scripts: Fix PE checksum for Windows releases

This should help with virus scanner false positives.

See pyinstaller/pyinstaller#5579
Fixes #6081
Fixes #6194

(cherry picked from commit 2b91081)

scripts/dev/build_release.py

@@ -143,6 +143,23 @@ def smoke_test(executable):
         raise Exception("Unexpected stderr:\n{}".format(stderr))
 
 
+def patch_windows_exe(exe_path):
+    """Make sure the Windows .exe has a correct checksum.
+
+    WORKAROUND for https://github.com/pyinstaller/pyinstaller/issues/5579
+    """
+    import pefile
+    pe = pefile.PE(exe_path)
+
+    # If this fails, a PyInstaller upgrade fixed things, and we can remove the
+    # workaround. Would be a good idea to keep the check, though.
+    assert not pe.verify_checksum()
+
+    pe.OPTIONAL_HEADER.CheckSum = pe.generate_checksum()
+    pe.close()
+    pe.write(exe_path)
+
+
 def patch_mac_app():
     """Patch .app to use our Info.plist and save some space."""
     app_path = os.path.join('dist', 'qutebrowser.app')
@@ -279,9 +296,13 @@ def _build_windows_single(*, x64, skip_packaging):
 
     out_pyinstaller = os.path.join('dist', 'qutebrowser')
     shutil.move(out_pyinstaller, outdir)
+    exe_path = os.path.join(outdir, 'qutebrowser.exe')
+
+    utils.print_title(f"Patching {human_arch} exe")
+    patch_windows_exe(exe_path)
 
     utils.print_title(f"Running {human_arch} smoke test")
-    smoke_test(os.path.join(outdir, 'qutebrowser.exe'))
+    smoke_test(exe_path)
 
     if skip_packaging:
         return []