Triple-C/scripts/windows-sign.ps1

# windows-sign.ps1 <file> - sign one file with Azure Artifact Signing.
#
# Tauri's bundle.windows.signCommand, set up by windows-signing-setup.ps1.
# Tauri calls it once per file it signs and fails the build on a non-zero exit.
#
# This may run as 32-bit PowerShell: the NSIS uninstaller is signed from inside
# makensis, which is 32-bit and resolves `powershell` to the SysWOW64 copy. So
# nothing here depends on $env:ProgramFiles or other per-bitness paths - every
# path comes in absolute from the setup script, and signtool is always the x64
# build, since that is what loads the x64 dlib.
#
# Credentials never touch a command line: the dlib reads AZURE_TENANT_ID,
# AZURE_CLIENT_ID and AZURE_CLIENT_SECRET from the environment itself.

param([Parameter(Mandatory = $true)][string]$Path)

$ErrorActionPreference = 'Stop'

foreach ($name in 'TRIPLE_C_SIGNTOOL', 'TRIPLE_C_SIGN_DLIB', 'TRIPLE_C_SIGN_METADATA', 'TRIPLE_C_SIGN_TIMESTAMP',
                  'AZURE_TENANT_ID', 'AZURE_CLIENT_ID', 'AZURE_CLIENT_SECRET') {
    if (-not [Environment]::GetEnvironmentVariable($name)) {
        throw "$name is not set - run windows-signing-setup.ps1 first and pass the AZURE_* secrets to this step"
    }
}
if (-not (Test-Path -LiteralPath $Path)) { throw "No such file to sign: $Path" }

# /d names the product in the UAC prompt, which for an MSI would otherwise show
# a temporary file name. The timestamp is what keeps the signature valid after
# the short-lived Artifact Signing certificate expires, so it is not optional.
$arguments = @(
    'sign', '/v',
    '/fd', 'SHA256',
    '/tr', $env:TRIPLE_C_SIGN_TIMESTAMP, '/td', 'SHA256',
    '/d', 'Triple-C',
    '/dlib', $env:TRIPLE_C_SIGN_DLIB,
    '/dmdf', $env:TRIPLE_C_SIGN_METADATA,
    $Path
)

# Timestamp servers and the signing endpoint both fail transiently now and
# then; a retry is cheaper than a failed three-platform release.
#
# Stop is relaxed around the call: Tauri captures this script's output, and
# PowerShell 5.1 turns a native command's stderr into error records when its
# own streams are redirected - under Stop, signtool's first warning would kill
# the script before its exit code is read.
$ErrorActionPreference = 'Continue'
for ($attempt = 1; $attempt -le 3; $attempt++) {
    & $env:TRIPLE_C_SIGNTOOL @arguments 2>&1 | ForEach-Object { "$_" }
    if ($LASTEXITCODE -eq 0) {
        # The evidence "Verify signatures" needs for files it cannot see
        # afterwards - the NSIS uninstaller is embedded in the installer.
        if ($env:TRIPLE_C_SIGN_LOG) {
            [IO.File]::AppendAllText($env:TRIPLE_C_SIGN_LOG, "$Path`n", (New-Object System.Text.UTF8Encoding $false))
        }
        exit 0
    }
    Write-Host "signtool exited $LASTEXITCODE signing $Path (attempt $attempt of 3)"
    if ($attempt -lt 3) { Start-Sleep -Seconds (10 * $attempt) }
}
exit 1