Skip to content

Commit 4c8c80a

Browse files
compnerdcompnerd
committed
WiX: integrate signing support into the MSBuild path
Rather than requiring external scripting to sign the installer components, add in integrated code-signing capability into the build. With this, a user can specify additional parameters when invoking the build: `-p:SignOutput=true -p:CERTIFICATE=... -p:PASSPHRASE=...`. By default the output is not code-signed, allowing control over the build, which is also useful for CI usage. This reduces some of the extra logic required for signing in the CI systems.
1 parent ca4e8bf commit 4c8c80a

File tree

6 files changed

+79
-0
lines changed

6 files changed

+79
-0
lines changed

‎platforms/Windows/WiXCodeSigning.targets

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<PropertyGroup>
4+
<SignOutput Condition=" '$(SignOutput)' == '' ">false</SignOutput>
5+
<SignOutput>$(SignOutput)</SignOutput>
6+
</PropertyGroup>
7+
8+
<Target Name="FindSignTool">
9+
<PropertyGroup>
10+
<WindowsKitsRoot Condition=" '$(WindowsKitsRoot)' == '' ">$([MSBuild]::GetRegistryValueFromView('HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Kits\Installed Roots', 'KitsRoot10', null, RegistryView.Registry32, RegistryView.Default))</WindowsKitsRoot>
11+
<WindowsKitsRoot Condition=" '$(WindowsKitsRoot)' == '' ">$([MSBuild]::GetRegistryValueFromView('HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Kits\Installed Roots', 'KitsRoot81', null, RegistryView.Registry32, RegistryView.Default))</WindowsKitsRoot>
12+
<WindowsKitsRoot Condition=" '$(WindowsKitsRoot)' == '' ">$([MSBuild]::GetRegistryValueFromView('HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Kits\Installed Roots', 'KitsRoot', null, RegistryView.Registry32, RegistryView.Default))</WindowsKitsRoot>
13+
14+
<!-- Windows 11 SDKs -->
15+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.22621.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.22621.0\x64\</SignToolPath>
16+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.22000.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.22000.0\x64\</SignToolPath>
17+
<!-- Windows 10 SDKs -->
18+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.20348.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.20348.0\x64\</SignToolPath>
19+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.19041.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.19041.0\x64\</SignToolPath>
20+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.18362.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.18362.0\x64\</SignToolPath>
21+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.17763.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.17763.0\x64\</SignToolPath>
22+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.17134.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.17134.0\x64\</SignToolPath>
23+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.16299.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.16299.0\x64\</SignToolPath>
24+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.15063.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.15063.0\x64\</SignToolPath>
25+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.14393.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.14393.0\x64\</SignToolPath>
26+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.10586.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.10586.0\x64\</SignToolPath>
27+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\10.0.10240.0\x64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.10240.0\x64\</SignToolPath>
28+
<!-- Windows 8.1 SDKS -->
29+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'AMD64' AND Exists('$(WindowsKitsRoot)bin\x64\signtool.exe')">$(WindowsKitsRoot)bin\x64\</SignToolPath>
30+
31+
<!-- Windows 11 SDKs -->
32+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.22621.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.22621.0\arm64\</SignToolPath>
33+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.22000.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.22000.0\arm64\</SignToolPath>
34+
<!-- Windows 10 SDKs -->
35+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.20348.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.20348.0\arm64\</SignToolPath>
36+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.19041.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.19041.0\arm64\</SignToolPath>
37+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.18362.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.18362.0\arm64\</SignToolPath>
38+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.17763.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.17763.0\arm64\</SignToolPath>
39+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.17134.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.17134.0\arm64\</SignToolPath>
40+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.16299.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.16299.0\arm64\</SignToolPath>
41+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.15063.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.15063.0\arm64\</SignToolPath>
42+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.14393.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.14393.0\arm64\</SignToolPath>
43+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.10586.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.10586.0\arm64\</SignToolPath>
44+
<SignToolPath Condition=" '$(SignToolPath)' == '' AND '$(PROCESSOR_ARCHITECTURE)' == 'ARM64' AND Exists('$(WindowsKitsRoot)bin\10.0.10240.0\arm64\signtool.exe')">$(WindowsKitsRoot)bin\10.0.10240.0\arm64\</SignToolPath>
45+
46+
<SignTool>"$(SignToolPath)signtool.exe" sign /f "$(CERTIFICATE)" /p "$(PASSPHRASE)" /tr http://timestamp.digicert.com /fd sha256 /td sha256</SignTool>
47+
</PropertyGroup>
48+
</Target>
49+
50+
<Target Name="SignCabs" DependsOnTargets="FindSignTool">
51+
<Exec Command="$(SignTool) &quot;%(SignCabs.FullPath)&quot;" />
52+
</Target>
53+
54+
<Target Name="SignMsi" DependsOnTargets="FindSignTool">
55+
<Exec Command="$(SignTool) &quot;%(SignMsi.FullPath)&quot;" />
56+
</Target>
57+
58+
<Target Name="SignMsm" DependsOnTargets="FindSignTool">
59+
<Exec Command="$(SignTool) &quot;%(SignMsm.FullPath)&quot;" />
60+
</Target>
61+
62+
<Target Name="SignBundleEngine" DependsOnTargets="FindSignTool">
63+
<Exec Command="$(SignTool) &quot;@(SignBundleEngine)&quot;" />
64+
</Target>
65+
66+
<Target Name="SignBundle">
67+
<Exec Command="$(SignTool) &quot;@(SignBundle)&quot;" />
68+
</Target>
69+
</Project>

‎platforms/Windows/devtools.wixproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
<Error Text="The WiX Toolset v3.11 (or newer) build tools must be installed to build this project. To download the WiX Toolset, see https://wixtoolset.org/releases/." />
2828
</Target>
2929

30+
<Import Project="WiXCodeSigning.targets" />
31+
3032
<PropertyGroup>
3133
<DefineConstants>ProductVersion=$(ProductVersion);DEVTOOLS_ROOT=$(DEVTOOLS_ROOT);</DefineConstants>
3234
<HarvestDirectoryAutogenerateGuids>false</HarvestDirectoryAutogenerateGuids>

‎platforms/Windows/installer.wixproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@
3030
<Error Text="The WiX Toolset v3.11 (or newer) build tools must be installed to build this project. To download the WiX Toolset, see https://wixtoolset.org/releases/." />
3131
</Target>
3232

33+
<Import Project="WiXCodeSigning.targets" />
34+
3335
<PropertyGroup>
3436
<DefineConstants>ProductVersion=$(ProductVersion);RequiredChain=$(RequiredChain);OptionalChain=$(OptionalChain);MSI_LOCATION=$(MSI_LOCATION);</DefineConstants>
3537
</PropertyGroup>

‎platforms/Windows/runtime.wixproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
<Error Text="The WiX Toolset v3.11 (or newer) build tools must be installed to build this project. To download the WiX Toolset, see https://wixtoolset.org/releases/." />
2828
</Target>
2929

30+
<Import Project="WiXCodeSigning.targets" />
31+
3032
<PropertyGroup>
3133
<DefineConstants>ProductVersion=$(ProductVersion);SDK_ROOT=$(SDK_ROOT);$(INCLUDE_DEBUG_INFO)</DefineConstants>
3234
</PropertyGroup>

‎platforms/Windows/sdk.wixproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
<Error Text="The WiX Toolset v3.11 (or newer) build tools must be installed to build this project. To download the WiX Toolset, see https://wixtoolset.org/releases/." />
2828
</Target>
2929

30+
<Import Project="WiXCodeSigning.targets" />
31+
3032
<PropertyGroup>
3133
<DefineConstants>ProductVersion=$(ProductVersion);PLATFORM_ROOT=$(PLATFORM_ROOT);SDK_ROOT=$(SDK_ROOT);SWIFT_SOURCE_DIR=$(SWIFT_SOURCE_DIR);SwiftShimsPath=$(SDK_ROOT)\usr\lib\swift\shims;</DefineConstants>
3234
<HarvestDirectoryAutogenerateGuids>false</HarvestDirectoryAutogenerateGuids>

‎platforms/Windows/toolchain.wixproj

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@
2727
<Error Text="The WiX Toolset v3.11 (or newer) build tools must be installed to build this project. To download the WiX Toolset, see https://wixtoolset.org/releases/." />
2828
</Target>
2929

30+
<Import Project="WiXCodeSigning.targets" />
31+
3032
<PropertyGroup>
3133
<DefineConstants>ProductVersion=$(ProductVersion);DEVTOOLS_ROOT=$(DEVTOOLS_ROOT);TOOLCHAIN_ROOT=$(TOOLCHAIN_ROOT);TOOLCHAIN_ROOT_USR_LIB_CLANG=$(TOOLCHAIN_ROOT)\usr\lib\clang;$(INCLUDE_DEBUG_INFO)</DefineConstants>
3234
<HarvestDirectoryAutogenerateGuids>false</HarvestDirectoryAutogenerateGuids>

0 commit comments

Comments
 (0)