winPackager.ts

import BluebirdPromise from "bluebird-lst"
import { Arch, asArray, InvalidConfigurationError, log, use, executeAppBuilder } from "builder-util"
import { parseDn } from "builder-util-runtime"
import { CopyFileTransformer, FileTransformer, walk } from "builder-util/out/fs"
import { createHash } from "crypto"
import { readdir } from "fs/promises"
import * as isCI from "is-ci"
import { Lazy } from "lazy-val"
import * as path from "path"
import { importCertificate } from "./codeSign/codesign"
import {
  CertificateFromStoreInfo,
  CertificateInfo,
  FileCodeSigningInfo,
  getCertificateFromStoreInfo,
  getCertInfo,
  getSignVendorPath,
  sign,
  WindowsSignOptions,
} from "./codeSign/windowsCodeSign"
import { AfterPackContext } from "./configuration"
import { DIR_TARGET, Platform, Target } from "./core"
import { RequestedExecutionLevel, WindowsConfiguration } from "./options/winOptions"
import { Packager } from "./packager"
import { chooseNotNull, PlatformPackager } from "./platformPackager"
import AppXTarget from "./targets/AppxTarget"
import { NsisTarget } from "./targets/nsis/NsisTarget"
import { AppPackageHelper, CopyElevateHelper } from "./targets/nsis/nsisUtil"
import { WebInstallerTarget } from "./targets/nsis/WebInstallerTarget"
import { createCommonTarget } from "./targets/targetFactory"
import { BuildCacheManager, digest } from "./util/cacheManager"
import { isBuildCacheEnabled } from "./util/flags"
import { time } from "./util/timer"
import { getWindowsVm, VmManager } from "./vm/vm"
import { execWine } from "./wine"

export class WinPackager extends PlatformPackager<WindowsConfiguration> {
  readonly cscInfo = new Lazy<FileCodeSigningInfo | CertificateFromStoreInfo | null>(() => {
    const platformSpecificBuildOptions = this.platformSpecificBuildOptions
    if (platformSpecificBuildOptions.certificateSubjectName != null || platformSpecificBuildOptions.certificateSha1 != null) {
      return this.vm.value
        .then(vm => getCertificateFromStoreInfo(platformSpecificBuildOptions, vm))
        .catch(e => {
          // https://github.com/electron-userland/electron-builder/pull/2397
          if (platformSpecificBuildOptions.sign == null) {
            throw e
          } else {
            log.debug({ error: e }, "getCertificateFromStoreInfo error")
            return null
          }
        })
    }

    const certificateFile = platformSpecificBuildOptions.certificateFile
    if (certificateFile != null) {
      const certificatePassword = this.getCscPassword()
      return Promise.resolve({
        file: certificateFile,
        password: certificatePassword == null ? null : certificatePassword.trim(),
      })
    }

    const cscLink = this.getCscLink("WIN_CSC_LINK")
    if (cscLink == null) {
      return Promise.resolve(null)
    }

    return (
      importCertificate(cscLink, this.info.tempDirManager, this.projectDir)
        // before then
        .catch(e => {
          if (e instanceof InvalidConfigurationError) {
            throw new InvalidConfigurationError(`Env WIN_CSC_LINK is not correct, cannot resolve: ${e.message}`)
          } else {
            throw e
          }
        })
        .then(path => {
          return {
            file: path,
            password: this.getCscPassword(),
          }
        })
    )
  })

  private _iconPath = new Lazy(() => this.getOrConvertIcon("ico"))

  readonly vm = new Lazy<VmManager>(() => (process.platform === "win32" ? Promise.resolve(new VmManager()) : getWindowsVm(this.debugLogger)))

  readonly computedPublisherName = new Lazy<Array<string> | null>(async () => {
    const publisherName = this.platformSpecificBuildOptions.publisherName
    if (publisherName === null) {
      return null
    } else if (publisherName != null) {
      return asArray(publisherName)
    }

    const certInfo = await this.lazyCertInfo.value
    return certInfo == null ? null : [certInfo.commonName]
  })

  readonly lazyCertInfo = new Lazy<CertificateInfo | null>(async () => {
    const cscInfo = await this.cscInfo.value
    if (cscInfo == null) {
      return null
    }

    if ("subject" in cscInfo) {
      const bloodyMicrosoftSubjectDn = cscInfo.subject
      return {
        commonName: parseDn(bloodyMicrosoftSubjectDn).get("CN")!,
        bloodyMicrosoftSubjectDn,
      }
    }

    const cscFile = cscInfo.file
    if (cscFile == null) {
      return null
    }
    return await getCertInfo(cscFile, cscInfo.password || "")
  })

  get isForceCodeSigningVerification(): boolean {
    return this.platformSpecificBuildOptions.verifyUpdateCodeSignature !== false
  }

  constructor(info: Packager) {
    super(info, Platform.WINDOWS)
  }

  get defaultTarget(): Array<string> {
    return ["nsis"]
  }

  protected doGetCscPassword(): string | undefined | null {
    return chooseNotNull(chooseNotNull(this.platformSpecificBuildOptions.certificatePassword, process.env.WIN_CSC_KEY_PASSWORD), super.doGetCscPassword())
  }

  createTargets(targets: Array<string>, mapper: (name: string, factory: (outDir: string) => Target) => void): void {
    let copyElevateHelper: CopyElevateHelper | null
    const getCopyElevateHelper = () => {
      if (copyElevateHelper == null) {
        copyElevateHelper = new CopyElevateHelper()
      }
      return copyElevateHelper
    }

    let helper: AppPackageHelper | null
    const getHelper = () => {
      if (helper == null) {
        helper = new AppPackageHelper(getCopyElevateHelper())
      }
      return helper
    }

    for (const name of targets) {
      if (name === DIR_TARGET) {
        continue
      }

      if (name === "nsis" || name === "portable") {
        mapper(name, outDir => new NsisTarget(this, outDir, name, getHelper()))
      } else if (name === "nsis-web") {
        // package file format differs from nsis target
        mapper(name, outDir => new WebInstallerTarget(this, path.join(outDir, name), name, new AppPackageHelper(getCopyElevateHelper())))
      } else {
        const targetClass: typeof NsisTarget | typeof AppXTarget | null = (() => {
          switch (name) {
            case "squirrel":
              try {
                return require("electron-builder-squirrel-windows").default
              } catch (e) {
                throw new InvalidConfigurationError(`Module electron-builder-squirrel-windows must be installed in addition to build Squirrel.Windows: ${e.stack || e}`)
              }

            case "appx":
              return require("./targets/AppxTarget").default

            case "msi":
              return require("./targets/MsiTarget").default

            default:
              return null
          }
        })()

        mapper(name, outDir => (targetClass === null ? createCommonTarget(name, outDir, this) : new (targetClass as any)(this, outDir, name)))
      }
    }
  }

  getIconPath() {
    return this._iconPath.value
  }

  async sign(file: string, logMessagePrefix?: string): Promise<void> {
    const signOptions: WindowsSignOptions = {
      path: file,
      name: this.appInfo.productName,
      site: await this.appInfo.computePackageUrl(),
      options: this.platformSpecificBuildOptions,
    }

    const cscInfo = await this.cscInfo.value
    if (cscInfo == null) {
      if (this.platformSpecificBuildOptions.sign != null) {
        await sign(signOptions, this)
      } else if (this.forceCodeSigning) {
        throw new InvalidConfigurationError(
          `App is not signed and "forceCodeSigning" is set to true, please ensure that code signing configuration is correct, please see https://electron.build/code-signing`
        )
      }
      return
    }

    if (logMessagePrefix == null) {
      logMessagePrefix = "signing"
    }

    if ("file" in cscInfo) {
      log.info(
        {
          file: log.filePath(file),
          certificateFile: cscInfo.file,
        },
        logMessagePrefix
      )
    } else {
      const info = cscInfo
      log.info(
        {
          file: log.filePath(file),
          subject: info.subject,
          thumbprint: info.thumbprint,
          store: info.store,
          user: info.isLocalMachineStore ? "local machine" : "current user",
        },
        logMessagePrefix
      )
    }

    await this.doSign({
      ...signOptions,
      cscInfo,
      options: {
        ...this.platformSpecificBuildOptions,
      },
    })
  }

  private async doSign(options: WindowsSignOptions) {
    for (let i = 0; i < 3; i++) {
      try {
        await sign(options, this)
        break
      } catch (e) {
        // https://github.com/electron-userland/electron-builder/issues/1414
        const message = e.message
        if (message != null && message.includes("Couldn't resolve host name")) {
          log.warn({ error: message, attempt: i + 1 }, `cannot sign`)
          continue
        }
        throw e
      }
    }
  }

  async signAndEditResources(file: string, arch: Arch, outDir: string, internalName?: string | null, requestedExecutionLevel?: RequestedExecutionLevel | null) {
    const appInfo = this.appInfo

    const files: Array<string> = []

    const args = [
      file,
      "--set-version-string",
      "FileDescription",
      appInfo.productName,
      "--set-version-string",
      "ProductName",
      appInfo.productName,
      "--set-version-string",
      "LegalCopyright",
      appInfo.copyright,
      "--set-file-version",
      appInfo.shortVersion || appInfo.buildVersion,
      "--set-product-version",
      appInfo.shortVersionWindows || appInfo.getVersionInWeirdWindowsForm(),
    ]

    if (internalName != null) {
      args.push("--set-version-string", "InternalName", internalName, "--set-version-string", "OriginalFilename", "")
    }

    if (requestedExecutionLevel != null && requestedExecutionLevel !== "asInvoker") {
      args.push("--set-requested-execution-level", requestedExecutionLevel)
    }

    use(appInfo.companyName, it => args.push("--set-version-string", "CompanyName", it))
    use(this.platformSpecificBuildOptions.legalTrademarks, it => args.push("--set-version-string", "LegalTrademarks", it))
    const iconPath = await this.getIconPath()
    use(iconPath, it => {
      files.push(it)
      args.push("--set-icon", it)
    })

    const config = this.config
    const cscInfoForCacheDigest = !isBuildCacheEnabled() || isCI || config.electronDist != null ? null : await this.cscInfo.value
    let buildCacheManager: BuildCacheManager | null = null
    // resources editing doesn't change executable for the same input and executed quickly - no need to complicate
    if (cscInfoForCacheDigest != null) {
      const cscFile = (cscInfoForCacheDigest as FileCodeSigningInfo).file
      if (cscFile != null) {
        files.push(cscFile)
      }

      const timer = time("executable cache")
      const hash = createHash("sha512")
      hash.update(config.electronVersion || "no electronVersion")
      hash.update(JSON.stringify(this.platformSpecificBuildOptions))
      hash.update(JSON.stringify(args))
      hash.update(this.platformSpecificBuildOptions.certificateSha1 || "no certificateSha1")
      hash.update(this.platformSpecificBuildOptions.certificateSubjectName || "no subjectName")

      buildCacheManager = new BuildCacheManager(outDir, file, arch)
      if (await buildCacheManager.copyIfValid(await digest(hash, files))) {
        timer.end()
        return
      }
      timer.end()
    }

    const timer = time("wine&sign")
    // rcedit crashed of executed using wine, resourcehacker works
    if (process.platform === "win32" || process.platform === "darwin") {
      await executeAppBuilder(["rcedit", "--args", JSON.stringify(args)], undefined /* child-process */, {}, 3 /* retry three times */)
    } else if (this.info.framework.name === "electron") {
      const vendorPath = await getSignVendorPath()
      await execWine(path.join(vendorPath, "rcedit-ia32.exe"), path.join(vendorPath, "rcedit-x64.exe"), args)
    }

    await this.sign(file)
    timer.end()

    if (buildCacheManager != null) {
      await buildCacheManager.save()
    }
  }

  private isSignDlls(): boolean {
    return this.platformSpecificBuildOptions.signDlls === true
  }

  protected createTransformerForExtraFiles(packContext: AfterPackContext): FileTransformer | null {
    if (this.platformSpecificBuildOptions.signAndEditExecutable === false) {
      return null
    }

    return file => {
      if (file.endsWith(".exe") || (this.isSignDlls() && file.endsWith(".dll"))) {
        const parentDir = path.dirname(file)
        if (parentDir !== packContext.appOutDir) {
          return new CopyFileTransformer(file => this.sign(file))
        }
      }
      return null
    }
  }

  protected async signApp(packContext: AfterPackContext, isAsar: boolean): Promise<any> {
    const exeFileName = `${this.appInfo.productFilename}.exe`
    if (this.platformSpecificBuildOptions.signAndEditExecutable === false) {
      return
    }

    await BluebirdPromise.map(readdir(packContext.appOutDir), (file: string): any => {
      if (file === exeFileName) {
        return this.signAndEditResources(
          path.join(packContext.appOutDir, exeFileName),
          packContext.arch,
          packContext.outDir,
          path.basename(exeFileName, ".exe"),
          this.platformSpecificBuildOptions.requestedExecutionLevel
        )
      } else if (file.endsWith(".exe") || (this.isSignDlls() && file.endsWith(".dll"))) {
        return this.sign(path.join(packContext.appOutDir, file))
      }
      return null
    })

    if (!isAsar) {
      return
    }

    const signPromise = (filepath: string[]) => {
      const outDir = path.join(packContext.appOutDir, ...filepath)
      return walk(outDir, (file, stat) => stat.isDirectory() || file.endsWith(".exe") || (this.isSignDlls() && file.endsWith(".dll")))
    }
    const filesToSign = await Promise.all([signPromise(["resources", "app.asar.unpacked"]), signPromise(["swiftshader"])])
    await BluebirdPromise.map(filesToSign.flat(1), file => this.sign(file), { concurrency: 4 })
  }
}