packaging/windows/sign-package.cmd

0001 @echo off
0002 setlocal enableextensions enabledelayedexpansion
0003
0004 set pkg_root=%~f1
0005
0006 if not "%SIGNTOOL%" == "" goto skip_find_signtool
0007
0008 :: Find Windows SDK for signtool.exe
0009 if "%WindowsSdkDir%" == "" if not "%ProgramFiles(x86)%" == "" set "WindowsSdkDir=%ProgramFiles(x86)%\Windows Kits\10"
0010 if "%WindowsSdkDir%" == "" set "WindowsSdkDir=%ProgramFiles(x86)%\Windows Kits\10"
0011 if exist "%WindowsSdkDir%\" (
0012     pushd "%WindowsSdkDir%"
0013     for /f "delims=" %%a in ('dir /a:d /b "bin\10.*"') do (
0014         if exist "bin\%%a\x64\signtool.exe" (
0015             set "SIGNTOOL=%WindowsSdkDir%\bin\%%a\x64\signtool.exe"
0016         )
0017     )
0018     if "%SIGNTOOL%" == "" if exist "bin\x64\signtool.exe" (
0019         set "SIGNTOOL=%WindowsSdkDir%\bin\x64\signtool.exe"
0020     )
0021     popd
0022 )
0023 if "%SIGNTOOL%" == "" (
0024     echo ERROR: signtool not found 1>&2
0025     exit /b 1
0026 )
0027
0028 :skip_find_signtool
0029
0030 if "!SIGNTOOL_SIGN_FLAGS!" == "" (
0031     echo ERROR: Please set environment variable SIGNTOOL_SIGN_FLAGS 1>&2
0032     exit /b 1
0033     :: This is what I used for testing:
0034     :: set "SIGNTOOL_SIGN_FLAGS=/f "C:\Users\Alvin\MySPC.pfx" /t http://timestamp.verisign.com/scripts/timstamp.dll"
0035 )
0036
0037 echo Signing binaries in "%pkg_root%"
0038 if not exist "%pkg_root%\" (
0039     echo ERROR: No packaging dir %pkg_root% 1>&2
0040     exit /b 1
0041 )
0042 for /r "%pkg_root%\" %%F in (*.exe *.com *.dll *.pyd) do (
0043     :: Check for existing signature
0044     "%SIGNTOOL%" verify /q /pa "%%F" > NUL
0045     if errorlevel 1 (
0046         echo Signing %%F
0047         "%SIGNTOOL%" sign %SIGNTOOL_SIGN_FLAGS% "%%F"
0048         if errorlevel 1 (
0049             echo ERROR: Got exit code !errorlevel! from signtool! 1>&2
0050             exit /b 1
0051         )
0052     ) else (
0053         echo Not signing %%F - file already signed
0054     )
0055 )
0056 endlocal