Thanks to visit codestin.com
Credit goes to github.com

Skip to content

feat(windows): add product information to coder.exe #5055

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

feat(windows): add product information to coder.exe #5055

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,9 @@ jobs:
AC_APIKEY_ISSUER_ID: ${{ secrets.AC_APIKEY_ISSUER_ID }}
AC_APIKEY_ID: ${{ secrets.AC_APIKEY_ID }}
AC_APIKEY_FILE: /tmp/apple_apikey.p8
CODER_SIGN_WINDOWS: "0"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've set this at 0 by default under assumption that we will obtain the signing certificate and install it afterwards as part of a seperate pull-request as signing certificates will take a couple of weeks.

AUTHENTICODE_CERTIFICATE_FILE: /tmp/windows_cert.pkcs12
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code signing certificates can be obtained via https://sectigo.com/ssl-certificates-tls/code-signing and will require organization validation (ie. a DUNS number and corresponding phone number that works)

AUTHENTICODE_CERTIFICATE_PASSWORD_FILE: /tmp/windows_cert_password.txt

- name: Delete Apple Developer certificate and API key
run: rm -f /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
Expand Down
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ site/out/
*.lock.hcl
.terraform/

**/*.syso

.vscode/*.log
.vscode/launch.json
**/*.swp
Expand Down
Binary file added cmd/coder/coder.exe.ico
View file
Open in desktop
Binary file not shown.
17 changes: 17 additions & 0 deletions cmd/coder/coder.exe.manifest
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
type="win32"
name="Coder.com.Coder"
version="1.0.0.0"
processorArchitecture="*"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel
level="asInvoker"
uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
44 changes: 44 additions & 0 deletions cmd/coder/versioninfo.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
{
"FixedFileInfo":
{
"FileVersion": {
"Major": 0,
"Minor": 0,
"Patch": 0,
"Build": 0
},
"ProductVersion": {
"Major": 0,
"Minor": 0,
"Patch": 0,
"Build": 0
},
"FileFlagsMask": "3f",
"FileFlags ": "00",
"FileOS": "040004",
"FileType": "01",
"FileSubType": "00"
},
"StringFileInfo":
{
"Comments": "https://coder.com",
"CompanyName": "Coder Technologies, Inc",
"FileDescription": "Coder",
"FileVersion": "",
"InternalName": "coder",
"LegalCopyright": "© Coder Technologies, Inc. All rights reserved.",
"LegalTrademarks": "",
"OriginalFilename": "coder.exe",
"PrivateBuild": "",
"ProductName": "Coder®",
"ProductVersion": "",
"SpecialBuild": ""
},
"VarFileInfo":
{
"Translation": {
"LangID": "0409",
"CharsetID": "04B0"
}
}
}
3 changes: 2 additions & 1 deletion docs/CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,8 @@ Alternatively if you do not want to use nix then you'll need to install the need
- on macOS, run `brew install pango`
- [`pandoc`]()
- on macOS, run `brew install pandocomatic`

- [`osslsigncode`]()
- on macOS, run `brew install osslsigncode`

### Development workflow

Expand Down
1 change: 1 addition & 0 deletions dogfood/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ RUN apt-get update --quiet && apt-get install --yes \
openjdk-11-jdk-headless \
openssh-server \
openssl \
osslsigncode \
pkg-config \
python3 \
python3-pip \
Expand Down
1 change: 1 addition & 0 deletions flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
nodePackages.typescript
nodePackages.typescript-language-server
nodejs
osslsigncode
openssh
openssl
postgresql
Expand Down
5 changes: 5 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,3 +302,8 @@ require (
gopkg.in/yaml.v2 v2.4.0 // indirect
howett.net/plist v1.0.0 // indirect
)

require (
github.com/akavel/rsrc v0.10.2 // indirect
github.com/josephspurrier/goversioninfo v1.4.0 // indirect
)
4 changes: 4 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,8 @@ github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki
github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
github.com/akavel/rsrc v0.10.2 h1:Zxm8V5eI1hW4gGaYsJQUhxpjkENuG91ki8B4zCrvEsw=
github.com/akavel/rsrc v0.10.2/go.mod h1:uLoCtb9J+EyAqh+26kdrTgmzRBFPGOolLWKpdxkKq+c=
github.com/akutz/memconn v0.1.0 h1:NawI0TORU4hcOMsMr11g7vwlCdkYeLKXBcxWu2W/P8A=
github.com/akutz/memconn v0.1.0/go.mod h1:Jo8rI7m0NieZyLI5e2CDlRdRqRRB4S7Xp77ukDjH+Fw=
github.com/alecthomas/chroma v0.9.4/go.mod h1:jtJATyUxlIORhUOFNA9NZDWGAQ8wpxQQqNSB4rjA/1s=
Expand Down Expand Up @@ -1118,6 +1120,8 @@ github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqx
github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
github.com/jonboulle/clockwork v0.2.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
github.com/josephspurrier/goversioninfo v1.4.0 h1:Puhl12NSHUSALHSuzYwPYQkqa2E1+7SrtAPJorKK0C8=
github.com/josephspurrier/goversioninfo v1.4.0/go.mod h1:JWzv5rKQr+MmW+LvM412ToT/IkYDZjaclF2pKDss8IY=
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
github.com/josharian/native v1.0.0 h1:Ts/E8zCSEsG17dUqv7joXJFybuMLjQfWE04tsBODTxk=
github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
Expand Down
25 changes: 24 additions & 1 deletion scripts/build_go.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,10 +32,11 @@ os="${GOOS:-linux}"
arch="${GOARCH:-amd64}"
slim="${CODER_SLIM_BUILD:-0}"
sign_darwin="${CODER_SIGN_DARWIN:-0}"
sign_windows="${CODER_SIGN_WINDOWS:-0}"
output_path=""
agpl="${CODER_BUILD_AGPL:-0}"

args="$(getopt -o "" -l version:,os:,arch:,output:,slim,agpl,sign-darwin -- "$@")"
args="$(getopt -o "" -l version:,os:,arch:,output:,slim,agpl,sign-darwin,sign-windows -- "$@")"
eval set -- "$args"
while true; do
case "$1" in
Expand Down Expand Up @@ -68,6 +69,10 @@ while true; do
sign_darwin=1
shift
;;
--sign-windows)
sign_windows=1
shift
;;
--)
shift
break
Expand All @@ -93,6 +98,20 @@ if [[ "$sign_darwin" == 1 ]]; then
requiredenvs AC_CERTIFICATE_FILE AC_CERTIFICATE_PASSWORD_FILE
fi

if [[ "$sign_windows" == 1 ]]; then
dependencies osslsigncode
requiredenvs AUTHENTICODE_CERTIFICATE_FILE AUTHENTICODE_CERTIFICATE_PASSWORD_FILE
fi

if [[ "$os" == "windows" ]]; then
goversioninfo -platform-specific=true \
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently the following files are outputted in ~

-rw-r--r--  1 coder coder 193962 Nov 23 05:07 resource_windows_386.syso
-rw-r--r--  1 coder coder 193962 Nov 23 05:07 resource_windows_amd64.syso
-rw-r--r--  1 coder coder 193962 Nov 23 05:07 resource_windows_arm.syso
-rw-r--r--  1 coder coder 193962 Nov 23 05:07 resource_windows_arm64.syso

Need to embed the appropriate arch into the appropriate windows build.

-product-version=${version} \
-icon=cmd/coder/coder.exe.ico \
-manifest=cmd/coder/coder.exe.manifest \
cmd/coder/versioninfo.json
fi


build_args=(
-ldflags "-s -w -X 'github.com/coder/coder/buildinfo.tag=$version'"
)
Expand Down Expand Up @@ -134,4 +153,8 @@ if [[ "$sign_darwin" == 1 ]] && [[ "$os" == "darwin" ]]; then
execrelative ./sign_darwin.sh "$output_path" 1>&2
fi

if [[ "$sign_windows" == 1 ]] && [[ "$os" == "windows" ]]; then
execrelative ./sign_windows.sh "$output_path" 1>&2
fi

echo "$output_path"
38 changes: 38 additions & 0 deletions scripts/sign_windows.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
#!/usr/bin/env bash

set -x
# This script signs the provided windows binary with a X.509 certificate and
# it's associated private key.
#
# Usage: ./sign_windows.sh path/to/binary
#
# On success, the input file will be signed using the X.509 certificate.
#
# You can check if a binary is signed by running the following command:
# osslsigncode verify path/to/binary
#
# Depends on the osslsigncode utility. Requires the following environment variables
# to be set:
# - $AUTHENTICODE_CERTIFICATE_FILE: The path to the X5.09 certificate file.
# - $AUTHENTICODE_CERTIFICATE_PASSWORD_FILE: The path to the file containing the password
# for the X5.09 certificate.

set -euo pipefail
# shellcheck source=scripts/lib.sh
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"

# Check dependencies
dependencies osslsigncode
requiredenvs AUTHENTICODE_CERTIFICATE_FILE AUTHENTICODE_CERTIFICATE_PASSWORD_FILE

osslsigncode sign \
Copy link
Contributor Author

@ghuntley ghuntley Nov 23, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Signing of windows executables in the next year is migrating [1] to requiring storage of the certificate to be within a hardware appliance (ie Google Cloud HSM).

[1] https://twitter.com/vcsjones/status/1595236155276120065 and https://knowledge.digicert.com/generalinformation/new-private-key-storage-requirement-for-standard-code-signing-certificates-november-2022.html

-pkcs12 "$AUTHENTICODE_CERTIFICATE_FILE" \
-readpass "$AUTHENTICODE_CERTIFICATE_PASSWORD_FILE" \
-n "Coder" \
-i "https://coder.com" \
-t "http://timestamp.sectigo.com"
-in "$@" \
-out "$@" \
1>&2

osslsigncodeosslsigncode verify "$@" 1>&2