feat: harden release signing and coverage gate

2026-07-29 22:54:51 +02:00
parent aa4895912a
commit 18f42621c2
13 changed files with 496 additions and 39 deletions
@@ -0,0 +1,22 @@
+"use strict";
+
+const pkg = require("../package.json");
+
+const expectedPublisher = String(process.env.FORGEFLOW_EXPECTED_PUBLISHER || "").trim();
+const commonName = expectedPublisher.match(/^CN=([^,]+)/i)?.[1]?.trim();
+const useAzure = Boolean(String(process.env.FORGEFLOW_AZURE_SIGNING_ENDPOINT || "").trim());
+const win = { ...pkg.build.win, forceCodeSigning: true };
+
+if (useAzure) {
+  win.azureSignOptions = {
+    publisherName: commonName,
+    endpoint: process.env.FORGEFLOW_AZURE_SIGNING_ENDPOINT,
+    codeSigningAccountName: process.env.FORGEFLOW_AZURE_SIGNING_ACCOUNT,
+    certificateProfileName: process.env.FORGEFLOW_AZURE_CERTIFICATE_PROFILE,
+    fileDigest: "SHA256",
+    timestampDigest: "SHA256",
+    timestampRfc3161: "http://timestamp.acs.microsoft.com",
+  };
+}
+
+module.exports = { ...pkg.build, win };
@@ -0,0 +1,17 @@
+const signedRelease = process.env.FORGEFLOW_SIGNED_RELEASE === "1";
+const publisher = String(process.env.FORGEFLOW_EXPECTED_PUBLISHER || "").trim();
+const classicCertificate = String(process.env.WIN_CSC_LINK || process.env.CSC_LINK || "").trim();
+const azureNames = ["AZURE_TENANT_ID", "AZURE_CLIENT_ID", "AZURE_CLIENT_SECRET", "FORGEFLOW_AZURE_SIGNING_ENDPOINT", "FORGEFLOW_AZURE_SIGNING_ACCOUNT", "FORGEFLOW_AZURE_CERTIFICATE_PROFILE"];
+const azureValues = azureNames.map((name) => String(process.env[name] || "").trim());
+const azure = azureValues.every(Boolean);
+const partialAzure = azureValues.some(Boolean) && !azure;
+
+if (!signedRelease) throw new Error("FORGEFLOW_SIGNED_RELEASE=1 is required for the production signing build.");
+if (!/^CN=.+/i.test(publisher)) throw new Error("FORGEFLOW_EXPECTED_PUBLISHER must be the exact certificate subject beginning with CN=.");
+if (partialAzure) throw new Error(`Azure Artifact Signing is incomplete. Configure: ${azureNames.filter((_, index) => !azureValues[index]).join(", ")}.`);
+if (!classicCertificate && !azure) throw new Error("Configure WIN_CSC_LINK/CSC_LINK or all Azure Artifact Signing credentials before building a signed release.");
+if (classicCertificate && !String(process.env.WIN_CSC_KEY_PASSWORD || process.env.CSC_KEY_PASSWORD || "").trim()) {
+  throw new Error("WIN_CSC_KEY_PASSWORD or CSC_KEY_PASSWORD is required for classic certificate signing.");
+}
+
+console.log(`Production ${azure ? "Azure Artifact Signing" : "classic certificate"} environment accepted for exact publisher ${publisher}.`);