feat: allowing negative patterns to be provided for signExts as signing overrides (electron-userland#9335)

Author: mmaietta

.changeset/spicy-mails-sing.md

@@ -0,0 +1,6 @@
+---
+"electron-builder-squirrel-windows": minor
+"app-builder-lib": minor
+---
+
+feat: allowing negative patterns to be provided for `signExts` as signing overrides

packages/app-builder-lib/scheme.json

@@ -6827,7 +6827,7 @@
             }
           ],
           "default": null,
-          "description": "Explicit file extensions to also sign. Advanced option."
+          "description": "Explicit file name/extensions (`str.endsWith`) to also sign. Advanced option.\nSupports negative patterns, e.g. example that excludes `.appx` files: `[\"somefilename\", \".dll\", \"!.appx\"]`."
         },
         "signtoolOptions": {
           "anyOf": [

packages/app-builder-lib/src/options/winOptions.ts

@@ -61,7 +61,8 @@ export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
   readonly signAndEditExecutable?: boolean
 
   /**
-   * Explicit file extensions to also sign. Advanced option.
+   * Explicit file name/extensions (`str.endsWith`) to also sign. Advanced option.
+   * Supports negative patterns, e.g. example that excludes `.appx` files: `["somefilename", ".dll", "!.appx"]`.
    * @see https://github.com/electron-userland/electron-builder/issues/7329
    * @default null
    */

packages/app-builder-lib/src/targets/AppxTarget.ts

@@ -149,7 +149,7 @@ export default class AppXTarget extends Target {
     }
     this.buildQueueManager.add(async () => {
       await vm.exec(vm.toVmFile(path.join(vendorPath, "windows-10", signToolArch, "makeappx.exe")), makeAppXArgs)
-      await packager.sign(artifactPath)
+      await packager.signIf(artifactPath)
 
       await stageDir.cleanup()
 

packages/app-builder-lib/src/targets/MsiTarget.ts

@@ -99,7 +99,7 @@ export default class MsiTarget extends Target {
 
     await stageDir.cleanup()
 
-    await packager.sign(artifactPath)
+    await packager.signIf(artifactPath)
 
     await packager.info.emitArtifactBuildCompleted({
       file: artifactPath,

packages/app-builder-lib/src/targets/nsis/NsisTarget.ts

@@ -359,7 +359,7 @@ export class NsisTarget extends Target {
       defines.UNINSTALLER_OUT_FILE = definesUninstaller.UNINSTALLER_OUT_FILE
 
       await this.executeMakensis(defines, commands, sharedHeader + (await this.computeFinalScript(script, true, archs)))
-      await Promise.all<any>([packager.sign(installerPath), defines.UNINSTALLER_OUT_FILE == null ? Promise.resolve() : unlink(defines.UNINSTALLER_OUT_FILE)])
+      await Promise.all<any>([packager.signIf(installerPath), defines.UNINSTALLER_OUT_FILE == null ? Promise.resolve() : unlink(defines.UNINSTALLER_OUT_FILE)])
 
       const safeArtifactName = computeSafeArtifactNameIfNeeded(installerFilename, () => this.generateGitHubInstallerName(primaryArch, defaultArch))
       let updateInfo: any
@@ -438,7 +438,7 @@ export class NsisTarget extends Target {
     } else {
       await execWine(installerPath, null, [], { env: { __COMPAT_LAYER: "RunAsInvoker" } })
     }
-    await packager.sign(uninstallerPath)
+    await packager.signIf(uninstallerPath)
 
     delete defines.BUILD_UNINSTALLER
     // platform-specific path, not wine

packages/app-builder-lib/src/targets/nsis/nsisUtil.ts

@@ -134,7 +134,7 @@ export class CopyElevateHelper {
       const outFile = path.join(appOutDir, "resources", "elevate.exe")
       const promise = copyFile(path.join(it, "elevate.exe"), outFile, false)
       if (target.packager.platformSpecificBuildOptions.signAndEditExecutable !== false) {
-        return promise.then(() => target.packager.sign(outFile))
+        return promise.then(() => target.packager.signIf(outFile))
       }
       return promise
     })

packages/app-builder-lib/src/winPackager.ts

@@ -1,4 +1,4 @@
-import { Arch, CopyFileTransformer, executeAppBuilder, FileTransformer, InvalidConfigurationError, use, walk } from "builder-util"
+import { Arch, CopyFileTransformer, executeAppBuilder, FileTransformer, InvalidConfigurationError, log, use, walk } from "builder-util"
 import { Nullish } from "builder-util-runtime"
 import { createHash } from "crypto"
 import { readdir } from "fs/promises"
@@ -119,7 +119,12 @@ export class WinPackager extends PlatformPackager<WindowsConfiguration> {
     return chooseNotNull(chooseNotNull(this.platformSpecificBuildOptions.signtoolOptions?.certificatePassword, process.env.WIN_CSC_KEY_PASSWORD), super.doGetCscPassword())
   }
 
-  async sign(file: string): Promise<boolean> {
+  async signIf(file: string): Promise<boolean> {
+    if (!this.shouldSignFile(file, true)) {
+      log.info({ file: log.filePath(file) }, "file signing skipped via signExts configuration")
+      return false
+    }
+
     const signOptions: WindowsSignOptions = {
       path: file,
       options: this.platformSpecificBuildOptions,
@@ -207,17 +212,31 @@ export class WinPackager extends PlatformPackager<WindowsConfiguration> {
       await execWine(path.join(vendorPath, "rcedit-ia32.exe"), path.join(vendorPath, "rcedit-x64.exe"), args)
     }
 
-    await this.sign(file)
+    await this.signIf(file)
     timer.end()
 
     if (buildCacheManager != null) {
       await buildCacheManager.save()
     }
   }
 
-  private shouldSignFile(file: string): boolean {
-    const shouldSignExplicit = !!this.platformSpecificBuildOptions.signExts?.some(ext => file.endsWith(ext))
-    return shouldSignExplicit || file.endsWith(".exe")
+  private shouldSignFile(file: string, fallbackValue = false): boolean {
+    const backwardCompatibility = file.endsWith(".exe")
+    const signExts = this.platformSpecificBuildOptions.signExts
+    if (!signExts?.length) {
+      return backwardCompatibility || fallbackValue
+    }
+    // process patterns ( !exe => exclude .exe, .dll => include .dll )
+    // we process first to allow literal negatives in case a filename matches "help!.txt" or similar
+    if (signExts.some(ext => file.endsWith(ext))) {
+      return true
+    }
+    // process negative patterns
+    if (signExts.some(ext => ext.startsWith("!") && file.endsWith(ext.substring(1)))) {
+      return false
+    }
+    // if no explicit patterns matched, fall back to backward compatibility
+    return backwardCompatibility || fallbackValue
   }
 
   protected createTransformerForExtraFiles(packContext: AfterPackContext): FileTransformer | null {
@@ -229,7 +248,7 @@ export class WinPackager extends PlatformPackager<WindowsConfiguration> {
       if (this.shouldSignFile(file)) {
         const parentDir = path.dirname(file)
         if (parentDir !== packContext.appOutDir) {
-          return new CopyFileTransformer(file => this.sign(file))
+          return new CopyFileTransformer(file => this.signIf(file))
         }
       }
       return null
@@ -253,7 +272,7 @@ export class WinPackager extends PlatformPackager<WindowsConfiguration> {
           this.platformSpecificBuildOptions.requestedExecutionLevel
         )
       } else if (this.shouldSignFile(file)) {
-        await this.sign(path.join(packContext.appOutDir, file))
+        await this.signIf(path.join(packContext.appOutDir, file))
       }
     }
 
@@ -267,7 +286,7 @@ export class WinPackager extends PlatformPackager<WindowsConfiguration> {
     }
     const filesToSign = await Promise.all([filesPromise(["resources", "app.asar.unpacked"]), filesPromise(["swiftshader"])])
     for (const file of filesToSign.flat(1)) {
-      await this.sign(file)
+      await this.signIf(file)
     }
 
     return true

packages/electron-builder-squirrel-windows/src/SquirrelWindowsTarget.ts

@@ -49,7 +49,7 @@ export default class SquirrelWindowsTarget extends Target {
     if (squirrelExe) {
       const filePath = path.join(tmpVendorDirectory, squirrelExe)
       log.debug({ file: filePath }, "signing vendor executable")
-      await this.packager.sign(filePath)
+      await this.packager.signIf(filePath)
     } else {
       log.warn("Squirrel.exe not found in vendor directory, skipping signing")
     }
@@ -67,9 +67,9 @@ export default class SquirrelWindowsTarget extends Target {
     const stubExePath = path.join(appOutDir, `${this.exeName}_ExecutionStub.exe`)
     await fs.promises.copyFile(path.join(vendorDir, "StubExecutable.exe"), stubExePath)
     await execWine(path.join(vendorDir, "WriteZipToSetup.exe"), null, ["--copy-stub-resources", filePath, stubExePath])
-    await this.packager.sign(stubExePath)
+    await this.packager.signIf(stubExePath)
     log.debug({ file: filePath }, "signing app executable")
-    await this.packager.sign(filePath)
+    await this.packager.signIf(filePath)
   }
 
   async build(appOutDir: string, arch: Arch) {
@@ -95,7 +95,7 @@ export default class SquirrelWindowsTarget extends Target {
       await packager.signAndEditResources(artifactPath, arch, installerOutDir)
 
       if (this.options.msi) {
-        await packager.sign(msiArtifactPath)
+        await packager.signIf(msiArtifactPath)
       }
 
       const safeArtifactName = (ext: string) => `${sanitizedName}-Setup-${version}${getArchSuffix(arch)}.${ext}`

test/src/helpers/CheckingPackager.ts

@@ -23,7 +23,7 @@ export class CheckingWinPackager extends WinPackager {
     const setupFile = this.expandArtifactNamePattern(newClass.options, "exe", arch, "${productName} Setup ${version}.${ext}")
     const installerOutDir = path.join(outDir, `squirrel-windows${getArchSuffix(arch)}`)
     this.effectiveDistOptions = await newClass.computeEffectiveDistOptions(installerOutDir, outDir, setupFile)
-    await this.sign(this.computeAppOutDir(outDir, arch))
+    await this.signIf(this.computeAppOutDir(outDir, arch))
   }
 
   //noinspection JSUnusedLocalSymbols