Call getCertificatePublisher only when publisher not set

[zobo]

When trying to sign MSIX with a certificate from the certificate store and not from PFX file, we can achieve this by setting our own signtool_options like this:

msix_config:
  display_name: Flutter App
  publisher_display_name: Company Name
  identity_name: company.suite.flutterapp
  msix_version: 1.0.0.0
  logo_path: C:\path\to\logo.png
  capabilities: internetClient, location, microphone, webcam
  signtool_options: /v /fd SHA256 /a /sha1 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx /tr http://timestamp.digicert.com
  install_certificate: false

However when running msix:create an error will be thrown:
Get-PfxData : The system cannot find the file specified. 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND)

Turns out the code tries to get the Certificate Publisher from a PFX - not set.

This patch mitigates the issue by taking the publisher from the config - if it is set.

msix_config:
  ...
  publisher: CN=Company, O=Company,...

I will try to prepare an alternative patch, that will allow alternative certificate selection method

[YehudaKremer]

Hello @zobo

I will think of a solution for this bug, thank you 👍

[zobo]

One thing I wanted to suggest was to create another config variable. You could either use certificatePath and certificatePassword or a new certificateThumbprint. To find the certificate with a (sha1) Thumbprint you can run a Powershell like this:
dir -Recurse cert: | where {$_.Thumbprint -eq "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"} | Format-List -Property Subject

[zobo]

Yet another suggestion. If the user has a .crt file (only the public part - and thus no certificatePassword set) one could use something like this.

$crt=new-object System.Security.Cryptography.X509Certificates.X509Certificate2("file.crt")
$crt | fl -Property Subject

I think passing only the public part to signtool via /f option is also valid. The system will find the private key alone.

I think the whole thing is important as certificates should not lie around on the file system in PFX format. For EV code signing cert you can't even get the private key. You get a pre-populated certificate hardware token mailed to you, and cloud signing is very much a thing today.
In all cases, you do not have a PFX.

I can provide a patch with these ideas.

[YehudaKremer]

Moving related work to #156.