windows executable signing (#566)

Windows executables are now signed with official cert when creating a release

1 files changed, 28 insertions, 2 deletions

diff --git a/scripts/bundle.lua b/scripts/bundle.lua
index 207122345..7294043ec 100644
--- a/scripts/bundle.lua
+++ b/scripts/bundle.lua
@@ -156,7 +156,7 @@ local function _find_vcpkg_binary(triple, port, binary)
 end
 
 --------------------------------------------------------------------------------
-local function main_windows()
+local function main_windows(signidentity)
     import("core.base.option")
 
     zip_path = "build/zenserver-win64.zip"
@@ -168,6 +168,31 @@ local function main_windows()
 
     _build("x64", false, config_args)
 
+    if signidentity == nil or signidentity == "" then
+        print("Skipping signing since no signidentity was given")
+    else
+        program_files_path = os.getenv("PROGRAMFILES(x86)")
+        signtool_path = program_files_path .. "/Windows Kits/10/App Certification Kit/signtool.exe"
+        if not os.isfile(signtool_path) then
+            raise("Failed signing, unable to locate signtool at "..signtool_path)
+        end
+        local ret = _exec(signtool_path,
+            "sign",
+            "/sm",
+            "/a",
+            "/n",
+            signidentity,
+            "/tr",
+            "http://timestamp.digicert.com",
+            "/v",
+            "/as",
+            "build/windows/x64/release/zenserver.exe",
+            "build/windows/x64/release/zen.exe")
+        if ret > 0 then
+            raise("Failed signing zenserver binary")
+        end
+    end
+
     local crashpad_handler_path = _find_vcpkg_binary(
         "x64-windows-static",
         "sentry-native",
@@ -272,7 +297,8 @@ import("core.base.option")
 
 function main()
     if is_host("windows") then
-        return main_windows()
+        signidentity = option.get("codesignidentity")
+        return main_windows(signidentity)
     end
 
     if is_host("mac") then