This is an archive of the discontinued Mercurial Phabricator instance.

Differential D8475

packaging: integrate signing into run_wix_packaging()
ClosedPublic

Authored by indygreg on Apr 21 2020, 10:39 PM.

Details

Reviewers
None
Group Reviewers
hg-reviewers
Commits
rHGa39984091380: packaging: integrate signing into run_wix_packaging()
rHG08423196245b: packaging: integrate signing into run_wix_packaging()
Summary

Previously, signing was implemented via a separate function
which called build_installer() and then called signing
functionality.

In this model, in order to implement an alternative build
mechanism, we would have to invent a new variant to handle
signing as well.

This commit merges the signing logic into the function invoking
wix. If we pass an argument holding metadata about how to sign,
we sign hg.exe and the installer. This means all we have to
do is pass in signing info and the signing just works.

A slight change here is that signing of hg.exe happens in the
staging directory as opposed to before the staging directory
is populated. I don't think this matters.

Diff Detail

Repository
rHG Mercurial
Branch
stable
Lint
No Linters Available
Unit
No Unit Test Coverage

Revision Contents
Changeset List

Diff 21208

contrib/packaging/hgpackaging/cli.py

sign_sn=None, sign_sn=None,
sign_cert=None, sign_cert=None,
sign_password=None, sign_password=None,
sign_timestamp_url=None, sign_timestamp_url=None,
extra_packages_script=None, extra_packages_script=None,
extra_wxs=None, extra_wxs=None,
extra_features=None, extra_features=None,
): ):
fn = wix.build_installer
kwargs = { kwargs = {
"source_dir": SOURCE_DIR, "source_dir": SOURCE_DIR,
"python_exe": pathlib.Path(python), "python_exe": pathlib.Path(python),
"version": version, "version": version,
} }
if not os.path.isabs(python): if not os.path.isabs(python):
raise Exception("--python arg must be an absolute path") raise Exception("--python arg must be an absolute path")
if extra_packages_script: if extra_packages_script:
kwargs["extra_packages_script"] = extra_packages_script kwargs["extra_packages_script"] = extra_packages_script
if extra_wxs: if extra_wxs:
kwargs["extra_wxs"] = dict( kwargs["extra_wxs"] = dict(
thing.split("=") for thing in extra_wxs.split(",") thing.split("=") for thing in extra_wxs.split(",")
) )
if extra_features: if extra_features:
kwargs["extra_features"] = extra_features.split(",") kwargs["extra_features"] = extra_features.split(",")
if sign_sn or sign_cert: if sign_sn or sign_cert:
fn = wix.build_signed_installer kwargs["signing_info"] = {
kwargs["name"] = name "name": name,
kwargs["subject_name"] = sign_sn "subject_name": sign_sn,
kwargs["cert_path"] = sign_cert "cert_path": sign_cert,
kwargs["cert_password"] = sign_password "cert_password": sign_password,
kwargs["timestamp_url"] = sign_timestamp_url "timestamp_url": sign_timestamp_url,
}
fn(**kwargs) wix.build_installer(**kwargs)
def get_parser(): def get_parser():
parser = argparse.ArgumentParser() parser = argparse.ArgumentParser()
subparsers = parser.add_subparsers() subparsers = parser.add_subparsers()
sp = subparsers.add_parser("inno", help="Build Inno Setup installer") sp = subparsers.add_parser("inno", help="Build Inno Setup installer")

contrib/packaging/hgpackaging/wix.py

] ]
if defines: if defines:
args.extend('-d%s=%s' % define for define in sorted(defines.items())) args.extend('-d%s=%s' % define for define in sorted(defines.items()))
subprocess.run(args, cwd=str(cwd), check=True) subprocess.run(args, cwd=str(cwd), check=True)
def make_post_build_signing_fn(
name,
subject_name=None,
cert_path=None,
cert_password=None,
timestamp_url=None,
):
"""Create a callable that will use signtool to sign hg.exe."""
def post_build_sign(source_dir, build_dir, dist_dir, version):
description = '%s %s' % (name, version)
sign_with_signtool(
dist_dir / 'hg.exe',
description,
subject_name=subject_name,
cert_path=cert_path,
cert_password=cert_password,
timestamp_url=timestamp_url,
)
return post_build_sign
def make_files_xml(staging_dir: pathlib.Path, is_x64) -> str: def make_files_xml(staging_dir: pathlib.Path, is_x64) -> str:
"""Create XML string listing every file to be installed.""" """Create XML string listing every file to be installed."""
# We derive GUIDs from a deterministic file path identifier. # We derive GUIDs from a deterministic file path identifier.
# We shoehorn the name into something that looks like a URL because # We shoehorn the name into something that looks like a URL because
# the UUID namespaces are supposed to work that way (even though # the UUID namespaces are supposed to work that way (even though
# the input data probably is never validated). # the input data probably is never validated).
return doc.toprettyxml() return doc.toprettyxml()
def build_installer( def build_installer(
source_dir: pathlib.Path, source_dir: pathlib.Path,
python_exe: pathlib.Path, python_exe: pathlib.Path,
msi_name='mercurial', msi_name='mercurial',
version=None, version=None,
post_build_fn=None,
extra_packages_script=None, extra_packages_script=None,
extra_wxs: typing.Optional[typing.Dict[str, str]] = None, extra_wxs: typing.Optional[typing.Dict[str, str]] = None,
extra_features: typing.Optional[typing.List[str]] = None, extra_features: typing.Optional[typing.List[str]] = None,
signing_info: typing.Optional[typing.Dict[str, str]] = None,
): ):
"""Build a WiX MSI installer. """Build a WiX MSI installer.
``source_dir`` is the path to the Mercurial source tree to use. ``source_dir`` is the path to the Mercurial source tree to use.
``arch`` is the target architecture. either ``x86`` or ``x64``. ``arch`` is the target architecture. either ``x86`` or ``x64``.
``python_exe`` is the path to the Python executable to use/bundle. ``python_exe`` is the path to the Python executable to use/bundle.
``version`` is the Mercurial version string. If not defined, ``version`` is the Mercurial version string. If not defined,
``mercurial/__version__.py`` will be consulted. ``mercurial/__version__.py`` will be consulted.
``post_build_fn`` is a callable that will be called after building
Mercurial but before invoking WiX. It can be used to e.g. facilitate
signing. It is passed the paths to the Mercurial source, build, and
dist directories and the resolved Mercurial version.
``extra_packages_script`` is a command to be run to inject extra packages ``extra_packages_script`` is a command to be run to inject extra packages
into the py2exe binary. It should stage packages into the virtualenv and into the py2exe binary. It should stage packages into the virtualenv and
print a null byte followed by a newline-separated list of packages that print a null byte followed by a newline-separated list of packages that
should be included in the exe. should be included in the exe.
``extra_wxs`` is a dict of {wxs_name: working_dir_for_wxs_build}. ``extra_wxs`` is a dict of {wxs_name: working_dir_for_wxs_build}.
``extra_features`` is a list of additional named Features to include in ``extra_features`` is a list of additional named Features to include in
the build. These must match Feature names in one of the wxs scripts. the build. These must match Feature names in one of the wxs scripts.
""" """
arch = 'x64' if r'\x64' in os.environ.get('LIB', '') else 'x86' arch = 'x64' if r'\x64' in os.environ.get('LIB', '') else 'x86'
hg_build_dir = source_dir / 'build' hg_build_dir = source_dir / 'build'
dist_dir = source_dir / 'dist'
requirements_txt = ( requirements_txt = (
source_dir / 'contrib' / 'packaging' / 'requirements_win32.txt' source_dir / 'contrib' / 'packaging' / 'requirements_win32.txt'
) )
build_py2exe( build_py2exe(
source_dir, source_dir,
hg_build_dir, hg_build_dir,
python_exe, python_exe,
'wix', 'wix',
requirements_txt, requirements_txt,
extra_packages=EXTRA_PACKAGES, extra_packages=EXTRA_PACKAGES,
extra_packages_script=extra_packages_script, extra_packages_script=extra_packages_script,
) )
orig_version = version or find_version(source_dir) orig_version = version or find_version(source_dir)
version = normalize_windows_version(orig_version) version = normalize_windows_version(orig_version)
print('using version string: %s' % version) print('using version string: %s' % version)
if version != orig_version: if version != orig_version:
print('(normalized from: %s)' % orig_version) print('(normalized from: %s)' % orig_version)
if post_build_fn:
post_build_fn(source_dir, hg_build_dir, dist_dir, version)
build_dir = hg_build_dir / ('wix-%s' % arch) build_dir = hg_build_dir / ('wix-%s' % arch)
staging_dir = build_dir / 'stage' staging_dir = build_dir / 'stage'
build_dir.mkdir(exist_ok=True) build_dir.mkdir(exist_ok=True)
# Purge the staging directory for every build so packaging is pristine. # Purge the staging directory for every build so packaging is pristine.
if staging_dir.exists(): if staging_dir.exists():
print('purging %s' % staging_dir) print('purging %s' % staging_dir)
build_dir, build_dir,
staging_dir, staging_dir,
arch, arch,
version=version, version=version,
orig_version=orig_version, orig_version=orig_version,
msi_name=msi_name, msi_name=msi_name,
extra_wxs=extra_wxs, extra_wxs=extra_wxs,
extra_features=extra_features, extra_features=extra_features,
signing_info=signing_info,
) )
def run_wix_packaging( def run_wix_packaging(
source_dir: pathlib.Path, source_dir: pathlib.Path,
build_dir: pathlib.Path, build_dir: pathlib.Path,
staging_dir: pathlib.Path, staging_dir: pathlib.Path,
arch: str, arch: str,
version: str, version: str,
orig_version: str, orig_version: str,
msi_name: typing.Optional[str] = "mercurial", msi_name: typing.Optional[str] = "mercurial",
extra_wxs: typing.Optional[typing.Dict[str, str]] = None, extra_wxs: typing.Optional[typing.Dict[str, str]] = None,
extra_features: typing.Optional[typing.List[str]] = None, extra_features: typing.Optional[typing.List[str]] = None,
signing_info: typing.Optional[typing.Dict[str, str]] = None,
): ):
"""Invokes WiX to package up a built Mercurial.""" """Invokes WiX to package up a built Mercurial.
``signing_info`` is a dict defining properties to facilitate signing the
installer. Recognized keys include ``name``, ``subject_name``,
``cert_path``, ``cert_password``, and ``timestamp_url``. If populated,
we will sign both the hg.exe and the .msi using the signing credentials
specified.
"""
if signing_info:
sign_with_signtool(
staging_dir / "hg.exe",
"%s %s" % (signing_info["name"], version),
subject_name=signing_info["subject_name"],
cert_path=signing_info["cert_path"],
cert_password=signing_info["cert_password"],
timestamp_url=signing_info["timestamp_url"],
)
wix_dir = source_dir / 'contrib' / 'packaging' / 'wix' wix_dir = source_dir / 'contrib' / 'packaging' / 'wix'
wix_pkg, wix_entry = download_entry('wix', build_dir) wix_pkg, wix_entry = download_entry('wix', build_dir)
wix_path = build_dir / ('wix-%s' % wix_entry['version']) wix_path = build_dir / ('wix-%s' % wix_entry['version'])
if not wix_path.exists(): if not wix_path.exists():
extract_zip_to_directory(wix_pkg, wix_path) extract_zip_to_directory(wix_pkg, wix_path)
args.extend( args.extend(
[str(build_dir / 'stage.wixobj'), str(build_dir / 'mercurial.wixobj'),] [str(build_dir / 'stage.wixobj'), str(build_dir / 'mercurial.wixobj'),]
) )
subprocess.run(args, cwd=str(source_dir), check=True) subprocess.run(args, cwd=str(source_dir), check=True)
print('%s created' % msi_path) print('%s created' % msi_path)
if signing_info:
sign_with_signtool(
msi_path,
"%s %s" % (signing_info["name"], version),
subject_name=signing_info["subject_name"],
cert_path=signing_info["cert_path"],
cert_password=signing_info["cert_password"],
timestamp_url=signing_info["timestamp_url"],
)
return { return {
'msi_path': msi_path, 'msi_path': msi_path,
} }
def build_signed_installer(
source_dir: pathlib.Path,
python_exe: pathlib.Path,
name: str,
version=None,
subject_name=None,
cert_path=None,
cert_password=None,
timestamp_url=None,
extra_packages_script=None,
extra_wxs=None,
extra_features=None,
):
"""Build an installer with signed executables."""
post_build_fn = make_post_build_signing_fn(
name,
subject_name=subject_name,
cert_path=cert_path,
cert_password=cert_password,
timestamp_url=timestamp_url,
)
info = build_installer(
source_dir,
python_exe=python_exe,
msi_name=name.lower(),
version=version,
post_build_fn=post_build_fn,
extra_packages_script=extra_packages_script,
extra_wxs=extra_wxs,
extra_features=extra_features,
)
description = '%s %s' % (name, version)
sign_with_signtool(
info['msi_path'],
description,
subject_name=subject_name,
cert_path=cert_path,
cert_password=cert_password,
timestamp_url=timestamp_url,
)