Whole installer

build_release.py

 #!/usr/bin/env python
 
 import sys, os, re, subprocess
 
 def print_usage():
   print >>sys.stderr, "Usage: %s release|devbuild SIGNING_KEY_FILE" % (os.path.basename(sys.argv[0]))
 
 if len(sys.argv) < 3:
   print_usage()
   sys.exit(1)
 
 basedir = os.path.dirname(os.path.abspath(sys.argv[0]))
 build_type = sys.argv[1]
 
 if not build_type in ["release", "devbuild"]:
   print_usage()
   sys.exit(2)
 
 key = sys.argv[2]
 
-def sign(*argv):
-  subprocess.check_call([
-    "signtool",
+def sign_command(*argv):
+  return [
+    "signtool.exe",
     "sign", "/v",
     "/d", "Adblock Plus",
-    "/du", "http://adblockplus.org/",
+    "/du", "https://adblockplus.org/",
     "/f", key,
     "/tr", "http://www.startssl.com/timestamp"
-  ] + list(argv))
+  ] + list(argv)
+
+def sign(*argv):
+  subprocess.check_call(sign_command(*argv))
 
 def read_macro_value(file, macro):
   handle = open(file, 'rb')
   for line in handle:
     match = re.search(r"^\s*#define\s+%s\s+\w?\"(.*?)\"" % macro, line)
     if match:
       return match.group(1)
   raise Exception("Macro %s not found in file %s" % (macro, file))
 
 version = read_macro_value(os.path.join(basedir, "src", "shared", "Version.h"), "IEPLUGIN_VERSION");
@@ skipping 13 matching lines @@
     os.path.join(basedir, "build", arch, "adblockplus.sln"),
     "/p:Configuration=Release", "/target:AdblockPlus;AdblockPlusEngine",
   ])
 
   sign(os.path.join(basedir, "build", arch, "Release", "AdblockPlus.dll"),
       os.path.join(basedir, "build", arch, "Release", "AdblockPlusEngine.exe"))
 
 installerParams = os.environ.copy()
 installerParams["VERSION"] = version
 subprocess.check_call(["nmake", "/A", "ia32", "x64"], env=installerParams, cwd=os.path.join(basedir, "installer"))
-sign(os.path.join(basedir, "build", "ia32", "adblockplusie-%s-en-us-ia32.msi" % version),
-    os.path.join(basedir, "build", "x64", "adblockplusie-%s-en-us-x64.msi" % version))
+sign(os.path.join(basedir, "installer", "build", "ia32", "adblockplusie-%s-multilanguage-ia32.msi" % version),
+    os.path.join(basedir, "installer", "build", "x64", "adblockplusie-%s-multilanguage-x64.msi" % version))
 
-subprocess.check_call(["nmake", "/A", "setup"], env=installerParams, cwd=os.path.join(basedir, "installer"))
-
-# Do the signing dance described on http://wix.sourceforge.net/manual-wix3/insignia.htm
-bundle = os.path.join(basedir, "build", "adblockplusie-%s.exe" % version)

[Felix Dahlke, 2014/08/07 15:15:04]

Why don't we sign the individual .exes anymore? Is signing the MSIs and
installer sufficient?

[Eric, 2014/08/07 15:52:35]

Wladimir figured out the signing issues a year ago on first release, which was
using WiX burn. WiX burn is too problematic for a number of reasons for
packaging MSI's, so Oleksandr switched just that one part over to InnoSetup. The
new signing tool is from InnoSetup. At the very least, it has different syntax.

I can't say whether it's the right kind of signing or not.

One thing we had talked about but have not done yet (to my knowledge) is to
generate a development-only signing key, checked into version control, that we
can use to test the signing procedure.

-engine = os.path.join(basedir, "build", "engine-%s.exe" % version)
-subprocess.check_call(["insignia", "-ib", bundle, "-o", engine])
-sign(engine)
-subprocess.check_call(["insignia", "-ab", engine, bundle, "-o", bundle])
-sign(bundle)
+# If this fails, please check if InnoSetup is installed and added to you PATH
+signparam = " ".join(map(lambda p: "$q%s$q" % p if " " in p else p, sign_command("$f")))
+subprocess.check_call(["iscc", "/A", "/Ssigntool=%s" % signparam, "/Dversion=%s" % version, os.path.join(basedir, "installer", "src", "innosetup-exe", "64BitTwoArch.iss")])