improve wdk signing

3 files changed, 66 insertions, 98 deletions

diff --git a/tests/projects/wdk/umdf/echo/xmake.lua b/tests/projects/wdk/umdf/echo/xmake.lua
index 45ec8ec9d..414c2f074 100644
--- a/tests/projects/wdk/umdf/echo/xmake.lua
+++ b/tests/projects/wdk/umdf/echo/xmake.lua
@@ -11,6 +11,13 @@ target("echo")
     -- add rules
     add_rules("wdk.umdf.driver")
 
+    -- set test sign
+--    set_values("wdk.sign.mode", "test")
+
+    -- set release sign
+--    set_values("wdk.sign.mode", "release")
+--    set_values("wdk.sign.certfile", path.join(os.projectdir(), "xxx.cer"))
+
     -- add files
     add_files("driver/*.c") 
     add_files("driver/*.inx")
diff --git a/xmake/rules/wdk/sign/sign.lua b/xmake/rules/wdk/sign/sign.lua
index 2d522a7b1..074384834 100644
--- a/xmake/rules/wdk/sign/sign.lua
+++ b/xmake/rules/wdk/sign/sign.lua
@@ -54,109 +54,53 @@ function _get_tool(target, name)
     return tool
 end
 
--- get thumbprint
-function _get_thumbprint(target)
-
-    -- get it from the cache
-    local thumbprint = _g.thumbprint
-    if not thumbprint then
-
-        -- try to get certificate info
-        local certinfo = try 
-        {
-            function ()
-                return os.iorun("certutil -store -user my")
-            end
-        }
-        assert(certinfo, "cannot get certificate info in local machine!")
-
-        -- trace certificate info
-        if option.get("verbose") then
-            print(certinfo)
-        end
-
-        -- get thumbprint from certificate info
-        thumbprint = (certinfo:match("sha1.-: (%w+)") or ""):trim()
-        assert(#thumbprint > 0, "cannot get thumbprint of certificate!")
-        _g.thumbprint = thumbprint
-    end
-    return thumbprint
-end
-
--- do test sign
-function _sign_test(target, filepath)
+-- do sign
+function main(target, filepath, mode)
 
     -- get signtool
     local signtool = _get_tool(target, "signtool")
 
-    -- get makecert
-    local makecert = _get_tool(target, "makecert")
-
-    -- get certmgr
-    local certmgr = _get_tool(target, "certmgr")
-
-    -- get a test certificate
-    local testcer = path.join(global.directory(), "sign", "test.cer")
-    local company = "tboox.org(test)"
+    -- get timestamp
     local timestamp = target:values("wdk.sign.timestamp") or "http://timestamp.verisign.com/scripts/timestamp.dll"
-    if not os.isfile(testcer) then
-
-        -- make a new test certificate
-        local signdir = path.directory(testcer)
-        if not os.isdir(signdir)  then
-            os.mkdir(signdir)
-        end
-        os.vrunv(makecert, {"-r", "-pe", "-ss", "PrivateCertStore", "-n", "CN=" .. company, testcer})
-
-        -- register this test certificate
-        try 
-        {
-            function ()
-                os.vrunv(certmgr, {"/add", testcer, "/s", "/r", "localMachine", "root"})
-                os.vrunv(certmgr, {"/add", testcer, "/s", "/r", "localMachine", "trustedpublisher"})
-            end,
-            catch
-            {
-                function (errors)
-                    os.tryrm(testcer)
-                    raise(errors)
-                end
-            }
-        }
-    end
-
-    -- do sign
-    os.vrunv(signtool, {"sign", "/a", "/v", "/s", "PrivateCertStore", "/n", company, "/t", timestamp, filepath})
-end
-
--- do release sign
-function _sign_release(target, filepath)
-
-    -- get signtool
-    local signtool = _get_tool(target, "signtool")
 
-    -- get *.cer file
-    local cerfile = target:values("wdk.sign.cerfile") 
-    assert(cerfile, "please call set_values(\"wdk.sign.cerfile\", ...) to set *.cer file for release signing!")
-
-    -- get company
+    -- init arguments
+    local argv = {"sign", "/v", "/t", timestamp}
     local company = target:values("wdk.sign.company") 
-    assert(company, "please call set_values(\"wdk.sign.company\", ...) to set company for release signing!")
-
-    -- get timestamp
-    local timestamp = target:values("wdk.sign.timestamp") or "http://timestamp.verisign.com/scripts/timestamp.dll"
+    if company then
+        table.insert(argv, "/n")
+        table.insert(argv, company)
+    end
+    local certfile = target:values("wdk.sign.certfile") 
+    if certfile then
+        table.insert(argv, "/ac")
+        table.insert(argv, certfile)
+    end
+    local thumbprint = target:values("wdk.sign.thumbprint")
+    if thumbprint then
+        table.insert(argv, "/sha1")
+        table.insert(argv, thumbprint)
+    end
+    local store = target:values("wdk.sign.store")
+    if not store and mode == "test" then
+    end
+    if store then
+        table.insert(argv, "/a")
+        table.insert(argv, "/s")
+        table.insert(argv, store)
+    end
 
-    -- do sign
-    os.vrunv(signtool, {"sign", "/v", "/ac", cerfile, "/n", company, "/t", timestamp, filepath})
-end
+    -- uses the default test certificate
+    if mode == "test" and (not certfile and not thumbprint and not store) then
+        table.insert(argv, "/a")
+        table.insert(argv, "/n")
+        table.insert(argv, "tboox.org(test)")
+        table.insert(argv, "/s")
+        table.insert(argv, "PrivateCertStore")
+    end
 
--- do sign
-function main(target, filepath, mode)
+    -- add target file
+    table.insert(argv, filepath)
 
     -- do sign
-    if mode == "test" then
-        _sign_test(target, filepath)
-    elseif mode == "release" then
-        _sign_release(target, filepath)
-    end
+    os.vrunv(signtool, argv)
 end
diff --git a/xmake/rules/wdk/sign/xmake.lua b/xmake/rules/wdk/sign/xmake.lua
index 93028e2cb..e3c28c615 100644
--- a/xmake/rules/wdk/sign/xmake.lua
+++ b/xmake/rules/wdk/sign/xmake.lua
@@ -25,10 +25,12 @@
 -- define rule: sign
 --
 -- values:
---   - wdk.sign.mode:      nosign/test/release (default: nosign)
---   - wdk.sign.company:   tboox.org (for release signing)
---   - wdk.sign.certfile:  signcert.cer (for release signing)
---   - wdk.sign.timestamp: http://timestamp.verisign.com/scripts/timstamp.dll
+--   - wdk.sign.mode:       nosign/test/release (default: nosign)
+--   - wdk.sign.store:      PrivateCertStore 
+--   - wdk.sign.thumbprint: 032122545DCAA6167B1ADBE5F7FDF07AE2234AAA
+--   - wdk.sign.company:    tboox.org
+--   - wdk.sign.certfile:   signcert.cer 
+--   - wdk.sign.timestamp:  http://timestamp.verisign.com/scripts/timstamp.dll
 --
 rule("wdk.sign")
 
@@ -57,6 +59,21 @@ rule("wdk.sign")
         end
         assert(os.isexec(inf2cat), "inf2cat not found!")
         target:data_set("wdk.sign.inf2cat", inf2cat)
+
+        -- check
+        local mode = target:values("wdk.sign.mode")
+        local store = target:values("wdk.sign.store")
+        local certfile = target:values("wdk.sign.certfile")
+        local thumbprint = target:values("wdk.sign.thumbprint")
+        if mode and (not certfile and not thumbprint and not store) then
+            if mode == "test" then
+                raise([[please first select one following step for signing:
+1. run `$xmake l utils.wdk.testsign install` as admin in console (only once) or
+2. add set_values(\"wdk.sign.[certfile|store|thumbprint]\", ...) in xmake.lua]], mode)
+            else
+                raise("please add set_values(\"wdk.sign.[certfile|store|thumbprint]\", ...) for %s signing!", mode)
+            end
+        end
     end)
 
     -- after build