-
Notifications
You must be signed in to change notification settings - Fork 133
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add SignPath signing to the Actions workflow
For Windows, provided by SignPath.io and with a certificate from the SignPath Foundation. Only Windows client builds for stable and beta releases are signed this way. The continuous development release, server and command-line tools are not, since we really don't need it for those. A link to the code signing policy is automatically prepended to the relevant release notes in the GitHub releases pages, but at the time of writing the link still 404s because it's not yet merged and deployed to the website.
- Loading branch information
1 parent
2a1a4a6
commit 11e4c5e
Showing
3 changed files
with
142 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| # SPDX-License-Identifier: MIT | ||
| if(NOT BUILD_VERSION OR NOT OUTPUT_PATH) | ||
| message(FATAL_ERROR "BUILD_VERSION and OUTPUT_PATH are required") | ||
| endif() | ||
|
|
||
| message(STATUS "Build version: '${BUILD_VERSION}'") | ||
| if(BUILD_VERSION MATCHES "^([0-9]+)\\.([0-9]+)\\.([0-9]+)") | ||
| set(server "${CMAKE_MATCH_1}") | ||
| set(major "${CMAKE_MATCH_2}") | ||
| set(minor "${CMAKE_MATCH_3}") | ||
|
|
||
| if(BUILD_VERSION MATCHES "-beta\\.([0-9]+)") | ||
| set(beta "${CMAKE_MATCH_1}") | ||
| else() | ||
| set(beta 0) | ||
| endif() | ||
|
|
||
| set(PRODUCT_VERSION "${server}.${major}.${minor}.${beta}") | ||
| message(STATUS "Product version: '${PRODUCT_VERSION}'") | ||
| file(APPEND "${OUTPUT_PATH}" "WINDOWS_PRODUCT_VERSION=${PRODUCT_VERSION}\n") | ||
| else() | ||
| message(FATAL_ERROR "Unable to determine product version") | ||
| endif() | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| # SPDX-License-Identifier: MIT | ||
| if(NOT PRODUCT_NAME OR NOT PRODUCT_VERSION OR NOT SEARCH_PATHS) | ||
| message(FATAL_ERROR "PRODUCT_NAME, PRODUCT_VERSION and SEARCH_PATHS are required") | ||
| endif() | ||
|
|
||
| find_program(RCEDIT_COMMAND rcedit REQUIRED) | ||
|
|
||
| unset(globs) | ||
| foreach(search_path IN LISTS SEARCH_PATHS) | ||
| list(APPEND globs "${search_path}/*.dll" "${search_path}/*.exe") | ||
| endforeach() | ||
|
|
||
| message(STATUS "Looking for PE files: ${globs}") | ||
| file(GLOB_RECURSE pe_paths FOLLOW_SYMLINKS ${globs}) | ||
| foreach(pe_path IN LISTS pe_paths) | ||
| execute_process( | ||
| COMMAND | ||
| ${RCEDIT_COMMAND} | ||
| "${pe_path}" | ||
| --set-version-string ProductName "${PRODUCT_NAME}" | ||
| --set-version-string ProductVersion "${PRODUCT_VERSION}" | ||
| COMMAND_ECHO STDOUT | ||
| COMMAND_ERROR_IS_FATAL ANY | ||
| ) | ||
| endforeach() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters