mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
yhh
0ae7693526
Build windows/arm64 on a native windows-11-arm runner and carry it through the signing chain as a second leg of every Windows stage: one tree per job, legs serial under the certum-signing group, a failed leg reruns alone. The package check learns app-arm64.7z and refuses any PE image that is not the leg's architecture, a new install smoke runs each installer on its own architecture before publish, and publish counts, names and hash-checks both architectures. The arm64 installer is packed with the 7-Zip BCJ filter: the default ARM64 filter yields an archive the NSIS extractor cannot decode, and the installer then exits 0 with every executable missing. Signing contract tests pin the matrix, the serial legs and the secret-free stages.
50 lines
1.9 KiB
PowerShell
50 lines
1.9 KiB
PowerShell
# Reads the Authenticode signatures back off the Windows files that will ship.
|
|
# A signature the release job believes it applied but that is not on the bytes
|
|
# is the one failure the signing requests cannot catch about themselves, so
|
|
# every file is checked from disk rather than trusted from the step order.
|
|
# Given a payload it checks the whole tree; given a file, that file.
|
|
[CmdletBinding(DefaultParameterSetName = "Payload")]
|
|
param(
|
|
[Parameter(Mandatory = $true, ParameterSetName = "Payload")]
|
|
[string]$PayloadDirectory,
|
|
|
|
[Parameter(ParameterSetName = "Payload")]
|
|
[string]$DigestPath,
|
|
|
|
[Parameter(Mandatory = $true, ParameterSetName = "Payload")]
|
|
[ValidateSet("amd64", "arm64")]
|
|
[string]$Architecture,
|
|
|
|
[Parameter(Mandatory = $true, ParameterSetName = "File")]
|
|
[string]$FilePath,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidatePattern('^[0-9a-fA-F]{40}$')]
|
|
[string]$ExpectedThumbprint,
|
|
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateNotNullOrEmpty()]
|
|
[string]$ExpectedSubject
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
. (Join-Path $PSScriptRoot "windows-signing-lib.ps1")
|
|
|
|
if ($PSCmdlet.ParameterSetName -eq "File") {
|
|
Assert-EmbeddedSignature -Path $FilePath -Thumbprint $ExpectedThumbprint -Subject $ExpectedSubject
|
|
exit 0
|
|
}
|
|
|
|
$root = (Resolve-Path -LiteralPath $PayloadDirectory).Path
|
|
Assert-DeclaredPeSet -Root $root
|
|
Assert-PeArchitecture -Root $root -Architecture $Architecture
|
|
foreach ($name in $script:ReleaseSignedPe) {
|
|
Assert-EmbeddedSignature -Path (Join-Path $root $name) -Thumbprint $ExpectedThumbprint -Subject $ExpectedSubject
|
|
}
|
|
foreach ($name in $script:MicrosoftSignedPe) {
|
|
Assert-MicrosoftSignature -Path (Join-Path $root $name)
|
|
}
|
|
$digest = Get-ManifestDigest -Manifest @(Get-TreeManifest -Root $root)
|
|
if ($DigestPath) { Set-Content -LiteralPath $DigestPath -Value $digest -NoNewline }
|
|
Write-Host "Windows Authenticode payload verified; tree digest $digest."
|