Skip to content

Commit f1e9bff

Browse files
mlocatimlocati
committed
Sign files before generating output dir
1 parent 284e0d2 commit f1e9bff

14 files changed

Lines changed: 548 additions & 497 deletions

‎.github/workflows/build.yml‎

Lines changed: 92 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -287,10 +287,8 @@ jobs:
287287
mkdir -p installed/include
288288
mkdir -p installed/lib
289289
mkdir -p installed/licenses
290-
mkdir files-unsigned
291-
mkdir files-signed
292-
mkdir installer-unsigned
293-
mkdir installer-signed
290+
mkdir output-exe
291+
mkdir installer
294292
cp ./LICENSE.txt installed/license.txt
295293
mkdir -p "$HOME"
296294
printf "\nPATH='${{ steps.vars.outputs.cygwin-path }}'\nexport PATH\n" >>$HOME/.bash_profile
@@ -569,6 +567,78 @@ jobs:
569567
name: Install iconv (2nd time)
570568
working-directory: src\libiconv-${{ needs.versions.outputs.iconv-version }}\build
571569
run: make --jobs=$(nproc) install-strip
570+
-
571+
name: Finalize install dir
572+
shell: pwsh
573+
run: >
574+
./build-exe/finalize-installed.ps1
575+
-Bits ${{ matrix.bits }}
576+
-Link ${{ matrix.link }}
577+
-Path installed
578+
-MinGWPath D:\cygwin\usr\${{ steps.vars.outputs.mingw-host }}
579+
-
580+
name: Extract version infos
581+
id: versioninfos
582+
shell: pwsh
583+
run: ./build-exe/extract-versiononfos.ps1 -RootPath installed
584+
-
585+
name: Check bitness
586+
run: ./build-exe/check-bits.sh ${{ matrix.bits }} installed
587+
-
588+
name: Upload unsigned files
589+
if: needs.versions.outputs.signpath-signing-policy
590+
id: upload-installed-unsigned
591+
uses: actions/upload-artifact@v6
592+
with:
593+
name: ${{ matrix.link }}-${{ matrix.bits }}-installed-unsigned
594+
path: installed
595+
if-no-files-found: error
596+
retention-days: 1
597+
-
598+
name: Sign files
599+
if: needs.versions.outputs.signpath-signing-policy
600+
id: sign-files
601+
uses: signpath/github-action-submit-signing-request@v2
602+
with:
603+
api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
604+
organization-id: 98c3accc-92c9-4962-b150-ff1f5c6356b8
605+
project-slug: gettext-iconv-windows
606+
signing-policy-slug: '${{ needs.versions.outputs.signpath-signing-policy }}'
607+
artifact-configuration-slug: ${{ needs.versions.outputs.signpath-artifactconfiguration-files }}
608+
github-artifact-id: ${{ steps.upload-installed-unsigned.outputs.artifact-id }}
609+
wait-for-completion: true
610+
output-artifact-directory: installed
611+
parameters: ${{ steps.versioninfos.outputs.signpath-parameters }}
612+
-
613+
name: Check signatures
614+
if: needs.versions.outputs.signpath-signing-policy
615+
shell: pwsh
616+
run: >
617+
./build-exe/check-signature.ps1
618+
-GettextVersion ${{ needs.versions.outputs.gettext-version }}
619+
-Path installed
620+
-CanBeInvalid ${{ needs.versions.outputs.signatures-canbeinvalid == 'yes' && '$true' || '$false' }}
621+
-
622+
name: Copy built executables
623+
run: ./build-exe/copy-output-exe.sh installed output-exe
624+
-
625+
name: Delete unused dependencies
626+
shell: pwsh
627+
run: ./build-exe/delete-unused-dependencies.ps1 -Bits ${{ matrix.bits }} -Link ${{ matrix.link }} -Path output-exe
628+
-
629+
name: Create executable files archive
630+
shell: pwsh
631+
working-directory: output-exe
632+
run: |
633+
& 7z.exe a -bd -bt -mx9 -r -sse -tzip ..\gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.zip
634+
-
635+
name: Upload executable files archive
636+
uses: actions/upload-artifact@v6
637+
with:
638+
name: ${{ matrix.link }}-${{ matrix.bits }}-files
639+
path: gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.zip
640+
if-no-files-found: error
641+
compression-level: 0
572642
-
573643
name: Prepare build log
574644
id: prepare-build-log
@@ -587,39 +657,21 @@ jobs:
587657
if [ -d src/gettext-${{ needs.versions.outputs.gettext-version }}/build ]; then
588658
tar c -J -f build-log/gettext.tar.xz src/gettext-${{ needs.versions.outputs.gettext-version }}/build
589659
fi
590-
if find installed -mindepth 1 -maxdepth 1 | read; then
591-
tar c -J -f build-log/installed.tar.xz installed
660+
if [ -d installed ]; then
661+
if find installed -mindepth 1 -maxdepth 1 | read; then
662+
tar c -J -f build-log/installed.tar.xz installed
663+
fi
592664
fi
593665
ls -al build-log
594-
-
595-
name: Copy built assets
596-
run: ./build-exe/create-output.sh installed files-unsigned
597666
-
598667
name: Delete install directory
599668
run: rm -rf installed
600-
-
601-
name: Process dependencies
602-
shell: pwsh
603-
run: >
604-
./build-exe/process-dependencies.ps1
605-
-Bits ${{ matrix.bits }}
606-
-Link ${{ matrix.link }}
607-
-Path files-unsigned
608-
-MinGWPath D:\cygwin\usr\${{ steps.vars.outputs.mingw-host }}
609-
-
610-
name: Extract version infos
611-
id: versioninfos
612-
shell: pwsh
613-
run: ./build-exe/extract-versiononfos.ps1 -RootPath '.\files-unsigned'
614-
-
615-
name: Check bitness
616-
run: ./build-exe/check-bits.sh ${{ matrix.bits }} files-unsigned
617669
-
618670
name: Check if iconv program load translations correctly
619671
shell: pwsh
620672
run: |
621673
$env:LANGUAGE = 'it'
622-
$stdout = & .\files-unsigned\bin\iconv.exe --help
674+
$stdout = & .\output-exe\bin\iconv.exe --help
623675
if (-not($?)) {
624676
throw "iconv.exe failed"
625677
}
@@ -633,7 +685,7 @@ jobs:
633685
shell: pwsh
634686
run: |
635687
$env:LANGUAGE = 'it'
636-
$stdout = & .\files-unsigned\bin\xgettext.exe --help
688+
$stdout = & .\output-exe\bin\xgettext.exe --help
637689
if (-not($?)) {
638690
throw "xgettext.exe failed"
639691
}
@@ -659,15 +711,15 @@ jobs:
659711
$lang = 'zu'
660712
661713
Remove-Item -LiteralPath Env:GETTEXTCLDRDIR -ErrorAction SilentlyContinue
662-
$po = $pot | & .\files-unsigned\bin\msginit.exe --input=- --output-file=- --locale="$lang"
714+
$po = $pot | & .\output-exe\bin\msginit.exe --input=- --output-file=- --locale="$lang"
663715
$rule = $po -match "Plural-Forms:"
664716
if ($rule) {
665717
throw "Without GETTEXTCLDRDIR there shouldn't be a Plural-Forms header in the .po file for the locale $lang, but we found it: $rule"
666718
}
667719
Write-Output -InputObject "As expected, without GETTEXTCLDRDIR there isn't a Plural-Forms header in the .po file for the locale $lang."
668720
669-
$env:GETTEXTCLDRDIR = "$PWD\files-unsigned\share\gettext\cldr"
670-
$po = $pot | & .\files-unsigned\bin\msginit.exe --input=- --output-file=- --locale="$lang"
721+
$env:GETTEXTCLDRDIR = "$PWD\output-exe\share\gettext\cldr"
722+
$po = $pot | & .\output-exe\bin\msginit.exe --input=- --output-file=- --locale="$lang"
671723
$rule = $po -match "Plural-Forms:"
672724
if ('${{ steps.vars.outputs.cldr-plural-works }}' -eq 'yes') {
673725
if (-not($rule)) {
@@ -699,7 +751,7 @@ jobs:
699751
if: steps.vars.outputs.check-spit-exe == 'yes'
700752
shell: pwsh
701753
run: |
702-
$spitPath = '.\files-unsigned\bin\spit.exe'
754+
$spitPath = '.\output-exe\bin\spit.exe'
703755
if (-not(Test-Path -LiteralPath $spitPath -PathType Leaf)) {
704756
throw "spit.exe not found at expected path: $spitPath"
705757
}
@@ -725,87 +777,28 @@ jobs:
725777
if ($null -ne $process) {
726778
$process.Kill($true)
727779
}
728-
-
729-
name: Upload unsigned files
730-
if: needs.versions.outputs.signpath-signing-policy
731-
id: upload-files-unsigned
732-
uses: actions/upload-artifact@v6
733-
with:
734-
name: ${{ matrix.link }}-${{ matrix.bits }}-files-unsigned
735-
path: files-unsigned
736-
if-no-files-found: error
737-
retention-days: 1
738-
-
739-
name: Sign files
740-
if: needs.versions.outputs.signpath-signing-policy
741-
id: sign-files
742-
uses: signpath/github-action-submit-signing-request@v2
743-
with:
744-
api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
745-
organization-id: 98c3accc-92c9-4962-b150-ff1f5c6356b8
746-
project-slug: gettext-iconv-windows
747-
signing-policy-slug: '${{ needs.versions.outputs.signpath-signing-policy }}'
748-
artifact-configuration-slug: ${{ needs.versions.outputs.signpath-artifactconfiguration-files }}
749-
github-artifact-id: ${{ steps.upload-files-unsigned.outputs.artifact-id }}
750-
wait-for-completion: true
751-
output-artifact-directory: files-signed
752-
parameters: ${{ steps.versioninfos.outputs.signpath-parameters }}
753-
-
754-
name: Check signatures
755-
if: needs.versions.outputs.signpath-signing-policy
756-
shell: pwsh
757-
run: >
758-
./build-exe/check-signature.ps1
759-
-Path files-signed
760-
-CanBeInvalid ${{ needs.versions.outputs.signatures-canbeinvalid == 'yes' && '$true' || '$false' }}
761-
-
762-
name: Create files archive
763-
shell: pwsh
764-
run: |
765-
if ('${{ needs.versions.outputs.signpath-signing-policy }}') {
766-
Set-Location -LiteralPath 'files-signed'
767-
} else {
768-
Set-Location -LiteralPath 'files-unsigned'
769-
}
770-
& 7z.exe a -bd -bt -mx9 -r -sse -tzip ..\gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.zip
771-
-
772-
name: Upload files archive
773-
uses: actions/upload-artifact@v6
774-
with:
775-
name: ${{ matrix.link }}-${{ matrix.bits }}-files
776-
path: gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.zip
777-
if-no-files-found: error
778-
compression-level: 0
779-
-
780-
name: Prepare installer files
781-
run: |
782-
if [ -n '${{ needs.versions.outputs.signpath-signing-policy }}' ]; then
783-
mv files-signed installer-files
784-
else
785-
mv files-unsigned installer-files
786-
fi
787780
-
788781
name: Create installer
789782
shell: pwsh
790783
run: >
791784
./build-exe/create-installer.ps1
792785
-Bits ${{ matrix.bits }}
793786
-Link ${{ matrix.link }}
794-
-SourceDirectory installer-files
795-
-OutputDirectory installer-unsigned
787+
-SourceDirectory output-exe
788+
-OutputDirectory installer
796789
-IconvVersion ${{ needs.versions.outputs.iconv-version }}
797790
-GettextVersion ${{ needs.versions.outputs.gettext-version }}
798791
-
799792
name: Check bitness
800-
run: ./build-exe/check-bits.sh 32 installer-unsigned/gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.exe
793+
run: ./build-exe/check-bits.sh 32 installer/gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.exe
801794
-
802795
name: Upload unsigned installer
803796
if: needs.versions.outputs.signpath-signing-policy
804797
id: upload-installer-unsigned
805798
uses: actions/upload-artifact@v6
806799
with:
807800
name: ${{ matrix.link }}-${{ matrix.bits }}-installer-unsigned
808-
path: installer-unsigned\gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.exe
801+
path: installer\gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.exe
809802
if-no-files-found: error
810803
compression-level: 0
811804
retention-days: 1
@@ -822,29 +815,22 @@ jobs:
822815
artifact-configuration-slug: gh_sign_installer
823816
github-artifact-id: ${{ steps.upload-installer-unsigned.outputs.artifact-id }}
824817
wait-for-completion: true
825-
output-artifact-directory: installer-signed
818+
output-artifact-directory: installer
826819
-
827820
name: Check signature
828821
if: needs.versions.outputs.signpath-signing-policy
829822
shell: pwsh
830823
run: >
831824
./build-exe/check-signature.ps1
832-
-Path installer-signed
825+
-GettextVersion ${{ needs.versions.outputs.gettext-version }}
826+
-Path installer
833827
-CanBeInvalid ${{ needs.versions.outputs.signatures-canbeinvalid == 'yes' && '$true' || '$false' }}
834-
-
835-
name: Move installer
836-
run: |
837-
if [ -n '${{ needs.versions.outputs.signpath-signing-policy }}' ]; then
838-
mv installer-signed/*.exe .
839-
else
840-
mv installer-unsigned/*.exe .
841-
fi
842828
-
843829
name: Upload installer
844830
uses: actions/upload-artifact@v6
845831
with:
846832
name: ${{ matrix.link }}-${{ matrix.bits }}-installer
847-
path: gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.exe
833+
path: installer/gettext${{ needs.versions.outputs.gettext-version }}-iconv${{ needs.versions.outputs.iconv-version }}-${{ matrix.link }}-${{ matrix.bits }}.exe
848834
if-no-files-found: error
849835
compression-level: 0
850836
-

‎build-exe/case-vars.ps1‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ param (
2424
[string] $JsonCVersion
2525
)
2626

27+
$ErrorActionPreference = 'Stop'
28+
Set-StrictMode -Version Latest
29+
2730
. "$PSScriptRoot/../service/functions.ps1"
2831

2932
function Join-Arguments {

‎build-exe/check-bits.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ checkBits()
3838
local checkMe="$1"
3939
local expectedBits
4040
case "$(basename "$checkMe")" in
41-
GNU.Gettext.dll | msgfmt.net.exe | msgunfmt.net.exe)
41+
GNU.Gettext.dll | msgfmt.net.exe | msgunfmt.net.exe | csharpexec-test.exe)
4242
expectedBits=32
4343
;;
4444
*)

0 commit comments

Comments
 (0)