Build and sign the Windows build with CircleCI (#7630)

* Code signing is somehow broken on AppVeyor. Keep AppVeyor in case it works again (but deployment is disabled)
* Use a "medium" worker for Windows as it's long a few minutes longer than "large" and 3x less expensive.

.circleci/config.yml

@@ -13,6 +13,7 @@ orbs:
   aws-cli: circleci/[email protected]
   macos: circleci/[email protected] # For Rosetta (see below)
   node: circleci/[email protected] # For a recent npm version (see below)
+  win: circleci/[email protected]
 jobs:
   # Build the **entire** app for macOS (including the GDevelop.js library).
   build-macos:
@@ -46,9 +47,9 @@ jobs:
       # GDevelop.js dependencies
       - restore_cache:
           keys:
-            - gd-macos-nodejs-dependencies-{{ checksum "newIDE/app/package.json" }}-{{ checksum "newIDE/electron-app/package.json" }}-{{ checksum "GDevelop.js/package.json" }}
+            - gd-macos-nodejs-dependencies-{{ checksum "newIDE/app/package.json" }}-{{ checksum "newIDE/electron-app/package.json" }}-{{ checksum "GDevelop.js/package.json" }}-{{ checksum "GDJS/package-lock.json" }}
             # fallback to using the latest cache if no exact match is found
-            - gd-macos-nodejs-dependencies---
+            - gd-macos-nodejs-dependencies-
 
       - run:
           name: Install GDevelop.js dependencies
@@ -69,7 +70,8 @@ jobs:
             - newIDE/electron-app/node_modules
             - newIDE/app/node_modules
             - GDevelop.js/node_modules
-          key: gd-macos-nodejs-dependencies-{{ checksum "newIDE/app/package.json" }}-{{ checksum "newIDE/electron-app/package.json" }}-{{ checksum "GDevelop.js/package.json" }}
+            - GDJS/node_modules
+          key: gd-macos-nodejs-dependencies-{{ checksum "newIDE/app/package.json" }}-{{ checksum "newIDE/electron-app/package.json" }}-{{ checksum "GDevelop.js/package.json" }}-{{ checksum "GDJS/package-lock.json" }}
 
       # Build GDevelop IDE (seems like we need to allow Node.js to use more space than usual)
       # Note: Code signing is done using CSC_LINK (see https://www.electron.build/code-signing).
@@ -118,9 +120,9 @@ jobs:
 
       - restore_cache:
           keys:
-            - gd-linux-nodejs-dependencies-{{ checksum "newIDE/app/package.json" }}-{{ checksum "newIDE/electron-app/package.json" }}-{{ checksum "GDevelop.js/package.json" }}
+            - gd-linux-nodejs-dependencies-{{ checksum "newIDE/app/package.json" }}-{{ checksum "newIDE/electron-app/package.json" }}-{{ checksum "GDevelop.js/package.json" }}-{{ checksum "GDJS/package-lock.json" }}
             # fallback to using the latest cache if no exact match is found
-            - gd-linux-nodejs-dependencies---
+            - gd-linux-nodejs-dependencies-
 
       # GDevelop IDE dependencies (using an exact version of GDevelop.js, built previously)
       - run:
@@ -132,7 +134,8 @@ jobs:
             - newIDE/electron-app/node_modules
             - newIDE/app/node_modules
             - GDevelop.js/node_modules
-          key: gd-linux-nodejs-dependencies-{{ checksum "newIDE/app/package.json" }}-{{ checksum "newIDE/electron-app/package.json" }}-{{ checksum "GDevelop.js/package.json" }}
+            - GDJS/node_modules
+          key: gd-linux-nodejs-dependencies-{{ checksum "newIDE/app/package.json" }}-{{ checksum "newIDE/electron-app/package.json" }}-{{ checksum "GDevelop.js/package.json" }}-{{ checksum "GDJS/package-lock.json" }}
 
       # Build GDevelop IDE (seems like we need to allow Node.js to use more space than usual)
       - run:
@@ -276,8 +279,7 @@ jobs:
           name: Deploy to S3 (specific commit)
           command: aws s3 sync Binaries/embuild/GDevelop.js s3://gdevelop-gdevelop.js/$(git rev-parse --abbrev-ref HEAD)/variant/debug-sanitizers/commit/$(git rev-parse HEAD)/
 
-  # Trigger AppVeyor build, which finishes building the Windows app
+  # Trigger AppVeyor build, which also does a Windows build (keep it for redundancy).
-  # (using GDevelop.js built in a previous step).
   trigger-appveyor-windows-build:
     docker:
       - image: cimg/node:16.13
@@ -294,12 +296,186 @@ jobs:
                  }" \
                  -X POST https://ci.appveyor.com/api/builds
 
+  build-windows:
+    executor:
+      name: win/default
+      size: medium
+    working_directory: /home/circleci/project
+    steps:
+      - checkout
+      - run:
+          # See https://www.ssl.com/how-to/how-to-integrate-esigner-cka-with-ci-cd-tools-for-automated-code-signing/
+          #
+          # This is necessary because of "signing to be FIPS-140 compliant". See
+          # https://github.com/electron-userland/electron-builder/issues/6158
+          #
+          # Make sure to DISABLE "malware blocker" in SSL.com to avoid errors like:
+          # Error information: "Error: SignerSign() failed." (-2146893821/0x80090003)
+          name: Download and Unzip eSignerCKA Setup
+          command: |
+
+            Invoke-WebRequest -OutFile eSigner_CKA_1.0.3.zip "https://www.ssl.com/download/ssl-com-esigner-cka-1-0-3"
+
+            Expand-Archive -Force eSigner_CKA_1.0.3.zip
+
+            Remove-Item eSigner_CKA_1.0.3.zip
+
+            Move-Item -Destination "eSigner_CKA_1.0.3.exe" -Path "eSigner_CKA_*\*.exe"
+      - run:
+          name: Setup eSignerCKA in Silent Mode
+          command: |
+
+            mkdir -p "/home/circleci/project/eSignerCKA"
+
+            ./eSigner_CKA_1.0.3.exe /CURRENTUSER /VERYSILENT /SUPPRESSMSGBOXES /DIR="/home/circleci/project/eSignerCKA" | Out-Null
+      - run:
+          name: Config Account Information on eSignerCKA
+          command: |
+
+            /home/circleci/project/eSignerCKA/eSignerCKATool.exe config -mode product -user "$env:ESIGNER_USER_NAME" -pass "$env:ESIGNER_USER_PASSWORD" -totp "$env:ESIGNER_USER_TOTP" -key "/home/circleci/project/eSignerCKA/master.key" -r
+      - run:
+          name: Load Certificate into Windows Store
+          command: |
+
+            /home/circleci/project/eSignerCKA/eSignerCKATool.exe unload
+
+            /home/circleci/project/eSignerCKA/eSignerCKATool.exe load
+      - run:
+          name: Select Certificate From Windows Store and Sign Sample File with SignTool
+          command: |
+
+            $CodeSigningCert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
+
+            echo Certificate: $CodeSigningCert
+
+      - restore_cache:
+          name: Restore node_modules cache
+          keys:
+            - v1-win-node-{{ checksum "newIDE/app/package-lock.json" }}-{{ checksum "newIDE/electron-app/package-lock.json" }}-{{ checksum "GDJS/package-lock.json" }}
+            - v1-win-node-
+
+      - run:
+          name: Install dependencies
+          no_output_timeout: 25m
+          # Remove package-lock.json because they seems to cause the npm install to be stuck. We should try again after re-generating them.
+          # Also install setuptools as something requires distutils in electron-app, and it was removed in Python 3.12.
+          # setuptools will make distutils available again (but we should migrate our packages probably).
+          command: |
+            pip install setuptools
+
+            cd newIDE\app
+
+            npm -v
+
+            Remove-Item package-lock.json
+            
+            $Env:REQUIRES_EXACT_LIBGD_JS_VERSION = "true"
+
+            npm install
+
+            cd ..\electron-app
+
+            Remove-Item package-lock.json
+
+            npm install
+
+            cd ..\..
+
+      - save_cache:
+          name: Save node_modules cache
+          key: v1-win-node-{{ checksum "newIDE/app/package-lock.json" }}-{{ checksum "newIDE/electron-app/package-lock.json" }}-{{ checksum "GDJS/package-lock.json" }}
+          paths:
+            - newIDE/app/node_modules
+            - newIDE/electron-app/node_modules
+            - GDJS/node_modules
+
+      - run:
+          name: Build NSIS executable (with code signing)
+          command: |
+            cd newIDE\electron-app
+
+            $CodeSigningCert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
+
+            echo Certificate: $CodeSigningCert
+
+            # Use a custom signtool path because of the signtool.exe bundled withy electron-builder not working for some reason.
+            # Can also be found in versioned folders like "C:/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x86/signtool.exe".
+            # or "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x86\signtool.exe".
+
+            $Env:SIGNTOOL_PATH = "C:\Program Files (x86)\Windows Kits\10\App Certification Kit\signtool.exe"
+
+            # Extract thumbprint and subject name of the certificate (will be passed to electron-builder).
+
+            $Env:GD_SIGNTOOL_THUMBPRINT = $CodeSigningCert.Thumbprint
+
+            $Env:GD_SIGNTOOL_SUBJECT_NAME = ($CodeSigningCert.Subject -replace ", ?", "`n" | ConvertFrom-StringData).CN
+
+            # Build the nsis installer (signed: electron-builder will use SignTool.exe with the certificate)
+
+            node scripts/build.js --win nsis --publish=never
+
+            cd ..\..
+      - run:
+          name: Build AppX (without code signing)
+          # Don't sign the appx (it will be signed by the Microsoft Store).
+          command: |
+            cd newIDE\electron-app
+
+            # Build the appx (not signed). Ensure all variables used for code signing are empty.
+
+            $Env:GD_SIGNTOOL_THUMBPRINT = ''
+
+            $Env:GD_SIGNTOOL_SUBJECT_NAME = ''            
+            
+            $Env:CSC_LINK = ''
+            
+            $Env:CSC_KEY_PASSWORD = ''
+
+            node scripts/build.js --skip-app-build --win appx --publish=never
+
+            cd ..\..
+
+      - run:
+          name: Clean binaries
+          shell: cmd.exe
+          command: |
+            rmdir /s /q newIDE\electron-app\dist\win-unpacked
+
+      - run:
+          name: Install AWS CLI
+          command: |
+            # Install the CLI for the current user
+            
+            pip install --quiet --upgrade --user awscli
+            
+            # Add the user-Scripts dir to PATH for this step and the next.
+            
+            $binDir = (python -m site --user-base) + "\Scripts"
+            $Env:Path += ";$binDir"
+
+            # Sanity check:
+            aws --version  
+
+      # Upload artifacts (S3)
+      - run:
+          name: Deploy to S3 (specific commit)
+          command: |
+            aws s3 sync newIDE\electron-app\dist "s3://gdevelop-releases/$Env:CIRCLE_BRANCH/commit/$Env:CIRCLE_SHA1/"
+
+      - run:
+          name: Deploy to S3 (latest)
+          command: |
+            aws s3 sync newIDE\electron-app\dist "s3://gdevelop-releases/$Env:CIRCLE_BRANCH/latest/"
+
+      # Upload artifacts (CircleCI)
+      - store_artifacts:
+          path: newIDE/electron-app/dist
 
 workflows:
   gdevelop_js-wasm-extra-checks:
     jobs:
       - build-gdevelop_js-debug-sanitizers-and-extra-checks:
-          # Extra checks are resource intensive so don't all run them.
+          # Extra checks are resource intensive so don't always run them.
           filters:
             branches:
               only:
@@ -326,6 +502,14 @@ workflows:
               only:
                 - master
                 - /experimental-build.*/
+      - build-windows:
+          requires:
+            - build-gdevelop_js-wasm-only
+          filters:
+            branches:
+              only:
+                - master
+                - /experimental-build.*/
       - trigger-appveyor-windows-build:
           requires:
             - build-gdevelop_js-wasm-only

appveyor.yml

@@ -1,6 +1,8 @@
-# AppVeyor configuration to build GDevelop app running
+# Deprecated AppVeyor configuration to build GDevelop app running
 # on the Electron runtime (newIDE/electron-app) for Windows.
-# For macOS and Linux, see the config.yml file.
+#
+# This was replaced by build on CircleCI - but kept for redundancy/tests.
+# For Windows, macOS and Linux builds, see the config.yml file.
 
 version: 1.0.{build}
 pull_requests:
@@ -17,6 +19,7 @@ cache:
   - newIDE\app\node_modules -> newIDE\app\package-lock.json
   - newIDE\electron-app\node_modules -> newIDE\electron-app\package-lock.json
   - GDevelop.js\node_modules -> GDevelop.js\package-lock.json
+  - GDJS\node_modules -> GDJS\package-lock.json
 install:
   # Download and install SSL.com eSigner CKA.
   # See https://www.ssl.com/how-to/how-to-integrate-esigner-cka-with-ci-cd-tools-for-automated-code-signing/.
@@ -90,9 +93,8 @@ build_script:
       echo Certificate: $CodeSigningCert
 
       # Use a custom signtool path because of the signtool.exe bundled withy electron-builder not working for some reason.
-      # Can also be found in versioned folders like "C:/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x86/signtool.exe".
 
-      $Env:SIGNTOOL_PATH = "C:\Program Files (x86)\Windows Kits\10\App Certification Kit\signtool.exe"
+      $Env:SIGNTOOL_PATH = "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x86\signtool.exe"
 
       # Extract thumbprint and subject name of the certificate (will be passed to electron-builder).
 
@@ -132,8 +134,9 @@ artifacts:
     name: GDevelopWindows
 
 # Upload artifacts (AWS) - configuration is stored on AppVeyor itself.
-deploy:
+# Disabled because done by CircleCI "build-windows" job.
-  - provider: Environment
+# deploy:
-    name: Amazon S3 releases
+#   - provider: Environment
-  - provider: Environment
+#     name: Amazon S3 releases
-    name: Amazon S3 latest releases
+#   - provider: Environment
+#     name: Amazon S3 latest releases