feat(windows): Sign resources/*.exe and *.exe files and elevate.exe

Close #2853

packages/electron-builder-lib/src/electron/ElectronFramework.ts

@@ -124,7 +124,7 @@ export async function createElectronFrameworkSupport(configuration: Configuratio
     isNpmRebuildRequired: true,
     prepareApplicationStageDirectory: options => unpack(options, createDownloadOpts(options.packager.config, options.platformName, options.arch, version!!), distMacOsAppName),
     beforeCopyExtraFiles: (packager: PlatformPackager<any>, appOutDir: string, asarIntegrity: AsarIntegrity | null) => {
-      return beforeCopyExtraFiles(packager, appOutDir, asarIntegrity, semver.gte(version || "1.8.3", "1.8.3"))
+      return beforeCopyExtraFiles(packager, appOutDir, asarIntegrity, semver.lte(version || "1.8.3", "1.8.3"))
     },
   }
 }

packages/electron-builder-lib/src/targets/nsis/NsisTarget.ts

@@ -37,7 +37,7 @@ export class NsisTarget extends Target {
   /** @private */
   readonly archs: Map<Arch, string> = new Map()
 
-  constructor(protected readonly packager: WinPackager, readonly outDir: string, targetName: string, protected readonly packageHelper: AppPackageHelper) {
+  constructor(readonly packager: WinPackager, readonly outDir: string, targetName: string, protected readonly packageHelper: AppPackageHelper) {
     super(targetName)
 
     this.packageHelper.refCount++

packages/electron-builder-lib/src/targets/nsis/nsisUtil.ts

@@ -60,7 +60,7 @@ export class AppPackageHelper {
 }
 
 export class CopyElevateHelper {
-  private readonly copied = new Map<string, Promise<string>>()
+  private readonly copied = new Map<string, Promise<any>>()
 
   copy(appOutDir: string, target: NsisTarget): Promise<any> {
     let isPackElevateHelper = target.options.packElevateHelper
@@ -78,7 +78,15 @@ export class CopyElevateHelper {
       return promise
     }
 
-    promise = NSIS_PATH.value.then(it => copyFile(path.join(it, "elevate.exe"), path.join(appOutDir, "resources", "elevate.exe"), false))
+    promise = NSIS_PATH.value
+      .then(it => {
+        const outFile = path.join(appOutDir, "resources", "elevate.exe")
+        const promise = copyFile(path.join(it, "elevate.exe"), outFile, false)
+        if (target.packager.platformSpecificBuildOptions.signAndEditExecutable !== false) {
+          return promise.then(() => target.packager.sign(outFile))
+        }
+        return promise
+      })
     this.copied.set(appOutDir, promise)
     return promise
   }

packages/electron-builder-lib/src/winPackager.ts

@@ -2,12 +2,14 @@ import { Arch, asArray, exec, execWine, InvalidConfigurationError, log, use } fr
 import { parseDn } from "builder-util-runtime"
 import { createHash } from "crypto"
 import _debug from "debug"
+import { readdir } from "fs-extra-p"
 import isCI from "is-ci"
 import { Lazy } from "lazy-val"
 import * as path from "path"
 import { downloadCertificate } from "./codeSign"
 import { AfterPackContext } from "./configuration"
 import { DIR_TARGET, Platform, Target } from "./core"
+import { isElectronBased } from "./Framework"
 import { RequestedExecutionLevel, WindowsConfiguration } from "./options/winOptions"
 import { Packager } from "./packager"
 import { chooseNotNull, PlatformPackager } from "./platformPackager"
@@ -21,6 +23,7 @@ import { isBuildCacheEnabled } from "./util/flags"
 import { time } from "./util/timer"
 import { getWindowsVm, VmManager } from "./vm/vm"
 import { CertificateFromStoreInfo, FileCodeSigningInfo, getCertificateFromStoreInfo, getSignVendorPath, sign, WindowsSignOptions } from "./windowsCodeSign"
+import BluebirdPromise from "bluebird-lst"
 
 export class WinPackager extends PlatformPackager<WindowsConfiguration> {
   readonly cscInfo = new Lazy<FileCodeSigningInfo | CertificateFromStoreInfo | null>(() => {
@@ -342,9 +345,33 @@ export class WinPackager extends PlatformPackager<WindowsConfiguration> {
 
   protected async signApp(packContext: AfterPackContext): Promise<any> {
     const exeFileName = `${this.appInfo.productFilename}.exe`
-    if (this.platformSpecificBuildOptions.signAndEditExecutable !== false) {
-      await this.signAndEditResources(path.join(packContext.appOutDir, exeFileName), packContext.arch, packContext.outDir, path.basename(exeFileName, ".exe"), this.platformSpecificBuildOptions.requestedExecutionLevel)
+    if (this.platformSpecificBuildOptions.signAndEditExecutable === false) {
+      return
+    }
+
+    await BluebirdPromise.map(readdir(packContext.appOutDir), (file: string): any => {
+      if (file === exeFileName) {
+        return this.signAndEditResources(path.join(packContext.appOutDir, exeFileName), packContext.arch, packContext.outDir, path.basename(exeFileName, ".exe"), this.platformSpecificBuildOptions.requestedExecutionLevel)
+      }
+      else if (file.endsWith(".exe")) {
+        return this.sign(path.join(packContext.appOutDir, file))
+      }
+      return null
+    })
+
+    if (!isElectronBased(this.info.framework)) {
+      return
     }
+
+    const outResourcesDir = path.join(packContext.appOutDir, "resources")
+    await BluebirdPromise.map(readdir(outResourcesDir), (file: string): any => {
+      if (file.endsWith(".exe")) {
+        return this.sign(path.join(outResourcesDir, file))
+      }
+      else {
+        return null
+      }
+    })
   }
 }