Skip to content

Sign .js files with 3PartyScriptsSHA2 for VS signing compliance #1666

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jesuszarate wants to merge 1 commit into from
Closed

Sign .js files with 3PartyScriptsSHA2 for VS signing compliance #1666

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion eng/Signing.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,10 @@
<FileExtensionSignInfo Include=".pyd" CertificateName="MicrosoftDotNet500" />
<FileExtensionSignInfo Include=".cat" CertificateName="MicrosoftDotNet500" />

<!-- We don't need to code sign .js files because they are not used in Windows Script Host. -->
<!-- JS files are customer-modifiable Emscripten toolchain files. They cannot be
Authenticode-signed because modifying a signed file breaks the signature.
Instead, a catalog file (emscripten-js.cat) is generated and signed to provide
integrity verification. See the GenerateCatalogFiles target in eng/emsdk.proj. -->
<FileExtensionSignInfo Update=".js" CertificateName="None" />

<!--
Expand Down
43 changes: 43 additions & 0 deletions eng/emsdk.proj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,6 +365,49 @@
<Delete Files="@(DeleteCacheFiles)" />
</Target>

<!--
Generate a catalog (.cat) file covering all .js files in the SDK package.
The .js files are customer-modifiable Emscripten toolchain files that cannot be
directly Authenticode-signed. The .cat provides integrity verification without
preventing modification. Only runs on Windows (makecat.exe is a Windows SDK tool)
and only the Windows packs are inserted into VS.
-->
<Target Name="GenerateCatalogFiles" AfterTargets="ReallyBuild" Condition="$([MSBuild]::IsOSPlatform('Windows'))">
<PropertyGroup>
<_CdfFile>$(ArtifactsObjDir)emscripten-js.cdf</_CdfFile>
<_CatOutputDir>$(ArtifactsObjDir)upstream\emscripten\</_CatOutputDir>
</PropertyGroup>

<Exec Command="powershell.exe -NoProfile -ExecutionPolicy Bypass -Command &quot;&amp; {
$$rootPath = '$(ArtifactsObjDir)upstream'
$$cdfPath = '$(_CdfFile)'
$$catPath = '$(_CatOutputDir)emscripten-js.cat'

$$files = Get-ChildItem -Path $$rootPath -Recurse -Filter '*.js' -File
$$cdf = @()
$$cdf += '[CatalogHeader]'
$$cdf += 'Name=' + $$catPath
$$cdf += 'CatalogVersion=2'
$$cdf += 'HashAlgorithms=SHA256'
$$cdf += ''
$$cdf += '[CatalogFiles]'

$$i = 0
foreach ($$f in $$files) {
$$label = 'js_' + $$i + '_' + ($$f.Name -replace '[^\w\.-]','_')
$$cdf += '&lt;hash&gt;' + $$label + '=' + $$f.FullName
$$i++
}

$$cdf | Set-Content -Path $$cdfPath -Encoding ASCII
Write-Host ('Generated CDF with ' + $$files.Count + ' .js files')
}&quot;" StandardOutputImportance="High" />

<Exec Command="makecat.exe &quot;$(_CdfFile)&quot;" StandardOutputImportance="High" />

<Message Importance="High" Text="Generated catalog file: $(_CatOutputDir)emscripten-js.cat" />
</Target>

<Target Name="ReallyPack" DependsOnTargets="Build" BeforeTargets="Pack">
<Message Importance="High" Text="Creating nuget packages..." />
<MSBuild Projects="$(MSBuildThisFileDirectory)nuget\Microsoft.NET.Runtime.Emscripten.Node\Microsoft.NET.Runtime.Emscripten.Node.pkgproj" Targets="Build" />
Expand Down
Loading