Generate ephemeral APPX signing key

.github/workflows/build.yml

@@ -207,6 +207,7 @@ jobs:
         path: |
           build/*.msi
           build/*.appx
+          build/*.cer
   coverity:
     name: Run Coverity tests
     if: github.repository == 'open-eid/DigiDoc4-Client' && contains(github.ref, 'coverity_scan')

client/CMakeLists.txt

@@ -271,12 +271,13 @@ elseif(WIN32)
 			--skip-plugin-types generic,networkinformation,iconengines --exclude-plugins qjpeg,qico,qgif,qcertonlybackend,qschannelbackend appx
 		COMMAND ${CMAKE_COMMAND} -E copy ${LIBS_PATH}/digidoc-tool.exe appx
 		COMMAND makeappx.exe pack -d appx -p ${MSI_FILE}.appx
-		# https://msdn.microsoft.com/en-us/library/windows/desktop/jj835832(v=vs.85).aspx
-		#Popups GUI
-		#COMMAND MakeCert.exe /n "CN=8BBBE4D8-620A-4884-A12A-72F1A2030D8B" /r /h 0 /eku "1.3.6.1.5.5.7.3.3,1.3.6.1.4.1.311.10.3.13" /m 120 /a sha256 /sv qdigidoc4.pvk qdigidoc4.cer
-		#COMMAND Pvk2Pfx.exe /pvk qdigidoc4.pvk /spc qdigidoc4.cer /pfx qdigidoc4.pfx /f
-		COMMAND signtool.exe sign -f ${CMAKE_SOURCE_DIR}/qdigidoc4.pfx -fd SHA256 -v ${MSI_FILE}.appx
+		COMMAND powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass
+			-File ${CMAKE_CURRENT_SOURCE_DIR}/SignAppx.ps1
+			-PackagePath ${MSI_FILE}.appx
+			-ManifestPath AppxManifest.xml
+			-CertificatePath ${MSI_FILE}.cer
 		WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
+		VERBATIM
 	)
 else()
 	find_package( Threads REQUIRED )

client/SignAppx.ps1

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: Estonian Information System Authority
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string] $PackagePath,
+
+    [Parameter(Mandatory = $true)]
+    [string] $ManifestPath,
+
+    [Parameter(Mandatory = $true)]
+    [string] $CertificatePath
+)
+
+$ErrorActionPreference = 'Stop'
+$certificate = $null
+
+try {
+    [xml] $manifest = Get-Content -LiteralPath $ManifestPath -Raw
+    $publisher = $manifest.Package.Identity.Publisher
+    if ([string]::IsNullOrWhiteSpace($publisher)) {
+        throw "The Appx manifest does not define a publisher."
+    }
+
+    $certificate = New-SelfSignedCertificate `
+        -Type Custom `
+        -Subject $publisher `
+        -FriendlyName 'DigiDoc4 ephemeral Appx test certificate' `
+        -CertStoreLocation 'Cert:\CurrentUser\My' `
+        -Provider 'Microsoft Software Key Storage Provider' `
+        -KeyAlgorithm RSA `
+        -KeyLength 2048 `
+        -HashAlgorithm SHA256 `
+        -KeyExportPolicy NonExportable `
+        -KeyUsage DigitalSignature `
+        -TextExtension @('2.5.29.37={text}1.3.6.1.5.5.7.3.3,1.3.6.1.4.1.311.10.3.13', '2.5.29.19={text}') `
+        -NotAfter (Get-Date).AddDays(30)
+
+    Export-Certificate -Cert $certificate -FilePath $CertificatePath -Type CERT -Force | Out-Null
+
+    & signtool.exe sign /v /s My /sha1 $certificate.Thumbprint /fd SHA256 $PackagePath
+    if ($LASTEXITCODE -ne 0) {
+        throw "SignTool failed with exit code $LASTEXITCODE."
+    }
+}
+finally {
+    if ($null -ne $certificate) {
+        Remove-Item -LiteralPath "Cert:\CurrentUser\My\$($certificate.Thumbprint)" -DeleteKey
+    }
+}