From 6f78369e4138f0ea398df5056d6514a5583d0a14 Mon Sep 17 00:00:00 2001
From: Maja Komel <maja.komel@gmail.com>
Date: Tue, 13 Feb 2024 12:06:05 +0100
Subject: [PATCH] Sign ooniprobe.exe during build

---
 scripts/download-probe-cli.js | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/scripts/download-probe-cli.js b/scripts/download-probe-cli.js
index da8adfd7..44cf95b1 100644
--- a/scripts/download-probe-cli.js
+++ b/scripts/download-probe-cli.js
@@ -13,11 +13,7 @@ const dstDir = path.join(appRoot, 'build', 'probe-cli')
 
 const download = () => {
   ensureDirSync(dstDir)
-  const osarchs = [
-    'darwin-amd64',
-    'linux-amd64',
-    'windows-amd64',
-  ]
+  const osarchs = ['darwin-amd64', 'linux-amd64', 'windows-amd64']
   var osarch
   for (osarch of osarchs) {
     const extension = osarch.includes('windows') ? '.exe' : ''
@@ -30,7 +26,19 @@ const download = () => {
     }
     osarch = osarch.replace('-', '_')
     ensureDirSync(`${dstDir}/${osarch}`)
-    execSync(`cp ${dstDir}/${versionedFilename} ${dstDir}/${osarch}/ooniprobe${extension}`)
+    if (osarch === 'windows_amd64') {
+      execSync(
+        `cp ${dstDir}/${versionedFilename} ${dstDir}/${osarch}/ooniprobe${extension}-unsigned`
+      )
+      execSync(
+        `osslsigncode sign -pkcs12 ${process.env.WIN_CSC_LINK} -pass ${process.env.WIN_CSC_KEY_PASSWORD} -n "OONI Probe CLI" -i https://ooni.org/ -in ${dstDir}/${osarch}/ooniprobe${extension}-unsigned -out ${dstDir}/${osarch}/ooniprobe${extension}`
+      )
+      execSync(`rm -rf ${dstDir}/${osarch}/ooniprobe${extension}-unsigned`)
+    } else {
+      execSync(
+        `cp ${dstDir}/${versionedFilename} ${dstDir}/${osarch}/ooniprobe${extension}`
+      )
+    }
     execSync(`chmod +x ${dstDir}/${osarch}/ooniprobe${extension}`)
   }
 }