完善 Windows 发布构建与开发证书流程

2026-08-17 09:53:28 +08:00
parent c3a8737fd6
commit 337390f53e
3 changed files with 171 additions and 37 deletions
@@ -0,0 +1,76 @@
+param(
+  [Parameter(Mandatory = $true)]
+  [string] $PfxPath,
+
+  [Parameter(Mandatory = $true)]
+  [string] $CerPath,
+
+  [Parameter(Mandatory = $true)]
+  [string] $Password,
+
+  [Parameter(Mandatory = $true)]
+  [string] $Subject,
+
+  [string] $VerifyPath = ''
+)
+
+$ErrorActionPreference = 'Stop'
+$securityModule = Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1'
+$pkiModule = Join-Path $PSHOME 'Modules\PKI\PKI.psd1'
+Import-Module $securityModule -ErrorAction Stop
+Import-Module $pkiModule -ErrorAction Stop
+
+if ($VerifyPath) {
+  if (-not (Test-Path -LiteralPath $VerifyPath)) {
+    throw "Signed artifact was not found: $VerifyPath"
+  }
+  if (-not (Test-Path -LiteralPath $CerPath)) {
+    throw "Signing certificate was not found: $CerPath"
+  }
+
+  $certificate = [Security.Cryptography.X509Certificates.X509Certificate2]::new($CerPath)
+  $signature = Get-AuthenticodeSignature -FilePath $VerifyPath
+  if (-not $signature.SignerCertificate) {
+    throw "Signed artifact does not expose a signer certificate: $VerifyPath"
+  }
+  if ($signature.SignerCertificate.Thumbprint -ne $certificate.Thumbprint) {
+    throw "Signed artifact certificate does not match the exported developer certificate: $VerifyPath"
+  }
+  exit 0
+}
+
+$parent = Split-Path -Parent $PfxPath
+if ($parent) {
+  New-Item -ItemType Directory -Force -Path $parent | Out-Null
+}
+
+$securePassword = ConvertTo-SecureString -String $Password -AsPlainText -Force
+if (Test-Path -LiteralPath $PfxPath) {
+  $certificate = [Security.Cryptography.X509Certificates.X509Certificate2]::new($PfxPath, $securePassword)
+  $cerMatches = $false
+  if (Test-Path -LiteralPath $CerPath) {
+    $existingCer = [Security.Cryptography.X509Certificates.X509Certificate2]::new($CerPath)
+    $cerMatches = $existingCer.Thumbprint -eq $certificate.Thumbprint
+  }
+  if (-not $cerMatches) {
+    Export-Certificate -Cert $certificate -FilePath $CerPath -Force | Out-Null
+  }
+} else {
+  $certificate = New-SelfSignedCertificate `
+    -Type CodeSigningCert `
+    -Subject $Subject `
+    -CertStoreLocation 'Cert:\CurrentUser\My' `
+    -KeyExportPolicy Exportable `
+    -KeyUsage DigitalSignature `
+    -FriendlyName 'YMhut Box WinUI local signing'
+
+  Export-PfxCertificate -Cert $certificate -FilePath $PfxPath -Password $securePassword | Out-Null
+  Export-Certificate -Cert $certificate -FilePath $CerPath -Force | Out-Null
+}
+
+foreach ($store in @('Cert:\CurrentUser\Root', 'Cert:\CurrentUser\TrustedPeople')) {
+  $present = Get-ChildItem -Path $store | Where-Object Thumbprint -eq $certificate.Thumbprint
+  if (-not $present) {
+    Import-Certificate -FilePath $CerPath -CertStoreLocation $store | Out-Null
+  }
+}