creatensis.pl: create signed installer

Author: jef-n

ms-windows/Installer-Files/QGIS.ico

@@ -35,8 +35,6 @@ RequestExecutionLevel admin
 
 ;Set the installer variables, depending on the selected version to build
 
-!define COMPLETE_NAME "${QGIS_BASE} ${VERSION_NUMBER} ${VERSION_NAME}"
-
 !addplugindir osgeo4w/untgz
 !addplugindir osgeo4w/nsis
 
@@ -58,7 +56,6 @@ Name "${DISPLAYED_NAME}"
 ;Name of the output file (installer executable)
 OutFile "${INSTALLER_NAME}"
 
-
 ;Tell the installer to show Install and Uninstall details as default
 ShowInstDetails hide
 ShowUnInstDetails hide
@@ -88,6 +85,10 @@ ShowUnInstDetails hide
 ;    if the uninstall procedure succeeded, call the current installer asking for the install PATH
 
 Function .onInit
+!ifdef INNER
+	WriteUninstaller "${UNINSTALLERDEST}\uninstall.exe"
+	Quit
+!endif
 	${If} ${ARCH} == "x86_64"
 		${If} ${RunningX64}
 			DetailPrint "Installer running on 64-bit host"
@@ -199,7 +200,6 @@ Function .onInit
 			Abort
 		${EndIf}
 	${EndIf}
-
 FunctionEnd
 
 ;----------------------------------------------------------------------------------------------------------------------------
@@ -280,6 +280,7 @@ Var /GLOBAL ARCHIVE_SIZE_KB
 Var /GLOBAL ARCHIVE_SIZE_MB
 Var /GLOBAL DOWNLOAD_MESSAGE_
 
+!ifndef INNER
 Section "QGIS" SecQGIS
 	SectionIn RO
 
@@ -320,8 +321,10 @@ Section "QGIS" SecQGIS
 	SetOutPath "$INSTALL_DIR"
 	File /r ${PACKAGE_FOLDER}\*.*
 
-	;Create the Uninstaller
-	WriteUninstaller "$INSTALL_DIR\Uninstall-QGIS.exe"
+!ifndef INNER
+	SetOutPath $INSTDIR
+	File uninstall.exe
+!endif
 
 	;Registry Key Entries
 
@@ -337,8 +340,8 @@ Section "QGIS" SecQGIS
 	WriteRegStr HKLM "Software\${QGIS_BASE}" "InstallPath" "$INSTALL_DIR"
 
 	;HKEY_LOCAL_MACHINE Uninstall entries
-	WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${QGIS_BASE}" "DisplayName" "${COMPLETE_NAME}"
-	WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${QGIS_BASE}" "UninstallString" "$INSTALL_DIR\Uninstall-QGIS.exe"
+	WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${QGIS_BASE}" "DisplayName" "${DISPLAYED_NAME}"
+	WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${QGIS_BASE}" "UninstallString" "$INSTALL_DIR\uninstall.exe"
 	WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${QGIS_BASE}" "DisplayIcon" "$INSTALL_DIR\icons\QGIS.ico"
 	WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${QGIS_BASE}" "EstimatedSize" 1
 	WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${QGIS_BASE}" "HelpLink" "${WIKI_PAGE}"
@@ -371,6 +374,7 @@ RebootNecessary:
 NoRebootNecessary:
 
 SectionEnd
+!endif
 
 Function DownloadDataSet
 
@@ -481,7 +485,15 @@ SectionEnd
 
 ;Uninstaller Section
 
+!ifdef INNER
 Section "Uninstall"
+	${If} ${ARCH} == "x86_64"
+		${If} ${RunningX64}
+			DetailPrint "Installer running on 64-bit host"
+			; disable registry redirection (enable access to 64-bit portion of registry)
+			SetRegView 64
+		${EndIf}
+	${EndIf}
 
 	GetFullPathName /SHORT $0 $INSTDIR
 	System::Call 'Kernel32::SetEnvironmentVariableA(t, t) i("OSGEO4W_ROOT", "$0").r0'
@@ -493,12 +505,13 @@ Section "Uninstall"
 	ReadEnvStr $0 COMSPEC
 	nsExec::ExecToLog '"$0" /c "$INSTDIR\preremove.bat"'
 
-	Delete "$INSTDIR\Uninstall-QGIS.exe"
+	Delete "$INSTDIR\uninstall.exe"
 	Delete "$INSTDIR\*.bat.done"
 	Delete "$INSTDIR\*.log"
 	Delete "$INSTDIR\*.txt"
 	Delete "$INSTDIR\*.ico"
 	Delete "$INSTDIR\*.bat"
+	Delete "$INSTDIR\*.dll"
 
 	RMDir /r "$INSTDIR\bin"
 	RMDir /r "$INSTDIR\apps"
@@ -529,15 +542,18 @@ Section "Uninstall"
 	DeleteRegKey HKLM "Software\${QGIS_BASE}"
 	DeleteRegKey HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${QGIS_BASE}"
 SectionEnd
+!endif
 
 ;----------------------------------------------------------------------------------------------------------------------------
 
+!ifndef INNER
 ;Installer Section Descriptions
 !insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN
 	!insertmacro MUI_DESCRIPTION_TEXT ${SecQGIS} "Install ${QGIS_BASE}"
 	!insertmacro MUI_DESCRIPTION_TEXT ${SecNorthCarolinaSDB} "Download and install the North Carolina sample data set"
 	!insertmacro MUI_DESCRIPTION_TEXT ${SecSpearfishSDB} "Download and install the South Dakota (Spearfish) sample data set"
 	!insertmacro MUI_DESCRIPTION_TEXT ${SecAlaskaSDB} "Download and install the Alaska sample database (shapefiles and TIFF data)"
 !insertmacro MUI_FUNCTION_DESCRIPTION_END
+!endif
 
 ;----------------------------------------------------------------------------------------------------------------------------

ms-windows/QGIS-Installer.nsi

@@ -7,7 +7,7 @@
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.         
+# (at your option) any later version.
 
 #
 # Download OSGeo4W packages
@@ -29,11 +29,15 @@
 my $root = "http://download.osgeo.org/osgeo4w";
 my $ininame = "setup.ini";
 my $arch = "x86_64";
+my $signwith;
+my $signpass;
 my $help;
 
 my $result = GetOptions(
 		"verbose+" => \$verbose,
 		"keep" => \$keep,
+		"signwith=s" => \$signwith,
+		"signpass=s" => \$signpass,
 		"releasename=s" => \$releasename,
 		"version=s" => \$version,
 		"binary=i" => \$binary,
@@ -45,6 +49,8 @@
 		"help" => \$help
 	);
 
+die "certificate not found" if defined $signwith && ! -f $signwith;
+
 pod2usage(1) if $help;
 
 my $wgetopt = $verbose ? "" : "-nv";
@@ -265,6 +271,38 @@ sub getDeps {
 	chdir "..";
 }
 
+my($major, $minor, $patch);
+
+open F, "../../CMakeLists.txt";
+while(<F>) {
+	if(/SET\(CPACK_PACKAGE_VERSION_MAJOR "(\d+)"\)/) {
+		$major = $1;
+	} elsif(/SET\(CPACK_PACKAGE_VERSION_MINOR "(\d+)"\)/) {
+		$minor = $1;
+	} elsif(/SET\(CPACK_PACKAGE_VERSION_PATCH "(\d+)"\)/) {
+		$patch = $1;
+	} elsif(/SET\(RELEASE_NAME "(.+)"\)/) {
+		$releasename = $1 unless defined $releasename;
+	}
+}
+close F;
+
+$version = "$major.$minor.$patch" unless defined $version;
+
+my($pmajor,$pminor,$ppatch) = $version =~ /^(\d+)\.(\d+)\.(\d+)$/;
+die "Invalid version $version" unless defined $ppatch;
+
+unless( defined $binary ) {
+	if( -f "binary$archpostfix-$version" ) {
+		open P, "binary$archpostfix-$version";
+		$binary = <P>;
+		close P;
+		$binary++;
+	} else {
+		$binary = 1;
+	}
+}
+
 #
 # Create postinstall.bat
 #
@@ -290,7 +328,7 @@ sub getDeps {
 print F "echo OSGEO4W_STARTMENU=%OSGEO4W_STARTMENU%$r";
 print F "echo OSGEO4W_DESKTOP=%OSGEO4W_DESKTOP%$r";
 print F "PATH %OSGEO4W_ROOT%\\bin;%PATH%$r";
-print F "cd %OSGEO4W_ROOT%$r";
+print F "cd /d %OSGEO4W_ROOT%$r";
 
 chdir $unpacked;
 for my $p (<etc/postinstall/*.bat>) {
@@ -320,7 +358,7 @@ sub getDeps {
 print F "if \"%OSGEO4W_ROOT_MSYS:~1,1%\"==\":\" set OSGEO4W_ROOT_MSYS=/%OSGEO4W_ROOT_MSYS:~0,1%/%OSGEO4W_ROOT_MSYS:~3%$r";
 print F "echo OSGEO4W_ROOT_MSYS=%OSGEO4W_ROOT_MSYS%$r";
 print F "PATH %OSGEO4W_ROOT%\\bin;%PATH%$r";
-print F "cd %OSGEO4W_ROOT%$r";
+print F "cd /d \"%OSGEO4W_ROOT%\"$r";
 
 chdir $unpacked;
 for my $p (<etc/preremove/*.bat>) {
@@ -337,38 +375,6 @@ sub getDeps {
 
 close F;
 
-my($major, $minor, $patch);
-
-open F, "../../CMakeLists.txt";
-while(<F>) {
-	if(/SET\(CPACK_PACKAGE_VERSION_MAJOR "(\d+)"\)/) {
-		$major = $1;
-	} elsif(/SET\(CPACK_PACKAGE_VERSION_MINOR "(\d+)"\)/) {
-		$minor = $1;
-	} elsif(/SET\(CPACK_PACKAGE_VERSION_PATCH "(\d+)"\)/) {
-		$patch = $1;
-	} elsif(/SET\(RELEASE_NAME "(.+)"\)/) {
-		$releasename = $1 unless defined $releasename;
-	}
-}
-close F;
-
-$version = "$major.$minor.$patch" unless defined $version;
-
-my($pmajor,$pminor,$ppatch) = $version =~ /^(\d+)\.(\d+)\.(\d+)$/;
-die "Invalid version $version" unless defined $ppatch;
-
-unless( defined $binary ) {
-	if( -f "binary$archpostfix-$version" ) {
-		open P, "binary$archpostfix-$version";
-		$binary = <P>;
-		close P;
-		$binary++;
-	} else {
-		$binary = 1;
-	}
-}
-
 unless(-d "untgz") {
 	system "unzip $packages/Untgz.zip";
 	die "unpacking Untgz.zip failed" if $?;
@@ -438,29 +444,77 @@ sub getDeps {
 
 print "Running NSIS\n" if $verbose;
 
-my $cmd = "makensis";
-$cmd .= " -V$verbose";
-$cmd .= " -DVERSION_NAME='$releasename'";
-$cmd .= " -DVERSION_NUMBER='$version'";
-$cmd .= " -DBINARY_REVISION=$binary";
-$cmd .= sprintf( " -DVERSION_INT='%d%02d%02d%02d'", $pmajor, $pminor, $ppatch, $binary );
-$cmd .= sprintf( " -DQGIS_BASE='$packagename %d.%d'", $pmajor, $pminor );
-$cmd .= " -DINSTALLER_NAME='$packagename-OSGeo4W-$version-$binary-Setup$archpostfix.exe'";
-$cmd .= " -DDISPLAYED_NAME=\"$packagename '$releasename' ($version)\"";
-$cmd .= " -DSHORTNAME='$shortname'";
-$cmd .= " -DINSTALLER_TYPE=OSGeo4W";
-$cmd .= " -DPACKAGE_FOLDER=osgeo4w/$unpacked";
-$cmd .= " -DLICENSE_FILE='$license'";
-$cmd .= " -DARCH='$arch'";
-$cmd .= " QGIS-Installer.nsi";
+my $installerbase = "$packagename-OSGeo4W-$version-$binary-Setup$archpostfix";
+
+my $run;
+my $instdest;
+unless($^O =~ /win/i) {
+	$run = "wine ";
+	$instdest = `winepath -w \$PWD`;
+	$instdest =~ s/\s+$//;
+	$instdest =~ s/\\/\\\\/g;
+} else {
+	$run = "";
+	$instdest = ".";
+}
+
 
+my $args = "";
+$args .= " -V$verbose";
+$args .= " -DVERSION_NAME='$releasename'";
+$args .= " -DVERSION_NUMBER='$version'";
+$args .= " -DBINARY_REVISION=$binary";
+$args .= sprintf( " -DVERSION_INT='%d%02d%02d%02d'", $pmajor, $pminor, $ppatch, $binary );
+$args .= sprintf( " -DQGIS_BASE='$packagename %d.%d'", $pmajor, $pminor );
+$args .= " -DDISPLAYED_NAME=\"$packagename $version '$releasename'\"";
+$args .= " -DPACKAGE_FOLDER=osgeo4w/$unpacked";
+$args .= " -DLICENSE_FILE='$license'";
+$args .= " -DARCH='$arch'";
+$args .= " QGIS-Installer.nsi";
+
+sub sign {
+	my $base = shift;
+
+	my $cmd = "osslsigncode sign";
+	$cmd .= " -pkcs12 \"$signwith\"";
+	$cmd .= " -pass \"$signpass\"" if defined $signpass;
+	$cmd .= " -n \"$packagename $version '$releasename'\"";
+	$cmd .= " -h sha256";
+	$cmd .= " -i \"https://qgis.org\"";
+	$cmd .= " -t \"http://timestamp.digicert.com\"";
+	$cmd .= " -in \"$base.exe\"";
+	$cmd .= " $base-signed.exe";
+	system $cmd;
+	die "signing failed [$cmd]" if $?;
+
+	rename("$base-signed.exe", "$base.exe") or die "rename failed: $!";
+}
+
+my $cmd;
+unlink "makeuinst.exe";
+$cmd = "makensis -DINNER=1 -DUNINSTALLERDEST='$instdest' -DINSTALLER_NAME='makeuinst.exe' $args";
 system $cmd;
-die "running nsis failed [$cmd]" if $?;
+die "running makensis failed [$cmd]" if $?;
+die "makeuinst.exe not created" unless -f "makeuinst.exe";
+
+unlink "uninstall.exe";
+system "${run}makeuinst.exe";
+die "uninstall.exe not created" unless -f "uninstall.exe";
+unlink "makeuinst.exe";
+
+sign "uninstall" if $signwith;
+
+$cmd = "makensis -DINSTALLER_NAME='$installerbase.exe' $args";
+system $cmd;
+die "running makensis failed [$cmd]" if $?;
+
+sign "$installerbase" if $signwith;
 
 open P, ">osgeo4w/binary$archpostfix-$version";
 print P $binary;
 close P;
 
+system "md5sum $installerbase.exe >$installerbase.exe.md5sum";
 
 __END__
 
@@ -476,6 +530,8 @@ =head1 SYNOPSIS
     -verbose		increase verbosity
     -releasename=name	name of release (defaults to CMakeLists.txt setting)
     -keep		don't start with a fresh unpacked directory
+    -signwith=cert.p12	optionall sign package with certificate (requires osslsigncode)
+    -signpass=password	password of certificate
     -version=m.m.p	package version (defaults to CMakeLists.txt setting)
     -binary=b		binary version of package
     -ininame=filename	name of the setup.ini (defaults to setup.ini)