forked from microsoft/AL-Go
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Uptake DotNet signing tool (microsoft#957)
Uptake DotNet signing tool as a replacement for AzureSignTool --------- Co-authored-by: aholstrup1 <[email protected]@users.noreply.github.com>
- Loading branch information
1 parent
c05e541
commit 0a51a4a
Showing
4 changed files
with
132 additions
and
58 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| { | ||
| "sign": "0.9.1-beta.24123.2" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,44 +1,101 @@ | ||
| function GetNavSipFromArtifacts | ||
| ( | ||
| [string] $NavSipDestination | ||
| ) | ||
| { | ||
| $artifactTempFolder = Join-Path $([System.IO.Path]::GetTempPath()) ([System.IO.Path]::GetRandomFileName()) | ||
|
|
||
| try { | ||
| Download-Artifacts -artifactUrl (Get-BCArtifactUrl -type Sandbox -country core) -basePath $artifactTempFolder | Out-Null | ||
| Write-Host "Downloaded artifacts to $artifactTempFolder" | ||
| $navsip = Get-ChildItem -Path $artifactTempFolder -Filter "navsip.dll" -Recurse | ||
| Write-Host "Found navsip at $($navsip.FullName)" | ||
| Copy-Item -Path $navsip.FullName -Destination $NavSipDestination -Force | Out-Null | ||
| Write-Host "Copied navsip to $NavSipDestination" | ||
| } | ||
| finally { | ||
| Remove-Item -Path $artifactTempFolder -Recurse -Force | ||
| } | ||
| <# | ||
| .SYNOPSIS | ||
| Installs the dotnet signing tool. | ||
| .DESCRIPTION | ||
| Installs the dotnet signing tool. | ||
| #> | ||
| function Install-SigningTool() { | ||
| . (Join-Path -Path $PSScriptRoot -ChildPath "..\AL-Go-Helper.ps1" -Resolve) | ||
|
|
||
| # Create folder in temp directory with a unique name | ||
| $tempFolder = Join-Path -Path ([System.IO.Path]::GetTempPath()) "SigningTool-$(Get-Random)" | ||
|
|
||
| # Get version of the signing tool | ||
| $version = Get-PackageVersion -PackageName "sign" | ||
|
|
||
| # Install the signing tool in the temp folder | ||
| Write-Host "Installing signing tool version $version in $tempFolder" | ||
| New-Item -ItemType Directory -Path $tempFolder | Out-Null | ||
| dotnet tool install sign --version $version --tool-path $tempFolder | Out-Null | ||
|
|
||
| # Return the path to the signing tool | ||
| $signingTool = Join-Path -Path $tempFolder "sign.exe" -Resolve | ||
| return $signingTool | ||
| } | ||
|
|
||
| <# | ||
| .SYNOPSIS | ||
| Register the navsip.dll in the system32 folder | ||
| .SYNOPSIS | ||
| Signs files in a given path using a certificate from Azure Key Vault. | ||
| .DESCRIPTION | ||
| Signs files in a given path using a certificate from Azure Key Vault. | ||
| .PARAMETER KeyVaultName | ||
| The name of the Azure Key Vault where the certificate is stored. | ||
| .PARAMETER CertificateName | ||
| The name of the certificate in the Azure Key Vault. | ||
| .PARAMETER ClientId | ||
| The client ID of the service principal used to authenticate with Azure Key Vault. | ||
| .PARAMETER ClientSecret | ||
| The client secret of the service principal used to authenticate with Azure Key Vault. | ||
| .PARAMETER TenantId | ||
| The tenant ID of the service principal used to authenticate with Azure Key Vault. | ||
| .PARAMETER FilesToSign | ||
| The path to the file(s) to be signed. Supports wildcards. | ||
| .PARAMETER Description | ||
| The description to be included in the signature. | ||
| .PARAMETER DescriptionUrl | ||
| The URL to be included in the signature. | ||
| .PARAMETER TimestampService | ||
| The URL of the timestamp server. | ||
| .PARAMETER DigestAlgorithm | ||
| The digest algorithm to use for signing and timestamping. | ||
| .PARAMETER Verbosity | ||
| The verbosity level of the signing tool. | ||
| .EXAMPLE | ||
| Invoke-SigningTool -KeyVaultName "my-key-vault" -CertificateName "my-certificatename" -ClientId "my-client-id" -ClientSecret "my-client-secret" -TenantId "my-tenant-id" | ||
| -FilesToSign "C:\path\to\files\*.app" -Description "Signed with AL-Go for GitHub" -DescriptionUrl "github.com/myorg/myrepo" | ||
| #> | ||
| function Register-NavSip() { | ||
| $navSipDestination = "C:\Windows\System32" | ||
| $navSipDllPath = Join-Path $navSipDestination "navsip.dll" | ||
| try { | ||
| if (-not (Test-Path $navSipDllPath)) { | ||
| GetNavSipFromArtifacts -NavSipDestination $navSipDllPath | ||
| } | ||
|
|
||
| Write-Host "Unregistering dll $navSipDllPath" | ||
| RegSvr32 /u /s $navSipDllPath | ||
| Write-Host "Registering dll $navSipDllPath" | ||
| RegSvr32 /s $navSipDllPath | ||
| } | ||
| catch { | ||
| Write-Host "Failed to copy navsip to $navSipDestination" | ||
| } | ||
| function Invoke-SigningTool() { | ||
| param( | ||
| [Parameter(Mandatory = $true)] | ||
| [string] $KeyVaultName, | ||
| [Parameter(Mandatory = $true)] | ||
| [string] $CertificateName, | ||
| [Parameter(Mandatory = $true)] | ||
| [string] $ClientId, | ||
| [Parameter(Mandatory = $true)] | ||
| [string] $ClientSecret, | ||
| [Parameter(Mandatory = $true)] | ||
| [string] $TenantId, | ||
| [Parameter(Mandatory = $true)] | ||
| [string] $FilesToSign, | ||
| [Parameter(Mandatory = $true)] | ||
| [string] $Description, | ||
| [Parameter(Mandatory = $true)] | ||
| [string] $DescriptionUrl, | ||
| [Parameter(Mandatory = $false)] | ||
| [string] $TimestampService = "http://timestamp.digicert.com", | ||
| [Parameter(Mandatory = $false)] | ||
| [string] $DigestAlgorithm = "sha256", | ||
| [Parameter(Mandatory = $false)] | ||
| [string] $Verbosity = "Information" | ||
| ) | ||
|
|
||
| $signingToolExe = Install-SigningTool | ||
|
|
||
| # Sign files | ||
| . $signingToolExe code azure-key-vault ` | ||
| --azure-key-vault-url "https://$KeyVaultName.vault.azure.net/" ` | ||
| --azure-key-vault-certificate $CertificateName ` | ||
| --azure-key-vault-client-id $ClientId ` | ||
| --azure-key-vault-client-secret $ClientSecret ` | ||
| --azure-key-vault-tenant-id $TenantId ` | ||
| --description $Description ` | ||
| --description-url $DescriptionUrl ` | ||
| --file-digest $DigestAlgorithm ` | ||
| --timestamp-digest $DigestAlgorithm ` | ||
| --timestamp-url $TimestampService ` | ||
| --verbosity $Verbosity ` | ||
| $FilesToSign | ||
| } | ||
|
|
||
| Export-ModuleMember Register-NavSip | ||
| Export-ModuleMember -Function Invoke-SigningTool |