Hardened signing with Developer ID (#1331)

IB-8451

Signed-off-by: Raul Metsma <[email protected]>

Author: metsma

.github/workflows/build.yml

@@ -29,7 +29,7 @@ jobs:
       env:
         HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: YES
       run: |
-        brew install ninja flatbuffers
+        brew install flatbuffers
         HASH=($(shasum prepare_osx_build_environment.sh))
         curl -O -L -s https://installer.id.ee/media/github/opensc_0.23.0.pkg
         curl -O -L -s https://installer.id.ee/media/github/${HASH}.zip
@@ -100,16 +100,8 @@ jobs:
     container: fedora:${{ matrix.container }}
     strategy:
       matrix:
-        container: [40, 41, 42]
+        container: [41, 42]
     steps:
-    - name: Install Deps
-      run: |
-        dnf install -y --setopt=install_weak_deps=False \
-        git gcc-c++ cmake rpm-build gettext openssl-devel openldap-devel pcsc-lite-devel qt6-qtsvg-devel qt6-qttools-devel flatbuffers-devel flatbuffers-compiler zlib-devel
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        submodules: recursive
     - name: Download artifact
       uses: dawidd6/action-download-artifact@v6
       with:
@@ -118,8 +110,12 @@ jobs:
         name: fedora_${{ matrix.container }}
         path: libdigidocpp-pkg
         repo: open-eid/libdigidocpp
-    - name: Install artifact
-      run: dnf install -y ./libdigidocpp-pkg/*.rpm
+    - name: Install Deps
+      run: dnf install -y ./libdigidocpp-pkg/*.rpm git gcc-c++ cmake rpm-build gettext openssl-devel openldap-devel pcsc-lite-devel qt6-qtsvg-devel qt6-qttools-devel flatbuffers-devel flatbuffers-compiler zlib-devel
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
     - name: Build
       run: |
         cmake -DCMAKE_INSTALL_PREFIX=/usr -B build -S .

client/CMakeLists.txt

@@ -200,7 +200,7 @@ if( APPLE )
 			$<TARGET_BUNDLE_CONTENT_DIR:${PROJECT_NAME}>/PlugIns/*/*
 			$<TARGET_BUNDLE_CONTENT_DIR:${PROJECT_NAME}>/Library/QuickLook/DigiDocQL.qlgenerator
 		COMMAND if echo \"$$SIGNCERT\" | grep -q "Developer ID" \; then
-				codesign -f -s \"$$SIGNCERT\" $<TARGET_BUNDLE_DIR:${PROJECT_NAME}> --entitlements ${CMAKE_SOURCE_DIR}/${PROJECT_NAME}.eToken.entitlements\;
+				codesign -f --options runtime -s \"$$SIGNCERT\" $<TARGET_BUNDLE_DIR:${PROJECT_NAME}> --entitlements ${CMAKE_SOURCE_DIR}/${PROJECT_NAME}.eToken.entitlements\;
 			else
 				codesign -f -s \"$$SIGNCERT\" $<TARGET_BUNDLE_DIR:${PROJECT_NAME}> --entitlements ${CMAKE_SOURCE_DIR}/${PROJECT_NAME}.entitlements\;
 			fi

extensions/windows/CMakeLists.txt

@@ -1,12 +1,5 @@
 cmake_minimum_required(VERSION 3.16)
 project(EsteidShellExtension VERSION 3.13.9)
-
-if(CMAKE_SIZEOF_VOID_P EQUAL 8)
-    set(PLATFORM "x64")
-else()
-    set(PLATFORM "x86")
-endif()
-
 add_library(${PROJECT_NAME} SHARED
     dllmain.cpp
     EsteidShellExtension.def
@@ -32,15 +25,15 @@ set_target_properties(${PROJECT_NAME} PROPERTIES
 
 add_custom_target(msishellext DEPENDS ${PROJECT_NAME}
     COMMAND wix.exe build -nologo
-        -arch ${PLATFORM}
+        -arch $ENV{PLATFORM}
         -d ShellExt=$<TARGET_FILE:EsteidShellExtension>
         ${CMAKE_CURRENT_SOURCE_DIR}/EsteidShellExtension.wxs
-        ${CMAKE_MODULE_PATH}/WelcomeDlg.wxs
-        ${CMAKE_MODULE_PATH}/WixUI_Minimal.wxs
+        ${CMAKE_CURRENT_SOURCE_DIR}/../../common/WelcomeDlg.wxs
+        ${CMAKE_CURRENT_SOURCE_DIR}/../../common/WixUI_Minimal.wxs
         -ext WixToolset.UI.wixext
-        -bv WixUIDialogBmp=${CMAKE_MODULE_PATH}/dlgbmp.bmp
-        -bv WixUIBannerBmp=${CMAKE_MODULE_PATH}/banner.bmp
-        -o Digidoc_ShellExt-${VERSION}$ENV{VER_SUFFIX}.${PLATFORM}.msi
+        -bv WixUIDialogBmp=${CMAKE_CURRENT_SOURCE_DIR}/../../common/dlgbmp.bmp
+        -bv WixUIBannerBmp=${CMAKE_CURRENT_SOURCE_DIR}/../../common/banner.bmp
+        -o Digidoc_ShellExt-${VERSION}$ENV{VER_SUFFIX}.$ENV{PLATFORM}.msi
     WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
 )
 
@@ -57,6 +50,6 @@ if(SIGNCERT)
     add_custom_command(TARGET msishellext POST_BUILD
         COMMAND signtool.exe sign /a /v /s MY /n "${SIGNCERT}" /fd SHA256 /du http://installer.id.ee
             /tr http://timestamp.digicert.com /td SHA256
-            "${CMAKE_BINARY_DIR}/Digidoc_ShellExt-${VERSION}$ENV{VER_SUFFIX}.${PLATFORM}.msi"
+            "${CMAKE_BINARY_DIR}/Digidoc_ShellExt-${VERSION}$ENV{VER_SUFFIX}.$ENV{PLATFORM}.msi"
     )
 endif()