c95a4373de
Fusion copies prep icon and version info via go-winres; optional Garble obfuscation, Authenticode signing, and dry-run size estimates. Forge Simple mode with smart defaults; fleet roster gets compact expandable cards, filters, bulk commands, per-agent notes/tags, and typed WebSocket payloads.
80 lines
1.7 KiB
Go
80 lines
1.7 KiB
Go
//go:build windows
|
|
|
|
package builder
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
func (h *Handler) shouldSignBuild(req *BuildRequest) bool {
|
|
if !h.policy.Sign.Enabled || strings.TrimSpace(h.policy.Sign.CertThumbprint) == "" {
|
|
return false
|
|
}
|
|
return req.SignBuild
|
|
}
|
|
|
|
func (h *Handler) signExecutable(path string) error {
|
|
policy := h.policy.Sign
|
|
tool := strings.TrimSpace(policy.ToolPath)
|
|
if tool == "" {
|
|
var err error
|
|
tool, err = findSignTool()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
tsURL := strings.TrimSpace(policy.TimestampURL)
|
|
if tsURL == "" {
|
|
tsURL = "http://timestamp.digicert.com"
|
|
}
|
|
|
|
args := []string{
|
|
"sign",
|
|
"/fd", "SHA256",
|
|
"/tr", tsURL,
|
|
"/td", "SHA256",
|
|
"/sha1", strings.TrimSpace(policy.CertThumbprint),
|
|
path,
|
|
}
|
|
cmd := exec.Command(tool, args...)
|
|
out, err := cmd.CombinedOutput()
|
|
if err != nil {
|
|
return fmt.Errorf("signtool: %w (%s)", err, strings.TrimSpace(string(out)))
|
|
}
|
|
log.Printf("[Forge] Signed %s", filepath.Base(path))
|
|
return nil
|
|
}
|
|
|
|
func findSignTool() (string, error) {
|
|
if p, err := exec.LookPath("signtool"); err == nil {
|
|
return p, nil
|
|
}
|
|
if p, err := exec.LookPath("signtool.exe"); err == nil {
|
|
return p, nil
|
|
}
|
|
|
|
roots := []string{
|
|
os.Getenv("ProgramFiles(x86)"),
|
|
os.Getenv("ProgramFiles"),
|
|
}
|
|
for _, root := range roots {
|
|
if root == "" {
|
|
continue
|
|
}
|
|
kits := filepath.Join(root, "Windows Kits", "10", "bin")
|
|
matches, _ := filepath.Glob(filepath.Join(kits, "*", "x64", "signtool.exe"))
|
|
for i := len(matches) - 1; i >= 0; i-- {
|
|
if _, err := os.Stat(matches[i]); err == nil {
|
|
return matches[i], nil
|
|
}
|
|
}
|
|
}
|
|
return "", fmt.Errorf("signtool.exe not found — install Windows SDK or set sign_tool_path in Calibrate")
|
|
}
|