null); otherwise derive from the certificate.\n    const certInfo = await this.lazyCertInfo.value\n    const publisher = publisherName ?? certInfo?.bloodyMicrosoftSubjectDn ?? null\n    if (publisher == null) {\n      throw new Error(\"Internal error: cannot compute subject using certificate info\")\n    }\n    return publisher\n  }\n\n  /**\n   * Called when cscInfo is null. Returns true to skip signing, false to proceed, or throws.\n   * Override in subclasses with different null-cert behaviour (HSM throws, PKCS#11 proceeds).\n   */\n  protected handleNullCscInfo(customSign: CustomWindowsSign | string | null | undefined): boolean {\n    return !customSign // default: skip when no cert and no custom sign hook\n  }\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    const signing = getSigntoolFamilyConfig(options.options)\n    let hashes = signing?.signingHashAlgorithms\n    // msi does not support dual-signing\n    if (options.path.endsWith(\".msi\")) {\n      hashes = [hashes != null && !hashes.includes(\"sha1\") ? \"sha256\" : \"sha1\"]\n    } else if (options.path.endsWith(\".appx\")) {\n      hashes = [\"sha256\"]\n    } else if (hashes == null) {\n      hashes = [\"sha1\", \"sha256\"]\n    } else {\n      hashes = Array.isArray(hashes) ? hashes : [hashes]\n    }\n\n    const name = this.packager.appInfo.productName\n    const site = await this.packager.appInfo.computePackageUrl()\n\n    const customSign = await resolveFunction(this.packager.appInfo.type, signing?.sign, \"sign\", await this.packager.getWorkspaceRoot())\n\n    const cscInfo = await this.cscInfo.value\n\n    if (cscInfo) {\n      let logInfo: any = {\n        file: log.filePath(options.path),\n      }\n      if (\"file\" in cscInfo) {\n        logInfo = { ...logInfo, certificateFile: cscInfo.file }\n      } else {\n        logInfo = {\n          ...logInfo,\n          subject: cscInfo.subject,\n          thumbprint: cscInfo.thumbprint,\n          store: cscInfo.store,\n          user: cscInfo.isLocalMachineStore ? \"local machine\" : \"current user\",\n        }\n      }\n      log.info(logInfo, \"signing\")\n    } else if (this.handleNullCscInfo(customSign)) {\n      log.debug({ signHook: !!customSign, cscInfo }, \"no signing info identified, signing is skipped\")\n      return false\n    }\n\n    const executor = customSign || ((config: CustomWindowsSignTaskConfiguration, packager: WinPackager) => this.doSign(config, packager))\n    let isNest = false\n    for (const hash of hashes) {\n      const taskConfiguration: WindowsSignTaskConfiguration = { ...options, name, site, cscInfo, hash, isNest }\n      await Promise.resolve(\n        executor(\n          {\n            ...taskConfiguration,\n            computeSignToolArgs: isWin => this.computeSignToolArgs(taskConfiguration, isWin),\n          },\n          this.packager\n        )\n      )\n      isNest = true\n      if (taskConfiguration.resultOutputPath != null) {\n        await rename(taskConfiguration.resultOutputPath, options.path)\n      }\n    }\n\n    return true\n  }\n\n  async getCertInfo(file: string, password: string): Promise<CertificateInfo> {\n    const errorMessagePrefix = \"Cannot extract publisher name from code signing certificate. As workaround, set win.publisherName. Error: \"\n    try {\n      return await readCertInfo(file, password)\n    } catch (e: any) {\n      throw new InvalidConfigurationError(`${errorMessagePrefix}${e.message || e}`)\n    }\n  }\n\n  // on windows be aware of http://stackoverflow.com/a/32640183/1910191\n  computeSignToolArgs(options: WindowsSignTaskConfiguration, isWin: boolean, vm: VmManager = new VmManager()): Array<string> {\n    return isWin ? this.computeWindowsSignArgs(options, vm) : this.computeOsslsigncodeArgs(options, vm)\n  }\n\n  protected isLegacyToolset(): boolean {\n    const v = this.packager.config.toolsets?.winCodeSign\n    // Only an explicit \"0.0.0\" pin is legacy; unset / null / \"latest\" / custom now resolve to a modern bundle.\n    return v === \"0.0.0\"\n  }\n\n  protected abstract computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>\n  protected abstract computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string>\n\n  // allowX509: set to true by HsmSignManager to permit .crt/.cer (public chain only, key is in HSM).\n  protected addCertificateArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean, allowX509 = false): void {\n    if (options.cscInfo == null) {\n      throw new Error(\"No code signing certificate configured. Provide certificateFile, certificateSha1, or certificateSubjectName.\")\n    }\n    const certificateFile = (options.cscInfo as FileCodeSigningInfo).file\n\n    if (certificateFile == null) {\n      // Certificate from store (Windows only)\n      if (!isWin) {\n        throw new Error(\"certificateSha1/certificateSubjectName supported only on Windows\")\n      }\n\n      const cscInfo = options.cscInfo as CertificateFromStoreInfo\n      args.push(\"/sha1\", cscInfo.thumbprint)\n      args.push(\"/s\", cscInfo.store)\n      if (cscInfo.isLocalMachineStore) {\n        args.push(\"/sm\")\n      }\n    } else {\n      const certExtension = path.extname(certificateFile).toLowerCase()\n\n      if (certExtension === \".p12\" || certExtension === \".pfx\") {\n        args.push(isWin ? \"/f\" : \"-pkcs12\", vm.toVmFile(certificateFile))\n      } else if (isWin && allowX509 && (certExtension === \".crt\" || certExtension === \".cer\")) {\n        args.push(\"/f\", vm.toVmFile(certificateFile))\n      } else {\n        throw new InvalidConfigurationError(`Please specify pkcs12 (.p12/.pfx) file, ${certificateFile} is not correct`)\n      }\n    }\n  }\n\n  protected addCommonSigningArgs(args: Array<string>, options: WindowsSignTaskConfiguration, vm: VmManager, isWin: boolean): void {\n    if (options.name) {\n      args.push(isWin ? \"/d\" : \"-n\", options.name)\n    }\n\n    if (options.site) {\n      args.push(isWin ? \"/du\" : \"-i\", options.site)\n    }\n\n    if (options.isNest) {\n      args.push(isWin ? \"/as\" : \"-nest\")\n    }\n\n    const password = (options.cscInfo as FileCodeSigningInfo)?.password\n    if (password) {\n      args.push(isWin ? \"/p\" : \"-pass\", password)\n    }\n\n    const signing = getSigntoolFamilyConfig(options.options)\n    const additionalCert = signing?.additionalCertificateFile\n    if (additionalCert) {\n      args.push(isWin ? \"/ac\" : \"-ac\", vm.toVmFile(additionalCert))\n    }\n  }\n\n  getOutputPath(inputPath: string, hash: string) {\n    const extension = path.extname(inputPath)\n    return path.join(path.dirname(inputPath), `${path.basename(inputPath, extension)}-signed-${hash}${extension}`)\n  }\n\n  async getCertificateFromStoreInfo(options: WindowsConfiguration, vm: VmManager): Promise<CertificateFromStoreInfo> {\n    const signing = getSigntoolFamilyConfig(options) as WindowsSigntoolSigningConfig | WindowsHsmSigningConfig | null\n    const certificateSubjectName = signing?.certificateSubjectName\n    const certificateSha1 = signing?.certificateSha1?.toUpperCase()\n\n    const ps = await vm.powershellCommand.value\n    const rawResult = await vm.exec(ps, [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-Command\",\n      \"Get-ChildItem -Recurse Cert: -CodeSigningCert | Select-Object -Property Subject,PSParentPath,Thumbprint | ConvertTo-Json -Compress\",\n    ])\n    const certList = rawResult.length === 0 ? [] : asArray<CertInfo>(JSON.parse(rawResult))\n    for (const certInfo of certList) {\n      if (\n        (certificateSubjectName != null && !certInfo.Subject.includes(certificateSubjectName)) ||\n        (certificateSha1 != null && certInfo.Thumbprint.toUpperCase() !== certificateSha1)\n      ) {\n        continue\n      }\n\n      const parentPath = certInfo.PSParentPath\n      const store = parentPath.substring(parentPath.lastIndexOf(\"\\\\\") + 1)\n      log.debug({ store, PSParentPath: parentPath }, \"auto-detect certificate store\")\n      // https://github.com/electron-userland/electron-builder/issues/1717\n      const isLocalMachineStore = parentPath.includes(\"Certificate::LocalMachine\")\n      log.debug(null, \"auto-detect using of LocalMachine store\")\n      return {\n        thumbprint: certInfo.Thumbprint,\n        subject: certInfo.Subject,\n        store,\n        isLocalMachineStore,\n      }\n    }\n\n    throw new Error(`Cannot find certificate ${certificateSubjectName || certificateSha1}, all certs: ${rawResult}`)\n  }\n\n  async getToolPath(isWin = process.platform === \"win32\"): Promise<ToolInfo> {\n    return getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n  }\n\n  async doSign(configuration: CustomWindowsSignTaskConfiguration, packager: WinPackager) {\n    // https://github.com/electron-userland/electron-builder/pull/1944\n    const timeout = parseInt(process.env.SIGNTOOL_TIMEOUT as any, 10) || 10 * 60 * 1000\n    let args: Array<string>\n    let vm: VmManager\n    // cscInfo can be null (e.g. PKCS#11 with no cert file); guard before using `in`.\n    // CertificateFromStoreInfo (no `file` property) requires a Windows VM for cert-store lookup.\n    const cscInfo = configuration.cscInfo\n    const useVmIfNotOnWin = configuration.path.endsWith(\".appx\") || (cscInfo != null && !(\"file\" in cscInfo))\n    const isWin = process.platform === \"win32\" || useVmIfNotOnWin\n    const toolInfo = await getSignToolPath(this.packager.config.toolsets?.winCodeSign, isWin, this.packager.buildResourcesDir)\n    const tool = toolInfo.path\n    if (useVmIfNotOnWin) {\n      vm = await packager.vm.value\n      args = this.computeSignToolArgs(configuration, isWin, vm)\n    } else {\n      vm = new VmManager()\n      args = configuration.computeSignToolArgs(isWin)\n    }\n\n    // signtool.exe (`/f`) is not safe to run concurrently — it races on the shared per-user crypto store.\n    // Serialize real-Windows signtool invocations across processes; osslsigncode (`!isWin`) is file-isolated.\n    const execSign = () => vm.exec(tool, args, { timeout, env: { ...process.env, ...(toolInfo.env || {}) } })\n    await retry(() => (isWin ? withSigntoolLock(execSign) : execSign()), {\n      retries: 2,\n      interval: 15000,\n      backoff: 10000,\n      shouldRetry: (e: any) => {\n        if (\n          e.message.includes(\"The file is being used by another process\") ||\n          e.message.includes(\"The specified timestamp server either could not be reached\") ||\n          e.message.includes(\"No certificates were found that met all the given criteria.\") ||\n          // Transient failure of SignerSignEx after cert selection, typically a concurrent-signtool race\n          // on the per-user crypto store; the cross-process lock above makes this rare, retry covers the rest.\n          e.message.includes(\"An error occurred while attempting to load the signing certificate\")\n        ) {\n          log.warn(`Attempt to code sign failed, another attempt will be made in 15 seconds: ${e.message}`)\n          return true\n        }\n        return false\n      },\n    })\n  }\n}\n\nexport class SigntoolSignManager extends SigntoolBaseSignManager {\n  protected computeWindowsSignArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const signing = getSigntoolFamilyConfig(options.options)\n\n    const inputFile = vm.toVmFile(options.path)\n    const args = [\"sign\"]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const isRfc3161 = options.isNest || options.hash === \"sha256\"\n      args.push(isRfc3161 ? \"/tr\" : \"/t\")\n      const timestampUrl = isRfc3161 ? signing?.rfc3161TimeStampServer || \"http://timestamp.digicert.com\" : signing?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(timestampUrl)\n    }\n\n    // Certificate\n    this.addCertificateArgs(args, options, vm, true)\n\n    // Hash algorithm\n    if (this.isLegacyToolset()) {\n      // Legacy v0.0.0: Only add /fd for non-SHA1 (original behavior)\n      if (options.hash !== \"sha1\") {\n        args.push(\"/fd\", options.hash)\n        if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n          args.push(\"/td\", \"sha256\")\n        }\n      }\n    } else {\n      // Modern: Always add /fd (required by new Windows Kits)\n      args.push(\"/fd\", options.hash.toLowerCase())\n      // Only add /td for RFC3161 timestamps (incompatible with /t)\n      if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\" && (options.isNest || options.hash === \"sha256\")) {\n        args.push(\"/td\", \"sha256\")\n      }\n    }\n\n    // Optional parameters\n    this.addCommonSigningArgs(args, options, vm, true)\n\n    // Windows-specific\n    args.push(\"/debug\")\n    args.push(inputFile) // Must be last\n\n    return args\n  }\n\n  protected computeOsslsigncodeArgs(options: WindowsSignTaskConfiguration, vm: VmManager): Array<string> {\n    const signing = getSigntoolFamilyConfig(options.options)\n\n    const inputFile = vm.toVmFile(options.path)\n    const outputPath = this.getOutputPath(inputFile, options.hash)\n    options.resultOutputPath = outputPath\n\n    const args = [\"sign\", \"-in\", inputFile, \"-out\", outputPath]\n\n    // Timestamping\n    if (process.env.ELECTRON_BUILDER_OFFLINE !== \"true\") {\n      const timestampUrl = signing?.timeStampServer || \"http://timestamp.digicert.com\"\n      args.push(\"-t\", timestampUrl)\n    }\n\n    // Certificate file\n    this.addCertificateArgs(args, options, vm, false)\n\n    // Hash algorithm\n    args.push(\"-h\", options.hash.toLowerCase())\n\n    // Optional parameters (name, site, nest, password, additionalCert)\n    this.addCommonSigningArgs(args, options, vm, false)\n\n    // Proxy support\n    const httpsProxy = process.env.HTTPS_PROXY\n    if (httpsProxy?.length) {\n      args.push(\"-p\", httpsProxy)\n    }\n\n    return args\n  }\n}\n"]}

package/dist/codeSign/win/windowsSignAzureManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"windowsSignAzureManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAiE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAIjI,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAI3F,qBAAa,uBAAwB,YAAW,WAAW;IAkB7C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAjBrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAGnD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAsJ;IAEzK,QAAQ,CAAC,qBAAqB,wBAE5B;IAEF,OAAO,KAAK,aAAa,GAMxB;gBAE4B,QAAQ,EAAE,WAAW;IAQlD,OAAO,CAAC,YAAY;IASd,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBjC,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpF,QAAQ,CAAC,OAAO,wFAGf;IAEK,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;YAI/C,cAAc;YA0Cd,gBAAgB;CAqE/B"}
+{"version":3,"file":"windowsSignAzureManager.d.ts","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAiE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAKjI,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAI3F,qBAAa,uBAAwB,YAAW,WAAW;IAkB7C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAjBrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAGnD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAsJ;IAEzK,QAAQ,CAAC,qBAAqB,wBAE5B;IAEF,OAAO,KAAK,aAAa,GAMxB;gBAE4B,QAAQ,EAAE,WAAW;IAQlD,OAAO,CAAC,YAAY;IAYd,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBjC,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpF,QAAQ,CAAC,OAAO,wFAGf;IAEK,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;YAI/C,cAAc;YA0Cd,gBAAgB;CAyE/B"}

package/dist/codeSign/win/windowsSignAzureManager.js

@@ -4,7 +4,8 @@ import _fsExtra from "fs-extra";
 import { Lazy } from "lazy-val";
 import * as path from "path";
 import { resolveWindowsSigningConfiguration } from "../../options/winOptions.js";
-import { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle } from "../../toolsets/winCodeSign.js";
+import { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle, WIN_CODESIGN_LATEST } from "../../toolsets/winCodeSign.js";
+import { resolveToolsetVersion } from "../../toolsets/version.js";
 import { VmManager } from "../../vm/vm.js";
 import { WineVmManager } from "../../vm/WineVm.js";
 import semver from "semver";
@@ -32,20 +33,25 @@ export class WindowsSignAzureManager {
         this.signing = signing;
     }
     isLegacyMode() {
-        const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {};
-        if (typeof wcs === "string") {
-            return semver.lt(wcs, minimumWinCodeSignVersionForDlib);
+        const wcs = this.packager.config.toolsets?.winCodeSign;
+        // ToolsetCustom object = user-managed bundle (provides its own dlib alongside signtool) → not legacy.
+        if (typeof wcs === "object" && wcs != null) {
+            return false;
         }
-        // null = built-in toolset not configured → legacy; ToolsetCustom object = user-managed → not legacy
-        return wcs == null;
+        // Unset / null / "latest" resolve to the newest bundle, which ships the ATS dlib + .NET payload.
+        // An explicit version below 1.3.0 (e.g. "0.0.0", "1.2.1") has no dlib → legacy PowerShell.
+        const resolved = resolveToolsetVersion(wcs, WIN_CODESIGN_LATEST);
+        return semver.lt(resolved, minimumWinCodeSignVersionForDlib);
     }
     async initialize() {
         if (!this.isLegacyMode()) {
             return;
         }
-        const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {};
-        const reason = typeof wcs === "string" ? `toolsets.winCodeSign "${wcs}" is below the minimum "${minimumWinCodeSignVersionForDlib}"` : `toolsets.winCodeSign is not set`;
-        log.info({ reason, guidance: `set toolsets.winCodeSign to "${minimumWinCodeSignVersionForDlib}" to use the faster signtool /dlib integration` }, `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`);
+        const wcs = this.packager.config.toolsets?.winCodeSign;
+        log.info({
+            reason: `toolsets.winCodeSign "${String(wcs)}" is below the minimum "${minimumWinCodeSignVersionForDlib}"`,
+            guidance: `leave toolsets.winCodeSign unset (or set it to "${minimumWinCodeSignVersionForDlib}" / "latest") to use the faster signtool /dlib integration`,
+        }, `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`);
         const vm = await this.packager.vm.value;
         const ps = await vm.powershellCommand.value;
         log.info(null, "installing required module (TrustedSigning) with scope CurrentUser");
@@ -100,30 +106,34 @@ export class WindowsSignAzureManager {
     }
     async signFileWithDlib(options) {
         const { signing } = this;
-        const winCodeSign = this.packager.config.toolsets.winCodeSign;
+        const winCodeSign = this.packager.config.toolsets?.winCodeSign;
+        const isCustom = typeof winCodeSign === "object" && winCodeSign != null;
         // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64
         // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under
         // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.
         const arch = process.arch === "ia32" ? Arch.ia32 : Arch.x64;
-        const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, arch, resourcesDir: this.packager.buildResourcesDir });
+        const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, resourcesDir: this.packager.buildResourcesDir });
         // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.
         // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).
-        const safeKitDir = sanitizeDirPath(kitDir, typeof winCodeSign === "object" ? this.packager.buildResourcesDir : undefined);
+        const safeKitDir = sanitizeDirPath(kitDir, isCustom ? this.packager.buildResourcesDir : undefined);
         const signtoolPath = path.join(safeKitDir, "signtool.exe");
         let dlibPath;
         let dotnetRootPath = null;
-        if (typeof winCodeSign === "string") {
-            // 1.3.0+: dlib ships in a separate ats-bundle with its full native dependency closure
-            // (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is in a separate dotnet-runtime
-            // bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll → shared framework.
-            const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(winCodeSign));
-            dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? "x86" : "x64", "Azure.CodeSigning.Dlib.dll");
-            dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(winCodeSign));
-        }
-        else {
+        if (typeof winCodeSign === "object" && winCodeSign != null) {
             // Custom toolset: user provides the dlib alongside signtool in the kit dir.
             dlibPath = path.join(safeKitDir, "Azure.CodeSigning.Dlib.dll");
         }
+        else {
+            // Built-in bundle. Unset / null / "latest" resolve to the newest version (>= 1.3.0); an
+            // explicit >= 1.3.0 version is used as-is. The dlib ships in a separate ats-bundle with its
+            // full native dependency closure (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is
+            // in a separate dotnet-runtime bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll →
+            // shared framework.
+            const version = resolveToolsetVersion(winCodeSign, WIN_CODESIGN_LATEST);
+            const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(version));
+            dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? "x86" : "x64", "Azure.CodeSigning.Dlib.dll");
+            dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(version));
+        }
         const metadataPath = await this.packager.getTempFile(".json");
         await _fsExtra.writeJson(metadataPath, {
             Endpoint: signing.endpoint,

package/dist/codeSign/win/windowsSignAzureManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,kCAAkC,EAAmD,MAAM,6BAA6B,CAAA;AACjI,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAC1G,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKlD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,MAAM,gCAAgC,GAAG,OAAO,CAAA;AAChD,MAAM,OAAO,uBAAuB;IAUlC,IAAY,aAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAA;QACzC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;QAC/H,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAflD,4FAA4F;QAC3E,OAAE,GAAc,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAEhK,0BAAqB,GAAG,IAAI,IAAI,CAAuB,GAAG,EAAE;YACnE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QAsDO,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EACnC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QA9CC,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iEAAiE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEO,YAAY;QAClB,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;QACvE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAA;QACzD,CAAC;QACD,oGAAoG;QACpG,OAAO,GAAG,IAAI,IAAI,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;QACvE,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,GAAG,2BAA2B,gCAAgC,GAAG,CAAC,CAAC,CAAC,iCAAiC,CAAA;QACvK,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,QAAQ,EAAE,gCAAgC,gCAAgC,gDAAgD,EAAE,EACtI,kFAAkF,CACnF,CAAA;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kEAAkE,CAAC,CAAA;QAC1H,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC,CAAA;IAC/K,CAAC;IAED,oBAAoB,CAAC,OAAe,EAAE,aAA4B;QAChE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,CAAA;IAC7D,CAAC;IAOD,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA2B;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,aAAa,GAAG,0BAA0B,CAAA;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,sIAAsI,CACrK,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAuC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAClF,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ;YACpD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;YAC1C,GAAG,OAAO,CAAC,kBAAkB;YAC7B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAA;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;aAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,+EAA+E;QAC/E,gFAAgF;QAChF,mGAAmG;QACnG,MAAM,SAAS,GAAG,yBAAyB,YAAY,EAAE,CAAA;QACzD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAA2B;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAS,CAAC,WAAY,CAAA;QAE/D,yFAAyF;QACzF,wFAAwF;QACxF,wEAAwE;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;QACxH,uFAAuF;QACvF,2FAA2F;QAC3F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACzH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;QAE1D,IAAI,QAAgB,CAAA;QACpB,IAAI,cAAc,GAAkB,IAAI,CAAA;QAExC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,sFAAsF;YACtF,0FAA0F;YAC1F,kFAAkF;YAClF,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;YACtE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAA;YAClG,cAAc,GAAG,eAAe,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAA;QAC1E,CAAC;aAAM,CAAC;YACN,4EAA4E;YAC5E,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,GAAG,OAAO,CAAC,kBAAkB;SAC9B,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG;YACX,MAAM;YACN,KAAK;YACL,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YAC9C,KAAK;YACL,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAChE,KAAK;YACL,CAAC,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YACnD,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/B,CAAA;QAED,GAAG,CAAC,IAAI,CACN;YACE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,sBAAsB;YACvC,OAAO,EAAE,OAAO,CAAC,sBAAsB;SACxC,EACD,qDAAqD,CACtD,CAAA;QAED,oFAAoF;QACpF,yFAAyF;QACzF,oDAAoD;QACpD,MAAM,WAAW,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACnH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { Arch, isEmptyOrSpaces, log, sanitizeDirPath } from \"builder-util\"\nimport { asArray, MemoLazy } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport { resolveWindowsSigningConfiguration, WindowsAzureSigningConfig, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle } from \"../../toolsets/winCodeSign.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport { WineVmManager } from \"../../vm/WineVm.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager.js\"\nimport semver from \"semver\"\n\nconst minimumWinCodeSignVersionForDlib = \"1.3.0\"\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly signing: WindowsAzureSigningConfig\n\n  // signtool.exe is a Windows PE binary; use Wine on non-Windows (same pattern as MsiTarget).\n  private readonly vm: VmManager = process.platform === \"win32\" ? new VmManager() : new WineVmManager(this.packager.config.toolsets?.wine, this.packager.buildResourcesDir)\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    return Promise.resolve(asArray(this.publisherName))\n  })\n\n  private get publisherName(): string {\n    const result = this.signing.publisherName\n    if (isEmptyOrSpaces(result)) {\n      throw new Error(\"Azure Trusted Signing requires 'publisherName' in win.sign config (no local certificate to derive it from)\")\n    }\n    return result\n  }\n\n  constructor(private readonly packager: WinPackager) {\n    const signing = resolveWindowsSigningConfiguration(packager.platformOptions)\n    if (signing?.type !== \"azure\") {\n      throw new Error(`WindowsSignAzureManager requires signing.type = \"azure\", got: ${signing?.type}`)\n    }\n    this.signing = signing\n  }\n\n  private isLegacyMode(): boolean {\n    const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {}\n    if (typeof wcs === \"string\") {\n      return semver.lt(wcs, minimumWinCodeSignVersionForDlib)\n    }\n    // null = built-in toolset not configured → legacy; ToolsetCustom object = user-managed → not legacy\n    return wcs == null\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.isLegacyMode()) {\n      return\n    }\n\n    const { winCodeSign: wcs = null } = this.packager.config.toolsets ?? {}\n    const reason = typeof wcs === \"string\" ? `toolsets.winCodeSign \"${wcs}\" is below the minimum \"${minimumWinCodeSignVersionForDlib}\"` : `toolsets.winCodeSign is not set`\n    log.info(\n      { reason, guidance: `set toolsets.winCodeSign to \"${minimumWinCodeSignVersionForDlib}\" to use the faster signtool /dlib integration` },\n      `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`\n    )\n\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider NuGet — may already be present\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser\"])\n  }\n\n  computePublisherName(_target: Target, publisherName: string | null): Promise<string> {\n    return Promise.resolve(this.publisherName ?? publisherName)\n  }\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformOptions,\n    _selected => Promise.resolve(null)\n  )\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    return this.isLegacyMode() ? this.signFileLegacy(options) : this.signFileWithDlib(options)\n  }\n\n  private async signFileLegacy(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    // Validate additionalMetadata keys before embedding as PS parameter names.\n    // Keys flow directly into `-${field} '...'` in the command string; a key\n    // containing semicolons or quotes would be PowerShell injection.\n    const PS_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/\n    for (const key of Object.keys(signing.additionalMetadata ?? {})) {\n      if (!PS_PARAM_NAME.test(key)) {\n        throw new Error(\n          `additionalMetadata key \"${key}\" is not a valid PowerShell parameter name. Keys must match /^[A-Za-z_][A-Za-z0-9_]*$/ (e.g. \"ExcludeCredentials\", \"CorrelationId\").`\n        )\n      }\n    }\n\n    const params: Record<string, string | undefined> = {\n      Endpoint: signing.endpoint,\n      CertificateProfileName: signing.certificateProfileName,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      TimestampRfc3161: signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: signing.timestampDigest ?? \"SHA256\",\n      FileDigest: signing.fileDigest ?? \"SHA256\",\n      ...signing.additionalMetadata,\n      Files: vm.toVmFile(options.path),\n    }\n\n    const paramsString = Object.entries(params)\n      .filter(([, value]) => value != null)\n      .map(([field, value]) => `-${field} '${String(value).replace(/'/g, \"''\")}'`)\n      .join(\" \")\n\n    // Use -EncodedCommand (Base64 UTF-16LE) so the command string is opaque to any\n    // intermediate shell or argument parser — no cmd.exe / ConHost escaping needed.\n    // PowerShell still parses the decoded string, so PS-level single-quote escaping above is retained.\n    const psCommand = `Invoke-TrustedSigning ${paramsString}`\n    const encodedCommand = Buffer.from(psCommand, \"utf16le\").toString(\"base64\")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encodedCommand])\n    return true\n  }\n\n  private async signFileWithDlib(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const winCodeSign = this.packager.config.toolsets!.winCodeSign!\n\n    // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64\n    // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under\n    // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.\n    const arch = process.arch === \"ia32\" ? Arch.ia32 : Arch.x64\n    const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, arch, resourcesDir: this.packager.buildResourcesDir })\n    // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.\n    // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).\n    const safeKitDir = sanitizeDirPath(kitDir, typeof winCodeSign === \"object\" ? this.packager.buildResourcesDir : undefined)\n    const signtoolPath = path.join(safeKitDir, \"signtool.exe\")\n\n    let dlibPath: string\n    let dotnetRootPath: string | null = null\n\n    if (typeof winCodeSign === \"string\") {\n      // 1.3.0+: dlib ships in a separate ats-bundle with its full native dependency closure\n      // (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is in a separate dotnet-runtime\n      // bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll → shared framework.\n      const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(winCodeSign))\n      dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? \"x86\" : \"x64\", \"Azure.CodeSigning.Dlib.dll\")\n      dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(winCodeSign))\n    } else {\n      // Custom toolset: user provides the dlib alongside signtool in the kit dir.\n      dlibPath = path.join(safeKitDir, \"Azure.CodeSigning.Dlib.dll\")\n    }\n\n    const metadataPath = await this.packager.getTempFile(\".json\")\n    await _fsExtra.writeJson(metadataPath, {\n      Endpoint: signing.endpoint,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      CertificateProfileName: signing.certificateProfileName,\n      ...signing.additionalMetadata,\n    })\n\n    const args = [\n      \"sign\",\n      \"/fd\",\n      (signing.fileDigest ?? \"SHA256\").toUpperCase(),\n      \"/tr\",\n      signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      \"/td\",\n      (signing.timestampDigest ?? \"SHA256\").toUpperCase(),\n      \"/dlib\",\n      this.vm.toVmFile(dlibPath),\n      \"/dmdf\",\n      this.vm.toVmFile(metadataPath),\n      this.vm.toVmFile(options.path),\n    ]\n\n    log.info(\n      {\n        file: log.filePath(options.path),\n        endpoint: signing.endpoint,\n        account: signing.codeSigningAccountName,\n        profile: signing.certificateProfileName,\n      },\n      \"signing with Azure Trusted Signing (signtool /dlib)\"\n    )\n\n    // DOTNET_ROOT: Ijwhost.dll (shipped in the ats-bundle) reads this env var to locate\n    // hostfxr.dll. On Wine, toVmFile converts the host path to a Z:\\ path that Wine resolves\n    // back to the same location on the host filesystem.\n    const execOptions = dotnetRootPath != null ? { env: { DOTNET_ROOT: this.vm.toVmFile(dotnetRootPath) } } : undefined\n    await this.vm.exec(signtoolPath, args, execOptions)\n    return true\n  }\n}\n"]}
+{"version":3,"file":"windowsSignAzureManager.js","sourceRoot":"","sources":["../../../src/codeSign/win/windowsSignAzureManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,kCAAkC,EAAmD,MAAM,6BAA6B,CAAA;AACjI,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AAC/H,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAKlD,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,MAAM,gCAAgC,GAAG,OAAO,CAAA;AAChD,MAAM,OAAO,uBAAuB;IAUlC,IAAY,aAAa;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAA;QACzC,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;QAC/H,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAflD,4FAA4F;QAC3E,OAAE,GAAc,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAEhK,0BAAqB,GAAG,IAAI,IAAI,CAAuB,GAAG,EAAE;YACnE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QA2DO,YAAO,GAAG,IAAI,QAAQ,CAC7B,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EACnC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CACnC,CAAA;QAnDC,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC5E,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iEAAiE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACnG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACtD,sGAAsG;QACtG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAA;QACd,CAAC;QACD,iGAAiG;QACjG,2FAA2F;QAC3F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAA;QAChE,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzB,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QACtD,GAAG,CAAC,IAAI,CACN;YACE,MAAM,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,2BAA2B,gCAAgC,GAAG;YAC1G,QAAQ,EAAE,mDAAmD,gCAAgC,4DAA4D;SAC1J,EACD,kFAAkF,CACnF,CAAA;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oEAAoE,CAAC,CAAA;QACpF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,yFAAyF,CAAC,CAAC,CAAA;QAC7J,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,EAAE,EAAE,kEAAkE,CAAC,CAAA;QAC1H,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,2GAA2G,CAAC,CAAC,CAAA;IAC/K,CAAC;IAED,oBAAoB,CAAC,OAAe,EAAE,aAA4B;QAChE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,CAAA;IAC7D,CAAC;IAOD,KAAK,CAAC,QAAQ,CAAC,OAA2B;QACxC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA2B;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAA;QACvC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAA;QAE3C,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,aAAa,GAAG,0BAA0B,CAAA;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,sIAAsI,CACrK,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAuC;YACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAClF,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ;YACpD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;YAC1C,GAAG,OAAO,CAAC,kBAAkB;YAC7B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SACjC,CAAA;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;aAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,+EAA+E;QAC/E,gFAAgF;QAChF,mGAAmG;QACnG,MAAM,SAAS,GAAG,yBAAyB,YAAY,EAAE,CAAA;QACzD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAA2B;QACxD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAA;QAC9D,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,CAAA;QAEvE,yFAAyF;QACzF,wFAAwF;QACxF,wEAAwE;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;QAC3D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;QAClH,uFAAuF;QACvF,2FAA2F;QAC3F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAClG,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;QAE1D,IAAI,QAAgB,CAAA;QACpB,IAAI,cAAc,GAAkB,IAAI,CAAA;QAExC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YAC3D,4EAA4E;YAC5E,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAA;QAChE,CAAC;aAAM,CAAC;YACN,wFAAwF;YACxF,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,oBAAoB;YACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAA;YACvE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;YAClE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAA;YAClG,cAAc,GAAG,eAAe,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;YACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,GAAG,OAAO,CAAC,kBAAkB;SAC9B,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG;YACX,MAAM;YACN,KAAK;YACL,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YAC9C,KAAK;YACL,OAAO,CAAC,gBAAgB,IAAI,oCAAoC;YAChE,KAAK;YACL,CAAC,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE;YACnD,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO;YACP,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;SAC/B,CAAA;QAED,GAAG,CAAC,IAAI,CACN;YACE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,sBAAsB;YACvC,OAAO,EAAE,OAAO,CAAC,sBAAsB;SACxC,EACD,qDAAqD,CACtD,CAAA;QAED,oFAAoF;QACpF,yFAAyF;QACzF,oDAAoD;QACpD,MAAM,WAAW,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QACnH,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;CACF","sourcesContent":["import { Arch, isEmptyOrSpaces, log, sanitizeDirPath } from \"builder-util\"\nimport { asArray, MemoLazy } from \"builder-util-runtime\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { Target } from \"../../core.js\"\nimport { resolveWindowsSigningConfiguration, WindowsAzureSigningConfig, WindowsConfiguration } from \"../../options/winOptions.js\"\nimport { getAtsBundleDir, getDotnetRuntimeDir, getWindowsKitsBundle, WIN_CODESIGN_LATEST } from \"../../toolsets/winCodeSign.js\"\nimport { resolveToolsetVersion } from \"../../toolsets/version.js\"\nimport { VmManager } from \"../../vm/vm.js\"\nimport { WineVmManager } from \"../../vm/WineVm.js\"\nimport { WinPackager } from \"../../winPackager.js\"\nimport { SignManager } from \"./signManager.js\"\nimport { WindowsSignOptions } from \"./windowsCodeSign.js\"\nimport { CertificateFromStoreInfo, FileCodeSigningInfo } from \"./windowsSignToolManager.js\"\nimport semver from \"semver\"\n\nconst minimumWinCodeSignVersionForDlib = \"1.3.0\"\nexport class WindowsSignAzureManager implements SignManager {\n  private readonly signing: WindowsAzureSigningConfig\n\n  // signtool.exe is a Windows PE binary; use Wine on non-Windows (same pattern as MsiTarget).\n  private readonly vm: VmManager = process.platform === \"win32\" ? new VmManager() : new WineVmManager(this.packager.config.toolsets?.wine, this.packager.buildResourcesDir)\n\n  readonly computedPublisherName = new Lazy<Array<string> | null>(() => {\n    return Promise.resolve(asArray(this.publisherName))\n  })\n\n  private get publisherName(): string {\n    const result = this.signing.publisherName\n    if (isEmptyOrSpaces(result)) {\n      throw new Error(\"Azure Trusted Signing requires 'publisherName' in win.sign config (no local certificate to derive it from)\")\n    }\n    return result\n  }\n\n  constructor(private readonly packager: WinPackager) {\n    const signing = resolveWindowsSigningConfiguration(packager.platformOptions)\n    if (signing?.type !== \"azure\") {\n      throw new Error(`WindowsSignAzureManager requires signing.type = \"azure\", got: ${signing?.type}`)\n    }\n    this.signing = signing\n  }\n\n  private isLegacyMode(): boolean {\n    const wcs = this.packager.config.toolsets?.winCodeSign\n    // ToolsetCustom object = user-managed bundle (provides its own dlib alongside signtool) → not legacy.\n    if (typeof wcs === \"object\" && wcs != null) {\n      return false\n    }\n    // Unset / null / \"latest\" resolve to the newest bundle, which ships the ATS dlib + .NET payload.\n    // An explicit version below 1.3.0 (e.g. \"0.0.0\", \"1.2.1\") has no dlib → legacy PowerShell.\n    const resolved = resolveToolsetVersion(wcs, WIN_CODESIGN_LATEST)\n    return semver.lt(resolved, minimumWinCodeSignVersionForDlib)\n  }\n\n  async initialize(): Promise<void> {\n    if (!this.isLegacyMode()) {\n      return\n    }\n\n    const wcs = this.packager.config.toolsets?.winCodeSign\n    log.info(\n      {\n        reason: `toolsets.winCodeSign \"${String(wcs)}\" is below the minimum \"${minimumWinCodeSignVersionForDlib}\"`,\n        guidance: `leave toolsets.winCodeSign unset (or set it to \"${minimumWinCodeSignVersionForDlib}\" / \"latest\") to use the faster signtool /dlib integration`,\n      },\n      `Azure Trusted Signing: falling back to legacy PowerShell (Invoke-TrustedSigning)`\n    )\n\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n    log.info(null, \"installing required module (TrustedSigning) with scope CurrentUser\")\n    try {\n      await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser\"])\n    } catch (error: any) {\n      log.debug({ message: error.message || error.stack }, \"unable to install PackageProvider NuGet — may already be present\")\n    }\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-Command\", \"Install-Module -Name TrustedSigning -MinimumVersion 0.5.0 -Force -Repository PSGallery -Scope CurrentUser\"])\n  }\n\n  computePublisherName(_target: Target, publisherName: string | null): Promise<string> {\n    return Promise.resolve(this.publisherName ?? publisherName)\n  }\n\n  readonly cscInfo = new MemoLazy<WindowsConfiguration, FileCodeSigningInfo | CertificateFromStoreInfo | null>(\n    () => this.packager.platformOptions,\n    _selected => Promise.resolve(null)\n  )\n\n  async signFile(options: WindowsSignOptions): Promise<boolean> {\n    return this.isLegacyMode() ? this.signFileLegacy(options) : this.signFileWithDlib(options)\n  }\n\n  private async signFileLegacy(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const vm = await this.packager.vm.value\n    const ps = await vm.powershellCommand.value\n\n    // Validate additionalMetadata keys before embedding as PS parameter names.\n    // Keys flow directly into `-${field} '...'` in the command string; a key\n    // containing semicolons or quotes would be PowerShell injection.\n    const PS_PARAM_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/\n    for (const key of Object.keys(signing.additionalMetadata ?? {})) {\n      if (!PS_PARAM_NAME.test(key)) {\n        throw new Error(\n          `additionalMetadata key \"${key}\" is not a valid PowerShell parameter name. Keys must match /^[A-Za-z_][A-Za-z0-9_]*$/ (e.g. \"ExcludeCredentials\", \"CorrelationId\").`\n        )\n      }\n    }\n\n    const params: Record<string, string | undefined> = {\n      Endpoint: signing.endpoint,\n      CertificateProfileName: signing.certificateProfileName,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      TimestampRfc3161: signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      TimestampDigest: signing.timestampDigest ?? \"SHA256\",\n      FileDigest: signing.fileDigest ?? \"SHA256\",\n      ...signing.additionalMetadata,\n      Files: vm.toVmFile(options.path),\n    }\n\n    const paramsString = Object.entries(params)\n      .filter(([, value]) => value != null)\n      .map(([field, value]) => `-${field} '${String(value).replace(/'/g, \"''\")}'`)\n      .join(\" \")\n\n    // Use -EncodedCommand (Base64 UTF-16LE) so the command string is opaque to any\n    // intermediate shell or argument parser — no cmd.exe / ConHost escaping needed.\n    // PowerShell still parses the decoded string, so PS-level single-quote escaping above is retained.\n    const psCommand = `Invoke-TrustedSigning ${paramsString}`\n    const encodedCommand = Buffer.from(psCommand, \"utf16le\").toString(\"base64\")\n    await vm.exec(ps, [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encodedCommand])\n    return true\n  }\n\n  private async signFileWithDlib(options: WindowsSignOptions): Promise<boolean> {\n    const { signing } = this\n    const winCodeSign = this.packager.config.toolsets?.winCodeSign\n    const isCustom = typeof winCodeSign === \"object\" && winCodeSign != null\n\n    // The ATS payload (dlib + its dependency closure) ships x64/x86 only; the bundle's arm64\n    // dir has no dlib. On arm64 hosts use the x64 signtool + dlib — x64 signtool runs under\n    // Windows-on-ARM emulation natively, and under x64 Wine on macOS/Linux.\n    const arch = process.arch === \"ia32\" ? Arch.ia32 : Arch.x64\n    const { kit: kitDir } = await getWindowsKitsBundle({ winCodeSign, resourcesDir: this.packager.buildResourcesDir })\n    // For custom toolsets the kit lives within buildResourcesDir; enforce that constraint.\n    // For versioned/cached bundles no base constraint is needed (paths are in the tool cache).\n    const safeKitDir = sanitizeDirPath(kitDir, isCustom ? this.packager.buildResourcesDir : undefined)\n    const signtoolPath = path.join(safeKitDir, \"signtool.exe\")\n\n    let dlibPath: string\n    let dotnetRootPath: string | null = null\n\n    if (typeof winCodeSign === \"object\" && winCodeSign != null) {\n      // Custom toolset: user provides the dlib alongside signtool in the kit dir.\n      dlibPath = path.join(safeKitDir, \"Azure.CodeSigning.Dlib.dll\")\n    } else {\n      // Built-in bundle. Unset / null / \"latest\" resolve to the newest version (>= 1.3.0); an\n      // explicit >= 1.3.0 version is used as-is. The dlib ships in a separate ats-bundle with its\n      // full native dependency closure (Ijwhost.dll, VC++ runtime, etc.). The .NET 8 framework is\n      // in a separate dotnet-runtime bundle; DOTNET_ROOT tells Ijwhost where to find hostfxr.dll →\n      // shared framework.\n      const version = resolveToolsetVersion(winCodeSign, WIN_CODESIGN_LATEST)\n      const safeAtsDir = sanitizeDirPath(await getAtsBundleDir(version))\n      dlibPath = path.join(safeAtsDir, arch === Arch.ia32 ? \"x86\" : \"x64\", \"Azure.CodeSigning.Dlib.dll\")\n      dotnetRootPath = sanitizeDirPath(await getDotnetRuntimeDir(version))\n    }\n\n    const metadataPath = await this.packager.getTempFile(\".json\")\n    await _fsExtra.writeJson(metadataPath, {\n      Endpoint: signing.endpoint,\n      CodeSigningAccountName: signing.codeSigningAccountName,\n      CertificateProfileName: signing.certificateProfileName,\n      ...signing.additionalMetadata,\n    })\n\n    const args = [\n      \"sign\",\n      \"/fd\",\n      (signing.fileDigest ?? \"SHA256\").toUpperCase(),\n      \"/tr\",\n      signing.timestampRfc3161 ?? \"http://timestamp.acs.microsoft.com\",\n      \"/td\",\n      (signing.timestampDigest ?? \"SHA256\").toUpperCase(),\n      \"/dlib\",\n      this.vm.toVmFile(dlibPath),\n      \"/dmdf\",\n      this.vm.toVmFile(metadataPath),\n      this.vm.toVmFile(options.path),\n    ]\n\n    log.info(\n      {\n        file: log.filePath(options.path),\n        endpoint: signing.endpoint,\n        account: signing.codeSigningAccountName,\n        profile: signing.certificateProfileName,\n      },\n      \"signing with Azure Trusted Signing (signtool /dlib)\"\n    )\n\n    // DOTNET_ROOT: Ijwhost.dll (shipped in the ats-bundle) reads this env var to locate\n    // hostfxr.dll. On Wine, toVmFile converts the host path to a Z:\\ path that Wine resolves\n    // back to the same location on the host filesystem.\n    const execOptions = dotnetRootPath != null ? { env: { DOTNET_ROOT: this.vm.toVmFile(dotnetRootPath) } } : undefined\n    await this.vm.exec(signtoolPath, args, execOptions)\n    return true\n  }\n}\n"]}