bitwarden/browser
1
0
Fork 0
mirror of https://github.com/bitwarden/browser synced 2026-02-18 18:33:50 +00:00
Code Issues Releases Wiki Activity

Allow local Electron app signing for Windows dev builds [PM-18325] (#17973)

Browse Source
This commit is contained in:
Isaiah Inuwa
2026-01-09 15:24:16 -06:00
committed by jaasen-livefront
parent 984e2b303d
commit 37495b0909
1 changed files with 50 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
apps/desktop/sign.js
View File

@@ -1,22 +1,60 @@
/* eslint-disable @typescript-eslint/no-require-imports, no-console */
const child_process = require("child_process");
exports.default = async function (configuration) {
if (parseInt(process.env.ELECTRON_BUILDER_SIGN) === 1 && configuration.path.slice(-4) == ".exe") {
const ext = configuration.path.split(".").at(-1);
if (parseInt(process.env.ELECTRON_BUILDER_SIGN) === 1 && ext == "exe") {
console.log(`[*] Signing file: ${configuration.path}`);
require("child_process").execSync(
`azuresigntool sign -v ` +
`-kvu ${process.env.SIGNING_VAULT_URL} ` +
`-kvi ${process.env.SIGNING_CLIENT_ID} ` +
`-kvt ${process.env.SIGNING_TENANT_ID} ` +
`-kvs ${process.env.SIGNING_CLIENT_SECRET} ` +
`-kvc ${process.env.SIGNING_CERT_NAME} ` +
`-fd ${configuration.hash} ` +
`-du ${configuration.site} ` +
`-tr http://timestamp.digicert.com ` +
`"${configuration.path}"`,
child_process.execFileSync(
"azuresigntool",
// prettier-ignore
[
"sign",
"-v",
"-kvu", process.env.SIGNING_VAULT_URL,
"-kvi", process.env.SIGNING_CLIENT_ID,
"-kvt", process.env.SIGNING_TENANT_ID,
"-kvs", process.env.SIGNING_CLIENT_SECRET,
"-kvc", process.env.SIGNING_CERT_NAME,
"-fd", configuration.hash,
"-du", configuration.site,
"-tr", "http://timestamp.digicert.com",
configuration.path,
],
{
stdio: "inherit",
},
);
} else if (process.env.ELECTRON_BUILDER_SIGN_CERT && ["exe", "appx"].includes(ext)) {
console.log(`[*] Signing file: ${configuration.path}`);
if (process.platform !== "win32") {
console.warn(
"Signing Windows executables on non-Windows platforms is not supported. Not signing.",
);
return;
}
const certFile = process.env.ELECTRON_BUILDER_SIGN_CERT;
const certPw = process.env.ELECTRON_BUILDER_SIGN_CERT_PW;
if (!certPw) {
throw new Error(
"The certificate file password must be set in ELECTRON_BUILDER_SIGN_CERT_PW in order to sign files.",
);
}
try {
child_process.execFileSync(
"signtool.exe",
["sign", "/fd", "SHA256", "/a", "/f", certFile, "/p", certPw, configuration.path],
{
stdio: "inherit",
},
);
console.info(`Signed ${configuration.path} successfully.`);
} catch (error) {
throw new Error(
`Failed to sign ${configuration.path}: ${error.message}\n` +
`Check that ELECTRON_BUILDER_SIGN_CERT points to a valid PKCS12 file ` +
`and ELECTRON_BUILDER_SIGN_CERT_PW is correct.`,
);
}
}
};