fix: windows certificate signing issues (#3175)

* fix: windows certificate signing issues

* fix: add has_ui option and phys/cloud opts

cmake/recipes_bootstrap.cmake

@@ -1,5 +1,6 @@
 find_program(CONAN_COMMAND "conan" REQUIRED
     HINTS
+		"${CMAKE_SOURCE_DIR}/.venv/Scripts"
         "${CMAKE_SOURCE_DIR}/.venv/bin"
         "/opt/homebrew/bin"
 )

cmake/sign_binaries.cmake

@@ -1,6 +1,9 @@
 if(NOT DEFINED SIGNTOOL_SUBJECT_NAME)
     set(SIGNTOOL_SUBJECT_NAME "$ENV{SIGNTOOL_SUBJECT_NAME}")
 endif()
+if(NOT DEFINED SIGNTOOL_CERT_HAS_UI)
+    set(SIGNTOOL_CERT_HAS_UI "$ENV{SIGNTOOL_CERT_HAS_UI}")
+endif()
 if(NOT DEFINED CODESIGN_SIGNATURE)
     set(CODESIGN_SIGNATURE "$ENV{CODESIGN_SIGNATURE}")
 endif()
@@ -9,14 +12,11 @@ if(NOT DEFINED CODESIGN_KEYCHAIN)
 endif()
 
 if(WIN32)
-    file(GLOB_RECURSE BINARIES
+	set(AMNEZIA_PACKAGE_DIR "${CPACK_TEMPORARY_DIRECTORY}/packages/AmneziaVPN/data")
-        "${CPACK_TEMPORARY_DIRECTORY}/*.dll"
+    if(SIGNTOOL_SUBJECT_NAME)
-        "${CPACK_TEMPORARY_DIRECTORY}/*.exe"
-    )
-
-    if(BINARIES AND SIGNTOOL_SUBJECT_NAME)
         include(${CMAKE_CURRENT_LIST_DIR}/util/signtool.cmake)
-        signtool_sign_files("${BINARIES}" "${SIGNTOOL_SUBJECT_NAME}")
+        signtool_sign_files("${AMNEZIA_PACKAGE_DIR}/*.exe" "${SIGNTOOL_SUBJECT_NAME}" "${SIGNTOOL_CERT_HAS_UI}")
+		signtool_sign_files("${AMNEZIA_PACKAGE_DIR}/*.dll" "${SIGNTOOL_SUBJECT_NAME}" "${SIGNTOOL_CERT_HAS_UI}")
     endif()
 endif()
 

cmake/sign_packages.cmake

@@ -1,6 +1,9 @@
 if(NOT DEFINED SIGNTOOL_SUBJECT_NAME)
     set(SIGNTOOL_SUBJECT_NAME "$ENV{SIGNTOOL_SUBJECT_NAME}")
 endif()
+if(NOT DEFINED SIGNTOOL_CERT_HAS_UI)
+    set(SIGNTOOL_CERT_HAS_UI "$ENV{SIGNTOOL_CERT_HAS_UI}")
+endif()
 if(NOT DEFINED NOTARYTOOL_EMAIL)
     set(NOTARYTOOL_EMAIL "$ENV{NOTARYTOOL_EMAIL}")
 endif()
@@ -15,7 +18,7 @@ if(WIN32)
     if (SIGNTOOL_SUBJECT_NAME)
         include(${CMAKE_CURRENT_LIST_DIR}/util/signtool.cmake)
         foreach(PACKAGE_FILE IN LISTS CPACK_PACKAGE_FILES)
-            signtool_sign_files("${PACKAGE_FILE}" "${SIGNTOOL_SUBJECT_NAME}")
+            signtool_sign_files("${PACKAGE_FILE}" "${SIGNTOOL_SUBJECT_NAME}" "${SIGNTOOL_CERT_HAS_UI}")
         endforeach()
     endif()
 endif()

cmake/util/signtool.cmake

@@ -1,10 +1,6 @@
 find_program(SIGNTOOL_COMMAND signtool REQUIRED)
 
-function(signtool_sign_files PACKAGE_FILES SUBJECT_NAME)
+function(signtool_sign_files PACKAGE_FILES SUBJECT_NAME CERT_HAS_UI)
-    if(NOT SUBJECT_NAME)
-        set(SUBJECT_NAME "Privacy Technologies OU")
-    endif()
-
     if(PACKAGE_FILES)
         set(args sign
             /n ${SUBJECT_NAME}
@@ -13,17 +9,24 @@ function(signtool_sign_files PACKAGE_FILES SUBJECT_NAME)
             /tr http://timestamp.comodoca.com/?td=sha256
         )
 
-        foreach(file IN LISTS PACKAGE_FILES)
+		if (NOT "${PACKAGE_FILES}" MATCHES "\\.msi$")
-            set(local_args ${args})
+			list(APPEND args /as)
-            if (NOT "${file}" MATCHES "\\.msi$")
-                list(APPEND local_args /as)
 		endif()
 
-            set(cmd ${SIGNTOOL_COMMAND} ${local_args} ${file})
+		set(cmd ${SIGNTOOL_COMMAND} ${args} ${PACKAGE_FILES})
 
 		list(JOIN cmd " " cmd_str)
 		message(STATUS "${cmd_str}")
 
+		if (CERT_HAS_UI)
+			execute_process(
+				COMMAND cmd /c start "" /wait ${cmd}
+				RESULT_VARIABLE result
+			)
+			if(NOT result EQUAL 0)
+				message(FATAL_ERROR "signtool failed with code ${result}")
+			endif()
+		else()
 			execute_process(
                 COMMAND ${cmd}
                 RESULT_VARIABLE result
@@ -33,6 +36,6 @@ function(signtool_sign_files PACKAGE_FILES SUBJECT_NAME)
 				string(REPLACE "\n" "\n  " error "  ${error}")
 				message(FATAL_ERROR "signtool failed:\n${error}")
 			endif()
-        endforeach()
+		endif()
     endif()
 endfunction()

deploy/build.bat

@@ -10,6 +10,8 @@ if /i "%~1" == "-i"             set "ARG_BUILD_INSTALLERS=!ARG_BUILD_INSTALLERS!
 if /i "%~1" == "--installer"    set "ARG_BUILD_INSTALLERS=!ARG_BUILD_INSTALLERS! %~2" & shift
 if /i "%~1" == "-arch"          set "ARCH=%~2" & shift
 if /i "%~1" == "--architecture" set "ARCH=%~2" & shift
+if /i "%~1" == "--sign-cloud"   set "SIGNTOOL_SUBJECT_NAME=%~2" & shift
+if /i "%~1" == "--sign-phys"    set "SIGNTOOL_SUBJECT_NAME=%~2" & set "SIGNTOOL_CERT_HAS_UI=true" & shift
 shift
 goto :parse_args
 :done_args