mirror of
https://github.com/fumiama/terasu-cloudflared.git
synced 2026-06-05 00:50:24 +08:00
eedbcf46d4
* TUN-9863: Introduce Code Signing for Windows Builds This commit adds a signing step to the build script for windows binaries. Since we package the MSI on Linux, this commit adds another CI step that depends on package-windows and signs all of the windows packages. To do so, we use azuresigntool which relies on a certificate stored in Azure Vault. Closes TUN-9863
30 lines
1.3 KiB
PowerShell
30 lines
1.3 KiB
PowerShell
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference = "Stop"
|
|
$ProgressPreference = "SilentlyContinue"
|
|
|
|
$env:TARGET_OS = "windows"
|
|
$env:LOCAL_OS = "windows"
|
|
$TIMESTAMP_RFC3161 = "http://timestamp.digicert.com"
|
|
|
|
New-Item -Path ".\artifacts" -ItemType Directory
|
|
|
|
Write-Output "Building for amd64"
|
|
$env:TARGET_ARCH = "amd64"
|
|
$env:LOCAL_ARCH = "amd64"
|
|
$env:CGO_ENABLED = 1
|
|
& make cloudflared
|
|
if ($LASTEXITCODE -ne 0) { throw "Failed to build cloudflared for amd64" }
|
|
# Sign build
|
|
azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\cloudflared.exe
|
|
copy .\cloudflared.exe .\artifacts\cloudflared-windows-amd64.exe
|
|
|
|
Write-Output "Building for 386"
|
|
$env:TARGET_ARCH = "386"
|
|
$env:LOCAL_ARCH = "386"
|
|
$env:CGO_ENABLED = 0
|
|
& make cloudflared
|
|
if ($LASTEXITCODE -ne 0) { throw "Failed to build cloudflared for 386" }
|
|
## Sign build
|
|
azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\cloudflared.exe
|
|
copy .\cloudflared.exe .\artifacts\cloudflared-windows-386.exe
|