GPII-1767: Allow code signing of the installer

README.md

@@ -10,7 +10,7 @@
 Make sure MSBuild and the WiX folder are in the path.
 
 ### Staging
-- Build GPII/windows (including the listeners - see https://github.com/GPII/windows/blob/master/provisioning/build.bat)
+- Build GPII/windows (including the listeners - see https://github.com/GPII/windows/tree/master/provisioning)
 - Edit line 10 of [`setup/build.cmd`](https://github.com/GPII/gpii-wix-installer/blob/master/setup/build.cmd) and replace `C:\projects\gpii\windows` with the path of your local GPII/windows repository (**no** trailing backslash)
 - Run [`setup/build.cmd`](https://github.com/GPII/gpii-wix-installer/blob/master/setup/build.cmd)
 
@@ -19,6 +19,16 @@ Staging makes a private copy of the GPII/windows repository inside the `staging`
 After running `build.cmd`, an MSI file can be found in the `output` folder.  
 Whenever there are changes to the local GPII/windows repository, rerun `build.cmd` to make a new installer.
 
+### Signing
+The MSI file can be optionally signed in the last step of the build. 
+
+You will need a code signing certificate in the PKCS#12/PFX format.
+- Set the `GPII_SIGNING_CERT` environment variable with the location of the certificate (eg `C:\gpii\my_certificate.pfx`)
+- Set the `GPII_SIGNING_CERT_PASSWORD` environment variable with the PFX password (or `""` if none)
+- Set the `GPII_SIGNING_DESCRIPTION` environment variable with a description (eg `"GPII Installer"`)
+
+Use double quotes if there are spaces in any of the values. 
+
 ## Unattended installation
 The installer is a standard MSI file and as such it can be also executed using `msiexec.exe` and supports all the [command-line options](https://msdn.microsoft.com/en-us/library/windows/desktop/aa367988(v=vs.85).aspx) available to `msiexec.exe`.
 

setup/setup.msbuild

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="3.5"
-         DefaultTargets="Clean;GPII;USBListener;RFIDListener;UCRT;WIX"
+         DefaultTargets="Clean;GPII;USBListener;RFIDListener;UCRT;WIX;Signing"
          xmlns="http://schemas.microsoft.com/developer/msbuild/2003"
          >
 
@@ -118,4 +118,21 @@
     <Delete Files="@(DeletePdb)" />
     <Message Text="Install package has been created." />
   </Target>
+
+    <Target Name="Signing">
+        <MSBuild.ExtensionPack.Computer.EnvironmentVariable TaskAction="Get" Variable="GPII_SIGNING_CERT">
+            <Output PropertyName="SigningCert" TaskParameter="Value"/>
+        </MSBuild.ExtensionPack.Computer.EnvironmentVariable>
+        <MSBuild.ExtensionPack.Computer.EnvironmentVariable TaskAction="Get" Variable="GPII_SIGNING_CERT_PASSWORD">
+            <Output PropertyName="SigningCertPassword" TaskParameter="Value"/>
+        </MSBuild.ExtensionPack.Computer.EnvironmentVariable>
+        <MSBuild.ExtensionPack.Computer.EnvironmentVariable TaskAction="Get" Variable="GPII_SIGNING_DESCRIPTION">
+            <Output PropertyName="SigningDescription" TaskParameter="Value"/>
+        </MSBuild.ExtensionPack.Computer.EnvironmentVariable>
+        <Exec Command='signtool sign /f $(SigningCert) /p $(SigningCertPassword) /d $(SigningDescription) /t http://timestamp.verisign.com/scripts/timstamp.dll /v $(OutDir)\$(MsiFile)' 
+              Condition="Exists($(SigningCert))"
+              ContinueOnError="false"
+              WorkingDirectory="."
+              />
+    </Target>
 </Project>