148 lines
4.8 KiB
TypeScript
148 lines
4.8 KiB
TypeScript
/**
|
|
* signing-config.ts — Pure utilities for managing code-signing fields in
|
|
* Tauri's `tauri.build-override.conf.json`.
|
|
*
|
|
* Used by:
|
|
* - `apply-signing-config.mjs` (LAUNCH-06 pilot wiring)
|
|
* - `tauri:sign:pilot:win:apply` npm script
|
|
*
|
|
* No filesystem side effects — safe to import in tests. The thin CLI wrapper
|
|
* does the file I/O.
|
|
*
|
|
* Reference: docs/code-signing-pilot-and-launch.md §1.1 (Windows self-sign)
|
|
* docs/code-signing-pilot-and-launch.md §1.2 (macOS ad-hoc)
|
|
*/
|
|
|
|
// ─── Types ──────────────────────────────────────────────────────────────────
|
|
|
|
export interface TauriBundleWindows {
|
|
certificateThumbprint?: string;
|
|
digestAlgorithm?: string;
|
|
timestampUrl?: string;
|
|
[key: string]: unknown;
|
|
}
|
|
|
|
export interface TauriBundleMacOS {
|
|
signingIdentity?: string;
|
|
[key: string]: unknown;
|
|
}
|
|
|
|
export interface TauriBundle {
|
|
windows?: TauriBundleWindows;
|
|
macOS?: TauriBundleMacOS;
|
|
[key: string]: unknown;
|
|
}
|
|
|
|
export interface TauriOverrideConfig {
|
|
bundle?: TauriBundle;
|
|
[key: string]: unknown;
|
|
}
|
|
|
|
export interface WindowsSigningOptions {
|
|
digestAlgorithm?: string;
|
|
timestampUrl?: string;
|
|
}
|
|
|
|
// ─── Defaults ───────────────────────────────────────────────────────────────
|
|
|
|
const DEFAULT_DIGEST_ALGORITHM = 'sha256';
|
|
const DEFAULT_TIMESTAMP_URL = 'http://timestamp.digicert.com';
|
|
const MACOS_ADHOC_IDENTITY = '-';
|
|
const THUMBPRINT_LENGTH = 40;
|
|
const HEX_PATTERN = /^[0-9A-F]+$/;
|
|
|
|
// ─── parseThumbprintString ──────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Normalise a raw thumbprint string into the canonical 40-char uppercase form.
|
|
*
|
|
* Accepts whitespace anywhere (tab, space, newline) since PowerShell's
|
|
* `$cert.Thumbprint` plus clipboard round-tripping can introduce arbitrary
|
|
* spacing. Throws when the result is not exactly 40 hex characters.
|
|
*/
|
|
export function parseThumbprintString(raw: string): string {
|
|
if (!raw || raw.trim().length === 0) {
|
|
throw new Error('Thumbprint is empty — cert generation may have failed.');
|
|
}
|
|
|
|
const compact = raw.replace(/\s+/g, '').toUpperCase();
|
|
|
|
if (compact.length !== THUMBPRINT_LENGTH || !HEX_PATTERN.test(compact)) {
|
|
throw new Error(
|
|
`Thumbprint must be 40 hex characters; got ${compact.length} chars (sample: "${compact.slice(0, 16)}...").`,
|
|
);
|
|
}
|
|
|
|
return compact;
|
|
}
|
|
|
|
// ─── addWindowsSigningToOverride ────────────────────────────────────────────
|
|
|
|
/**
|
|
* Return a new override config with Windows code-signing fields applied.
|
|
*
|
|
* Preserves all existing top-level and bundle fields; replaces only the
|
|
* three signing-specific keys under `bundle.windows`. Idempotent — calling
|
|
* twice with the same thumbprint yields an equal result.
|
|
*/
|
|
export function addWindowsSigningToOverride<T extends TauriOverrideConfig>(
|
|
config: Readonly<T>,
|
|
thumbprint: string,
|
|
options?: WindowsSigningOptions,
|
|
): T {
|
|
const normalisedThumbprint = parseThumbprintString(thumbprint);
|
|
const digestAlgorithm = options?.digestAlgorithm ?? DEFAULT_DIGEST_ALGORITHM;
|
|
const timestampUrl = options?.timestampUrl ?? DEFAULT_TIMESTAMP_URL;
|
|
|
|
const existingBundle: TauriBundle = config.bundle ?? {};
|
|
const existingWindows: TauriBundleWindows = existingBundle.windows ?? {};
|
|
|
|
const nextWindows: TauriBundleWindows = {
|
|
...existingWindows,
|
|
certificateThumbprint: normalisedThumbprint,
|
|
digestAlgorithm,
|
|
timestampUrl,
|
|
};
|
|
|
|
const nextBundle: TauriBundle = {
|
|
...existingBundle,
|
|
windows: nextWindows,
|
|
};
|
|
|
|
return {
|
|
...config,
|
|
bundle: nextBundle,
|
|
};
|
|
}
|
|
|
|
// ─── addMacosAdhocToOverride ────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Return a new override config with macOS ad-hoc signing applied.
|
|
*
|
|
* Sets `bundle.macOS.signingIdentity` to "-" (Tauri / codesign sentinel for
|
|
* ad-hoc sign). Preserves all other fields. Used during pilot before a real
|
|
* Apple Developer ID cert is procured.
|
|
*/
|
|
export function addMacosAdhocToOverride<T extends TauriOverrideConfig>(
|
|
config: Readonly<T>,
|
|
): T {
|
|
const existingBundle: TauriBundle = config.bundle ?? {};
|
|
const existingMacOS: TauriBundleMacOS = existingBundle.macOS ?? {};
|
|
|
|
const nextMacOS: TauriBundleMacOS = {
|
|
...existingMacOS,
|
|
signingIdentity: MACOS_ADHOC_IDENTITY,
|
|
};
|
|
|
|
const nextBundle: TauriBundle = {
|
|
...existingBundle,
|
|
macOS: nextMacOS,
|
|
};
|
|
|
|
return {
|
|
...config,
|
|
bundle: nextBundle,
|
|
};
|
|
}
|