summaryrefslogtreecommitdiff
path: root/postprocess/CustomTarget_signing.mk
AgeCommit message (Collapse)Author
2021-01-16tdf#68198: sign the rest of binariesMike Kaganski
Change-Id: I89bad00245e9e2c9f8cad1cdc33e40007ae6f80d Reviewed-on: https://gerrit.libreoffice.org/c/core/+/109414 Tested-by: Jenkins Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
2020-02-16GBUILD_TRACE, support for finding out where the build time is spentLuboš Luňák
See instructions in solenv/gbuild/Trace.mk . This generates a file than can be viewed e.g. in the Chromium tracing view. Change-Id: I5f90647c58ca729375525b6daed2d4918adc8188 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/88754 Tested-by: Jenkins Reviewed-by: Luboš Luňák <l.lunak@collabora.com>
2019-09-06split msi signing from creation to reduce number of singtool callsChristian Lohmaier
as with private key on crypto-smartcard you'd have to enter your pin over a hundred times while creating full-lang builds and that is not fun. This reduces it to * once for dll/exe (at least in case for mergelib is is less than 350 objects and that doesn't break commandline limits - previously it was set to only sign 20 objects at a time, forcing a pin-entry over 15 times) and * once for main installation set * once for SDK * once for all the helppacks (signing description previously also contained the language, this change drops that to just "<productname> <version> Helppack" and last three are not scattered timewise, but are done after all packaging is complete, so the build only waits twice for user-input. Change-Id: Ibb8bb233e967556f9654573ad30d0ed5883b533f Reviewed-on: https://gerrit.libreoffice.org/78649 Tested-by: Jenkins Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
2019-04-01no need to sign mysql-connector-ooo files, because they no longer exist in LOAndras Timar
Change-Id: Id9361cc6fd6d9bb150fd5a70fde7f6c91097b04a Reviewed-on: https://gerrit.libreoffice.org/70018 Tested-by: Jenkins Reviewed-by: Andras Timar <andras.timar@collabora.com>
2017-12-18tdf#108580: integrate vc_redist.exe into MSIMike Kaganski
... in InstallUISequense. Use --with-vcredist-dir to point to a directory with vc_redist.x64.exe and/or vc_redist.x86.exe. Use --without-vcredist-dir (or --with-vcredist-dir=no) if you don't want to ship it as part of installer and want to silence the configure warning. VCRedist 2015 version 14.0.24215.1 is available at https://www.microsoft.com/en-us/download/details.aspx?id=53840 Since VisualStudio 2015, VC redist merge module that we used before started to work differently: it installs the UCRT only on WinXP, but not on later OSes (Vista to 8.1) which may lack the UCRT (Win10 has it out of the box). The merge module only installs VCRuntime on those systems, which still leaves us with "api-ms-*.dll is missing" problem. (https://blogs.msdn.microsoft.com/vcblog/2015/03/03/introducing-the-universal-crt/ gives more information on VCRedist refactoring background.) Since commit 71d9a61302e65fe091cf70c13fa72b3df09b7e3a, we use a workaround described at the page mentioned above as "App-local deployment of the Universal CRT". We just copy all UCRT DLLs to LibreOffice/program. This has a drawback though, that our UCRT is not updated by Windows Update, so users would rely on LibreOffice updates in case of some vulnerabilities in UCRT (and they could even not realize they have that problem). MS recommends to install UCRT using EXEs they provide from their site. The EXEs install both VCRuntimes and UCRTs, along with required patches, for all Windows versions (Windows XP through Windows 10, where they only install VCRuntimes); the installed libraries are managed by system's update mechanism. But those EXEs cannot be used in MSI custom actions inside InstallExecuteSequence, because they use MSI themselves. So this patch integrates the vc_redist.xXX.exe into MSI binary table, and uses custom action to run the EXE after ExecuteAction in InstallUISequence. This will show the user a VCRedist install window after the main LibreOffice installation finishes; no user interaction is required (except for one additional UAC request), and errors are ignored. Since this installation takes care of both VCRuntime and UCRT, we can ultimately drop both the app-local workaround, and vcredist merge module (so VCRuntime would also be updated by system). The former is done here: this reverts commit 71d9a61302e65fe091cf70c13fa72b3df09b7e3a. This approach has its drawback: if one wants to use unattended installation (without UI; one example is deployment using ActiveDirectory GPO), then InstallUISequence is not run, and so VCRedist isn't installed. In this case, one should install VCRedist separately. Supposedly this should not be huge problem, because this is the case for many existing applications that need separate VCRedist deployment in these scenarios, and unattended installation is advanced stuff that requires prepared user. A notice would be required in release notes and FAQ, though. Change-Id: Ia6a16be60af8a08f41ea7c3dbd457d8f89006006 Reviewed-on: https://gerrit.libreoffice.org/46356 Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com> Tested-by: Mike Kaganski <mike.kaganski@collabora.com>
2017-10-31msc-externals: don't attempt to chmod nonexisting filesChristian Lohmaier
440ac656f783a7a5e33431410a1c038b7d04c42e forgot to also guard the chmod and thus 64bit builds on windows fail when attempting to sign, as in this case there is no cross-compiled explorer extension and the dlls are not copied into instdir Change-Id: Ie17a079b64256d3ef0bf253bdda6cfe722dac3e2 Reviewed-on: https://gerrit.libreoffice.org/44076 Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com> Tested-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
2017-10-31tdf#108580 ship universal crts with the program as workaroundChristian Lohmaier
the universal crts redistributables are available as part of the Windows 10 SDK. Point to the dir (or a copy of the dir) using --with-ucrt-dir Use --without-ucrt-dir (or --with-ucrt-dir=no) if you don't want to ship them as part of LO and are annoyed by the configure warning. Change-Id: I5487e3f6e583222fa053b2fc03176f061d57746c Reviewed-on: https://gerrit.libreoffice.org/44074 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
2017-05-31tdf#86776 Digitally sign soffice.bin on WindowsAndras Timar
Change-Id: I79e223f7ac8367a22668c015afddafe1c8b8cd42 Reviewed-on: https://gerrit.libreoffice.org/38246 Tested-by: Jenkins <ci@libreoffice.org> Reviewed-by: Andras Timar <andras.timar@collabora.com>
2017-05-09cannot sign read-only files, so u+w the redistributablesChristian Lohmaier
Change-Id: I5290d2093555d00e7b7cd4e21098d54af58ee6b8
2017-05-09have screenshot target depend on signing.done, not other way roundChristian Lohmaier
Change-Id: Ia19b3eb122b66c0a6c2304f09faa83345f90892c
2016-08-18screenshots: add new global make targetArmin Le Grand
Up to now the screenshot creation was added/dependent of target slowcheck. Since quite some modules have added screenshot creations now, I added an own target 'screenshot' to allow to keep current slowcheck and screenshot creation separated Change-Id: I80a49a0db607edf8e0405672d570f624d29912e7
2015-04-20don't try to sign merged libs on windowsChristian Lohmaier
as those are fake, just textfiles with dll extension that signtool doesn't like. Also made the text more descriptive "invalid" is ambiguous, "invalid - merged lib" states the reason why the file is a dummy. Change-Id: I31801fd0c3aa593549fac5e6275189e18bbc0010 Reviewed-on: https://gerrit.libreoffice.org/15444 Reviewed-by: Michael Stahl <mstahl@redhat.com> Tested-by: Jenkins <ci@libreoffice.org>
2014-04-29make signing depend on slowchecks being doneChristian Lohmaier
otherwise signing (at least on windows) fails because files are in use Change-Id: Ida6a7d43dc74eb278fd79410b9c0a60f823c5933 Reviewed-on: https://gerrit.libreoffice.org/9176 Tested-by: David Tardon <dtardon@redhat.com> Reviewed-by: David Tardon <dtardon@redhat.com>
2013-10-31postprocess: CustomTarget_signing: find libs in INSTDIRMichael Stahl
... not sure if it wouldn't be better to do this directly when linking, but what do i know about this signing stuff anyway... Change-Id: Iabebf21dd8c0198afb4fd03403fca3ca8a0c9b22
2013-07-23it is not possible to sign libs that are in useDavid Tardon
... so we have to make sure they are not, by delaying the signing after all unit tests have been run. This is just a workaround; IMHO the real fix is fdo#63315 "sign windows binaries during build". Change-Id: Ia26826ec7d324f840f2606b1928bea71cb4f0c48
2013-07-05Missing slash that prevents windows signingFridrich Štrba
Change-Id: I7c84e861f45643a0e66504d10b5d76b2dbb6f629
2013-07-03OOpsFridrich Štrba
Change-Id: Idd7e957064d89d9a5b1fbec9b5fb7d7961872d3e
2013-07-03Fix Windows signing and timestampingFridrich Štrba
Change-Id: Ife8774c9a6157e8bb943d1ba8ec32f560c8281c4
2013-02-26move postprocess to gbuildBjoern Michaelsen
the gb_Postprocess* foo could also be in gb_Module* as it is conceptionally close ('do things globally/productwide'). OTOH I see no obvious reason for e.g. signing not to be done right along with building a lib/executable anyway instead of in postprocess. The same is likely true for the other stuff too. Change-Id: I9c8f569564c056643af7ca39bfe038ed228dcd3d Reviewed-on: https://gerrit.libreoffice.org/2426 Reviewed-by: Matúš Kukan <matus.kukan@gmail.com> Reviewed-by: Fridrich Strba <fridrich@documentfoundation.org> Tested-by: Fridrich Strba <fridrich@documentfoundation.org>
2013-01-03gbuild: replace all use of PRODUCT with ENABLE_DBGUTILMichael Stahl
Also fix the wrong check in cppunit/ExternalProject_cppunit.mk which caused cppunit to always be built without -D_GLIBCXX_DEBUG. Change-Id: Ia247dcd84e2c6fa0e9384fd27643537984d980b5
2012-12-20No StarOffice directories in our buildFridrich Štrba
Change-Id: I609c6f3c071d304f222cd2d15a6ad52dc34652c7
2012-12-20Use a working timestamp engine by defaultFridrich Štrba
Change-Id: I6771f427148f9f46abacaa5f096b98693f3673f9
2012-12-15postprocess: convert to gbuildMatúš Kukan
Change-Id: I6c81fa0f1b8d7273541d5d9883b5fc96a5091bbd Reviewed-on: https://gerrit.libreoffice.org/1080 Reviewed-by: Fridrich Strba <fridrich@documentfoundation.org> Tested-by: Fridrich Strba <fridrich@documentfoundation.org>