sign msix package

.github/workflows/build.yml

@@ -70,6 +70,7 @@ jobs:
       MSYS2_DIR: C:\msys64
       EMACS_REPO: ${{ needs.prepare_env.outputs.repo }}
       EMACS_PKG_VERSION: ${{ needs.prepare_env.outputs.pkg_version }}
+      EMACS_CERT_SECRET: ${{ secrets.EMACS_CERT_SECRET }}
 
     defaults:
       run:

emacs-build.sh

@@ -345,9 +345,11 @@ function action5_package_all ()
             pkg_version="${EMACS_PKG_VERSION:-0.0.0.0}"
             dist_file=`cygpath -w "$emacs_build_root/zips/${emacs_pkg_prefix}.msix"`
             script_file=`cygpath -w "$emacs_build_root/scripts/create_msix.ps1"`
+            cert_file=`cygpath -w "$emacs_build_root/certs/emacs-cert.pfx"`
+            secret="${EMACS_CERT_SECRET:-cert!emacs}"
 
-            echo Creating $dist_file package with version $pkg_version and manifest $man_file
-            powershell.exe -nop -ex bypass -c "& {$script_file -m $man_file -v $pkg_version -d . -p $dist_file}"
+            echo Creating $dist_file package with version $pkg_version
+            powershell.exe -nop -ex bypass -c "& {$script_file -m $man_file -v $pkg_version -d . -p $dist_file -c $cert_file -s $secret}"
         else
             echo Creating zip package
             zip -9 -r "${emacs_distfile}" *

scripts/create_msix.ps1

@@ -4,17 +4,18 @@ param(
     [string] $manifesTemplate,
     [string] $version,
     [string] $directory,
-    [string] $package
+    [string] $package,
+    [string] $cert,
+    [string] $secret
 )
 
 # create a manifest file
 $content = [System.IO.File]::ReadAllText($manifesTemplate).Replace("{{version}}", $version)
 [System.IO.File]::WriteAllText("$directory\AppxManifest.xml", $content)
 
+$msixcli = if ($env:MSIXHeroCLI) { $env:MSIXHeroCLI } else { "MSIXHeroCLI.exe" }
 # create the msix package
-if ($env:MSIXHeroCLI) {
-    &$env:MSIXHeroCLI pack -d $directory -p $package
-}
-else {
-    MSIXHeroCLI.exe pack -d $directory -p $package
-}
+& $msixcli pack -d $directory -p $package
+
+# sign the msix package
+& $msixcli sign -f $cert -p $secret -t "http://timestamp.comodoca.com" "$package"