Azure Trusted Signing

.github/workflows/build.yml

@@ -46,15 +46,15 @@ jobs:
           npx electron-builder install-app-deps
           case "${{ matrix.os }}" in
             macos*)
-              CSC_IDENTITY_AUTO_DISCOVERY=false npx electron-builder --mac --universal --publish never -c.mac.identity=null
+              npm run build electron mac
               ;;
             ubuntu*)
               sudo apt-get install rpm --yes
-              npx electron-builder --linux --publish never
+              npm run build electron linux
               npx electron-builder --linux snap --x64 --publish never
               ;;
             windows*)
-              npx electron-builder --win --x64 --arm64 --publish never
+              npm run build electron windows
               ;;
           esac
 

.github/workflows/publish.yml

@@ -44,27 +44,28 @@ jobs:
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
-          WIN_CSC_LINK: ${{ secrets.WIN_CSC_LINK }}
-          WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CSC_KEY_PASSWORD }}
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
         run: |
           npx electron-builder install-app-deps
           case "${{ matrix.os }}" in
             macos*)
               mkdir -p ~/.private_keys
               echo '${{ secrets.APPLE_API_KEY }}' > ~/.private_keys/AuthKey_${{ secrets.APPLE_API_KEY_ID }}.p8
-              npx electron-builder --mac --universal --publish always
+              npm run publish electron mac
               ;;
             ubuntu*)
               sudo apt-get install rpm --yes
-              npx electron-builder --linux --publish always
+              npm run publish electron linux
               sudo snap install snapcraft --classic
               npx electron-builder --linux snap --x64 --publish always
               ;;
             windows*)
               unset CSC_LINK;
               unset CSC_KEY_PASSWORD;
-              npx electron-builder --win --x64 --arm64 --publish always
+              npm run publish electron windows
               ;;
           esac
 

package.js

@@ -274,8 +274,8 @@ const build = async (target) => {
             await install();
             await exec('npx electron-builder install-app-deps');
             const table = new Map([
-                ['mac',     'npx electron-builder --mac --universal --publish never -c.mac.identity=null'],
-                ['windows', 'npx electron-builder --win --x64 --arm64 --publish never'],
+                ['mac',     'npx electron-builder --mac --universal --publish never --config.mac.identity=null'],
+                ['windows', 'npx electron-builder --win --x64 --arm64 --publish never --config.win.azureSignOptions='],
                 ['linux',   'npx electron-builder --linux --publish never']
             ]);
             const targets = table.has(key) ? [table.get(key)] : Array.from(table.values());

publish/electron-builder.json

@@ -76,8 +76,8 @@
         "artifactName":"${productName}-${version}-${arch}.${ext}",
         "executableName": "netron",
         "target": [ 
-            { "target": "deb", "arch": ["x64", "arm64"] },
-            { "target": "rpm", "arch": ["x64", "arm64"] },
+            { "target": "deb", "arch": ["x64"] },
+            { "target": "rpm", "arch": ["x64"] },
             { "target": "AppImage", "arch": ["x64"] }
         ]
     },
@@ -92,10 +92,12 @@
     },
     "win": {
         "target": [ "nsis" ],
-        "signtoolOptions": {
-            "signingHashAlgorithms": [ "sha256" ]
-        },
-        "verifyUpdateCodeSignature": false
+        "azureSignOptions" : {
+            "publisherName": "Lutz Roeder",
+            "endpoint": "https://eus.codesigning.azure.net/",
+            "codeSigningAccountName": "lutzroeder",
+            "certificateProfileName": "lutzroeder"
+        }
     },
     "dmg": {
         "artifactName": "${productName}-${version}.${ext}",