Merge branch 'prometheansacrifice@sign-windows-installer-3' into 'dev'

CI: Sign Ligo windows installer with a test developer certificate

See merge request ligolang/ligo!2686

.ci/.gitlab-ci-npm.yml

@@ -33,6 +33,7 @@ esy-windows:
     - cp ./LICENSE.md ./windows-installer
     - cp ./tools/webide-new/ligo-webide-frontend/ligo-ide/public/favicon.ico ./windows-installer
     - cd windows-installer; makensis .\WindowsInstaller.nsi; mv ligo_installer.exe ../ligo_installer.exe ; cd ..
+    - ./scripts/signInstallerWithTestCertificates.ps1 -Path ./ligo_installer.exe -Password $env:TEST_CERTIFICATE_PASSWORD
     - bash -c "esy release || esy release || esy release"
     - mv _release platform-windows-x64
   artifacts:

scripts/signInstallerWithTestCertificates.ps1

@@ -0,0 +1,36 @@
+param([switch]$Elevated, $Path, $Password)
+
+function Test-Admin {
+    $currentUser = New-Object Security.Principal.WindowsPrincipal $([Security.Principal.WindowsIdentity]::GetCurrent())
+    $currentUser.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
+}
+
+if ((Test-Admin) -eq $false)  {
+    if ($elevated) {
+        # tried to elevate, did not work, aborting
+	echo "Could not elevate"
+	exit 1
+    } else {
+        Start-Process powershell.exe -Verb RunAs -ArgumentList ("-noprofile -file {0} -Password ${env:TEST_CERTIFICATE_PASSWORD} -Path $(Resolve-Path $Path) -elevated" -f ($myinvocation.MyCommand.Definition))
+    }
+    exit
+}
+
+
+$TestCertificatePassword = "default"
+if ($env:TEST_CERTIFICATE_PASSWORD) {
+    $TestCertificatePassword = $env:TEST_CERTIFICATE_PASSWORD
+}
+if ($Password) {
+    $TestCertificatePassword = $Password
+}
+
+$cert = New-SelfSignedCertificate -DnsName ligolang -CertStoreLocation cert:\LocalMachine\My -type CodeSigning
+$pwd = ConvertTo-SecureString -String $TestCertificatePassword -Force -AsPlainText
+Export-PfxCertificate -cert $cert -FilePath ligolang-certs.pfx -Password $pwd
+$env:PATH = $env:PATH + ';C:\Program Files (x86)\Windows Kits\10\App Certification Kit;C:\Program Files (x86)\Windows Kits\10\bin\x64'
+signtool.exe sign /a /f ligolang-certs.pfx /p $TestCertificatePassword /fd SHA256 $Path
+
+if (!$?) {
+    echo "Could not sign ${Path}"
+}