Merge pull request #336 from ooni/issues/2683

Sign ooniprobe.exe during build
ooni · Mar 18, 2024 · 23a7cf7 · 23a7cf7
2 parents dbf1b34 + 6f78369
commit 23a7cf7
Showing 1 changed file with 14 additions and 6 deletions.
diff --git a/scripts/download-probe-cli.js b/scripts/download-probe-cli.js
@@ -13,11 +13,7 @@ const dstDir = path.join(appRoot, 'build', 'probe-cli')
 
 const download = () => {
   ensureDirSync(dstDir)
-  const osarchs = [
-    'darwin-amd64',
-    'linux-amd64',
-    'windows-amd64',
-  ]
+  const osarchs = ['darwin-amd64', 'linux-amd64', 'windows-amd64']
   var osarch
   for (osarch of osarchs) {
     const extension = osarch.includes('windows') ? '.exe' : ''
@@ -30,7 +26,19 @@ const download = () => {
     }
     osarch = osarch.replace('-', '_')
     ensureDirSync(`${dstDir}/${osarch}`)
-    execSync(`cp ${dstDir}/${versionedFilename} ${dstDir}/${osarch}/ooniprobe${extension}`)
+    if (osarch === 'windows_amd64') {
+      execSync(
+        `cp ${dstDir}/${versionedFilename} ${dstDir}/${osarch}/ooniprobe${extension}-unsigned`
+      )
+      execSync(
+        `osslsigncode sign -pkcs12 ${process.env.WIN_CSC_LINK} -pass ${process.env.WIN_CSC_KEY_PASSWORD} -n "OONI Probe CLI" -i https://ooni.org/ -in ${dstDir}/${osarch}/ooniprobe${extension}-unsigned -out ${dstDir}/${osarch}/ooniprobe${extension}`
+      )
+      execSync(`rm -rf ${dstDir}/${osarch}/ooniprobe${extension}-unsigned`)
+    } else {
+      execSync(
+        `cp ${dstDir}/${versionedFilename} ${dstDir}/${osarch}/ooniprobe${extension}`
+      )
+    }
     execSync(`chmod +x ${dstDir}/${osarch}/ooniprobe${extension}`)
   }
 }