Gitian windows signing normalization

[theuni]

Sorry for yet another PR here. This one includes @Michagogo's suggestions and doc changes. It replaces #6343 and #6342.

Teach gitian to output a -win-unsigned.tar.gz similar to OSX. The signer will attempt to combine any "-unsigned.exe" with a matching "*-unsigned.exe.pem" from the detatched signature repo.

Also note that the new target signature dir for windows has changed from "${VERSION}-win" to "${VERSION}-win-unsigned".

Tested with a phony tag and signature.

Safe for backport, should be good to go for rc3.

[Michagogo]

Minor nit: NSIS shouldn't output installers with unsigned in the name. Unless I'm misunderstanding, the .dmg that the (non-gitian) build process for OS X outputs doesn't contain that in the name, and that's a good thing. The {un,}signed only makes sense in the context of the gitian process, so gitian should include it in output file names, but the normal build process (e.g. if you're building yourself) shouldn't.

[laanwj]

Thanks!

@Michagogo That comment sounds sensible to me.

[theuni]

Ok, I'll revert that and change the name in the win descriptor instead.

[Michagogo]

There's still the difference in where the tools for the signature application are built... It seems weird to have to manually download those files when we already have a process for fetching and building things that we need for the build process, which is used for OS X. And there's also the fact that the OS X tarball is a full package of everything you need to apply the signature, while Windows is just the installer binaries.

[Michagogo]

Oh, and are the process and tools for creating the detached signature (the commands/script to perform the signing and detach the signature) in the repo somewhere? They are in OS X (contrib/macdeploy/detached-sig-create.sh).

[laanwj]

@Michagogo Manually download which files? The idea is to distribute the Windows and OSX signatures in the same way, through the bitcoin-detached-sigs repository.

If you mean the osslsigncode-1.7.1.tar.gz I certainly don't think they should be part of the signature, nor automatically downloaded by depends. They are not required for the build, just for signing. It was your own argument to make the split between building and gitian clearer.

[theuni]

Updated as suggested.

@Michagogo All of those differences come from the fact that building the osx attacher is a nasty, complicated process, while the Linux attacher is a simple tool. Since signing is only used during the gitian/release process, I don't see any point in adding osslsigntool to depends.

[laanwj]

utACK

[theuni]

@Michagogo as for instructions for signing and maybe a wrapper around osslsigntool to make it foolproof, that's a reasonable suggestion. I'll add that soonish. Not a blocker here, though.

[Michagogo]

I assume you mean the Windows attacher. Okay, I guess that makes sense. As mentioned in IRC recently, it's considered a good practice to also sign the binaries inside the installer, but that's also not worth delaying this (and rc3) for, since on Windows the place where it's actually user-facing is the UAC prompt on installation, as opposed to on Macs where the actual binary that runs needs to be signed. BTW, do we also timestamp?

[theuni]

Yes

[laanwj]

backported to 0.11 as via bdf0d94 bad1e8b

[theuni]

@Michagogo here's a quick go at a signing script that matches the current process. Note that the modified osslsigncode is needed for the "-pem" option.

#!/bin/sh
set -e

TIMESTAMP_URL=http://timestamp.comodoca.com/authenticode

if [ ! -n "$1" ]; then
  echo "usage: $0 <extra osslsigncode args>"
  echo "example: $0 -pkcs12 /path/to/keys.p12 -pass mypass"
  exit 1
fi

if [ -z ${OSSLSIGNCODE} ]; then
  OSSLSIGNCODE=osslsigncode
fi

find . -name "*-unsigned.exe" | while read i; do
  echo "Signing: ${i}"
  INFILE="`basename "${i}"`"
  OUTFILE="`echo "${INFILE}".temp`"
  SIG="`echo "${INFILE}".pem`"
  ${OSSLSIGNCODE} sign "$@" -t ${TIMESTAMP_URL} -in "${INFILE}" -out "${OUTFILE}"
  ${OSSLSIGNCODE} extract-signature -pem -in "${OUTFILE}" -out "${SIG}"
  rm "${OUTFILE}"
done

[Michagogo]

You probably want to quote the ${OSSLSIGNCODE} -- I've had issues with [ -z ] not returning what would be expected, while [ -z "" ] did work.

[laanwj]

I noticed while signing 0.11.0rc3:
The output of the windows signer has the versioned names bitcoin-0.11.0-win32-setup.exe and bitcoin-0.11.0-win64-setup.exe, whereas the osx signer produces bitcoin-osx-signed.dmg.

Let's do the same for the latter e.g. remove the -signed, add the version, so bitcoin-0.11.0-osx.dmg.

The new process works great apart from that.