Add signing to release binaries

.github/workflows/build.yml

@@ -47,6 +47,11 @@ jobs:
 
       - name: 🧐 Test
         run: dotnet test --no-build --verbosity normal
+
+      - name: 🔏 Sign binaries
+        if: runner.os == 'Windows'
+        run: |
+          osslsigncode sign -certs ${{ secrets.SIGN_CERT_PATH }} -key ${{ secrets.SIGN_CERT_PASS }} -in path/to/binary.exe -out path/to/signed_binary.exe
 
   spa:
     name: "SPA App"
@@ -75,4 +80,4 @@ jobs:
         run: npm run build
 
       - name: 🧐 Test
-        run: npm test
+        run: npm test

scripts/package-electron.sh

@@ -57,6 +57,11 @@ if ! command -v electronize &> /dev/null; then
     exit 1
 fi
 
+if ! command -v osslsigncode &> /dev/null; then
+    echo "Could not find 'osslsigncode'."
+    exit 1
+fi
+
 SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
 APP_DIR=$(cd "$SCRIPT_DIR/../src/Apps/NetPad.Apps.App" && pwd)
 PACKAGES_SOURCE_DIR="$APP_DIR/bin/Desktop"
@@ -116,6 +121,12 @@ package() {
 
     echo "   - Copying: $filename"
     mv "$filename" "$PACKAGES_DEST_DIR/$filename"
+
+    if [[ $filename == *.exe* ]]; then
+      echo "   - Signing: $filename"
+      osslsigncode sign -certs "$SIGN_CERT_PATH" -key "$SIGN_CERT_PASS" -in "$PACKAGES_DEST_DIR/$filename" -out "$PACKAGES_DEST_DIR/$filename.signed"
+      mv "$PACKAGES_DEST_DIR/$filename.signed" "$PACKAGES_DEST_DIR/$filename"
+    fi
   done
 }
 

src/Apps/NetPad.Apps.App/electron.manifest.js

@@ -81,7 +81,12 @@ const electronBuilderConfig = {
             {
                 target: "zip"
             }
-        ]
+        ],
+        sign: {
+            certificateFile: process.env.SIGN_CERT_PATH,
+            certificatePassword: process.env.SIGN_CERT_PASS,
+            signToolPath: "osslsigncode"
+        }
     },
     pacman: {
         artifactName: "${name}-${version}-${os}-${arch}.${ext}",