Ricardo | added support to Microsoft Trusted Signing to sign stub .exe before MSI

src/creator.ts

@@ -14,7 +14,7 @@ import { Component,
          StringMap } from './interfaces';
 import { addFilesToTree, arrayToTree } from './utils/array-to-tree';
 import { hasCandle, hasLight } from './utils/detect-wix';
-import { createStubExe } from './utils/rc-edit';
+import { createStubExe, getAzureTrustedSigningOptions } from './utils/rc-edit';
 import { replaceInString, replaceToFile } from './utils/replace';
 import { createInstallInfoFile, getWindowsCompliantVersion } from './utils/version-util';
 import { getDirectoryStructure } from './utils/walker';
@@ -250,6 +250,7 @@ export class MSICreator {
     }
 
     const { wixobjFile } = await this.createWixobj();
+    await this.SignExe();
     const { msiFile } = await this.createMsi();
     await this.signMSI(msiFile);
 
@@ -311,7 +312,7 @@ export class MSICreator {
       '{{Version}}': this.windowsCompliantVersion,
       '{{SemanticVersion}}': this.semanticVersion,
       '{{Platform}}': this.arch,
-      '{{ProgramFilesFolder}}': this.arch === 'x86' ? 'ProgramFilesFolder' : 'ProgramFiles64Folder',
+      '{{ProgramFilesFolder}}':'WindowsVolume',
       '{{ProcessorArchitecture}}' : this.arch,
       '{{Win64YesNo}}' : this.arch === 'x86' ? 'no' : 'yes',
       '{{DesktopShortcutGuid}}': uuid(),
@@ -331,6 +332,35 @@ export class MSICreator {
     return { wxsFile: target, wxsContent: output };
   }
 
+  public async SignExe(): Promise<void> {
+    const signToolPath = 'C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22621.0\\x64\\signtool.exe';
+    const exePath = path.join(this.outputDirectory, `${this.exe}.exe`);
+    const azureOptions = getAzureTrustedSigningOptions();
+    const targets: Array<string> = [];
+
+    if (fs.existsSync(exePath)) {
+      targets.push(exePath);
+    }
+    const specialExe = (this as any).specialFiles?.find((f: any) =>
+      f && f.name && f.name.toLowerCase() === `${this.exe.toLowerCase()}.exe`);
+    if (specialExe && specialExe.path && fs.existsSync(specialExe.path)) {
+      targets.push(specialExe.path);
+    }
+    if (targets.length === 0) {
+      return;
+    }
+    for (const target of targets) {
+      //console.log(`electron-wix-msi: Assinando EXE com Microsoft Trusted Signing: ${target}`);
+      const { code, stderr, stdout } = await spawnPromise(signToolPath, ['sign', ...azureOptions, target], {
+        env: process.env
+      });
+      if (code !== 0) {
+        throw new Error(`Signtool (EXE) saiu com código ${code}. Stderr: ${stderr}. Stdout: ${stdout}`);
+      }
+      //console.log(`electron-wix-msi: Assinatura do EXE concluída com sucesso: ${target}`);
+    }
+  }
+
   /**
    * Creates a wixobj file.
    *
@@ -678,6 +708,14 @@ export class MSICreator {
       this.windowsCompliantVersion,
       this.icon);
 
+    try {
+      const outExePath = path.join(this.outputDirectory, `${this.exe}.exe`);
+      await fs.ensureDir(this.outputDirectory);
+      await fs.copyFile(stubExe, outExePath);
+    } catch (copyErr: any) {
+      console.warn(`electron-wix-msi: Não foi possível copiar o StubExecutable para outputDirectory para assinatura: ${copyErr}`);
+    }
+
     const installInfoFile = createInstallInfoFile(this.manufacturer,
                                                   this.shortName,
                                                   this.productCode,

src/utils/rc-edit.ts

@@ -4,6 +4,12 @@ import * as rcedit from 'rcedit';
 import * as rcinfo from 'rcinfo';
 import { getTempFilePath } from './fs-helper';
 
+export function getAzureTrustedSigningOptions(): Array<string> {
+  const userProfile = process.env.USERPROFILE || '';
+  const dlib = path.join(userProfile, 'AppData\\Local\\Microsoft\\MicrosoftTrustedSigningClientTools\\Azure.CodeSigning.Dlib.dll');
+  const metadataFile = 'Codesign\\metadata.json';
+  return ['/v', '/debug', '/fd', 'SHA256', '/tr', 'http://timestamp.acs.microsoft.com', '/td', 'SHA256', '/dlib', dlib, '/dmdf', metadataFile];
+}
 
 interface RcInfo {
   'version-string': {

static/wix.xml

@@ -67,6 +67,16 @@
                       Name="InstallPath"
                       Win64="{{Win64YesNo}}"/>
     </Property>
+
+    <!-- Cache do app em %APPDATA%  -->
+    <Property Id="APPDATAPATH">
+      <RegistrySearch Key="SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{{{ProductCode}}}.msq"
+                      Root="HKCU" 
+                      Type="raw"
+                      Id="AppDataPathRegSearch"
+                      Name="CachePath"/>
+    </Property>
+
     <!-- Lets change the product name depending on the perUser installMode. 
     This way the user and admins can see in which scope the MSI was installed. -->
     <SetProperty Action="SetVisibleProductName" Id="VisibleProductName" Sequence="both" Before="AppSearch"  Value="{{ApplicationName}} (User)">
@@ -96,6 +106,13 @@
       <Directory Id="ProgramMenuFolder">
         <Directory Id="ApplicationProgramsFolder" Name="{{ShortcutFolderName}}"/>
       </Directory>
+
+      <!-- Remover ApData Cache/Dados do usuario do %APPDATA% -->
+      <Component Id="AppDataUninstall">
+         <RegistryValue Root="HKCU" Key="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{{{ProductCode}}}.msq" Name="CachePath" Type="string" Value="[AppDataFolder]{{ApplicationShortName}}" KeyPath="yes" />
+        <util:RemoveFolderEx On="uninstall" Property="APPDATAPATH"/>
+      </Component>
+
     </Directory>
 
     <!-- Step 3: Add app to Start Menu -->
@@ -145,6 +162,7 @@
         <util:RemoveFolderEx On="uninstall" Property="INSTALLPATH" />
       </Component>
     </DirectoryRef>
+
 
     <Feature Id="Complete" Title="{{ApplicationName}} ({{SemanticVersion}})" Description="The complete package." Display="expand" Level="1" {{ConfigurableDirectory}}>
       <!-- Step 5: Tell WiX to install the files -->
@@ -153,6 +171,7 @@
         <ComponentRef Id="ApplicationShortcut" />
         <ComponentRef Id="DesktopShortcut" />
         <ComponentRef Id="PurgeOnUninstall" />
+        <ComponentRef Id="AppDataUninstall" />
       </Feature> 
 <!-- {{AutoLaunchFeature}} -->
 <!-- {{AutoUpdateFeature}} -->