Migrate to Logitech code signing infrastructure

electron-builder/afterPack.js

@@ -1,6 +1,7 @@
 const cp = require('child_process');
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 
 function signAndCheck(identity, filePath) {
   console.log(`Signing: ${filePath}`);
@@ -50,9 +51,7 @@
   }
 }
 
-exports.default = async function(context) {
-  if (process.platform !== 'darwin') return;
-
+function afterPackMac() {
   console.log('Updating dependency paths');
   cp.execSync(
     `install_name_tool -change ./node_modules/node-libuiohook/libuiohook.1.dylib @executable_path/../Resources/app.asar.unpacked/node_modules/node-libuiohook/libuiohook.1.dylib \"${context.appOutDir}/${context.packager.appInfo.productName}.app/Contents/Resources/app.asar.unpacked/node_modules/node-libuiohook/node_libuiohook.node\"`,
@@ -72,4 +71,22 @@
     context.packager.config.mac.identity,
     `${context.appOutDir}/${context.packager.appInfo.productName}.app/Contents/Resources/app.asar.unpacked`,
   );
+}
+
+function afterPackWin() {
+  if (process.env.SLOBS_NO_SIGN) return;
+
+  // Ensure an empty signing manifest file
+  const signingPath = path.join(os.tmpdir(), 'sldesktopsigning');
+  fs.writeFileSync(signingPath, '', { flag: 'w' });
+}
+
+exports.default = async function(context) {
+  if (process.platform === 'darwin') {
+    afterPackMac();
+  }
+
+  if (process.platform === 'win32') {
+    afterPackWin();
+  }
 };

electron-builder/notarize.js → electron-builder/afterSign.js

@@ -1,7 +1,10 @@
 const { notarize } = require('@electron/notarize');
 const fs = require('fs');
+const cp = require('child_process');
+const path = require('path');
+const os = require('os');
 
-exports.default = async function notarizing(context) {
+async function notarizeMac() {
   if (process.env.SLOBS_NO_NOTARIZE) return;
   if (process.platform !== 'darwin') return;
 
@@ -25,4 +28,27 @@ exports.default = async function notarizing(context) {
   });
 
   console.log('Notarization finished.');
+}
+
+async function afterPackWin() {
+  if (process.env.SLOBS_NO_SIGN) return;
+
+  const signingPath = path.join(os.tmpdir(), 'sldesktopsigning');
+
+  if (fs.existsSync(signingPath)) {
+    cp.execSync(`logisign client --client logitech-cpg-sign-client --app streamlabs --filelist ${signingPath}`, { stdio: 'inherit' });
+    fs.unlinkSync(signingPath);
+  } else {
+    throw new Error('EXPECTED TO SIGN BINARIES BUT SIGNING MANIFEST IS MISSING');
+  }
+}
+
+exports.default = async function afterSign(context) {
+  if (process.platform === 'darwin') {
+    await notarizeMac();
+  }
+
+  if (process.platform === 'win32') {
+    await afterPackWin();
+  }
 };

electron-builder/base.config.js

@@ -1,4 +1,8 @@
 const signtool = require('signtool');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const cp = require('child_process');
 
 const base = {
   appId: 'com.streamlabs.slobs',
@@ -41,6 +45,7 @@
     rfc3161TimeStampServer: 'http://timestamp.digicert.com',
     timeStampServer: 'http://timestamp.digicert.com',
     signDlls: true,
+    signingHashAlgorithms: ['sha256'],
     async sign(config) {
       if (process.env.SLOBS_NO_SIGN) return;
 
@@ -52,14 +57,14 @@
       }
 
       console.log(`Signing ${config.hash} ${config.path}`);
-      await signtool.sign(config.path, {
-        subject: 'Streamlabs (General Workings, Inc.)',
-        rfcTimestamp: 'http://timestamp.digicert.com',
-        algorithm: config.hash,
-        append: config.isNest,
-        description: config.name,
-        url: config.site,
-      });
+
+      const signingPath = path.join(os.tmpdir(), 'sldesktopsigning');
+
+      if (fs.existsSync(signingPath)) {
+        fs.appendFileSync(signingPath, `${config.path}\n`);
+      } else {
+        cp.execSync(`logisign client --client logitech-cpg-sign-client --app streamlabs --files "${config.path}"`, { stdio: 'inherit' });
+      }
     },
   },
   mac: {
@@ -117,7 +122,7 @@
   },
   beforePack: './electron-builder/beforePack.js',
   afterPack: './electron-builder/afterPack.js',
-  afterSign: './electron-builder/notarize.js',
+  afterSign: './electron-builder/afterSign.js',
 };
 
 module.exports = base;