Merge pull request #1186 from OpenBCI/1185-add-ev-certificate-signing-for-windows-builds

Add EV certificate signing for Windows builds

Author: retiutut

.github/workflows/linux_build_deploy.yml

@@ -17,7 +17,7 @@ env:
 jobs:
   build:
     name: Build for Linux
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
@@ -27,56 +27,52 @@ jobs:
         uses: actions/setup-python@v4
         with:
           python-version: '3.9'
-          cache: 'pip' # caching pip dependencies
+          cache: 'pip'
 
       - name: Install Python Dependencies
-        run: pip install -r release_script/requirements.txt
+        run: pip install -r release/requirements.txt
 
-      - name: Download and Unzip Processing
+      - name: Install Processing
         run: |
-          mkdir -p $GITHUB_WORKSPACE/temp
-          cd $GITHUB_WORKSPACE/temp
+          mkdir -p $GITHUB_WORKSPACE/processing
+          cd $GITHUB_WORKSPACE/processing
           curl -O -L --insecure https://github.com/processing/processing4/releases/download/processing-1292-4.2/processing-4.2-linux-x64.tgz
           tar -xzvf processing-4.2-linux-x64.tgz
           ls
 
       - name: Add Processing to PATH
-        run: |
-          sudo su -c "ln -s $GITHUB_WORKSPACE/temp/processing-4.2/processing-java /usr/local/bin/processing-java"
+        run: sudo su -c "ln -s $GITHUB_WORKSPACE/processing/processing-4.2/processing-java /usr/local/bin/processing-java"
 
-      - name: Test processing-java command
-        run: |
-          processing-java --help
+      - name: Print PATH
+        run: echo "$PATH"
+
+      - name: Test processing-java Command
+        run: processing-java --help
 
-      - name: Copy libraries to Processing
+      - name: Copy Libraries to Processing
         run: |
           mkdir -p $HOME/sketchbook/libraries/
           cp -a $GITHUB_WORKSPACE/OpenBCI_GUI/libraries/. $HOME/sketchbook/libraries/
 
-      - name: Run Unit Tests
-        run: |
-          echo "Unit tests cannot be run on Linux without attached display."
-          echo "https://github.com/processing/processing/wiki/Running-without-a-Display"
+      # Unit tests cannot be run on Linux without attached display.
 
-      - name: Build GUI
-        run: |
-          touch temp/timestamp.txt
-          touch temp/versionstring.txt
-          python $GITHUB_WORKSPACE/release_script/make-release.py --no-prompts
-          GUI_COMMIT_TIME=`cat temp/timestamp.txt`
-          GUI_VERSION_STRING=`cat temp/versionstring.txt`
+      - name: Build
+        run: python $GITHUB_WORKSPACE/release/build.py
+    
+      - name: Package
+        run: python $GITHUB_WORKSPACE/release/package.py
 
-      - name: Configure AWS credentials from Production account
+      - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v2
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: ${{ env.AWS_REGION }}
 
-      - name: Get branch names
+      - name: Get Branch Names
         id: branch-name
         uses: tj-actions/branch-names@v7
 
-      - name: Store DMG on AWS
+      - name: Store Build on AWS
         run: |
           cd $GITHUB_WORKSPACE
           ls

.github/workflows/mac_build_deploy.yml

@@ -27,82 +27,88 @@ jobs:
         uses: actions/setup-python@v4
         with:
           python-version: '3.9'
-          cache: 'pip' # caching pip dependencies
+          cache: 'pip'
 
       - name: Install Python Dependencies
-        run: pip install -r release_script/requirements.txt
+        run: pip install -r release/requirements.txt
 
-      - name: Download and Unzip Processing
+      - name: Install Processing
         run: |
           curl -O -L --insecure https://github.com/processing/processing4/releases/download/processing-1292-4.2/processing-4.2-macos-x64.zip
           unzip processing-4.2-macos-x64.zip
           ls
-
-      - name: Move Processing.app to Applications
-        run: |
           mv Processing.app /Applications/Processing.app
 
-      - name: Add Processing to PATH
+      - name: Configure PATH
         run: |
-          echo "$GITHUB_WORKSPACE/release_script/mac_only/" >> $GITHUB_PATH
-          chmod +x $GITHUB_WORKSPACE/release_script/mac_only/processing-java
+          echo "$GITHUB_WORKSPACE/release/mac/" >> $GITHUB_PATH
+          chmod +x $GITHUB_WORKSPACE/release/mac/processing-java
 
-      - name: Check GITHUB PATH
-        run: echo $GITHUB_PATH
+      - name: Print PATH
+        run: echo "$PATH"
 
       - name: Test processing-java command
-        run: |
-          processing-java --help
+        run: processing-java --help
 
-      - name: Copy libraries to Processing
+      - name: Copy Libraries to Processing
         run: |
           mkdir -p $HOME/Documents/Processing/libraries/
           cp -a $GITHUB_WORKSPACE/OpenBCI_GUI/libraries/. $HOME/Documents/Processing/libraries/
 
       - name: Run Unit Tests
-        run: |
-          ls
-          python $GITHUB_WORKSPACE/GuiUnitTests/run-unittests.py
-
-      - name: Save Encrypted Certificate to File
-        run: |
-          echo $MAC_CERTIFICATE_ENCRYPTED | base64 --decode > $GITHUB_WORKSPACE/release_script/mac_only/Certificates_2023.p12.enc
-        env: 
-          MAC_CERTIFICATE_ENCRYPTED: ${{ secrets.MAC_CERTIFICATE_ENCRYPTED }}
+        run: python $GITHUB_WORKSPACE/GuiUnitTests/run-unittests.py
 
       - name: Decrypt Certificate
         run: |
           openssl version
-          openssl enc -aes-256-cbc -a -d -pbkdf2 -in $GITHUB_WORKSPACE/release_script/mac_only/Certificates_2023.p12.enc -out $GITHUB_WORKSPACE/release_script/mac_only/Certificates.p12 -k "$OPENSSL_CERT_K"
+          echo $MAC_CERTIFICATE_ENCRYPTED | base64 --decode > $GITHUB_WORKSPACE/release/mac/encrypted-certificate.p12.enc
+          openssl enc -aes-256-cbc -a -d -pbkdf2 \
+            -in $GITHUB_WORKSPACE/release/mac/encrypted-certificate.p12.enc \
+            -out $GITHUB_WORKSPACE/release/mac/certificate.p12 \
+            -k "$OPENSSL_CERT_K"
         env:
           OPENSSL_CERT_K: ${{ secrets.OPENSSL_CERT_K }}
+          MAC_CERTIFICATE_ENCRYPTED: ${{ secrets.MAC_CERTIFICATE_ENCRYPTED }}
 
       - name: Add OSX Signing Certificate to Keychain
         uses: apple-actions/import-codesign-certs@v2
         with: 
-          p12-filepath: ${{ github.workspace }}/release_script/mac_only/Certificates.p12
+          p12-filepath: ${{ github.workspace }}/release/mac/certificate.p12
           p12-password: ${{ secrets.CERTIFICATE_P12_PASSWORD }}
 
-      - name: Build GUI
+      - name: Build
         run: |
-          mkdir $GITHUB_WORKSPACE/temp
-          touch temp/timestamp.txt
-          touch temp/versionstring.txt
-          python $GITHUB_WORKSPACE/release_script/make-release.py --no-prompts
-          GUI_COMMIT_TIME=`cat temp/timestamp.txt`
-          GUI_VERSION_STRING=`cat temp/versionstring.txt`
-
-      - name: Configure AWS credentials from Production account
+          python $GITHUB_WORKSPACE/release/build.py
+          cp $GITHUB_WORKSPACE/OpenBCI_GUI/sketch.icns $GITHUB_WORKSPACE/application.macosx/OpenBCI_GUI.app/Contents/Resources/sketch.icns
+
+      - name: Sign Build
+        run: |
+          codesign -f -v -s "Developer ID Application: OpenBCI, Inc. (3P82WRGLM8)" $GITHUB_WORKSPACE/application.macosx/OpenBCI_GUI.app
+
+      - name: Create DMG
+        run: |
+          dmgbuild -s release/mac/dmgbuild_settings.py \
+            -D app=$GITHUB_WORKSPACE/application.macosx/OpenBCI_GUI.app \
+            OpenBCI_GUI $GITHUB_WORKSPACE/application.macosx.dmg
+
+      - name: Sign DMG
+        run: |
+          codesign -f -v -s "Developer ID Application: OpenBCI, Inc. (3P82WRGLM8)" $GITHUB_WORKSPACE/application.macosx.dmg
+
+      - name: Package
+        run: python $GITHUB_WORKSPACE/release/package.py
+
+      - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: ${{ env.AWS_REGION }}
 
-      - name: Get branch names
+      - name: Get Branch Names
         id: branch-name
         uses: tj-actions/branch-names@v7
 
-      - name: Store DMG on AWS S3
+      - name: Store Build on AWS
         run: |
           cd $GITHUB_WORKSPACE
           ls

.github/workflows/windows_build_deploy.yml

@@ -17,7 +17,7 @@ env:
 jobs:
   build:
     name: Build for Windows
-    runs-on: windows-2019
+    runs-on: windows-latest
 
     steps:
     - name: Clone Repository
@@ -28,95 +28,63 @@ jobs:
       with:
         python-version: '3.9'
         architecture: 'x64'
-        cache: 'pip' # caching pip dependencies
-
-    - name: Install Python Dependencies
-      run: |
-        python -m pip install requests
-        python -m pip install beautifulsoup4
+        cache: 'pip'
 
     - name: Install Processing
       run: |
-        mkdir %GITHUB_WORKSPACE%\temp
-        cd %GITHUB_WORKSPACE%\temp
+        mkdir %GITHUB_WORKSPACE%\processing
+        cd %GITHUB_WORKSPACE%\processing
         curl -O -L --insecure https://github.com/processing/processing4/releases/download/processing-1292-4.2/processing-4.2-windows-x64.zip
-        ls -l %GITHUB_WORKSPACE%\temp
+        ls -l %GITHUB_WORKSPACE%\processing
         unzip processing-4.2-windows-x64.zip
-        ls -l %GITHUB_WORKSPACE%\temp\processing-4.2
+        ls -l %GITHUB_WORKSPACE%\processing\processing-4.2
         mkdir %userprofile%\documents\processing\libraries
         xcopy %GITHUB_WORKSPACE%\OpenBCI_GUI\libraries\* %userprofile%\documents\processing\libraries /s /i /q
         ls -l %userprofile%\documents\processing\libraries
       shell: cmd
 
     - name: Set Path
       run: |
-        echo %GITHUB_WORKSPACE%\temp\processing-4.2 >> %GITHUB_PATH%
-        echo C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x64 >> %GITHUB_PATH%
-        ls -l "C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x64"
+        echo %GITHUB_WORKSPACE%\processing\processing-4.2>>%GITHUB_PATH%
+        echo C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64>>%GITHUB_PATH%
       shell: cmd
 
     - name: Print Path
-      run: echo %GITHUB_PATH%
-      shell: cmd
-
-    - name: Explicitly run processing-java
-      run: |
-        %GITHUB_WORKSPACE%\temp\processing-4.2\processing-java.exe --help
+      run: echo %PATH%
       shell: cmd
 
-    - name: Check processing-java command
-      run: |
-        set PATH=%PATH%;%GITHUB_WORKSPACE%\temp\processing-4.2
-        processing-java --help
+    - name: Check processing-java Command
+      run: processing-java --help
       shell: cmd
 
     - name: Run Unit Tests
-      run: |
-        set PATH=%PATH%;%GITHUB_WORKSPACE%\temp\processing-4.2
-        ls -l
-        python %GITHUB_WORKSPACE%\GuiUnitTests\run-unittests.py
+      run: python %GITHUB_WORKSPACE%\GuiUnitTests\run-unittests.py
       shell: cmd
 
-    - name: Build without Signing
-      if: ${{ true }}
-      run: |
-        echo %cd%
-        ls
-        set PATH=%PATH%;%GITHUB_WORKSPACE%\temp\processing-4.2
-        set PATH=%PATH%;C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x64
-        type nul > temp/versionstring.txt
-        type nul > temp/timestamp.txt
-        python %GITHUB_WORKSPACE%\release_script\make-release.py --no-prompts
+    - name: Build
+      run: python %GITHUB_WORKSPACE%\release\build.py
       shell: cmd
 
-    - name: Decrypt pfx files
-      if: ${{ false }}
+    - name: Sign
       run: |
-        iex ((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/appveyor/secure-file/master/install.ps1'))
-        appveyor-tools\secure-file -decrypt $env:GITHUB_WORKSPACE\release_script\windows_only\0a2d0e9821bd184a1d969a1db3630c92-SHA2.pfx.enc -secret $env:PFX_SECRET -salt $env:PFX_SALT -out $env:GITHUB_WORKSPACE\release_script\windows_only\0a2d0e9821bd184a1d969a1db3630c92-SHA2.pfx
-        ls -l $env:GITHUB_WORKSPACE\release_script\windows_only
-      env:
-        PFX_PASS: ${{ secrets.PFX_PASS }}
-        PFX_SECRET: ${{ secrets.PFX_SECRET }}
-        PFX_SALT: ${{ secrets.PFX_SALT }}
-
-    - name: Build and Sign
-      if: ${{ false }}
-      run: |
-        python %GITHUB_WORKSPACE%\release_script\make-release.py --no-prompts --pfx-password %PFX_PASS% --pfx-path %GITHUB_WORKSPACE%\release_script\windows_only\0a2d0e9821bd184a1d969a1db3630c92-SHA2.pfx
-      env:
-        PFX_PASS: ${{ secrets.PFX_PASS }}
-        PFX_SECRET: ${{ secrets.PFX_SECRET }}
-        PFX_SALT: ${{ secrets.PFX_SALT }}
+        dotnet tool install --global azuresigntool
+        mt -manifest %GITHUB_WORKSPACE%\release\windows\gui.manifest -outputresource:%GITHUB_WORKSPACE%\application.windows64\OpenBCI_GUI.exe;#1
+        mt -manifest %GITHUB_WORKSPACE%\release\windows\java.manifest -outputresource:%GITHUB_WORKSPACE%\application.windows64\java\bin\java.exe;#1
+        mt -manifest %GITHUB_WORKSPACE%\release\windows\javaw.manifest -outputresource:%GITHUB_WORKSPACE%\application.windows64\java\bin\javaw.exe;#1
+        azuresigntool sign --azure-key-vault-url "${{ secrets.AZURE_KEY_VAULT_URI }}" --azure-key-vault-client-id "${{ secrets.AZURE_CLIENT_ID }}" --azure-key-vault-tenant-id "${{ secrets.AZURE_TENANT_ID }}" --azure-key-vault-client-secret "${{ secrets.AZURE_CLIENT_SECRET }}" --azure-key-vault-certificate "${{ secrets.AZURE_CERT_NAME }}" --timestamp-rfc3161 http://timestamp.digicert.com --verbose %GITHUB_WORKSPACE%\application.windows64\OpenBCI_GUI.exe
+      shell: cmd
+  
+    - name: Package
+      run: python %GITHUB_WORKSPACE%\release\package.py
       shell: cmd
 
-    - name: Configure AWS credentials from Production account
+    - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@v2
       with:
         role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
         aws-region: ${{ env.AWS_REGION }}
 
-    - name: Get branch names
+    - name: Get Branch Names
       id: branch-name
       uses: tj-actions/branch-names@v7