| 1 | #!/usr/bin/env bash |
| 2 | set -euo pipefail |
| 3 | |
| 4 | arch="${1:?usage: finalize-windows-signed-candidate.sh ARCH SIGNING_WORK PAYLOAD DIST BUNDLE VERSION}" |
| 5 | signing_work="${2:?missing signing work directory}" |
| 6 | signed_payload="${3:?missing signed payload directory}" |
| 7 | dist="${4:?missing output dist directory}" |
| 8 | bundle="${5:?missing output bundle directory}" |
| 9 | version="${6:?missing release version}" |
| 10 | |
| 11 | case "$arch" in |
| 12 | amd64 | arm64) ;; |
| 13 | *) echo "unsupported Windows architecture: $arch" >&2; exit 1 ;; |
| 14 | esac |
| 15 | |
| 16 | product_root="$(pwd)" |
| 17 | control_root="$(cd "$(dirname "$0")/.." && pwd)" |
| 18 | case "$signing_work" in /*) ;; *) signing_work="$product_root/$signing_work" ;; esac |
| 19 | case "$signed_payload" in /*) ;; *) signed_payload="$product_root/$signed_payload" ;; esac |
| 20 | case "$dist" in /*) ;; *) dist="$product_root/$dist" ;; esac |
| 21 | case "$bundle" in /*) ;; *) bundle="$product_root/$bundle" ;; esac |
| 22 | for variable in CERTUM_KEY_ID MINISIGN_PRIVATE_KEY MINISIGN_PASSWORD RELEASE_SOURCE_SHA RELEASE_CONTROL_SHA RELEASE_TAG RELEASE_VERSION RELEASE_CHANNEL RELEASE_SIGNING_FINGERPRINT RELEASE_ARTIFACT_PREFIX; do |
| 23 | [ -n "${!variable:-}" ] || { echo "missing $variable" >&2; exit 1; } |
| 24 | done |
| 25 | |
| 26 | pwsh -NoProfile -File "$control_root/scripts/sign-certum.ps1" -PayloadDirectory "$signed_payload" |
| 27 | |
| 28 | # Keep the immutable checkout's NSIS template and icon. The signing handoff |
| 29 | # carries generated identity and payload files, not these committed inputs. |
| 30 | rm -rf "$dist" "$bundle" |
| 31 | mkdir -p "$product_root/desktop/build/windows/installer" |
| 32 | cp "$signing_work/desktop/build/windows/installer/reasonix_project.nsh" \ |
| 33 | "$product_root/desktop/build/windows/installer/" |
| 34 | ( |
| 35 | cd "$product_root/desktop" |
| 36 | go run ./cmd/sign windows-payload "$signed_payload" "$version" |
| 37 | go run ./cmd/sign sign "$signed_payload/reasonix-payload.json" |
| 38 | go run ./cmd/sign verify "$signed_payload/reasonix-payload.json" |
| 39 | ) |
| 40 | |
| 41 | REASONIX_REQUIRE_PAYLOAD_MANIFEST=1 \ |
| 42 | "$product_root/scripts/package-windows-desktop.sh" "$arch" "$signed_payload" |
| 43 | mv "$product_root/dist" "$dist" |
| 44 | |
| 45 | installer="$dist/Reasonix-windows-$arch-installer.exe" |
| 46 | portable="$dist/Reasonix-windows-$arch.zip" |
| 47 | pwsh -NoProfile -File "$control_root/scripts/sign-certum.ps1" -FilePath "$installer" |
| 48 | |
| 49 | portable_layout="legacy-dual" |
| 50 | if [ -f "$product_root/desktop/packaging/windows-portable-layout.txt" ]; then |
| 51 | portable_layout="$(tr -d '\r\n' < "$product_root/desktop/packaging/windows-portable-layout.txt")" |
| 52 | fi |
| 53 | pwsh -NoProfile -File "$control_root/scripts/verify-windows-authenticode.ps1" \ |
| 54 | -PayloadDirectory "$signed_payload" -InstallerPath "$installer" \ |
| 55 | -PortableArchivePath "$portable" -ExpectedThumbprint "$CERTUM_KEY_ID" \ |
| 56 | -RequireTrusted -PortableLayout "$portable_layout" |
| 57 | |
| 58 | node "$product_root/desktop/packaging/size-report.mjs" \ |
| 59 | --platform "windows/$arch" --version "$version" \ |
| 60 | --bundle "$signed_payload" --dist "$dist" \ |
| 61 | --output "$product_root/desktop/build/reports/windows-$arch" |
| 62 | ( |
| 63 | cd "$product_root/desktop" |
| 64 | go run ./cmd/sign sign "$dist"/* |
| 65 | ) |
| 66 | node "$control_root/scripts/desktop-release-artifacts.mjs" pack "$dist" "$bundle" "windows-$arch" |
| 67 |