|
| 1 | +"use strict"; |
| 2 | +/*--------------------------------------------------------------------------------------------- |
| 3 | + * Copyright (c) Microsoft Corporation. All rights reserved. |
| 4 | + * Licensed under the MIT License. See License.txt in the project root for license information. |
| 5 | + *--------------------------------------------------------------------------------------------*/ |
| 6 | +Object.defineProperty(exports, "__esModule", { value: true }); |
| 7 | +exports.main = void 0; |
| 8 | +const cp = require("child_process"); |
| 9 | +const fs = require("fs"); |
| 10 | +const tmp = require("tmp"); |
| 11 | +const crypto = require("crypto"); |
| 12 | +function getParams(type) { |
| 13 | + switch (type) { |
| 14 | + case 'windows': |
| 15 | + return '[{"keyCode":"CP-230012","operationSetCode":"SigntoolSign","parameters":[{"parameterName":"OpusName","parameterValue":"VS Code"},{"parameterName":"OpusInfo","parameterValue":"https://code.visualstudio.com/"},{"parameterName":"Append","parameterValue":"/as"},{"parameterName":"FileDigest","parameterValue":"/fd \\"SHA256\\""},{"parameterName":"PageHash","parameterValue":"/NPH"},{"parameterName":"TimeStamp","parameterValue":"/tr \\"http://rfc3161.gtm.corp.microsoft.com/TSS/HttpTspServer\\" /td sha256"}],"toolName":"sign","toolVersion":"1.0"},{"keyCode":"CP-230012","operationSetCode":"SigntoolVerify","parameters":[{"parameterName":"VerifyAll","parameterValue":"/all"}],"toolName":"sign","toolVersion":"1.0"}]'; |
| 16 | + case 'rpm': |
| 17 | + return '[{ "keyCode": "CP-450779-Pgp", "operationSetCode": "LinuxSign", "parameters": [], "toolName": "sign", "toolVersion": "1.0" }]'; |
| 18 | + case 'darwin-sign': |
| 19 | + return '[{"keyCode":"CP-401337-Apple","operationSetCode":"MacAppDeveloperSign","parameters":[{"parameterName":"Hardening","parameterValue":"--options=runtime"}],"toolName":"sign","toolVersion":"1.0"}]'; |
| 20 | + case 'darwin-notarize': |
| 21 | + return '[{"keyCode":"CP-401337-Apple","operationSetCode":"MacAppNotarize","parameters":[{"parameterName":"BundleId","parameterValue":"$(BundleIdentifier)"}],"toolName":"sign","toolVersion":"1.0"}]'; |
| 22 | + default: |
| 23 | + throw new Error(`Sign type ${type} not found`); |
| 24 | + } |
| 25 | +} |
| 26 | +function main([esrpCliPath, type, cert, username, password, folderPath, pattern]) { |
| 27 | + tmp.setGracefulCleanup(); |
| 28 | + const patternPath = tmp.tmpNameSync(); |
| 29 | + fs.writeFileSync(patternPath, pattern); |
| 30 | + const paramsPath = tmp.tmpNameSync(); |
| 31 | + fs.writeFileSync(paramsPath, getParams(type)); |
| 32 | + const keyFile = tmp.tmpNameSync(); |
| 33 | + const key = crypto.randomBytes(32); |
| 34 | + const iv = crypto.randomBytes(16); |
| 35 | + fs.writeFileSync(keyFile, JSON.stringify({ key: key.toString('hex'), iv: iv.toString('hex') })); |
| 36 | + const clientkeyPath = tmp.tmpNameSync(); |
| 37 | + const clientkeyCypher = crypto.createCipheriv('aes-256-cbc', key, iv); |
| 38 | + let clientkey = clientkeyCypher.update(password, 'utf8', 'hex'); |
| 39 | + clientkey += clientkeyCypher.final('hex'); |
| 40 | + fs.writeFileSync(clientkeyPath, clientkey); |
| 41 | + const clientcertPath = tmp.tmpNameSync(); |
| 42 | + const clientcertCypher = crypto.createCipheriv('aes-256-cbc', key, iv); |
| 43 | + let clientcert = clientcertCypher.update(cert, 'utf8', 'hex'); |
| 44 | + clientcert += clientcertCypher.final('hex'); |
| 45 | + fs.writeFileSync(clientcertPath, clientcert); |
| 46 | + const args = [ |
| 47 | + esrpCliPath, |
| 48 | + 'vsts.sign', |
| 49 | + '-a', username, |
| 50 | + '-k', clientkeyPath, |
| 51 | + '-z', clientcertPath, |
| 52 | + '-f', folderPath, |
| 53 | + '-p', patternPath, |
| 54 | + '-u', 'false', |
| 55 | + '-x', 'regularSigning', |
| 56 | + '-b', 'input.json', |
| 57 | + '-l', 'AzSecPack_PublisherPolicyProd.xml', |
| 58 | + '-y', 'inlineSignParams', |
| 59 | + '-j', paramsPath, |
| 60 | + '-c', '9997', |
| 61 | + '-t', '120', |
| 62 | + '-g', '10', |
| 63 | + '-v', 'Tls12', |
| 64 | + '-s', 'https://api.esrp.microsoft.com/api/v1', |
| 65 | + '-m', '0', |
| 66 | + '-o', 'Microsoft', |
| 67 | + '-i', 'https://www.microsoft.com', |
| 68 | + '-n', '5', |
| 69 | + '-r', 'true', |
| 70 | + '-e', keyFile, |
| 71 | + ]; |
| 72 | + cp.spawnSync('dotnet', args, { stdio: 'inherit' }); |
| 73 | +} |
| 74 | +exports.main = main; |
| 75 | +if (require.main === module) { |
| 76 | + main(process.argv.slice(2)); |
| 77 | +} |
0 commit comments