Whole installer

build_release.py

Index: build_release.py
===================================================================
--- a/build_release.py
+++ b/build_release.py
@@ -18,15 +18,18 @@
 
 key = sys.argv[2]
 
-def sign(*argv):
-  subprocess.check_call([
-    "signtool",
+def sign_command(*argv):
+  return [
+    "signtool.exe",
     "sign", "/v",
     "/d", "Adblock Plus",
-    "/du", "http://adblockplus.org/",
+    "/du", "https://adblockplus.org/",
     "/f", key,
     "/tr", "http://www.startssl.com/timestamp"
-  ] + list(argv))
+  ] + list(argv)
+
+def sign(*argv):
+  subprocess.check_call(sign_command(*argv))
 
 def read_macro_value(file, macro):
   handle = open(file, 'rb')
@@ -60,15 +63,9 @@
 installerParams = os.environ.copy()
 installerParams["VERSION"] = version
 subprocess.check_call(["nmake", "/A", "ia32", "x64"], env=installerParams, cwd=os.path.join(basedir, "installer"))
-sign(os.path.join(basedir, "build", "ia32", "adblockplusie-%s-en-us-ia32.msi" % version),
-    os.path.join(basedir, "build", "x64", "adblockplusie-%s-en-us-x64.msi" % version))
+sign(os.path.join(basedir, "installer", "build", "ia32", "adblockplusie-%s-multilanguage-ia32.msi" % version),
+    os.path.join(basedir, "installer", "build", "x64", "adblockplusie-%s-multilanguage-x64.msi" % version))
 
-subprocess.check_call(["nmake", "/A", "setup"], env=installerParams, cwd=os.path.join(basedir, "installer"))
-
-# Do the signing dance described on http://wix.sourceforge.net/manual-wix3/insignia.htm
-bundle = os.path.join(basedir, "build", "adblockplusie-%s.exe" % version)

[Felix Dahlke, 2014/08/07 15:15:04]

Why don't we sign the individual .exes anymore? Is signing the MSIs and
installer sufficient?

[Eric, 2014/08/07 15:52:35]

Wladimir figured out the signing issues a year ago on first release, which was
using WiX burn. WiX burn is too problematic for a number of reasons for
packaging MSI's, so Oleksandr switched just that one part over to InnoSetup. The
new signing tool is from InnoSetup. At the very least, it has different syntax.

I can't say whether it's the right kind of signing or not.

One thing we had talked about but have not done yet (to my knowledge) is to
generate a development-only signing key, checked into version control, that we
can use to test the signing procedure.

-engine = os.path.join(basedir, "build", "engine-%s.exe" % version)
-subprocess.check_call(["insignia", "-ib", bundle, "-o", engine])
-sign(engine)
-subprocess.check_call(["insignia", "-ab", engine, bundle, "-o", bundle])
-sign(bundle)
+# If this fails, please check if InnoSetup is installed and added to you PATH
+signparam = " ".join(map(lambda p: "$q%s$q" % p if " " in p else p, sign_command("$f")))
+subprocess.check_call(["iscc", "/A", "/Ssigntool=%s" % signparam, "/Dversion=%s" % version, os.path.join(basedir, "installer", "src", "innosetup-exe", "64BitTwoArch.iss")])