From c801801ac8d086016927fb51848891ee530c1df3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Luis=20=C3=81ngel=20San=20Mart=C3=ADn?=
 <luisangelsm@gmail.com>
Date: Thu, 15 Sep 2022 15:39:18 +0200
Subject: [PATCH] Try to codesign windows installers

---
 azure-pipelines-windows-template-qt6.yml | 11 ++++++++++-
 azure-pipelines-windows-template.yml     | 11 ++++++++++-
 ci/win/create_installer.cmd              |  4 ++--
 3 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/azure-pipelines-windows-template-qt6.yml b/azure-pipelines-windows-template-qt6.yml
index cb38fba8..0a83adf9 100644
--- a/azure-pipelines-windows-template-qt6.yml
+++ b/azure-pipelines-windows-template-qt6.yml
@@ -11,6 +11,9 @@ parameters:
 jobs:
 - job: ${{ parameters.name }}
   dependsOn: CodeFormatValidation
+  variables:
+  - ${{ if and(eq(variables['System.TeamFoundationCollectionUri'], 'https://dev.azure.com/luisangelsm/'), or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq(variables['Build.SourceBranch'], 'refs/heads/develop'))) }}:
+    - group: windows-codesign
   pool:
     vmImage: 'windows-2019'
   steps:
@@ -38,10 +41,16 @@ jobs:
       set PATH=C:\Qt\${{ parameters.qt_version }}\${{ parameters.qt_spec }}\bin;%PATH%
       nmake check TESTARGS="-maxwarnings 100000"
     displayName: 'Run tests'
+  - ${{ if and(eq(variables['System.TeamFoundationCollectionUri'], 'https://dev.azure.com/luisangelsm/'), or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq(variables['Build.SourceBranch'], 'refs/heads/develop'))) }}:
+    - task: DownloadSecureFile@1
+      name: pdxFile
+      displayName: 'Get the pfx file certificate'
+      inputs:
+        secureFile: 'certificate.pdx'
   - script: |
       set PATH=C:\Qt\${{ parameters.qt_version }}\${{ parameters.qt_spec }}\bin;%PATH%
       cd $(Build.SourcesDirectory)\ci\win
-      .\create_installer.cmd ${{ parameters.architecture }} 7z $(Build.BuildNumber) qt6
+      .\create_installer.cmd ${{ parameters.architecture }} 7z $(Build.BuildNumber) qt6 $(pdxFile) $(pdxPassword)
     displayName: 'Create installer'
   - task: CopyFiles@2
     inputs:
diff --git a/azure-pipelines-windows-template.yml b/azure-pipelines-windows-template.yml
index 23d039d9..8fae23f7 100644
--- a/azure-pipelines-windows-template.yml
+++ b/azure-pipelines-windows-template.yml
@@ -11,6 +11,9 @@ parameters:
 jobs:
 - job: ${{ parameters.name }}
   dependsOn: CodeFormatValidation
+  variables:
+  - ${{ if and(eq(variables['System.TeamFoundationCollectionUri'], 'https://dev.azure.com/luisangelsm/'), or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq(variables['Build.SourceBranch'], 'refs/heads/develop'))) }}:
+    - group: windows-codesign
   pool:
     vmImage: 'windows-2019'
   steps:
@@ -38,10 +41,16 @@ jobs:
       set PATH=C:\Qt\${{ parameters.qt_version }}\${{ parameters.qt_spec }}\bin;%PATH%
       nmake check TESTARGS="-maxwarnings 100000"
     displayName: 'Run tests'
+  - ${{ if and(eq(variables['System.TeamFoundationCollectionUri'], 'https://dev.azure.com/luisangelsm/'), or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq(variables['Build.SourceBranch'], 'refs/heads/develop'))) }}:
+    - task: DownloadSecureFile@1
+      name: pdxFile
+      displayName: 'Get the pfx file certificate'
+      inputs:
+        secureFile: 'certificate.pdx'
   - script: |
       set PATH=C:\Qt\${{ parameters.qt_version }}\${{ parameters.qt_spec }}\bin;%PATH%
       cd $(Build.SourcesDirectory)\ci\win
-      .\create_installer.cmd ${{ parameters.architecture }} 7z $(Build.BuildNumber)
+      .\create_installer.cmd ${{ parameters.architecture }} 7z $(Build.BuildNumber) qt5 $(pdxFile) $(pdxPassword)
     displayName: 'Create installer'
   - task: CopyFiles@2
     inputs:
diff --git a/ci/win/create_installer.cmd b/ci/win/create_installer.cmd
index c58d066b..b3b729e7 100644
--- a/ci/win/create_installer.cmd
+++ b/ci/win/create_installer.cmd
@@ -59,9 +59,9 @@ if "%1"=="x86" (
 )
 
 if "%4"=="qt6" (
-	iscc /DVERSION=%VERSION% /DPLATFORM=%1 /DCOMPRESSED_ARCHIVE_BACKEND=%2 /DBUILD_NUMBER=%3 build_installer_qt6.iss || exit /b
+	iscc /DVERSION=%VERSION% /DPLATFORM=%1 /DCOMPRESSED_ARCHIVE_BACKEND=%2 /DBUILD_NUMBER=%3 build_installer_qt6.iss "/Ssigntool=signtool.exe sign /f %5 /p %6 $f" || exit /b
 ) else (
-	iscc /DVERSION=%VERSION% /DPLATFORM=%1 /DCOMPRESSED_ARCHIVE_BACKEND=%2 /DBUILD_NUMBER=%3 build_installer.iss || exit /b
+	iscc /DVERSION=%VERSION% /DPLATFORM=%1 /DCOMPRESSED_ARCHIVE_BACKEND=%2 /DBUILD_NUMBER=%3 build_installer.iss "/Ssigntool=signtool.exe sign /f %5 /p %6 $f" || exit /b
 )
 
 cd ..
\ No newline at end of file