Merge pull request #27 from github/windows-installer-signing

Windows installer signing

.appveyor.yml

@@ -5,13 +5,17 @@ os: 'Visual Studio 2015'
 
 clone_folder: C:\gopath\src\github.com\github\smimesign
 
+environment:
+  pfx_password:
+    secure: WfQzoLeQ6dGF2NnDKhZX6ai/k5s+qWyWLdIZoAjPineepfZeXovgrB2bmOtZfO2d
+
 init:
   # Always build with CGO
   - set CGO_ENABLED=1
   # Paths and Go environment
   - set GOPATH=c:\gopath
   - set GOROOT=c:\go
-  - set PATH=%GOROOT%\bin;%GOPATH%\bin;C:\msys64\usr\bin;%PATH%
+  - set PATH=%GOROOT%\bin;%GOPATH%\bin;C:\msys64\usr\bin;C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin;%PATH%
   - set PATH_WAS=%PATH%
 
 install:
@@ -39,8 +43,14 @@ build_script:
   - go build -o smimesign-386.exe -ldflags "-X main.versionString=%GIT_VERSION%" .
 
 after_build:
+  # Sign binaries
+  - if "%pfx_password%" NEQ "" (signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /p %pfx_password% /f windows-installer\codesign.pfx smimesign-amd64.exe)
+  - if "%pfx_password%" NEQ "" (signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /p %pfx_password% /f windows-installer\codesign.pfx smimesign-386.exe)
   # Build installer
   - iscc windows-installer/inno-setup-smimesign-installer.iss
+  # Sign installer — AppVeyor's "secure variables" aren't included in PR builds,
+  # so we skip this step if the PFX password is missing.
+  - if "%pfx_password%" NEQ "" (signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /p %pfx_password% /f windows-installer\codesign.pfx smimesign-windows-*.exe)
 
 test_script:
   - go test -v ./...

windows-installer/chain.p7b

@@ -0,0 +1,79 @@
+-----BEGIN PKCS7-----
+MIIOSQYJKoZIhvcNAQcCoIIOOjCCDjYCAQExADALBgkqhkiG9w0BBwGggg4eMIIF
+KzCCBBOgAwIBAgIQAazRhwJwBiUSjoFVxp5zCTANBgkqhkiG9w0BAQsFADByMQsw
+CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu
+ZGlnaWNlcnQuY29tMTEwLwYDVQQDEyhEaWdpQ2VydCBTSEEyIEFzc3VyZWQgSUQg
+Q29kZSBTaWduaW5nIENBMB4XDTE4MDkyNjAwMDAwMFoXDTIxMDkzMDEyMDAwMFow
+aDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNh
+biBGcmFuY2lzY28xFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEVMBMGA1UEAxMMR2l0
+SHViLCBJbmMuMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA15A41ItC
+pmIq15t6YDXGpkZr8UXulHDpkOWVDafLlhwU0xuHfbWePCpa0GA0GvKCgixFD9Zm
+lsC9hjFT7/9llLgPBDv95hFnFea+aTss/HrktN3WbOsGQpW/zV72GC27GRmjmv5r
+FJ3ofYIyqD62GfK8aD3pfOz2rgKf05NiQP/Hqhm0PkKXSFYa1AdsLm6tjXP2X1oN
+q22vaDv9a2A1PE54BE/ul9zauqe8TLb83Kcf3TYin8LFVaEezQ/E804K/A24JwMf
+xzl4Ky9MHzPprdE1pLzv6GbuT3Wq7Q0ftrk8b45aeunB0O2Q1KXFAs1E9Vfs7GUU
+t+f+b+6cJm3cnwIDAQABo4IBxTCCAcEwHwYDVR0jBBgwFoAUWsS5eyoKo6XqcQPA
+YPkt9mV1DlgwHQYDVR0OBBYEFO3Sr5gdLb2WVc35JSB6skdIq2lZMA4GA1UdDwEB
+/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzB3BgNVHR8EcDBuMDWgM6Axhi9o
+dHRwOi8vY3JsMy5kaWdpY2VydC5jb20vc2hhMi1hc3N1cmVkLWNzLWcxLmNybDA1
+oDOgMYYvaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL3NoYTItYXNzdXJlZC1jcy1n
+MS5jcmwwTAYDVR0gBEUwQzA3BglghkgBhv1sAwEwKjAoBggrBgEFBQcCARYcaHR0
+cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAIBgZngQwBBAEwgYQGCCsGAQUFBwEB
+BHgwdjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tME4GCCsG
+AQUFBzAChkJodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRTSEEy
+QXNzdXJlZElEQ29kZVNpZ25pbmdDQS5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG
+9w0BAQsFAAOCAQEAxqOBjNQmRnY1A7fbJ3KwweuSeD9I7OMH7VnCPUaZ4kXgqs6Y
+f+ZN1AbnMfH3BksHXp+4ghSu+PwnO3fSIYjS+oRjjpuOT4TlcYFaIRK65r5Q/qJU
+18DK8j3wokg19B0EJi6pHIDko7Qbetz4ojw0ThENqsTJ+T4G/XBERXi2qo5vee+c
+X9Fugeic56pCv8p1zdYIudg3Er6I3fERaAXLwHsvonYMTIfUa+Lq5dE07udrkpCy
+wxMwUpLrVL2H+5xWpN/QhaI6u3xnJCb+B1n1nSTi/DzMe6PmI2jIKv3HomJ/29Ie
+QYpeIe1he5Bw6CdwEdCi2k6Wss6FvxTDyw7sjDCCBTAwggQYoAMCAQICEAQJGBtf
+1btmdVNDtW+VUAgwDQYJKoZIhvcNAQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNV
+BAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIG
+A1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEzMTAyMjEyMDAw
+MFoXDTI4MTAyMjEyMDAwMFowcjELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lD
+ZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTExMC8GA1UEAxMoRGln
+aUNlcnQgU0hBMiBBc3N1cmVkIElEIENvZGUgU2lnbmluZyBDQTCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAPjTsxx/DhGvZ3cH0wsxSRnP0PtFmbE620T1
+f+Wondsy13Hqdp0FLreP+pJDwKX5idQ3Gde2qvCchqXYJawOeSg6funRZ9PG+ykn
+x9N7I5TkkSOWkHeC+aGEI2YSVDNQdLEoJrskacLCUvIUZ4qJRdQtoaPpiCwgla4c
+SocI3wz14k1gGL6qxLKucDFmM3E+rHCiq85/6XzLkqHlOzEcz+ryCuRXu0q16XTm
+K/5sy350OTYNkO/ktU6kqepqCquE86xnTrXE94zRICUj6whkPlKWwfIPEvTFjg/B
+ougsUfdzvL2FsWKDc0GCB+Q4i2pzINAPZHM8np+mM6n9Gd8lk9ECAwEAAaOCAc0w
+ggHJMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQM
+MAoGCCsGAQUFBwMDMHkGCCsGAQUFBwEBBG0wazAkBggrBgEFBQcwAYYYaHR0cDov
+L29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUFBzAChjdodHRwOi8vY2FjZXJ0cy5k
+aWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8E
+ejB4MDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1
+cmVkSURSb290Q0EuY3JsMDqgOKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20v
+RGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3JsME8GA1UdIARIMEYwOAYKYIZIAYb9
+bAACBDAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BT
+MAoGCGCGSAGG/WwDMB0GA1UdDgQWBBRaxLl7KgqjpepxA8Bg+S32ZXUOWDAfBgNV
+HSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQsFAAOCAQEA
+PuwNWiSz8yLRFcgsfCUpdqgdXRwtOhrE7zBh134LYP3DPQ/Er4v97yrfIFU3sOH2
+0ZJ1D1G0bqWOWuJeJIFOEKTuP3GOYw4TS63XX0R58zYUBor3nEZOXP+QsRsHDpEV
++7qvtVHCjSSuJMbHJyqhKSgaOnEoAjwukaPAJRHinBRHoXpoaK+bp1wgXNlxsQyP
+u6j4xRJon89Ay0BEpRPw5mQMJQhCMrI2iiQC/i9yfhzXSUWW6Fkd6fp0ZGuy62ZD
+2rOwjNXpDd32ASDOmTFjPQgaGLOBm0/GkxAG/AeB+ova+YJJ92JuoVP6EpQYhS6S
+kepobEQysmah5xikmmRR7zCCA7cwggKfoAMCAQICEAzn4OUX2Eb+j+Vg/BvwMDkw
+DQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0
+IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNl
+cnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAw
+MDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG
+A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJl
+ZCBJRCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArQ4V
+zuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShYYAz4gNqpFZUyYTy1sSiEiorcnwoM
+gxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g1x/isdn+GGTSEltf
++VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2bdfx
+oksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6
+cqHm+qTZ1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8Wo
+P5UW0P+hlusIXxh3TwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/
+BAUwAwEB/zAdBgNVHQ4EFgQUReuir/SSy4IxLVGLp6chnfNtyA8wHwYDVR0jBBgw
+FoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcNAQEFBQADggEBAKIOvN/i
+7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3lazn8zOFCi5DZdgXBJMWOTTPYNJRViX
+NWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91//IuKXhB/pZe+H4N/BZ0mz
+XeuyCSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+GxvpkaOuBLZTr
+Qrf6jB7dYvG+UGe3bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cqaBHf
+gOcMM2a/Ew0UbvN/H2MQHvqNGyVtbI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u
+5lCyp/oKRS+i8PIxAA==
+-----END PKCS7-----

windows-installer/codesign.conf

@@ -0,0 +1,19 @@
+# Code-signing certificate request
+
+[ req ]
+default_md         = sha256
+distinguished_name = github_dn
+req_extensions     = codesign_reqext
+prompt             = no
+
+[ github_dn ]
+countryName             = "US"
+stateOrProvinceName     = "CA"
+localityName            = "San Francisco"
+organizationName        = "GitHub, Inc."
+commonName              = "GitHub, Inc."
+
+[ codesign_reqext ]
+keyUsage                = critical,digitalSignature
+extendedKeyUsage        = critical,codeSigning
+subjectKeyIdentifier    = hash

windows-installer/genreate-csr.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -e
+
+export KEY_PASSWORD=$(head -n100 /dev/urandom | shasum -a256 | awk '{print $1}')
+echo "Key passphrase (save this): $KEY_PASSWORD"
+
+openssl req -new -utf8 -out req.pem -newkey rsa:2048 -keyout key.pem -passout env:KEY_PASSWORD -config codesign.conf
+
+
+

windows-installer/key.pem

@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFHzBJBgkqhkiG9w0BBQ0wPDAbBgkqhkiG9w0BBQwwDgQIkFSJC5YgS5wCAggA
+MB0GCWCGSAFlAwQBKgQQAvG9OtlSUFI8ESm2pdM2iASCBNDe5qxtAIHMNcAeJ4bM
+e0DY9KMLwSe4IoyDRYXf4Ajzg/rnaljTVviozQvCIAfKkldVnQvn/QeJnFl3k89n
+29+uKv8jE/5PUO5YTrzdY2FzR4KJpiWyww9E94ld8dtTjmZWJok6Vx/bGUL1Od40
+MNSeyBqM2XEHE2829IWhwfxkapzCU575UTjUamMprPZR31sFrGYKI0LJzR9g93VZ
+9PG7hviTwj5Rcx2H5CD+sLkZWEYz9imvFeRS/Erz485T8X8L8sLOliYmz5YleXL5
+J5vE/0faNf8UspF4ogslWRrs6NRUFWJ4ifJZh9pWME7OlWbjRsoGWzvKLpZvEr2F
+H73pFvs+rJTxJwRlz31LKT3SbC+y1sdpsbt6yQMp+h/Q48qQlZEB7+Cv90zy2GGL
+oZQHOEfCADvVeNYZyKaBg1wDf7sNogDIT4NVkCJdtXNRa+3kHEP75Ov9qRMSl4Gw
+3zxIjkwyeB0O4zwUSWjjZbUhbP5TiETzPWqnbPmU1tAYn10kha4wi7I5nTauWk+S
+rU4+kwmtp2XgwTJ/UeP1TtTBjOBPZhrJzbp158CIEWjxYC2nIHO5Exxwx2KQI8yB
+RXF39JZWw7OflG4MC0KZ3XezOmz1OGFpNIYCiuKVQO3MMVscV1O/GvJPQnna6jbE
+M/rkkz46ckxIOttoOTEm0b/qMYlzkFY3p+F1RPRFBBYnuXlkrAWfHn7GWEom0l9s
+QZpWu4/scSCq4RbUMW4i5ulVvwBbfSm7JxdJJpcZFo5+vKfzdNSoBOjUOsLPMXL5
+kxbrTDQ7doJUZ4ESdhYfnvad5AdjWfDxpHbZeUltluan1ecRdgXMxZCyVLYuSRVG
+81KD1FCafUYYI6T8YVLJvjOng6jrQiC/+JPy5uDfuUrIa/T9vpWWbc/6kzzS5R3U
+p3kc92b3gRSsl/vwa3t2lQF/D7AUvo8pUKYyACNduvBspScxFvsBdQ76ezvIa7ZB
+w7Hru/7pQ2pf1d1IPFfQDtXVzPunyo+onUYL5kCCLsq7c+pTtYigVCdwgtVwm7Eo
+2dVdcB1lnIlP3Kp7VyaggsTNDpmL40m6J5Gzf3qz9j82O2cdWGA7dRpzAz7JnJUt
+cDpFrHeQwgRm4lHHFXxbkrT3NbxJnkFIPZFfsxld0nn+2PUWvWgwRG6OAqhGWBj8
+FH021w9/izKPiuNRpqDcuywXROltrC3CM4nTKh3VUDhKUrsMbwkUpaQ1UXcKZiHU
+doziVFLVWMhB8/xmKSj4+SX9DBJHTeoASulr0BqxZ2OyNjNd60kLQ9YHBuIgwRyp
+i2JAGa2U1PxrcLqURd9p5NH7zeYfi2t6BU69hg3awJn7OXkFHVZHU8u0ZO/LAqbG
+YVlW12QERGawKYo2Ct/+f3QkOzckWugLQP6zVHdxWqbbKdXC9kg/+Bf/WONTCVZB
+Zos/9uPmRWTjRl7mqU6bcCAL2JALwF1tUydJ8FgxTXTJLzR2NBWCxOTD/dKnu1dv
+rRQHMau/oaYWcFe+uBXthcFEtBUZe5UeVA7la6WIdEtOI1Lwm6x/jSweSInB1FvK
+DcFwbaftkHFSxkmfxB5PvfZznEjOMdsgLP2/qI4GOa17y/PM4Mdi8jRerwJM750G
+DxCNUjJPu9njXMLGguhaor1VWg==
+-----END ENCRYPTED PRIVATE KEY-----

windows-installer/make-pfx.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -e
+
+# use sha1, since there is a max pw length
+export KEY_PASSWORD=$(head -n100 /dev/urandom | shasum | awk '{print $1}')
+echo "PFX passphrase (save this): $KEY_PASSWORD"
+
+openssl pkcs7 -in chain.p7b -inform PEM -out result.pem -print_certs
+trap "rm result.pem" EXIT
+
+openssl pkcs12 -export -inkey key.pem -in result.pem -out codesign.pfx -passout env:KEY_PASSWORD
+

windows-installer/req.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIC/TCCAeUCAQAwYDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQH
+DA1TYW4gRnJhbmNpc2NvMRUwEwYDVQQKDAxHaXRIdWIsIEluYy4xFTATBgNVBAMM
+DEdpdEh1YiwgSW5jLjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANeQ
+ONSLQqZiKtebemA1xqZGa/FF7pRw6ZDllQ2ny5YcFNMbh321njwqWtBgNBrygoIs
+RQ/WZpbAvYYxU+//ZZS4DwQ7/eYRZxXmvmk7LPx65LTd1mzrBkKVv81e9hgtuxkZ
+o5r+axSd6H2CMqg+thnyvGg96Xzs9q4Cn9OTYkD/x6oZtD5Cl0hWGtQHbC5urY1z
+9l9aDattr2g7/WtgNTxOeARP7pfc2rqnvEy2/NynH902Ip/CxVWhHs0PxPNOCvwN
+uCcDH8c5eCsvTB8z6a3RNaS87+hm7k91qu0NH7a5PG+OWnrpwdDtkNSlxQLNRPVX
+7OxlFLfn/m/unCZt3J8CAwEAAaBYMFYGCSqGSIb3DQEJDjFJMEcwDgYDVR0PAQH/
+BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMDMB0GA1UdDgQWBBTt0q+YHS29
+llXN+SUgerJHSKtpWTANBgkqhkiG9w0BAQsFAAOCAQEAUmxgOFiqHIVo3BoVwPUb
+Iqr5BVOFf+/FV6Y02YhIG0wFTAg+RzbxkZyXg/tpf7F8z8pAU384//ac3vdhC3ND
+g/rBowJjTp0WSkgsLm8gh+mmW4PCODzxjj+QQ+Xc2RlcGnIVMDcBN/RWjV6lpd72
+oooPhZuDPDymF7uDaJi4A1sTid8p9hdMK0YBd8x8d+q3HkeFy/CnIsYvkf1P79mr
+yTrJYJz+RCiM1LMtpKKFFdALQvdkOwqK8elHfveqeGw2WFpivdeWpjVIRTnpFBE2
+OjwHVE2QZyKE9stKbqTwtEy8TDVcZhPznMTUxsklk0ggRNjMskO6eATDRMEqdetX
+JA==
+-----END CERTIFICATE REQUEST-----