Work on #321~

.github/workflows/build.yml

@@ -54,6 +54,12 @@ jobs:
           smksp_cert_sync.exe
         shell: cmd
 
+      - name: Certificates Sync
+        if: startsWith(matrix.os, 'windows')
+        run: |
+          smctl windows certsync
+        shell: cmd
+
       - name: Install setuptools (macos)
         if: startsWith(matrix.os, 'macos')
         run: sudo -H pip install setuptools
@@ -79,16 +85,16 @@ jobs:
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
-      # new Windows Signing (2024)
-      - name: Signing using Signtool
-        if: startsWith(matrix.os, 'windows')
-        run: |
-          signtool.exe sign /sha1 ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 "D:\a\OpenBuilds-CONTROL\OpenBuilds-CONTROL\dist\*.exe"
-          signtool.exe verify /v /pa "D:\a\OpenBuilds-CONTROL\OpenBuilds-CONTROL\dist\*.exe"
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v2
-        with:
-          name: ${{ matrix.os }}
-          path: |
-            dist/*.exe
+      # # new Windows Signing (2024)
+      # - name: Signing using Signtool
+      #   if: startsWith(matrix.os, 'windows')
+      #   run: |
+      #     signtool.exe sign /sha1 ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 "D:\a\OpenBuilds-CONTROL\OpenBuilds-CONTROL\dist\*.exe"
+      #     signtool.exe verify /v /pa "D:\a\OpenBuilds-CONTROL\OpenBuilds-CONTROL\dist\*.exe"
+      #
+      # - name: Upload artifacts
+      #   uses: actions/upload-artifact@v2
+      #   with:
+      #     name: ${{ matrix.os }}
+      #     path: |
+      #       dist/*.exe

package.json

@@ -51,6 +51,8 @@
       }
     ],
     "afterSign": "./notarize.js",
+    "sign": "./signWin.js",
+    "signingHashAlgorithms": "sha256",
     "mac": {
       "icon": "build/icon.icns",
       "category": "public.app-category.graphics-design",

signWin.js

@@ -0,0 +1,18 @@
+const {
+  execSync
+} = require('node:child_process')
+
+exports.default = async configuration => {
+  if (!process.env.SM_API_KEY) {
+    console.info(`Skip signing because SM_API_KEY and  not configured`)
+    return
+  }
+
+  if (!configuration.path) {
+    throw new Error(`Path of application is not found`)
+  }
+
+  execSync(`smctl sign --keypair-alias="${process.env.SM_KEYPAIR_NAME}" --input "${String(configuration.path)}"`, {
+    stdio: 'inherit',
+  })
+}