Skip to content

Commit 1f2769a

Browse files
nb-ccdnb-ccd
committed
chore: test extracting and repackaging the cabinet files
1 parent 3fa9152 commit 1f2769a

File tree

1 file changed

+145
-77
lines changed

1 file changed

+145
-77
lines changed

‎.github/workflows/test-windows-code-signing.yaml‎

Lines changed: 145 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ jobs:
7979
8080
node-windows:
8181
runs-on: windows-latest
82-
environment: release # This step needs to use the release context to access credentials for code signing.
82+
# environment: release # This step needs to use the release context to access credentials for code signing.
8383
needs: [validate-preconditions]
8484
if: contains(fromJSON('["rc", "alpha", "node-windows"]'), needs.validate-preconditions.outputs.release_type)
8585
defaults:
@@ -101,94 +101,162 @@ jobs:
101101
id: digicert_client
102102
uses: digicert/[email protected]
103103

104-
- name: Import Windows certificate (Windows only)
105-
id: windows_certificate
106-
env:
107-
# Base64 encoding of the pfx/p12 certificate for Windows code signing.
108-
SM_CLIENT_CERT_FILE_B64: ${{ secrets.WINDOWS_SM_CLIENT_CERT_FILE_B64 }}
104+
# Disabling these to test the windows-y commandline file manipulation stuff.
105+
# - name: Import Windows certificate (Windows only)
106+
# id: windows_certificate
107+
# env:
108+
# # Base64 encoding of the pfx/p12 certificate for Windows code signing.
109+
# SM_CLIENT_CERT_FILE_B64: ${{ secrets.WINDOWS_SM_CLIENT_CERT_FILE_B64 }}
110+
# run: |
111+
# $CERTIFICATE_PATH_BASE64="$env:RUNNER_TEMP\cert-b64.txt"
112+
# $CERTIFICATE_PATH="$env:RUNNER_TEMP\cert.pfx"
113+
114+
# Set-Content -Path $CERTIFICATE_PATH_BASE64 -Value $env:SM_CLIENT_CERT_FILE_B64
115+
# certutil -decode $CERTIFICATE_PATH_BASE64 $CERTIFICATE_PATH
116+
# echo "CERTIFICATE_PATH=$CERTIFICATE_PATH" >> $env:GITHUB_OUTPUT
117+
118+
# - name: Run smctl healthcheck to confirm if the tool is configured properly.
119+
# working-directory: ${{steps.build.outputs.bin_dir}}
120+
# env:
121+
# # windows signing
122+
# # FILE_TO_SIGN: ${{ steps.build.outputs.FILE_TO_SIGN }}
123+
# WINDOWS_PKCS11_CONFIG: ${{ steps.digicert_client.outputs.PKCS11_CONFIG }}
124+
# WINDOWS_SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SM_KEYPAIR_ALIAS }}
125+
# SM_HOST: ${{ vars.WINDOWS_SM_HOST }}
126+
# SM_API_KEY: ${{ secrets.WINDOWS_SM_API_KEY }}
127+
# SM_CLIENT_CERT_FILE: ${{ steps.windows_certificate.outputs.CERTIFICATE_PATH }}
128+
# SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SM_CLIENT_CERT_PASSWORD }}
129+
# run: |
130+
# smctl healthcheck --all
131+
# # smctl sign --verbose --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ${{ env.FILE_TO_SIGN }} --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} --verbose --exit-non-zero-on-fail --failfast
132+
# shell: cmd
133+
134+
- name: Install dependencies
109135
run: |
110-
$CERTIFICATE_PATH_BASE64="$env:RUNNER_TEMP\cert-b64.txt"
111-
$CERTIFICATE_PATH="$env:RUNNER_TEMP\cert.pfx"
112-
113-
Set-Content -Path $CERTIFICATE_PATH_BASE64 -Value $env:SM_CLIENT_CERT_FILE_B64
114-
certutil -decode $CERTIFICATE_PATH_BASE64 $CERTIFICATE_PATH
115-
echo "CERTIFICATE_PATH=$CERTIFICATE_PATH" >> $env:GITHUB_OUTPUT
116-
117-
- name: Run smctl healthcheck to confirm if the tool is configured properly.
118-
working-directory: ${{steps.build.outputs.bin_dir}}
119-
env:
120-
# windows signing
121-
# FILE_TO_SIGN: ${{ steps.build.outputs.FILE_TO_SIGN }}
122-
WINDOWS_PKCS11_CONFIG: ${{ steps.digicert_client.outputs.PKCS11_CONFIG }}
123-
WINDOWS_SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SM_KEYPAIR_ALIAS }}
124-
SM_HOST: ${{ vars.WINDOWS_SM_HOST }}
125-
SM_API_KEY: ${{ secrets.WINDOWS_SM_API_KEY }}
126-
SM_CLIENT_CERT_FILE: ${{ steps.windows_certificate.outputs.CERTIFICATE_PATH }}
127-
SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SM_CLIENT_CERT_PASSWORD }}
136+
choco install yq jq -y
137+
shell: bash
138+
139+
- name: Install Rust
140+
uses: actions-rust-lang/setup-rust-toolchain@v1
141+
with:
142+
toolchain: ${{ env.RUST_VERSION }}-x86_64-pc-windows-msvc
143+
144+
- name: Install Rust
145+
uses: actions-rust-lang/setup-rust-toolchain@v1
146+
with:
147+
toolchain: ${{ env.RUST_VERSION }}-x86_64-pc-windows-gnu
148+
149+
- name: Setup node folder
128150
run: |
129-
smctl healthcheck --all
130-
# smctl sign --verbose --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ${{ env.FILE_TO_SIGN }} --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} --verbose --exit-non-zero-on-fail --failfast
131-
shell: cmd
151+
mkdir -p "C:/Program Files/node/include"
152+
Add-Content -Path $env:GITHUB_PATH -Value "C:/Program Files/node"
132153
133-
# - name: Install dependencies
134-
# run: |
135-
# choco install yq jq -y
136-
# shell: bash
154+
- name: Install flatbuffers
155+
run: |
156+
curl -L -O https://github.com/google/flatbuffers/releases/download/v${{ env.FLATBUFFERS_VERSION }}/Windows.flatc.binary.zip
157+
unzip Windows.flatc.binary.zip
158+
mv flatc.exe "C:/Program Files/node/"
137159
138-
# - name: Install Rust
139-
# uses: actions-rust-lang/setup-rust-toolchain@v1
140-
# with:
141-
# toolchain: ${{ env.RUST_VERSION }}-x86_64-pc-windows-msvc
160+
- name: Install protobuf (protoc)
161+
run: |
162+
curl -L -O https://github.com/protocolbuffers/protobuf/releases/download/v${{ env.PROTOC_VERSION }}/protoc-${{ env.PROTOC_VERSION }}-win64.zip
163+
unzip protoc-${{ env.PROTOC_VERSION }}-win64.zip
164+
mv bin/protoc.exe "C:/Program Files/node/"
165+
mv include/* "C:/Program Files/node/include"
142166
143-
# - name: Install Rust
144-
# uses: actions-rust-lang/setup-rust-toolchain@v1
145-
# with:
146-
# toolchain: ${{ env.RUST_VERSION }}-x86_64-pc-windows-gnu
167+
- name: Setup Haskell
168+
uses: haskell-actions/setup@v2
169+
with:
170+
ghc-version: ${{ env.GHC_VERSION }}
171+
enable-stack: true
172+
stack-version: ${{ env.STACK_VERSION }}
147173

148-
# - name: Setup node folder
149-
# run: |
150-
# mkdir -p "C:/Program Files/node/include"
151-
# Add-Content -Path $env:GITHUB_PATH -Value "C:/Program Files/node"
174+
- uses: milliewalky/setup-7-zip@v1
152175

153-
# - name: Install flatbuffers
154-
# run: |
155-
# curl -L -O https://github.com/google/flatbuffers/releases/download/v${{ env.FLATBUFFERS_VERSION }}/Windows.flatc.binary.zip
156-
# unzip Windows.flatc.binary.zip
157-
# mv flatc.exe "C:/Program Files/node/"
176+
- name: Install GCC
177+
run: |
178+
curl -L -O https://github.com/brechtsanders/winlibs_mingw/releases/download/14.2.0posix-19.1.1-12.0.0-msvcrt-r2/winlibs-x86_64-posix-seh-gcc-14.2.0-llvm-19.1.1-mingw-w64msvcrt-12.0.0-r2.7z
179+
7z x winlibs-x86_64-posix-seh-gcc-14.2.0-llvm-19.1.1-mingw-w64msvcrt-12.0.0-r2.7z -oC:/gcc
180+
Add-Content -Path $env:GITHUB_PATH -Value "C:/gcc/mingw64/bin"
158181
159-
# - name: Install protobuf (protoc)
160-
# run: |
161-
# curl -L -O https://github.com/protocolbuffers/protobuf/releases/download/v${{ env.PROTOC_VERSION }}/protoc-${{ env.PROTOC_VERSION }}-win64.zip
162-
# unzip protoc-${{ env.PROTOC_VERSION }}-win64.zip
163-
# mv bin/protoc.exe "C:/Program Files/node/"
164-
# mv include/* "C:/Program Files/node/include"
182+
- name: Install LMDB
183+
run: stack exec -- pacman -S --noconfirm mingw-w64-x86_64-lmdb
165184

166-
# - name: Setup Haskell
167-
# uses: haskell-actions/setup@v2
168-
# with:
169-
# ghc-version: ${{ env.GHC_VERSION }}
170-
# enable-stack: true
171-
# stack-version: ${{ env.STACK_VERSION }}
185+
- name: Build Windows Node
186+
run: |
187+
./scripts/distribution/windows/build-all.ps1 -nodeVersion ${{ needs.validate-preconditions.outputs.version }} -rustVersion ${{ env.RUST_VERSION }}
172188
173-
# - uses: milliewalky/setup-7-zip@v1
189+
- name: Extract files to prepare for signing
190+
run: |
191+
pwd
192+
MsiDb.exe -d ./service/windows/installer/Node.msi -x Node.cab
193+
mkdir -p ./Node
194+
expand -F:* Node.cab ./Node
195+
196+
- name: Rename files to prepare for signing
197+
run: |
198+
mv ./Node/ConcordiumConsensusDLL ./Node/ConcordiumConsensusDLL.dll
199+
mv ./Node/ConcordiumBaseDLL ./Node/ConcordiumBaseDLL.dll
200+
mv ./Node/ConcordiumSmartContractEngineDLL ./Node/ConcordiumSmartContractEngineDLL.dll
201+
mv ./Node/Sha2DLL ./Node/Sha2DLL.dll
202+
mv ./Node/NodeRunnerService ./Node/NodeRunnerService.exe
203+
mv ./Node/NodeCollector ./Node/NodeCollector.exe
204+
mv ./Node/ConcordiumNode ./Node/ConcordiumNode.exe
174205
175-
# - name: Install GCC
206+
# - name: Sign files with smctl
207+
# working-directory: ${{steps.build.outputs.bin_dir}}
208+
# env:
209+
# WINDOWS_PKCS11_CONFIG: ${{ steps.digicert_client.outputs.PKCS11_CONFIG }}
210+
# WINDOWS_SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SM_KEYPAIR_ALIAS }}
211+
# SM_HOST: ${{ vars.WINDOWS_SM_HOST }}
212+
# SM_API_KEY: ${{ secrets.WINDOWS_SM_API_KEY }}
213+
# SM_CLIENT_CERT_FILE: ${{ steps.windows_certificate.outputs.CERTIFICATE_PATH }}
214+
# SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SM_CLIENT_CERT_PASSWORD }}
215+
# SM_ARGS: "--verbose --exit-non-zero-on-fail --failfast"
176216
# run: |
177-
# curl -L -O https://github.com/brechtsanders/winlibs_mingw/releases/download/14.2.0posix-19.1.1-12.0.0-msvcrt-r2/winlibs-x86_64-posix-seh-gcc-14.2.0-llvm-19.1.1-mingw-w64msvcrt-12.0.0-r2.7z
178-
# 7z x winlibs-x86_64-posix-seh-gcc-14.2.0-llvm-19.1.1-mingw-w64msvcrt-12.0.0-r2.7z -oC:/gcc
179-
# Add-Content -Path $env:GITHUB_PATH -Value "C:/gcc/mingw64/bin"
217+
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumConsensusDLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
218+
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumBaseDLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
219+
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumSmartContractEngineDLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
220+
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/Sha2DLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
221+
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/NodeRunnerService.exe --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
222+
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/NodeCollector.exe --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
223+
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumNode.exe --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
224+
# shell: cmd
180225

181-
# - name: Install LMDB
182-
# run: stack exec -- pacman -S --noconfirm mingw-w64-x86_64-lmdb
226+
- name: Rename files back to their original form without extension.
227+
run: |
228+
mv ./Node/ConcordiumConsensusDLL.dll ./Node/ConcordiumConsensusDLL
229+
mv ./Node/ConcordiumBaseDLL.dll ./Node/ConcordiumBaseDLL
230+
mv ./Node/ConcordiumSmartContractEngineDLL.dll ./Node/ConcordiumSmartContractEngineDLL
231+
mv ./Node/Sha2DLL.dll ./Node/Sha2DLL
232+
mv ./Node/NodeRunnerService.exe ./Node/NodeRunnerService
233+
mv ./Node/NodeCollector.exe ./Node/NodeCollector
234+
mv ./Node/ConcordiumNode.exe ./Node/ConcordiumNode
183235
184-
# - name: Build Windows Node
185-
# run: |
186-
# ./scripts/distribution/windows/build-all.ps1 -nodeVersion ${{ needs.validate-preconditions.outputs.version }} -rustVersion ${{ env.RUST_VERSION }}
187-
# cp ./service/windows/installer/Node.msi ./${{ env.ARTIFACT_NAME }}
188-
189-
# - name: Upload artifact
190-
# uses: actions/upload-artifact@v4
191-
# with:
192-
# name: ${{ github.job }}
193-
# path: ${{ env.ARTIFACT_NAME }}
236+
- name: Recreate the cabinet file.
237+
run: |
238+
dir Node /b /a-d > filelist.txt
239+
makecab.exe /D MaxDiskSize=0 /D Cabinet=ON /D Compress=ON /D CabinetName1=Node.cab /D SourceDir=Node /f cabdirs.txt
240+
shell: cmd
241+
242+
243+
- name: Repackage the cabinet file.
244+
run: |
245+
rm Node.cab
246+
mv disk1\Node.cab .
247+
MsiDb.exe -d ./service/windows/installer/Node.msi -k Node.cab
248+
MsiDb.exe -d ./service/windows/installer/Node.msi -a Node.cab
249+
shell: cmd
250+
251+
# Sign the installer
252+
253+
- name: Rename the package to target filename.
254+
run: |
255+
cp ./service/windows/installer/Node.msi ./${{ env.ARTIFACT_NAME }}
256+
257+
- name: Upload artifact
258+
uses: actions/upload-artifact@v4
259+
with:
260+
name: ${{ github.job }}
261+
path: ${{ env.ARTIFACT_NAME }}
194262

0 commit comments

Comments
 (0)