Stowage/tutanota
2
0
Fork 0
mirror of https://github.com/tutao/tutanota.git synced 2025-12-08 06:09:50 +00:00
Code Issues Projects Releases Packages Wiki Activity
tutanota/buildSrc/signDesktopClients.js

71 lines
3 KiB
JavaScript
Raw Permalink Normal View History

Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
/**
* Utility to sign the desktop installers of the app for all platforms.
* The following environment variables are useful when developing:
[maintenance] remove node-forge dependency node-forge is a pure JS crypto library that was used during the build process to sign the clients and at runtime to verify the signature before downloading the updated client: * check the update manifest on the server, if the version is higher than installed: * get the sha512 digest and signature from the manifest and verify the signature (node-forge only requires the digest, not the data) if it matches: * download the update and let electron-updater do its thing with this change, we have to download the update first because node crypto requires the data to verify the signature (digest is calculated internally). In case the signature doesn't match, we delete the downloaded file and stop polling for updates for this run. forge was also used to get a private key for signing out of a self-signed cert in development environments. from now on, this is done by providing PEM encoded private and public keys. close #3832
2022-08-18 17:58:19 +02:00
* * DEBUG_SIGN - path to a folder containing either a self-signed certificate for signing the desktop client (test.p12) or a private key in PEM format (test.key)
* More Info in Wiki -> Desktop Updater Test & Development
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
*/
fix linter errors for missing node: protocol close #4367
2023-04-20 17:14:30 +02:00
import fs from "node:fs"
import path from "node:path"
Run prettier on the whole project
2022-12-27 15:37:40 +01:00
import { fileExists } from "./buildUtils.js"
import { sign } from "./installerSigner.js"
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
Fix signDesktopClients.js
2022-02-18 16:07:55 +01:00
console.log("Sign Desktop Clients")
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
signDesktopClients()
[build] Build better-sqlite3 on windows during Jenkins CI This commit not only sets up the build for windows on jenkins, it also consolidates how we get prebuilt binaries for native modules i.e. keytar and better-sqlite3 and generally has some refactorings
2022-03-02 18:21:01 +01:00
.then(() => process.exit())
[ci] Containerize Jenkins release This builds the client in a Debian 11 container to prevent conflicts with `glibc` versions. Co-authored-by: jat <jat@tutao.de>
2024-07-23 12:28:32 +02:00
.catch((error) => {
console.error(error)
process.exit(1)
})
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
[maintenance] remove node-forge dependency node-forge is a pure JS crypto library that was used during the build process to sign the clients and at runtime to verify the signature before downloading the updated client: * check the update manifest on the server, if the version is higher than installed: * get the sha512 digest and signature from the manifest and verify the signature (node-forge only requires the digest, not the data) if it matches: * download the update and let electron-updater do its thing with this change, we have to download the update first because node crypto requires the data to verify the signature (digest is calculated internally). In case the signature doesn't match, we delete the downloaded file and stop polling for updates for this run. forge was also used to get a private key for signing out of a self-signed cert in development environments. from now on, this is done by providing PEM encoded private and public keys. close #3832
2022-08-18 17:58:19 +02:00
if (process.env.DEBUG_SIGN) {
const certPath = path.join(process.env.DEBUG_SIGN, "test.p12")
const keyPath = path.join(process.env.DEBUG_SIGN, "test.key")
if (!fs.existsSync(certPath) && !fs.existsSync(keyPath)) {
console.error("ERROR:\nPlease make sure your DEBUG_SIGN test certificate authority is set up properly!\n\n")
process.exit(1)
}
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
}
async function signDesktopClients() {
Run prettier on the whole project
2022-12-27 15:37:40 +01:00
const MAC_ZIP_SIGNATURE_FILE = "mac-sig-zip.bin"
const MAC_DMG_SIGNATURE_FILE = "mac-sig-dmg.bin"
const WIN_SIGNATURE_FILE = "win-sig.bin"
const LINUX_SIGNATURE_FILE = "linux-sig.bin"
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
Run prettier on the whole project
2022-12-27 15:37:40 +01:00
const MAC_YML_FILE = "latest-mac.yml"
const WIN_YML_FILE = "latest.yml"
const LINUX_YML_FILE = "latest-linux.yml"
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
[maintenance] remove node-forge dependency node-forge is a pure JS crypto library that was used during the build process to sign the clients and at runtime to verify the signature before downloading the updated client: * check the update manifest on the server, if the version is higher than installed: * get the sha512 digest and signature from the manifest and verify the signature (node-forge only requires the digest, not the data) if it matches: * download the update and let electron-updater do its thing with this change, we have to download the update first because node crypto requires the data to verify the signature (digest is calculated internally). In case the signature doesn't match, we delete the downloaded file and stop polling for updates for this run. forge was also used to get a private key for signing out of a self-signed cert in development environments. from now on, this is done by providing PEM encoded private and public keys. close #3832
2022-08-18 17:58:19 +02:00
let filesSigned = 0
[build] fix signDesktopClients we now unconditionally do it when the script is called also we no longer consider the whole build failed if npm publish fails
2022-02-18 15:46:25 +01:00
const signIfExists = async (fileName, sigName, ymlName) => {
if (await fileExists(fileName)) {
console.log("signing", fileName)
[maintenance] remove node-forge dependency node-forge is a pure JS crypto library that was used during the build process to sign the clients and at runtime to verify the signature before downloading the updated client: * check the update manifest on the server, if the version is higher than installed: * get the sha512 digest and signature from the manifest and verify the signature (node-forge only requires the digest, not the data) if it matches: * download the update and let electron-updater do its thing with this change, we have to download the update first because node crypto requires the data to verify the signature (digest is calculated internally). In case the signature doesn't match, we delete the downloaded file and stop polling for updates for this run. forge was also used to get a private key for signing out of a self-signed cert in development environments. from now on, this is done by providing PEM encoded private and public keys. close #3832
2022-08-18 17:58:19 +02:00
await sign(fileName, sigName, ymlName)
filesSigned = filesSigned + 1
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
}
[build] fix signDesktopClients we now unconditionally do it when the script is called also we no longer consider the whole build failed if npm publish fails
2022-02-18 15:46:25 +01:00
}
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
Run prettier on the whole project
2022-12-27 15:37:40 +01:00
await signIfExists("./build/desktop/tutanota-desktop-mac.zip", MAC_ZIP_SIGNATURE_FILE, MAC_YML_FILE)
await signIfExists("./build/desktop/tutanota-desktop-mac.dmg", MAC_DMG_SIGNATURE_FILE, null)
await signIfExists("./build/desktop/tutanota-desktop-win.exe", WIN_SIGNATURE_FILE, WIN_YML_FILE)
await signIfExists("./build/desktop/tutanota-desktop-linux.AppImage", LINUX_SIGNATURE_FILE, LINUX_YML_FILE)
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
Run prettier on the whole project
2022-12-27 15:37:40 +01:00
await signIfExists("./build/desktop-test/tutanota-desktop-test-mac.zip", MAC_ZIP_SIGNATURE_FILE, MAC_YML_FILE)
await signIfExists("./build/desktop-test/tutanota-desktop-test-mac.dmg", MAC_DMG_SIGNATURE_FILE, null)
await signIfExists("./build/desktop-test/tutanota-desktop-test-win.exe", WIN_SIGNATURE_FILE, WIN_YML_FILE)
await signIfExists("./build/desktop-test/tutanota-desktop-test-linux.AppImage", LINUX_SIGNATURE_FILE, LINUX_YML_FILE)
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
Run prettier on the whole project
2022-12-27 15:37:40 +01:00
await signIfExists("./build/desktop-snapshot/tutanota-desktop-snapshot-mac.zip", MAC_ZIP_SIGNATURE_FILE, MAC_YML_FILE)
await signIfExists("./build/desktop-snapshot/tutanota-desktop-snapshot-mac.dmg", MAC_DMG_SIGNATURE_FILE, null)
await signIfExists("./build/desktop-snapshot/tutanota-desktop-snapshot-win.exe", WIN_SIGNATURE_FILE, WIN_YML_FILE)
await signIfExists("./build/desktop-snapshot/tutanota-desktop-snapshot-linux.AppImage", LINUX_SIGNATURE_FILE, LINUX_YML_FILE)
[maintenance] remove node-forge dependency node-forge is a pure JS crypto library that was used during the build process to sign the clients and at runtime to verify the signature before downloading the updated client: * check the update manifest on the server, if the version is higher than installed: * get the sha512 digest and signature from the manifest and verify the signature (node-forge only requires the digest, not the data) if it matches: * download the update and let electron-updater do its thing with this change, we have to download the update first because node crypto requires the data to verify the signature (digest is calculated internally). In case the signature doesn't match, we delete the downloaded file and stop polling for updates for this run. forge was also used to get a private key for signing out of a self-signed cert in development environments. from now on, this is done by providing PEM encoded private and public keys. close #3832
2022-08-18 17:58:19 +02:00
if (filesSigned === 0) {
console.log("Error: no files were signed!")
process.exit(1)
} else {
console.log(`Signed ${filesSigned} files!`)
}
Refactor dist.js #3221 Split dist.js (desktop.js, webapp.js) Simplify command line interface for dist builds Extract utilities used from dist builds Extract fetching and publishing dictionaries into its own build step Extract signing installers into its own build step Extract .deb packaging and publishing into its own build step Add some documentation, verbosity and general improvements to the code
2022-02-14 10:19:20 +01:00
}
Reference in a new issue Copy permalink