73 lines
2.1 KiB
Go
73 lines
2.1 KiB
Go
//go:build !windows
|
|
|
|
package builder
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
"os/exec"
|
|
"strings"
|
|
)
|
|
|
|
// shouldSignBuild returns true when signing is configured AND osslsigncode is available.
|
|
// On Linux/macOS we can sign Windows PE files with osslsigncode + a PFX certificate.
|
|
// Install: apt install osslsigncode / brew install osslsigncode
|
|
func (h *Handler) shouldSignBuild(req *BuildRequest) bool {
|
|
if !h.policy.Sign.Enabled || strings.TrimSpace(h.policy.Sign.CertThumbprint) == "" {
|
|
return false
|
|
}
|
|
if !req.SignBuild {
|
|
return false
|
|
}
|
|
_, err := exec.LookPath("osslsigncode")
|
|
if err != nil {
|
|
log.Printf("[Forge] sign requested but osslsigncode not found — install with: apt install osslsigncode (or brew install osslsigncode)")
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
// signExecutable signs a Windows PE binary using osslsigncode.
|
|
// Requires: osslsigncode on PATH and a PFX certificate file set in sign_tool_path.
|
|
// The sign_cert_thumbprint field is repurposed as the path to the .pfx file on non-Windows.
|
|
func (h *Handler) signExecutable(path string) error {
|
|
policy := h.policy.Sign
|
|
|
|
pfxPath := strings.TrimSpace(policy.CertThumbprint)
|
|
if pfxPath == "" {
|
|
return fmt.Errorf("sign_cert_thumbprint must contain the path to a .pfx certificate file on Linux/macOS")
|
|
}
|
|
|
|
tsURL := strings.TrimSpace(policy.TimestampURL)
|
|
if tsURL == "" {
|
|
tsURL = "http://timestamp.digicert.com"
|
|
}
|
|
|
|
// osslsigncode usage: osslsigncode sign -pkcs12 <pfx> -ts <url> -in <file> -out <file>
|
|
// We sign in-place by writing to a temp path then replacing.
|
|
tmpPath := path + ".signed"
|
|
args := []string{
|
|
"sign",
|
|
"-pkcs12", pfxPath,
|
|
"-ts", tsURL,
|
|
"-h", "sha2",
|
|
"-in", path,
|
|
"-out", tmpPath,
|
|
}
|
|
|
|
osslBin, _ := exec.LookPath("osslsigncode")
|
|
cmd := exec.Command(osslBin, args...)
|
|
out, err := cmd.CombinedOutput()
|
|
if err != nil {
|
|
return fmt.Errorf("osslsigncode: %w (%s)", err, strings.TrimSpace(string(out)))
|
|
}
|
|
|
|
// Replace the original with the signed copy
|
|
if err := exec.Command("mv", tmpPath, path).Run(); err != nil {
|
|
return fmt.Errorf("could not replace binary with signed version: %w", err)
|
|
}
|
|
|
|
log.Printf("[Forge] Signed %s via osslsigncode", path)
|
|
return nil
|
|
}
|