feat(docker): support pwsh for running codesigning (#8787)

Author: mmaietta

.changeset/violet-dancers-bow.md

@@ -0,0 +1,5 @@
+---
+"app-builder-lib": minor
+---
+
+feat: add `pwsh` detection to enable azure trusted signing within docker image

.github/workflows/test.yaml

@@ -71,7 +71,7 @@ jobs:
         testFiles:
           - ArtifactPublisherTest,BuildTest,ExtraBuildTest,RepoSlugTest,binDownloadTest,configurationValidationTest,filenameUtilTest,filesTest,globTest,ignoreTest,macroExpanderTest,mainEntryTest,urlUtilTest,extraMetadataTest,linuxArchiveTest,linuxPackagerTest,HoistedNodeModuleTest,MemoLazyTest
           - snapTest,debTest,fpmTest,protonTest
-          - winPackagerTest,installerTest,BuildTest
+          - winPackagerTest,installerTest,BuildTest,winCodeSignTest
     steps:
       - name: Checkout code repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
@@ -165,7 +165,7 @@ jobs:
       matrix:
         testFiles:
           - winCodeSignTest,differentialUpdateTest
-          - installerTest,appxTest,msiTest,portableTest,assistedInstallerTest,protonTest
+          - appxTest,msiTest,portableTest,assistedInstallerTest,protonTest
           - BuildTest,oneClickInstallerTest,winPackagerTest,nsisUpdaterTest,webInstallerTest
     steps:
       - name: Checkout code repository
@@ -186,6 +186,12 @@ jobs:
 
   test-mac:
     runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        testFiles:
+          - winPackagerTest,installerTest,winCodeSignTest
+          - masTest,dmgTest,filesTest,macPackagerTest,differentialUpdateTest
     steps:
       - name: Checkout code repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
@@ -196,8 +202,13 @@ jobs:
           cache-path: ~/Library/Caches/electron
           cache-key: v-23.3.10-macos-electron
 
+      - name: Install pwsh and wine via brew
+        run: |
+          brew install powershell/tap/powershell
+          brew install --cask wine-stable
+
       - name: Test
         run: pnpm ci:test
         env:
-          TEST_FILES: masTest,dmgTest,filesTest,macPackagerTest,differentialUpdateTest
+          TEST_FILES: ${{ matrix.testFiles }}
           FORCE_COLOR: 1

packages/app-builder-lib/scheme.json

@@ -6226,7 +6226,7 @@
               "type": "null"
             }
           ],
-          "description": "Options for usage of Azure Trusted Signing (beta)"
+          "description": "Options for usage of Azure Trusted Signing (beta)\nCannot be used in conjunction with `signtoolOptions`, signing will default to Azure Trusted Signing"
         },
         "compression": {
           "anyOf": [
@@ -6525,7 +6525,7 @@
               "type": "null"
             }
           ],
-          "description": "Options for usage with signtool.exe"
+          "description": "Options for usage with signtool.exe\nCannot be used in conjunction with `azureSignOptions`, signing will default to Azure Trusted Signing"
         },
         "target": {
           "anyOf": [

packages/app-builder-lib/src/codeSign/windowsCodeSign.ts

@@ -1,6 +1,5 @@
 import { log, retry } from "builder-util"
 import { WindowsConfiguration } from "../options/winOptions"
-import { VmManager } from "../vm/vm"
 import { WinPackager } from "../winPackager"
 
 export interface WindowsSignOptions {
@@ -9,7 +8,6 @@ export interface WindowsSignOptions {
 }
 
 export async function signWindows(options: WindowsSignOptions, packager: WinPackager): Promise<boolean> {
-  const packageManager = await packager.signingManager.value
   if (options.options.azureSignOptions) {
     if (options.options.signtoolOptions) {
       log.warn(null, "ignoring signtool options, using Azure Trusted Signing; please only configure one")
@@ -18,7 +16,7 @@ export async function signWindows(options: WindowsSignOptions, packager: WinPack
   } else {
     log.info({ path: log.filePath(options.path) }, "signing with signtool.exe")
   }
-
+  const packageManager = await packager.signingManager.value
   return signWithRetry(async () => packageManager.signFile(options))
 }
 
@@ -37,16 +35,3 @@ function signWithRetry(signer: () => Promise<boolean>): Promise<boolean> {
     return false
   })
 }
-
-export async function getPSCmd(vm: VmManager): Promise<string> {
-  return await vm
-    .exec("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Get-Command pwsh.exe`])
-    .then(() => {
-      log.debug(null, "identified pwsh.exe for executing code signing")
-      return "pwsh.exe"
-    })
-    .catch(() => {
-      log.debug(null, "unable to find pwsh.exe, falling back to powershell.exe")
-      return "powershell.exe"
-    })
-}

packages/app-builder-lib/src/codeSign/windowsSignAzureManager.ts

@@ -1,7 +1,7 @@
 import { asArray, InvalidConfigurationError, log } from "builder-util"
 import { WindowsAzureSigningConfiguration, WindowsConfiguration } from "../options/winOptions"
 import { WinPackager } from "../winPackager"
-import { getPSCmd, WindowsSignOptions } from "./windowsCodeSign"
+import { WindowsSignOptions } from "./windowsCodeSign"
 import { Lazy } from "lazy-val"
 import { SignManager } from "./signManager"
 import { MemoLazy } from "builder-util-runtime"
@@ -29,7 +29,7 @@ export class WindowsSignAzureManager implements SignManager {
 
   async initialize() {
     const vm = await this.packager.vm.value
-    const ps = await getPSCmd(vm)
+    const ps = await vm.powershellCommand.value
 
     log.info(null, "installing required module (TrustedSigning) with scope CurrentUser")
     try {
@@ -105,7 +105,7 @@ export class WindowsSignAzureManager implements SignManager {
   // prerequisite: requires `initializeProviderModules` to already have been executed
   async signFile(options: WindowsSignOptions): Promise<boolean> {
     const vm = await this.packager.vm.value
-    const ps = await getPSCmd(vm)
+    const ps = await vm.powershellCommand.value
 
     const {
       publisherName: _publisher, // extract from `extraSigningArgs`

packages/app-builder-lib/src/codeSign/windowsSignToolManager.ts

@@ -11,7 +11,6 @@ import { isUseSystemSigncode } from "../util/flags"
 import { VmManager } from "../vm/vm"
 import { WinPackager } from "../winPackager"
 import { WindowsSignOptions } from "./windowsCodeSign"
-import { getPSCmd } from "./windowsCodeSign"
 import { MemoLazy, parseDn } from "builder-util-runtime"
 import { Lazy } from "lazy-val"
 import { importCertificate } from "./codesign"
@@ -395,7 +394,7 @@ export class WindowsSignToolManager implements SignManager {
     const certificateSubjectName = options.signtoolOptions?.certificateSubjectName
     const certificateSha1 = options.signtoolOptions?.certificateSha1?.toUpperCase()
 
-    const ps = await getPSCmd(vm)
+    const ps = await vm.powershellCommand.value
     const rawResult = await vm.exec(ps, [
       "-NoProfile",
       "-NonInteractive",

packages/app-builder-lib/src/options/winOptions.ts

@@ -25,11 +25,13 @@ export interface WindowsConfiguration extends PlatformSpecificBuildOptions {
 
   /**
    * Options for usage with signtool.exe
+   * Cannot be used in conjunction with `azureSignOptions`, signing will default to Azure Trusted Signing
    */
   readonly signtoolOptions?: WindowsSigntoolConfiguration | null
 
   /**
    * Options for usage of Azure Trusted Signing (beta)
+   * Cannot be used in conjunction with `signtoolOptions`, signing will default to Azure Trusted Signing
    */
   readonly azureSignOptions?: WindowsAzureSigningConfiguration | null
 

packages/app-builder-lib/src/vm/PwshVm.ts

@@ -0,0 +1,25 @@
+import { Lazy } from "lazy-val"
+import { isPwshAvailable, VmManager } from "./vm"
+import { log } from "builder-util"
+
+export class PwshVmManager extends VmManager {
+  constructor() {
+    super()
+  }
+
+  readonly powershellCommand = new Lazy<string>(async () => {
+    log.info(null, "checking for `pwsh` for powershell")
+    if (await isPwshAvailable.value) {
+      return "pwsh"
+    }
+    const errorMessage = `unable to find \`pwsh\`, please install per instructions linked in logs`
+    log.error(
+      {
+        mac: "https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-macos",
+        linux: "https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-linux",
+      },
+      errorMessage
+    )
+    throw new Error(errorMessage)
+  })
+}

packages/app-builder-lib/src/vm/vm.ts

@@ -1,7 +1,8 @@
-import { DebugLogger, exec, ExtraSpawnOptions, InvalidConfigurationError, spawn } from "builder-util"
+import { DebugLogger, exec, ExtraSpawnOptions, InvalidConfigurationError, log, spawn } from "builder-util"
 import { ExecFileOptions, SpawnOptions } from "child_process"
+import { Lazy } from "lazy-val"
 import * as path from "path"
-
+import { ParallelsVm } from "./ParallelsVm"
 export class VmManager {
   get pathSep(): string {
     return path.sep
@@ -18,15 +19,52 @@ export class VmManager {
   toVmFile(file: string): string {
     return file
   }
+
+  readonly powershellCommand = new Lazy(() => {
+    return this.exec("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Get-Command pwsh.exe`])
+      .then(() => {
+        log.info(null, "identified pwsh.exe")
+        return "pwsh.exe"
+      })
+      .catch(() => {
+        log.info(null, "unable to find pwsh.exe, falling back to powershell.exe")
+        return "powershell.exe"
+      })
+  })
 }
 
 export async function getWindowsVm(debugLogger: DebugLogger): Promise<VmManager> {
   const parallelsVmModule = await import("./ParallelsVm")
-  const vmList = (await parallelsVmModule.parseVmList(debugLogger)).filter(it => ["win-10", "win-11"].includes(it.os))
+  let vmList: ParallelsVm[] = []
+  try {
+    vmList = (await parallelsVmModule.parseVmList(debugLogger)).filter(it => ["win-10", "win-11"].includes(it.os))
+  } catch (_error) {
+    if ((await isPwshAvailable.value) && (await isWineAvailable.value)) {
+      const vmModule = await import("./PwshVm")
+      return new vmModule.PwshVmManager()
+    }
+  }
   if (vmList.length === 0) {
-    throw new InvalidConfigurationError("Cannot find suitable Parallels Desktop virtual machine (Windows 10 is required)")
+    throw new InvalidConfigurationError("Cannot find suitable Parallels Desktop virtual machine (Windows 10 is required) and cannot access `pwsh` and `wine` locally")
   }
 
   // prefer running or suspended vm
   return new parallelsVmModule.ParallelsVmManager(vmList.find(it => it.state === "running") || vmList.find(it => it.state === "suspended") || vmList[0])
 }
+
+const isWineAvailable = new Lazy(async () => {
+  return isCommandAvailable("wine", ["--version"])
+})
+
+export const isPwshAvailable = new Lazy(async () => {
+  return isCommandAvailable("pwsh", ["--version"])
+})
+
+export const isCommandAvailable = async (command: string, args: string[]) => {
+  try {
+    await exec(command, args)
+    return true
+  } catch {
+    return false
+  }
+}

test/snapshots/windows/winCodeSignTest.js.snap

@@ -1,7 +1,5 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`azure signing without credentials 1`] = `"ERR_ELECTRON_BUILDER_INVALID_CONFIGURATION"`;
-
 exports[`electronDist 1`] = `"ENOENT"`;
 
 exports[`forceCodeSigning 1`] = `"ERR_ELECTRON_BUILDER_INVALID_CONFIGURATION"`;
@@ -14,3 +12,9 @@ Map {
   "C" => "GB",
 }
 `;
+
+exports[`win code sign using pwsh 1`] = `
+{
+  "win": [],
+}
+`;