mirror of
https://github.com/openp2p-cn/openp2p.git
synced 2026-07-03 02:37:00 +08:00
add(ci): support core build & signing by cert (#166)
* add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * add(ci): github action & signing * chore: update signature CI * fix(ci): sign windows binaries with direct CERTUM SHA1 * fix(ci): replace cert-store wait with simplysign readiness check * feat(ci): refactor certum signing flow for release * fix(ci): fail certum auth when session not ready * fix(ci): retry certum auth and fail critical steps * fix(ci): add cert preflight checks before signtool * fix(install): update SimplySign Desktop MSI download link to version 9.4.3.90 * fix(ci): mask totp and certificate identifiers in scripts * fix(ci): remove certificate inventory logs from release * add(ci): CHANGE beta release * feat(ci): resolve certum msi url dynamically from download page * add(ci): github action & signing * add(ci): github action & signing * revert(ci): app/app/build.gradle for build * add(ci): github action & signing * add(ci): github action & signing * Update default URLs for binary file downloads --------- Co-authored-by: Suyunmeng <Susus0175@proton.me> Co-authored-by: OpenP2P <89245779+TenderIronh@users.noreply.github.com>
This commit is contained in:
Pikachu Ren
252
.github/scripts/configure-simplysign-registry.ps1
vendored
Normal file
252
.github/scripts/configure-simplysign-registry.ps1
vendored
Normal file
@@ -0,0 +1,252 @@
|
||||
param(
|
||||
[switch]$DebugMode = $false,
|
||||
[switch]$VerifyOnly = $false
|
||||
)
|
||||
|
||||
# SimplySign Desktop Registry Configuration Script
|
||||
# Pre-configures optimal registry settings for automated login dialog display
|
||||
|
||||
Write-Host "=== SimplySign Desktop Registry Configuration ==="
|
||||
|
||||
if ($DebugMode) {
|
||||
Write-Host "Debug mode enabled - verbose logging active"
|
||||
}
|
||||
|
||||
# Registry path for SimplySign Desktop settings
|
||||
$RegistryPath = "HKCU:\Software\Certum\SimplySign"
|
||||
|
||||
# Optimal configuration values for automation
|
||||
$OptimalSettings = @{
|
||||
"ShowLoginDialogOnStart" = 1
|
||||
"ShowLoginDialogOnAppRequest" = 1
|
||||
"RememberLastUserName" = 1
|
||||
"Autostart" = 0
|
||||
"UnregisterCertificatesOnDisconnect" = 0
|
||||
"RememberPINinCSP" = 1
|
||||
"ForgetPINinCSPonDisconnect" = 1
|
||||
"LangID" = 9
|
||||
}
|
||||
|
||||
# Function to check if registry path exists
|
||||
function Test-RegistryPath {
|
||||
param([string]$Path)
|
||||
|
||||
try {
|
||||
$null = Get-Item -Path $Path -ErrorAction Stop
|
||||
return $true
|
||||
} catch {
|
||||
return $false
|
||||
}
|
||||
}
|
||||
|
||||
# Function to get current registry value
|
||||
function Get-RegistryValue {
|
||||
param(
|
||||
[string]$Path,
|
||||
[string]$Name
|
||||
)
|
||||
|
||||
try {
|
||||
$value = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Stop
|
||||
return $value.$Name
|
||||
} catch {
|
||||
return $null
|
||||
}
|
||||
}
|
||||
|
||||
# Function to set registry value safely
|
||||
function Set-RegistryValue {
|
||||
param(
|
||||
[string]$Path,
|
||||
[string]$Name,
|
||||
[int]$Value
|
||||
)
|
||||
|
||||
try {
|
||||
Set-ItemProperty -Path $Path -Name $Name -Value $Value -Type DWord -ErrorAction Stop
|
||||
if ($DebugMode) {
|
||||
Write-Host " Set $Name = $Value"
|
||||
}
|
||||
return $true
|
||||
} catch {
|
||||
Write-Host " ERROR: Failed to set $Name = $Value - $($_.Exception.Message)"
|
||||
return $false
|
||||
}
|
||||
}
|
||||
|
||||
# Function to display current settings
|
||||
function Show-CurrentSettings {
|
||||
Write-Host "Current SimplySign Desktop registry settings:"
|
||||
Write-Host "============================================="
|
||||
|
||||
if (-not (Test-RegistryPath $RegistryPath)) {
|
||||
Write-Host "Registry path does not exist: $RegistryPath"
|
||||
return
|
||||
}
|
||||
|
||||
foreach ($setting in $OptimalSettings.Keys) {
|
||||
$currentValue = Get-RegistryValue -Path $RegistryPath -Name $setting
|
||||
if ($null -eq $currentValue) {
|
||||
Write-Host " $setting : NOT SET"
|
||||
} else {
|
||||
Write-Host " $setting : $currentValue"
|
||||
}
|
||||
}
|
||||
Write-Host ""
|
||||
}
|
||||
|
||||
# Function to create registry structure
|
||||
function Initialize-RegistryStructure {
|
||||
Write-Host "Initializing registry structure..."
|
||||
|
||||
# Create parent keys if they don't exist
|
||||
$ParentPaths = @(
|
||||
"HKCU:\Software\Certum",
|
||||
$RegistryPath
|
||||
)
|
||||
|
||||
$allCreated = $true
|
||||
foreach ($path in $ParentPaths) {
|
||||
if (-not (Test-RegistryPath $path)) {
|
||||
try {
|
||||
New-Item -Path $path -Force -ErrorAction Stop | Out-Null
|
||||
if ($DebugMode) {
|
||||
Write-Host " Created registry path: $path"
|
||||
}
|
||||
} catch {
|
||||
Write-Host " ERROR: Failed to create registry path: $path - $($_.Exception.Message)"
|
||||
$allCreated = $false
|
||||
}
|
||||
} else {
|
||||
if ($DebugMode) {
|
||||
Write-Host " Registry path exists: $path"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return $allCreated
|
||||
}
|
||||
|
||||
# Function to apply optimal configuration
|
||||
function Set-OptimalConfiguration {
|
||||
Write-Host "Applying optimal configuration for automation..."
|
||||
|
||||
$successCount = 0
|
||||
$totalSettings = $OptimalSettings.Count
|
||||
|
||||
foreach ($setting in $OptimalSettings.Keys) {
|
||||
$value = $OptimalSettings[$setting]
|
||||
if (Set-RegistryValue -Path $RegistryPath -Name $setting -Value $value) {
|
||||
$successCount++
|
||||
}
|
||||
}
|
||||
|
||||
Write-Host "Applied $successCount of $totalSettings settings successfully"
|
||||
return ($successCount -eq $totalSettings)
|
||||
}
|
||||
|
||||
# Function to verify configuration
|
||||
function Test-Configuration {
|
||||
Write-Host "Verifying configuration..."
|
||||
|
||||
$verificationResults = @{}
|
||||
$allCorrect = $true
|
||||
|
||||
foreach ($setting in $OptimalSettings.Keys) {
|
||||
$expectedValue = $OptimalSettings[$setting]
|
||||
$actualValue = Get-RegistryValue -Path $RegistryPath -Name $setting
|
||||
|
||||
$isCorrect = ($actualValue -eq $expectedValue)
|
||||
$verificationResults[$setting] = @{
|
||||
Expected = $expectedValue
|
||||
Actual = $actualValue
|
||||
Correct = $isCorrect
|
||||
}
|
||||
|
||||
if (-not $isCorrect) {
|
||||
$allCorrect = $false
|
||||
}
|
||||
|
||||
if ($DebugMode -or -not $isCorrect) {
|
||||
$status = if ($isCorrect) { "OK" } else { "MISMATCH" }
|
||||
Write-Host " $setting : Expected=$expectedValue, Actual=$actualValue [$status]"
|
||||
}
|
||||
}
|
||||
|
||||
return $verificationResults, $allCorrect
|
||||
}
|
||||
|
||||
# Main execution
|
||||
try {
|
||||
Write-Host "Starting registry configuration process..."
|
||||
Write-Host ""
|
||||
|
||||
# Show current state
|
||||
Write-Host "BEFORE CONFIGURATION:"
|
||||
Show-CurrentSettings
|
||||
|
||||
if ($VerifyOnly) {
|
||||
Write-Host "Verification-only mode - no changes will be made"
|
||||
$verificationResults, $allCorrect = Test-Configuration
|
||||
|
||||
if ($allCorrect) {
|
||||
Write-Host "SUCCESS: All settings are correctly configured"
|
||||
exit 0
|
||||
} else {
|
||||
Write-Host "CONFIGURATION NEEDED: Some settings require adjustment"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
# Initialize registry structure
|
||||
if (-not (Initialize-RegistryStructure)) {
|
||||
Write-Host "FATAL ERROR: Failed to initialize registry structure"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Apply optimal configuration
|
||||
if (-not (Set-OptimalConfiguration)) {
|
||||
Write-Host "ERROR: Failed to apply complete configuration"
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "AFTER CONFIGURATION:"
|
||||
Show-CurrentSettings
|
||||
|
||||
# Verify the configuration was applied correctly
|
||||
$verificationResults, $allCorrect = Test-Configuration
|
||||
|
||||
if ($allCorrect) {
|
||||
Write-Host "SUCCESS: Registry configuration completed successfully"
|
||||
Write-Host ""
|
||||
Write-Host "Key automation settings enabled:"
|
||||
Write-Host " ShowLoginDialogOnStart = 1 (Login dialog will appear automatically)"
|
||||
Write-Host " ShowLoginDialogOnAppRequest = 1 (Dialog appears when apps request access)"
|
||||
Write-Host " RememberLastUserName = 1 (Username persistence for efficiency)"
|
||||
Write-Host ""
|
||||
Write-Host "Next steps:"
|
||||
Write-Host "1. Launch SimplySign Desktop"
|
||||
Write-Host "2. Login dialog should appear automatically"
|
||||
Write-Host "3. Complete authentication process"
|
||||
|
||||
# Create a status file for the workflow to check
|
||||
"REGISTRY_CONFIGURATION_SUCCESS" | Out-File -FilePath "registry_config_status.log" -Encoding UTF8
|
||||
|
||||
exit 0
|
||||
} else {
|
||||
Write-Host "ERROR: Configuration verification failed"
|
||||
Write-Host "Some settings were not applied correctly"
|
||||
|
||||
"REGISTRY_CONFIGURATION_PARTIAL" | Out-File -FilePath "registry_config_status.log" -Encoding UTF8
|
||||
|
||||
exit 1
|
||||
}
|
||||
|
||||
} catch {
|
||||
Write-Host "FATAL ERROR: Registry configuration failed - $($_.Exception.Message)"
|
||||
|
||||
"REGISTRY_CONFIGURATION_FAILED" | Out-File -FilePath "registry_config_status.log" -Encoding UTF8
|
||||
|
||||
exit 1
|
||||
}
|
||||
390
.github/scripts/connect-simplySign-enhanced.ps1
vendored
Normal file
390
.github/scripts/connect-simplySign-enhanced.ps1
vendored
Normal file
@@ -0,0 +1,390 @@
|
||||
# Connect-SimplySign-Enhanced.ps1
|
||||
# Registry-Enhanced TOTP Authentication for SimplySign Desktop
|
||||
# Uses registry pre-configuration + TOTP credential injection approach
|
||||
|
||||
param(
|
||||
[string]$OtpUri = $env:CERTUM_OTP_URI,
|
||||
[string]$UserId = $env:CERTUM_USERNAME,
|
||||
[string]$ExePath = $env:CERTUM_EXE_PATH,
|
||||
[string]$ExpectedCertificateSHA1 = $env:CERTUM_CERTIFICATE_SHA1
|
||||
)
|
||||
|
||||
function Normalize-Sha1 {
|
||||
param([string]$InputSha1)
|
||||
if (-not $InputSha1) {
|
||||
return $null
|
||||
}
|
||||
return ($InputSha1 -replace "[^a-fA-F0-9]", "").ToUpperInvariant()
|
||||
}
|
||||
|
||||
function Find-CertificateByThumbprint {
|
||||
param([string]$Thumbprint)
|
||||
|
||||
if (-not $Thumbprint) {
|
||||
return @()
|
||||
}
|
||||
|
||||
$all = Get-ChildItem -Path "Cert:\CurrentUser\My", "Cert:\LocalMachine\My" -ErrorAction SilentlyContinue
|
||||
# 对证书库中的 Thumbprint 同样做规范化（去除不可见字符、统一大写），避免 BOM 或格式差异导致匹配失败
|
||||
return @($all | Where-Object {
|
||||
$normalizedStoreThumbprint = ($_.Thumbprint -replace "[^a-fA-F0-9]", "").ToUpperInvariant()
|
||||
$normalizedStoreThumbprint -eq $Thumbprint
|
||||
})
|
||||
}
|
||||
|
||||
# Validate required parameters
|
||||
if (-not $OtpUri) {
|
||||
Write-Host "ERROR: CERTUM_OTP_URI environment variable not provided"
|
||||
exit 1
|
||||
}
|
||||
|
||||
if (-not $UserId) {
|
||||
Write-Host "ERROR: CERTUM_USERNAME environment variable not provided"
|
||||
exit 1
|
||||
}
|
||||
|
||||
if (-not $ExePath) {
|
||||
$ExePath = "C:\Program Files\Certum\SimplySign Desktop\SimplySignDesktop.exe"
|
||||
}
|
||||
|
||||
Write-Host "=== REGISTRY-ENHANCED TOTP AUTHENTICATION ==="
|
||||
Write-Host "Using registry pre-configuration + credential injection"
|
||||
Write-Host "OTP URI provided (length: $($OtpUri.Length))"
|
||||
Write-Host "User ID: $UserId"
|
||||
Write-Host "Executable: $ExePath"
|
||||
Write-Host ""
|
||||
|
||||
# Verify SimplySign Desktop exists
|
||||
if (-not (Test-Path $ExePath)) {
|
||||
Write-Host "ERROR: SimplySign Desktop not found at: $ExePath"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Parse the otpauth:// URI
|
||||
$uri = [Uri]$OtpUri
|
||||
|
||||
# Parse query parameters (compatible with both PowerShell 5.1 and 7+)
|
||||
try {
|
||||
$q = [System.Web.HttpUtility]::ParseQueryString($uri.Query)
|
||||
} catch {
|
||||
$q = @{}
|
||||
foreach ($part in $uri.Query.TrimStart('?') -split '&') {
|
||||
$kv = $part -split '=', 2
|
||||
if ($kv.Count -eq 2) {
|
||||
$q[$kv[0]] = [Uri]::UnescapeDataString($kv[1])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$Base32 = $q['secret']
|
||||
$Digits = if ($q['digits']) { [int]$q['digits'] } else { 6 }
|
||||
$Period = if ($q['period']) { [int]$q['period'] } else { 30 }
|
||||
$Algorithm = if ($q['algorithm']) { $q['algorithm'].ToUpper() } else { 'SHA256' }
|
||||
|
||||
# Validate supported algorithms
|
||||
$SupportedAlgorithms = @('SHA1', 'SHA256', 'SHA512')
|
||||
if ($Algorithm -notin $SupportedAlgorithms) {
|
||||
Write-Host "ERROR: Unsupported algorithm: $Algorithm. Supported: $($SupportedAlgorithms -join ', ')"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# TOTP Generator (inline C# implementation)
|
||||
Add-Type -Language CSharp @"
|
||||
using System;
|
||||
using System.Security.Cryptography;
|
||||
|
||||
public static class Totp
|
||||
{
|
||||
private const string B32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
|
||||
|
||||
private static byte[] Base32Decode(string s)
|
||||
{
|
||||
s = s.TrimEnd('=').ToUpperInvariant();
|
||||
int byteCount = s.Length * 5 / 8;
|
||||
byte[] bytes = new byte[byteCount];
|
||||
|
||||
int bitBuffer = 0, bitsLeft = 0, idx = 0;
|
||||
foreach (char c in s)
|
||||
{
|
||||
int val = B32.IndexOf(c);
|
||||
if (val < 0) throw new ArgumentException("Invalid Base32 char: " + c);
|
||||
|
||||
bitBuffer = (bitBuffer << 5) | val;
|
||||
bitsLeft += 5;
|
||||
|
||||
if (bitsLeft >= 8)
|
||||
{
|
||||
bytes[idx++] = (byte)(bitBuffer >> (bitsLeft - 8));
|
||||
bitsLeft -= 8;
|
||||
}
|
||||
}
|
||||
return bytes;
|
||||
}
|
||||
|
||||
private static HMAC GetHmacAlgorithm(string algorithm, byte[] key)
|
||||
{
|
||||
switch (algorithm.ToUpper())
|
||||
{
|
||||
case "SHA1":
|
||||
return new HMACSHA1(key);
|
||||
case "SHA256":
|
||||
return new HMACSHA256(key);
|
||||
case "SHA512":
|
||||
return new HMACSHA512(key);
|
||||
default:
|
||||
throw new ArgumentException("Unsupported algorithm: " + algorithm);
|
||||
}
|
||||
}
|
||||
|
||||
public static string Now(string secret, int digits, int period, string algorithm = "SHA256")
|
||||
{
|
||||
byte[] key = Base32Decode(secret);
|
||||
long counter = DateTimeOffset.UtcNow.ToUnixTimeSeconds() / period;
|
||||
|
||||
byte[] cnt = BitConverter.GetBytes(counter);
|
||||
if (BitConverter.IsLittleEndian) Array.Reverse(cnt);
|
||||
|
||||
byte[] hash;
|
||||
using (var hmac = GetHmacAlgorithm(algorithm, key))
|
||||
{
|
||||
hash = hmac.ComputeHash(cnt);
|
||||
}
|
||||
|
||||
int offset = hash[hash.Length - 1] & 0x0F;
|
||||
int binary =
|
||||
((hash[offset] & 0x7F) << 24) |
|
||||
((hash[offset + 1] & 0xFF) << 16) |
|
||||
((hash[offset + 2] & 0xFF) << 8) |
|
||||
(hash[offset + 3] & 0xFF);
|
||||
|
||||
int otp = binary % (int)Math.Pow(10, digits);
|
||||
return otp.ToString(new string('0', digits));
|
||||
}
|
||||
}
|
||||
"@
|
||||
|
||||
function Get-TotpCode {
|
||||
param([string]$Secret, [int]$Digits = 6, [int]$Period = 30, [string]$Algorithm = 'SHA256')
|
||||
[Totp]::Now($Secret, $Digits, $Period, $Algorithm)
|
||||
}
|
||||
|
||||
# Add Win32 API for force foreground window
|
||||
Add-Type @"
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
public static class Win32 {
|
||||
[DllImport("user32.dll")]
|
||||
public static extern bool SetForegroundWindow(IntPtr hWnd);
|
||||
|
||||
[DllImport("user32.dll")]
|
||||
public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
|
||||
|
||||
[DllImport("user32.dll")]
|
||||
public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);
|
||||
|
||||
[DllImport("user32.dll")]
|
||||
public static extern bool AllowSetForegroundWindow(int dwProcessId);
|
||||
|
||||
public const int SW_RESTORE = 9;
|
||||
public const int SW_SHOW = 5;
|
||||
}
|
||||
"@
|
||||
|
||||
# 预先验证证书 SHA1
|
||||
$normalizedExpectedSha1 = Normalize-Sha1 -InputSha1 $ExpectedCertificateSHA1
|
||||
if ($normalizedExpectedSha1) {
|
||||
if ($normalizedExpectedSha1.Length -ne 40) {
|
||||
Write-Host "ERROR: CERTUM_CERTIFICATE_SHA1 is invalid after normalization"
|
||||
Write-Host "Raw length: $($ExpectedCertificateSHA1.Length), normalized length: $($normalizedExpectedSha1.Length)"
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
# === 认证重试循环（最多 10 次） ===
|
||||
$maxAttempts = 10
|
||||
$authSuccess = $false
|
||||
|
||||
for ($attempt = 1; $attempt -le $maxAttempts; $attempt++) {
|
||||
Write-Host ""
|
||||
Write-Host "=========================================="
|
||||
Write-Host "=== AUTHENTICATION ATTEMPT $attempt / $maxAttempts ==="
|
||||
Write-Host "=========================================="
|
||||
Write-Host ""
|
||||
|
||||
# 每次重试都重新生成 TOTP（确保验证码有效）
|
||||
$otp = Get-TotpCode -Secret $Base32 -Digits $Digits -Period $Period -Algorithm $Algorithm
|
||||
Write-Host "Generated TOTP code successfully (masked) using $Algorithm algorithm"
|
||||
Write-Host ""
|
||||
|
||||
# 终止之前可能残留的 SimplySign Desktop 进程
|
||||
Get-Process -Name "SimplySignDesktop" -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
|
||||
Start-Sleep -Seconds 2
|
||||
|
||||
# 启动 SimplySign Desktop
|
||||
Write-Host "Launching SimplySign Desktop..."
|
||||
Write-Host "Registry pre-configuration should auto-open login dialog"
|
||||
$proc = Start-Process -FilePath $ExePath -PassThru
|
||||
Write-Host "Process started with ID: $($proc.Id)"
|
||||
Write-Host ""
|
||||
|
||||
# 等待应用初始化
|
||||
Write-Host "Waiting for SimplySign Desktop to initialize..."
|
||||
Start-Sleep -Seconds 10
|
||||
|
||||
# Allow our process to set foreground window
|
||||
[Win32]::AllowSetForegroundWindow($proc.Id) | Out-Null
|
||||
|
||||
# Create WScript.Shell for window interaction
|
||||
$wshell = New-Object -ComObject WScript.Shell
|
||||
|
||||
# 尝试聚焦 SimplySign Desktop 窗口
|
||||
Write-Host "Attempting to focus SimplySign Desktop window..."
|
||||
$focused = $false
|
||||
|
||||
# Method 1: Use Win32 API to find and activate window
|
||||
$mainWindowHandle = $proc.MainWindowHandle
|
||||
if ($mainWindowHandle -ne $null -and $mainWindowHandle -ne [IntPtr]::Zero) {
|
||||
[Win32]::ShowWindow($mainWindowHandle, [Win32]::SW_RESTORE) | Out-Null
|
||||
[Win32]::SetForegroundWindow($mainWindowHandle) | Out-Null
|
||||
$focused = $true
|
||||
Write-Host "Focused via MainWindowHandle"
|
||||
} else {
|
||||
Write-Host "MainWindowHandle not available yet, will try other methods..."
|
||||
}
|
||||
|
||||
# Method 2: Find window by title
|
||||
if (-not $focused) {
|
||||
$hwnd = [Win32]::FindWindow($null, "SimplySign Desktop")
|
||||
if ($hwnd -ne [IntPtr]::Zero) {
|
||||
[Win32]::ShowWindow($hwnd, [Win32]::SW_RESTORE) | Out-Null
|
||||
[Win32]::SetForegroundWindow($hwnd) | Out-Null
|
||||
$focused = $true
|
||||
Write-Host "Focused via FindWindow"
|
||||
}
|
||||
}
|
||||
|
||||
# Method 3: AppActivate with extended retries
|
||||
for ($i = 0; (-not $focused) -and ($i -lt 20); $i++) {
|
||||
Start-Sleep -Milliseconds 1000
|
||||
|
||||
# Refresh process handle
|
||||
$proc.Refresh()
|
||||
$mainWindowHandle = $proc.MainWindowHandle
|
||||
if ($mainWindowHandle -ne [IntPtr]::Zero) {
|
||||
[Win32]::ShowWindow($mainWindowHandle, [Win32]::SW_RESTORE) | Out-Null
|
||||
[Win32]::SetForegroundWindow($mainWindowHandle) | Out-Null
|
||||
$focused = $true
|
||||
Write-Host "Focused via MainWindowHandle (attempt $($i + 1))"
|
||||
break
|
||||
}
|
||||
|
||||
$focused = $wshell.AppActivate($proc.Id)
|
||||
if (-not $focused) {
|
||||
$focused = $wshell.AppActivate('SimplySign Desktop')
|
||||
}
|
||||
if (-not $focused) {
|
||||
$focused = $wshell.AppActivate('SimplySign')
|
||||
}
|
||||
Write-Host "Focus attempt $($i + 1): $focused"
|
||||
}
|
||||
|
||||
if (-not $focused) {
|
||||
Write-Host "WARNING: Could not bring SimplySign Desktop to foreground via window handle"
|
||||
Write-Host "SimplySign Desktop may be running as a background/tray process - proceeding with credential injection anyway"
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
|
||||
# Small delay to ensure window is ready for input
|
||||
Start-Sleep -Milliseconds 400
|
||||
|
||||
# 注入凭据: Username + TAB + TOTP + ENTER
|
||||
Write-Host "Injecting credentials into login dialog..."
|
||||
Write-Host "Sending: Username -> TAB -> TOTP -> ENTER"
|
||||
|
||||
$wshell.SendKeys($UserId)
|
||||
Start-Sleep -Milliseconds 200
|
||||
$wshell.SendKeys("{TAB}")
|
||||
Start-Sleep -Milliseconds 200
|
||||
$wshell.SendKeys($otp)
|
||||
Start-Sleep -Milliseconds 200
|
||||
$wshell.SendKeys("{ENTER}")
|
||||
|
||||
Write-Host "Credentials injected successfully"
|
||||
Write-Host ""
|
||||
|
||||
# 等待认证处理
|
||||
Write-Host "Waiting for authentication to complete..."
|
||||
Start-Sleep -Seconds 5
|
||||
|
||||
# 验证证书是否可用
|
||||
if ($normalizedExpectedSha1) {
|
||||
Write-Host "Validating certificate availability for expected signing certificate"
|
||||
$ready = $false
|
||||
$withPrivateKey = $false
|
||||
|
||||
for ($i = 0; $i -lt 15; $i++) {
|
||||
$matched = Find-CertificateByThumbprint -Thumbprint $normalizedExpectedSha1
|
||||
if ($matched.Count -gt 0) {
|
||||
$ready = $true
|
||||
$withPrivateKey = ($matched | Where-Object { $_.HasPrivateKey }).Count -gt 0
|
||||
if ($withPrivateKey) {
|
||||
Write-Host "Certificate is available and has private key"
|
||||
break
|
||||
}
|
||||
}
|
||||
Start-Sleep -Seconds 2
|
||||
}
|
||||
|
||||
if ($ready -and $withPrivateKey) {
|
||||
$authSuccess = $true
|
||||
Write-Host "SUCCESS: Authentication verified - certificate with private key is available"
|
||||
break
|
||||
}
|
||||
|
||||
# 认证失败，准备重试
|
||||
if (-not $ready) {
|
||||
Write-Host "WARNING: Target certificate was not found after attempt $attempt"
|
||||
} elseif (-not $withPrivateKey) {
|
||||
Write-Host "WARNING: Target certificate found but no private key available after attempt $attempt"
|
||||
}
|
||||
} else {
|
||||
# 没有指定证书 SHA1，无法验证，假设成功
|
||||
$authSuccess = $true
|
||||
break
|
||||
}
|
||||
|
||||
# 如果不是最后一次尝试，等待后重试
|
||||
if ($attempt -lt $maxAttempts) {
|
||||
Write-Host "Authentication attempt $attempt failed, will retry in 5 seconds..."
|
||||
# 终止当前 SimplySign Desktop 进程
|
||||
$stillRunning = Get-Process -Id $proc.Id -ErrorAction SilentlyContinue
|
||||
if ($stillRunning) {
|
||||
Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
Start-Sleep -Seconds 5
|
||||
}
|
||||
}
|
||||
|
||||
if (-not $authSuccess) {
|
||||
Write-Host ""
|
||||
Write-Host "ERROR: Authentication failed after $maxAttempts attempts"
|
||||
Write-Host "All TOTP injection attempts were unsuccessful"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Verify SimplySign Desktop is still running
|
||||
$stillRunning = Get-Process -Id $proc.Id -ErrorAction SilentlyContinue
|
||||
if ($stillRunning) {
|
||||
Write-Host "SUCCESS: SimplySign Desktop is running"
|
||||
Write-Host "Authentication should be complete"
|
||||
Write-Host "Cloud certificate should now be available"
|
||||
} else {
|
||||
Write-Host "WARNING: SimplySign Desktop process has exited"
|
||||
Write-Host "This may indicate authentication failure"
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
Write-Host "=== TOTP AUTHENTICATION COMPLETE ==="
|
||||
Write-Host "Registry pre-configuration + credential injection finished"
|
||||
138
.github/scripts/install-simplysign.sh
vendored
Normal file
138
.github/scripts/install-simplysign.sh
vendored
Normal file
@@ -0,0 +1,138 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Install SimplySign Desktop - Clean MSI Installation
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "=== INSTALLING SIMPLYSIGN DESKTOP ==="
|
||||
echo "Using proven installation method from successful testing..."
|
||||
|
||||
# Download SimplySign Desktop MSI
|
||||
CERTUM_INSTALLER="SimplySignDesktop.msi"
|
||||
CERTUM_DOWNLOAD_PAGE="https://pomoc.certum.pl/pl/oprogramowanie/procertum-smartsign/"
|
||||
FALLBACK_MSI_URL="https://files.certum.eu/software/SimplySignDesktop/Windows/9.4.3.90/SimplySignDesktop-9.4.3.90-64-bit-pl.msi"
|
||||
echo "Downloading SimplySign Desktop MSI..."
|
||||
|
||||
# Resolve the latest 64-bit MSI URL from Certum software page to avoid hardcoded version expiry.
|
||||
PAGE_CONTENT="$(curl -L "$CERTUM_DOWNLOAD_PAGE" --fail --max-time 60 || true)"
|
||||
|
||||
MSI_CANDIDATES="$(printf '%s' "$PAGE_CONTENT" | grep -oE 'https://(www\.)?files\.certum\.eu/software/SimplySignDesktop/Windows/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/SimplySignDesktop-[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-64-bit[^"[:space:]]*\.msi' | sort -u || true)"
|
||||
|
||||
DOWNLOAD_URL=""
|
||||
if [ -n "$MSI_CANDIDATES" ]; then
|
||||
LATEST_VERSION="$(printf '%s\n' "$MSI_CANDIDATES" | sed -E 's#^.*/Windows/([0-9.]+)/.*$#\1#' | sort -V | tail -n1)"
|
||||
LATEST_VERSION_URLS="$(printf '%s\n' "$MSI_CANDIDATES" | grep "/Windows/${LATEST_VERSION}/" || true)"
|
||||
DOWNLOAD_URL="$(printf '%s\n' "$LATEST_VERSION_URLS" | grep -- '-64-bit-pl\.msi$' | head -n1 || true)"
|
||||
|
||||
if [ -z "$DOWNLOAD_URL" ]; then
|
||||
DOWNLOAD_URL="$(printf '%s\n' "$LATEST_VERSION_URLS" | head -n1)"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$DOWNLOAD_URL" ]; then
|
||||
echo "WARNING: Could not resolve latest MSI URL from Certum page, using fallback URL"
|
||||
DOWNLOAD_URL="$FALLBACK_MSI_URL"
|
||||
fi
|
||||
|
||||
RESOLVED_VERSION="$(printf '%s' "$DOWNLOAD_URL" | sed -E 's#^.*/Windows/([0-9.]+)/.*$#\1#')"
|
||||
echo "Resolved SimplySign Desktop MSI version: $RESOLVED_VERSION"
|
||||
|
||||
if curl -L "$DOWNLOAD_URL" -o "$CERTUM_INSTALLER" --fail --max-time 60; then
|
||||
echo "✅ Downloaded SimplySign Desktop MSI ($(ls -lh "$CERTUM_INSTALLER" | awk '{print $5}'))"
|
||||
else
|
||||
echo "❌ Failed to download SimplySign Desktop"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Install with proven method (matching successful test)
|
||||
echo "Installing SimplySign Desktop..."
|
||||
echo "Full command: msiexec /i \"$CERTUM_INSTALLER\" /quiet /norestart /l*v install.log ALLUSERS=1 REBOOT=ReallySuppress"
|
||||
|
||||
# Check for administrative privileges (like the successful test)
|
||||
ADMIN_RIGHTS=false
|
||||
if powershell -Command "([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)" 2>/dev/null; then
|
||||
echo "✅ Running with administrative privileges"
|
||||
ADMIN_RIGHTS=true
|
||||
else
|
||||
echo "⚠️ No explicit administrative privileges detected"
|
||||
fi
|
||||
|
||||
# Use the exact method that worked: PowerShell with admin privileges
|
||||
if [ "$ADMIN_RIGHTS" = true ]; then
|
||||
echo "Running MSI installation with administrator privileges..."
|
||||
powershell -Command "Start-Process -FilePath 'msiexec.exe' -ArgumentList '/i', '\"$CERTUM_INSTALLER\"', '/quiet', '/norestart', '/l*v', 'install.log', 'ALLUSERS=1', 'REBOOT=ReallySuppress' -Wait -NoNewWindow -PassThru" &
|
||||
INSTALL_PID=$!
|
||||
else
|
||||
echo "Running MSI installation without explicit admin elevation..."
|
||||
timeout 300 msiexec /i "$CERTUM_INSTALLER" /quiet /norestart /l*v install.log ALLUSERS=1 REBOOT=ReallySuppress &
|
||||
INSTALL_PID=$!
|
||||
fi
|
||||
|
||||
# Monitor with the same logic as successful test
|
||||
echo "Monitoring installation progress..."
|
||||
INSTALL_START_TIME=$(date +%s)
|
||||
sleep 10
|
||||
|
||||
# Check if msiexec process is actually running (like successful test)
|
||||
if kill -0 $INSTALL_PID 2>/dev/null; then
|
||||
echo "MSI installation process is running (PID: $INSTALL_PID)"
|
||||
|
||||
# Monitor for up to 3 minutes with status updates
|
||||
for i in {1..18}; do
|
||||
sleep 10
|
||||
CURRENT_TIME=$(date +%s)
|
||||
ELAPSED=$((CURRENT_TIME - INSTALL_START_TIME))
|
||||
|
||||
if kill -0 $INSTALL_PID 2>/dev/null; then
|
||||
echo "Installation still running after ${ELAPSED} seconds..."
|
||||
|
||||
# Check log file growth
|
||||
if [ -f "install.log" ]; then
|
||||
LOG_SIZE=$(stat -c%s "install.log" 2>/dev/null || stat -f%z "install.log" 2>/dev/null || echo 0)
|
||||
echo " Log file size: $LOG_SIZE bytes"
|
||||
fi
|
||||
else
|
||||
echo "MSI installation completed after ${ELAPSED} seconds"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
# Final wait if still running
|
||||
if kill -0 $INSTALL_PID 2>/dev/null; then
|
||||
echo "Installation taking longer, waiting for completion..."
|
||||
wait $INSTALL_PID 2>/dev/null || echo "Installation process ended"
|
||||
fi
|
||||
else
|
||||
echo "MSI installation process ended quickly"
|
||||
fi
|
||||
|
||||
# Quick success check using proven patterns
|
||||
INSTALLATION_SUCCESSFUL=false
|
||||
if [ -f "install.log" ]; then
|
||||
if grep -qi "Installation.*operation.*completed.*successfully\|Installation.*success.*or.*error.*status.*0\|MainEngineThread.*is.*returning.*0\|Windows.*Installer.*installed.*the.*product" install.log 2>/dev/null; then
|
||||
echo "✅ Installation successful (confirmed by log patterns)"
|
||||
INSTALLATION_SUCCESSFUL=true
|
||||
fi
|
||||
fi
|
||||
|
||||
# Verify installation directory
|
||||
INSTALL_PATH="/c/Program Files/Certum/SimplySign Desktop"
|
||||
if [ -d "$INSTALL_PATH" ]; then
|
||||
echo "✅ SimplySign Desktop installed successfully"
|
||||
echo "✅ Virtual card emulation now active for code signing"
|
||||
INSTALLATION_SUCCESSFUL=true
|
||||
|
||||
# Set output for GitHub Actions
|
||||
if [ -n "${GITHUB_OUTPUT:-}" ]; then
|
||||
echo "SIMPLYSIGN_PATH=$INSTALL_PATH" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$INSTALLATION_SUCCESSFUL" = false ]; then
|
||||
echo "❌ Installation verification failed"
|
||||
echo "Last 10 lines of install log:"
|
||||
tail -10 install.log 2>/dev/null || echo "No install log available"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "🎉 SimplySign Desktop installation completed successfully!"
|
||||
182
.github/scripts/sign-windows.ps1
vendored
Normal file
182
.github/scripts/sign-windows.ps1
vendored
Normal file
@@ -0,0 +1,182 @@
|
||||
# Sign-Windows.ps1
|
||||
# Signs Windows EasyTier executables and libraries with a Certum SimplySign cloud certificate.
|
||||
|
||||
param(
|
||||
[string]$TargetDirectory = "sign_binaries",
|
||||
[string]$CertificateSHA1 = $env:CERTUM_CERTIFICATE_SHA1,
|
||||
[string]$TimestampServer = "http://time.certum.pl"
|
||||
)
|
||||
|
||||
function Get-LatestSignToolPath {
|
||||
$windowsKitsBin = Join-Path ${env:ProgramFiles(x86)} "Windows Kits\10\bin"
|
||||
if (Test-Path $windowsKitsBin) {
|
||||
$candidate = (
|
||||
Get-ChildItem -Path $windowsKitsBin -Recurse -File -Filter "signtool.exe" -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.FullName -match "\\x64\\signtool\.exe$" } |
|
||||
ForEach-Object {
|
||||
$version = [version]"0.0"
|
||||
if ($_.FullName -match "\\bin\\([^\\]+)\\x64\\signtool\.exe$") {
|
||||
try {
|
||||
$version = [version]$matches[1]
|
||||
} catch {
|
||||
$version = [version]"0.0"
|
||||
}
|
||||
}
|
||||
[PSCustomObject]@{
|
||||
Path = $_.FullName
|
||||
Version = $version
|
||||
}
|
||||
} |
|
||||
Sort-Object -Property Version -Descending |
|
||||
Select-Object -First 1
|
||||
)
|
||||
|
||||
if ($candidate) {
|
||||
return $candidate.Path
|
||||
}
|
||||
}
|
||||
|
||||
$cmd = Get-Command "signtool.exe" -ErrorAction SilentlyContinue
|
||||
if ($cmd) {
|
||||
return $cmd.Source
|
||||
}
|
||||
|
||||
return $null
|
||||
}
|
||||
|
||||
function Find-TargetCertificate {
|
||||
param([string]$Thumbprint)
|
||||
|
||||
$all = Get-ChildItem -Path "Cert:\CurrentUser\My", "Cert:\LocalMachine\My" -ErrorAction SilentlyContinue
|
||||
# 对证书库中的 Thumbprint 同样做规范化（去除不可见字符、统一大写），避免 BOM 或格式差异导致匹配失败
|
||||
return @($all | Where-Object {
|
||||
$normalizedStoreThumprint = ($_.Thumbprint -replace "[^a-fA-F0-9]", "").ToUpperInvariant()
|
||||
$normalizedStoreThumprint -eq $Thumbprint
|
||||
})
|
||||
}
|
||||
|
||||
function Show-PrivateKeyCertificateHints {
|
||||
$candidates = Get-ChildItem -Path "Cert:\CurrentUser\My", "Cert:\LocalMachine\My" -ErrorAction SilentlyContinue |
|
||||
Where-Object { $_.HasPrivateKey }
|
||||
|
||||
if (($null -eq $candidates) -or ($candidates.Count -eq 0)) {
|
||||
Write-Host "No certificates with private keys were found in Personal stores"
|
||||
return
|
||||
}
|
||||
|
||||
Write-Host "Certificates with private keys are present in Personal stores, but details are hidden for security"
|
||||
}
|
||||
|
||||
Write-Host "=== WINDOWS BINARY SIGNING (CERTUM SIMPLYSIGN) ==="
|
||||
Write-Host "Target directory: $TargetDirectory"
|
||||
|
||||
if (-not (Test-Path $TargetDirectory)) {
|
||||
Write-Host "ERROR: Target directory not found: $TargetDirectory"
|
||||
exit 1
|
||||
}
|
||||
|
||||
if (-not $CertificateSHA1) {
|
||||
Write-Host "ERROR: CERTUM_CERTIFICATE_SHA1 environment variable not provided"
|
||||
exit 1
|
||||
}
|
||||
|
||||
$normalizedSha1 = ($CertificateSHA1 -replace "[^a-fA-F0-9]", "").ToUpperInvariant()
|
||||
if ($normalizedSha1.Length -ne 40) {
|
||||
Write-Host "ERROR: CERTUM_CERTIFICATE_SHA1 is invalid after normalization"
|
||||
Write-Host "Raw length: $($CertificateSHA1.Length), normalized length: $($normalizedSha1.Length)"
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host "Expected signing certificate thumbprint has been received (masked)"
|
||||
|
||||
$targetCerts = Find-TargetCertificate -Thumbprint $normalizedSha1
|
||||
if (($null -eq $targetCerts) -or ($targetCerts.Count -eq 0)) {
|
||||
Write-Host "ERROR: Target certificate not found in Cert:\CurrentUser\My or Cert:\LocalMachine\My"
|
||||
Write-Host "Authentication likely failed or CERTUM_CERTIFICATE_SHA1 is incorrect"
|
||||
Show-PrivateKeyCertificateHints
|
||||
exit 1
|
||||
}
|
||||
|
||||
$targetWithPrivateKey = @($targetCerts | Where-Object { $_.HasPrivateKey })
|
||||
if (($null -eq $targetWithPrivateKey) -or ($targetWithPrivateKey.Count -eq 0)) {
|
||||
Write-Host "ERROR: Target certificate exists but has no available private key"
|
||||
Write-Host "Signing cannot continue without private key access"
|
||||
Show-PrivateKeyCertificateHints
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host "Locating signtool..."
|
||||
$signTool = Get-LatestSignToolPath
|
||||
if (-not $signTool) {
|
||||
Write-Host "ERROR: signtool.exe not found"
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host "Found signtool: $signTool"
|
||||
|
||||
Write-Host "Scanning for Windows binaries to sign (.exe, .dll)..."
|
||||
$filesToSign = Get-ChildItem -Path $TargetDirectory -Recurse -File |
|
||||
Where-Object { $_.Extension -iin @(".exe", ".dll") }
|
||||
|
||||
if (($null -eq $filesToSign) -or ($filesToSign.Count -eq 0)) {
|
||||
Write-Host "WARNING: No signable files (.exe, .dll) found to sign"
|
||||
exit 0
|
||||
}
|
||||
|
||||
Write-Host "Found $($filesToSign.Count) files to sign"
|
||||
$signedCount = 0
|
||||
$failedCount = 0
|
||||
|
||||
foreach ($file in $filesToSign) {
|
||||
Write-Host "=== Signing: $($file.Name) ==="
|
||||
Write-Host "Path: $($file.FullName)"
|
||||
|
||||
$attempts = @(
|
||||
@{ Name = "SHA1 thumbprint + /td SHA256"; Args = @("sign", "/sha1", $normalizedSha1, "/tr", $TimestampServer, "/td", "SHA256", "/fd", "SHA256", "/v", $file.FullName) },
|
||||
@{ Name = "SHA1 thumbprint in CurrentUser\\My"; Args = @("sign", "/sha1", $normalizedSha1, "/s", "My", "/tr", $TimestampServer, "/td", "SHA256", "/fd", "SHA256", "/v", $file.FullName) },
|
||||
@{ Name = "SHA1 thumbprint in LocalMachine\\My"; Args = @("sign", "/sha1", $normalizedSha1, "/sm", "/s", "My", "/tr", $TimestampServer, "/td", "SHA256", "/fd", "SHA256", "/v", $file.FullName) },
|
||||
@{ Name = "Auto-select cert (fallback)"; Args = @("sign", "/a", "/tr", $TimestampServer, "/td", "SHA256", "/fd", "SHA256", "/v", $file.FullName) }
|
||||
)
|
||||
|
||||
$signed = $false
|
||||
foreach ($attempt in $attempts) {
|
||||
Write-Host "Attempt: $($attempt.Name)"
|
||||
$signOutput = & $signTool @($attempt.Args) 2>&1
|
||||
if ($LASTEXITCODE -eq 0) {
|
||||
Write-Host "SUCCESS: $($attempt.Name)"
|
||||
$signed = $true
|
||||
break
|
||||
}
|
||||
|
||||
Write-Host "FAILED: $($attempt.Name)"
|
||||
Write-Host "signtool returned a non-zero exit code; detailed output is hidden for security"
|
||||
}
|
||||
|
||||
if ($signed) {
|
||||
$signedCount++
|
||||
$verifyOutput = & $signTool verify /pa /v $file.FullName 2>&1
|
||||
if ($LASTEXITCODE -eq 0) {
|
||||
Write-Host "VERIFIED: Signature verification successful"
|
||||
} else {
|
||||
Write-Host "WARNING: Signature verification failed"
|
||||
Write-Host "Detailed verification output is hidden for security"
|
||||
}
|
||||
} else {
|
||||
$failedCount++
|
||||
}
|
||||
|
||||
Write-Host ""
|
||||
}
|
||||
|
||||
Write-Host "=== SIGNING SUMMARY ==="
|
||||
Write-Host "Total files: $($filesToSign.Count)"
|
||||
Write-Host "Successfully signed: $signedCount"
|
||||
Write-Host "Failed to sign: $failedCount"
|
||||
|
||||
if ($failedCount -eq 0) {
|
||||
Write-Host "ALL WINDOWS BINARIES SIGNED SUCCESSFULLY"
|
||||
exit 0
|
||||
}
|
||||
|
||||
Write-Host "SOME WINDOWS BINARIES FAILED TO SIGN"
|
||||
exit 1
|
||||
Reference in New Issue
Block a user