Jens/ForgeFlow
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 24 Wiki Activity

fix: make packaged updates certificate-free
ForgeFlow quality gate / quality (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
NuklearRabbit
2026-07-29 23:11:24 +02:00
parent 18f42621c2
commit 6ef4620388
10 changed files with 46 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/signed-electron-builder-config.cjs
-22
View File
@@ -1,22 +0,0 @@
"use strict";
const pkg = require("../package.json");
const expectedPublisher = String(process.env.FORGEFLOW_EXPECTED_PUBLISHER || "").trim();
const commonName = expectedPublisher.match(/^CN=([^,]+)/i)?.[1]?.trim();
const useAzure = Boolean(String(process.env.FORGEFLOW_AZURE_SIGNING_ENDPOINT || "").trim());
const win = { ...pkg.build.win, forceCodeSigning: true };
if (useAzure) {
win.azureSignOptions = {
publisherName: commonName,
endpoint: process.env.FORGEFLOW_AZURE_SIGNING_ENDPOINT,
codeSigningAccountName: process.env.FORGEFLOW_AZURE_SIGNING_ACCOUNT,
certificateProfileName: process.env.FORGEFLOW_AZURE_CERTIFICATE_PROFILE,
fileDigest: "SHA256",
timestampDigest: "SHA256",
timestampRfc3161: "http://timestamp.acs.microsoft.com",
};
}
module.exports = { ...pkg.build, win };
scripts/validate-signing-environment.mjs
-17
View File
@@ -1,17 +0,0 @@
const signedRelease = process.env.FORGEFLOW_SIGNED_RELEASE === "1";
const publisher = String(process.env.FORGEFLOW_EXPECTED_PUBLISHER || "").trim();
const classicCertificate = String(process.env.WIN_CSC_LINK || process.env.CSC_LINK || "").trim();
const azureNames = ["AZURE_TENANT_ID", "AZURE_CLIENT_ID", "AZURE_CLIENT_SECRET", "FORGEFLOW_AZURE_SIGNING_ENDPOINT", "FORGEFLOW_AZURE_SIGNING_ACCOUNT", "FORGEFLOW_AZURE_CERTIFICATE_PROFILE"];
const azureValues = azureNames.map((name) => String(process.env[name] || "").trim());
const azure = azureValues.every(Boolean);
const partialAzure = azureValues.some(Boolean) && !azure;
if (!signedRelease) throw new Error("FORGEFLOW_SIGNED_RELEASE=1 is required for the production signing build.");
if (!/^CN=.+/i.test(publisher)) throw new Error("FORGEFLOW_EXPECTED_PUBLISHER must be the exact certificate subject beginning with CN=.");
if (partialAzure) throw new Error(`Azure Artifact Signing is incomplete. Configure: ${azureNames.filter((_, index) => !azureValues[index]).join(", ")}.`);
if (!classicCertificate && !azure) throw new Error("Configure WIN_CSC_LINK/CSC_LINK or all Azure Artifact Signing credentials before building a signed release.");
if (classicCertificate && !String(process.env.WIN_CSC_KEY_PASSWORD || process.env.CSC_KEY_PASSWORD || "").trim()) {
throw new Error("WIN_CSC_KEY_PASSWORD or CSC_KEY_PASSWORD is required for classic certificate signing.");
}
console.log(`Production ${azure ? "Azure Artifact Signing" : "classic certificate"} environment accepted for exact publisher ${publisher}.`);
scripts/verify-release-signatures.mjs
+1 -1
View File
@@ -19,5 +19,5 @@ for (const artifact of artifacts) {
const valid = result.Status === "Valid" && Boolean(result.TimestampSubject);
const publisherMatches = !expectedPublisher || String(result.Subject || "").trim() === expectedPublisher;
if (signedRelease && (!valid || !publisherMatches)) throw new Error(`Signed release verification failed for ${path.basename(artifact)}: status=${result.Status}, publisher=${result.Subject || "missing"}, timestamp=${result.TimestampSubject || "missing"}.`);
console.log(`${path.basename(artifact)}: ${valid && publisherMatches ? "valid signed artifact" : "unsigned development artifact"}`);
console.log(`${path.basename(artifact)}: ${valid && publisherMatches ? "valid signed artifact" : "checksum-protected unsigned artifact"}`);
}