Mailspring/app/build/create-signed-windows-installer.js
Ben Gotow 38672d50cf
Migrate Windows code signing to Azure Trusted Signing (#2552)
Replace traditional P12 certificate-based signing with Azure Trusted Signing
for Windows builds. This provides better security and simplifies certificate
management by using Azure's cloud-based signing service.

Changes:
- Remove P12 certificate setup step from workflow
- Add Azure Trusted Signing action to sign application files (exe, dll)
- Add Azure Trusted Signing action to sign the installer after creation
- Update create-signed-windows-installer.js to remove certificate options

Required secrets:
- AZURE_TENANT_ID
- AZURE_CLIENT_ID
- AZURE_CLIENT_SECRET
- AZURE_TRUSTED_SIGNING_ENDPOINT
- AZURE_TRUSTED_SIGNING_ACCOUNT_NAME
- AZURE_TRUSTED_SIGNING_CERT_PROFILE_NAME

Co-authored-by: Claude <noreply@anthropic.com>
2026-01-07 17:21:46 -06:00

43 lines
1.4 KiB
JavaScript

/* eslint import/no-dynamic-require:0 */
/**
* NOTE: Due to path issues, this script must be run outside of grunt
* directly from a powershell command.
*
* Code signing is handled separately by Azure Trusted Signing action in the
* GitHub workflow. This script creates an unsigned installer which is then
* signed by the workflow after creation.
*/
const path = require('path');
const { createWindowsInstaller } = require('electron-winstaller');
const appDir = path.join(__dirname, '..');
const { version } = require(path.join(appDir, 'package.json'));
const config = {
usePackageJson: false,
outputDirectory: path.join(appDir, 'dist'),
appDirectory: path.join(appDir, 'dist', 'mailspring-win32-x64'),
loadingGif: path.join(appDir, 'build', 'resources', 'win', 'loading.gif'),
iconUrl: 'http://mailspring-builds.s3.amazonaws.com/assets/mailspring.ico',
description: 'Mailspring',
version: version,
title: 'Mailspring',
authors: 'Foundry 376, LLC',
setupIcon: path.join(appDir, 'build', 'resources', 'win', 'mailspring.ico'),
setupExe: 'MailspringSetup.exe',
exe: 'mailspring.exe',
name: 'Mailspring',
};
console.log(config);
console.log('---> Starting');
createWindowsInstaller(config)
.then(() => {
console.log('createWindowsInstaller succeeded.');
process.exit(0);
})
.catch(e => {
console.error(`createWindowsInstaller failed: ${e.message}`);
process.exit(1);
});