Skip to content

Commit 89b749e

Browse files
HiroshibaHiroshiba
authored
[release-0.14] コード署名をeSignerCKAに (#1597)
1 parent 65a4465 commit 89b749e

File tree

4 files changed

+153
-18
lines changed

4 files changed

+153
-18
lines changed

‎.github/workflows/build.yml‎

Lines changed: 60 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -213,18 +213,30 @@ jobs:
213213
run: |
214214
df -h
215215
216-
# build electronでコード署名するには環境変数を指定が必要だけど、
217-
# コード署名しない場合に環境変数を定義するとエラーになるので、動的に環境変数を足す
218216
- name: Define Code Signing Envs
219217
if: startsWith(matrix.os, 'windows-') && github.event.inputs.code_signing == 'true'
220218
shell: bash
221219
run: |
222-
# 複数行の文字列を環境変数に代入
223-
echo 'CSC_LINK<<EOF' >> $GITHUB_ENV
224-
echo "${{ secrets.CERT_BASE64 }}" >> $GITHUB_ENV
225-
echo 'EOF' >> $GITHUB_ENV
220+
bash build/codesign_setup.bash
221+
THUMBPRINT="$(head -n 1 $THUMBPRINT_PATH)"
222+
SIGNTOOL_PATH="$(head -n 1 $SIGNTOOL_PATH_PATH)"
223+
echo "::add-mask::$THUMBPRINT"
226224
227-
echo 'CSC_KEY_PASSWORD=${{ secrets.CERT_PASSWORD }}' >> $GITHUB_ENV
225+
echo "WIN_CERTIFICATE_SHA1=$THUMBPRINT" >> $GITHUB_ENV
226+
echo 'WIN_SIGNING_HASH_ALGORITHMS=["sha256"]' >> $GITHUB_ENV
227+
echo "SIGNTOOL_PATH=$SIGNTOOL_PATH" >> $GITHUB_ENV
228+
229+
# NOTE: electron-builder 22.14.13 は指定したsigntoolを使わないので、ワークアラウンドとしてディレクトリを差し替える
230+
CACHE_SIGNTOOL_DIR="$ELECTRON_BUILDER_CACHE/winCodeSign/winCodeSign-2.6.0/windows-10/x64"
231+
mv "$CACHE_SIGNTOOL_DIR"{,.bak}
232+
SIGNTOOL_DIR=$(dirname "$SIGNTOOL_PATH")
233+
ln -s "$SIGNTOOL_DIR" "$CACHE_SIGNTOOL_DIR"
234+
env:
235+
ESIGNERCKA_USERNAME: ${{ secrets.ESIGNERCKA_USERNAME }}
236+
ESIGNERCKA_PASSWORD: ${{ secrets.ESIGNERCKA_PASSWORD }}
237+
ESIGNERCKA_TOTP_SECRET: ${{ secrets.ESIGNERCKA_TOTP_SECRET }}
238+
THUMBPRINT_PATH: /tmp/esignercka_thumbprint.txt
239+
SIGNTOOL_PATH_PATH: /tmp/signtool_path.txt
228240

229241
# Build result will be exported to ${{ matrix.artifact_path }}
230242
- name: Build Electron
@@ -243,8 +255,17 @@ jobs:
243255
if: startsWith(matrix.os, 'windows-') && github.event.inputs.code_signing == 'true'
244256
shell: bash
245257
run: |
246-
echo 'CSC_LINK=' >> $GITHUB_ENV
247-
echo 'CSC_KEY_PASSWORD=' >> $GITHUB_ENV
258+
bash build/codesign_cleanup.bash
259+
echo 'WIN_CERTIFICATE_SHA1=' >> $GITHUB_ENV
260+
echo 'WIN_SIGNING_HASH_ALGORITHMS=' >> $GITHUB_ENV
261+
echo 'SIGNTOOL_PATH=' >> $GITHUB_ENV
262+
263+
# NOTE: ワークアラウンドで差し替えたディレクトリを元に戻す
264+
CACHE_SIGNTOOL_DIR="$ELECTRON_BUILDER_CACHE/winCodeSign/winCodeSign-2.6.0/windows-10/x64"
265+
rm -r "$CACHE_SIGNTOOL_DIR"
266+
mv "$CACHE_SIGNTOOL_DIR"{.bak,}
267+
env:
268+
THUMBPRINT_PATH: /tmp/esignercka_thumbprint.txt
248269

249270
- name: Upload NoEngine Prepackage
250271
uses: actions/upload-artifact@v3
@@ -654,18 +675,30 @@ jobs:
654675
run: |
655676
df -h
656677
657-
# build electronでコード署名するには環境変数を指定が必要だけど、
658-
# コード署名しない場合に環境変数を定義するとエラーになるので、動的に環境変数を足す
659678
- name: Define Code Signing Envs
660679
if: endsWith(matrix.artifact_name, '-nsis-web') && github.event.inputs.code_signing == 'true'
661680
shell: bash
662681
run: |
663-
# 複数行の文字列を環境変数に代入
664-
echo 'CSC_LINK<<EOF' >> $GITHUB_ENV
665-
echo "${{ secrets.CERT_BASE64 }}" >> $GITHUB_ENV
666-
echo 'EOF' >> $GITHUB_ENV
682+
bash build/codesign_setup.bash
683+
THUMBPRINT="$(head -n 1 $THUMBPRINT_PATH)"
684+
SIGNTOOL_PATH="$(head -n 1 $SIGNTOOL_PATH_PATH)"
685+
echo "::add-mask::$THUMBPRINT"
667686
668-
echo 'CSC_KEY_PASSWORD=${{ secrets.CERT_PASSWORD }}' >> $GITHUB_ENV
687+
echo "WIN_CERTIFICATE_SHA1=$THUMBPRINT" >> $GITHUB_ENV
688+
echo 'WIN_SIGNING_HASH_ALGORITHMS=["sha256"]' >> $GITHUB_ENV
689+
echo "SIGNTOOL_PATH=$SIGNTOOL_PATH" >> $GITHUB_ENV
690+
691+
# NOTE: electron-builder 22.14.13 は指定したsigntoolを使わないので、ワークアラウンドとしてディレクトリを差し替える
692+
CACHE_SIGNTOOL_DIR="$ELECTRON_BUILDER_CACHE/winCodeSign/winCodeSign-2.6.0/windows-10/x64"
693+
mv "$CACHE_SIGNTOOL_DIR"{,.bak}
694+
SIGNTOOL_DIR=$(dirname "$SIGNTOOL_PATH")
695+
ln -s "$SIGNTOOL_DIR" "$CACHE_SIGNTOOL_DIR"
696+
env:
697+
ESIGNERCKA_USERNAME: ${{ secrets.ESIGNERCKA_USERNAME }}
698+
ESIGNERCKA_PASSWORD: ${{ secrets.ESIGNERCKA_PASSWORD }}
699+
ESIGNERCKA_TOTP_SECRET: ${{ secrets.ESIGNERCKA_TOTP_SECRET }}
700+
THUMBPRINT_PATH: /tmp/esignercka_thumbprint.txt
701+
SIGNTOOL_PATH_PATH: /tmp/signtool_path.txt
669702

670703
# NOTE: prepackage can be removed before splitting nsis-web archive
671704
- name: Build Electron
@@ -688,8 +721,17 @@ jobs:
688721
if: endsWith(matrix.artifact_name, '-nsis-web') && github.event.inputs.code_signing == 'true'
689722
shell: bash
690723
run: |
691-
echo 'CSC_LINK=' >> $GITHUB_ENV
692-
echo 'CSC_KEY_PASSWORD=' >> $GITHUB_ENV
724+
bash build/codesign_cleanup.bash
725+
echo 'WIN_CERTIFICATE_SHA1=' >> $GITHUB_ENV
726+
echo 'WIN_SIGNING_HASH_ALGORITHMS=' >> $GITHUB_ENV
727+
echo 'SIGNTOOL_PATH=' >> $GITHUB_ENV
728+
729+
# NOTE: ワークアラウンドで差し替えたディレクトリを元に戻す
730+
CACHE_SIGNTOOL_DIR="$ELECTRON_BUILDER_CACHE/winCodeSign/winCodeSign-2.6.0/windows-10/x64"
731+
rm -r "$CACHE_SIGNTOOL_DIR"
732+
mv "$CACHE_SIGNTOOL_DIR"{.bak,}
733+
env:
734+
THUMBPRINT_PATH: /tmp/esignercka_thumbprint.txt
693735

694736
- name: Show disk space (debug info)
695737
shell: bash

‎build/codesign_cleanup.bash‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# !!! コードサイニング証明書を取り扱うので取り扱い注意 !!!
2+
3+
# eSignerCKAで読み込んだコードサイニング証明書を破棄する
4+
5+
set -eu
6+
7+
if [ ! -v THUMBPRINT_PATH ]; then # THUMBPRINTの出力先
8+
echo "THUMBPRINT_PATHが未定義です"
9+
exit 1
10+
fi
11+
12+
if [ ! -v ESIGNERCKA_INSTALL_DIR ]; then # eSignerCKAのインストール先
13+
ESIGNERCKA_INSTALL_DIR='..\eSignerCKA'
14+
fi
15+
16+
# 証明書を破棄
17+
powershell "& '$ESIGNERCKA_INSTALL_DIR\eSignerCKATool.exe' unload"
18+
19+
# THUMBPRINTを削除
20+
rm "$THUMBPRINT_PATH"

‎build/codesign_setup.bash‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# !!! コードサイニング証明書を取り扱うので取り扱い注意 !!!
2+
3+
# eSignerCKAを使ってコードサイニング証明書を読み込む
4+
# electronから利用するためにTHUMBPRINTとsigntoolのパスを出力する
5+
6+
set -eu
7+
8+
if [ ! -v ESIGNERCKA_USERNAME ]; then # eSignerCKAのユーザー名
9+
echo "ESIGNERCKA_USERNAMEが未定義です"
10+
exit 1
11+
fi
12+
if [ ! -v ESIGNERCKA_PASSWORD ]; then # eSignerCKAのパスワード
13+
echo "ESIGNERCKA_PASSWORDが未定義です"
14+
exit 1
15+
fi
16+
if [ ! -v ESIGNERCKA_TOTP_SECRET ]; then # eSignerCKAのTOTP Secret
17+
echo "ESIGNERCKA_TOTP_SECRETが未定義です"
18+
exit 1
19+
fi
20+
if [ ! -v THUMBPRINT_PATH ]; then # THUMBPRINTの出力先
21+
echo "THUMBPRINT_PATHが未定義です"
22+
exit 1
23+
fi
24+
if [ ! -v SIGNTOOL_PATH_PATH ]; then # 対応しているsigntoolのパスの出力先
25+
echo "SIGNTOOL_PATH_PATHが未定義です"
26+
exit 1
27+
fi
28+
29+
if [ ! -v ESIGNERCKA_INSTALL_DIR ]; then
30+
ESIGNERCKA_INSTALL_DIR='..\eSignerCKA'
31+
fi
32+
33+
# eSignerCKAのセットアップ
34+
if [ ! -d "$ESIGNERCKA_INSTALL_DIR" ]; then
35+
curl -LO "https://github.com/SSLcom/eSignerCKA/releases/download/v1.0.6/SSL.COM-eSigner-CKA_1.0.6.zip"
36+
unzip -o SSL.COM-eSigner-CKA_1.0.6.zip
37+
mv *eSigner*CKA_*.exe eSigner_CKA_Installer.exe
38+
powershell "
39+
& ./eSigner_CKA_Installer.exe /CURRENTUSER /VERYSILENT /SUPPRESSMSGBOXES /DIR="$ESIGNERCKA_INSTALL_DIR" | Out-Null
40+
& '$ESIGNERCKA_INSTALL_DIR\eSignerCKATool.exe' config -mode product -user '$ESIGNERCKA_USERNAME' -pass '$ESIGNERCKA_PASSWORD' -totp '$ESIGNERCKA_TOTP_SECRET' -key '$ESIGNERCKA_INSTALL_DIR\master.key' -r
41+
& '$ESIGNERCKA_INSTALL_DIR\eSignerCKATool.exe' unload
42+
"
43+
rm SSL.COM-eSigner-CKA_1.0.6.zip eSigner_CKA_Installer.exe
44+
fi
45+
46+
# 証明書を読み込む
47+
powershell "& '$ESIGNERCKA_INSTALL_DIR\eSignerCKATool.exe' load"
48+
49+
THUMBPRINT=$(
50+
powershell '
51+
$CodeSigningCert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
52+
echo "$($CodeSigningCert.Thumbprint)"
53+
'
54+
)
55+
56+
# THUMBPRINTを出力
57+
echo "$THUMBPRINT" >"$THUMBPRINT_PATH"
58+
59+
# 対応しているsigntoolのパスを出力
60+
SIGNTOOL_PATH=$(ls "C:/Program Files (x86)/Windows Kits/"10/bin/*/x86/signtool.exe | sort -V | tail -n 1) # なぜかこれじゃないと動かない
61+
echo "$SIGNTOOL_PATH" >"$SIGNTOOL_PATH_PATH"

‎vue.config.js‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,12 @@ const LINUX_EXECUTABLE_NAME = process.env.LINUX_EXECUTABLE_NAME;
1818
// ${productName}-${version}.${ext}
1919
const MACOS_ARTIFACT_NAME = process.env.MACOS_ARTIFACT_NAME;
2020

21+
// コード署名証明書
22+
const WIN_CERTIFICATE_SHA1 = process.env.WIN_CERTIFICATE_SHA1;
23+
const WIN_SIGNING_HASH_ALGORITHMS = process.env.WIN_SIGNING_HASH_ALGORITHMS
24+
? JSON.parse(process.env.WIN_SIGNING_HASH_ALGORITHMS)
25+
: undefined;
26+
2127
const isMac = process.platform === "darwin";
2228

2329
module.exports = {
@@ -76,6 +82,12 @@ module.exports = {
7682
arch: ["x64"],
7783
},
7884
],
85+
certificateSha1:
86+
WIN_CERTIFICATE_SHA1 !== "" ? WIN_CERTIFICATE_SHA1 : undefined,
87+
signingHashAlgorithms:
88+
WIN_SIGNING_HASH_ALGORITHMS !== ""
89+
? WIN_SIGNING_HASH_ALGORITHMS
90+
: undefined,
7991
},
8092
directories: {
8193
buildResources: "build",

0 commit comments

Comments
 (0)