chore: windows signing

.github/workflows/desktop.windows.release.yml

@@ -6,6 +6,10 @@ on:
 jobs:
   Windows:
     runs-on: self-hosted
+    env:
+      WINDOWS_TOKEN_ALIAS: ${{ secrets.WINDOWS_TOKEN_ALIAS }}
+      WINDOWS_TOKEN_PASSWORD: ${{ secrets.WINDOWS_TOKEN_PASSWORD }}
+
     defaults:
       run:
         working-directory: packages/desktop

packages/desktop/jsign/eToken.cfg

@@ -0,0 +1,3 @@
+name = HardwareToken
+library = /Library/Frameworks/eToken.framework/Versions/A/libeToken.dylib
+slotListIndex = 0

packages/desktop/package.json

@@ -113,7 +113,8 @@
     "win": {
       "certificateSubjectName": "Standard Notes Ltd.",
       "publisherName": "Standard Notes Ltd.",
-      "signDlls": true
+      "signDlls": true,
+      "sign": "scripts/windowsSign.js"
     },
     "nsis": {
       "deleteAppDataOnUninstall": true

packages/desktop/scripts/windowsSign.js

@@ -0,0 +1,16 @@
+exports.default = async function (configuration) {
+  require('child_process').execSync(
+    `java \
+    -jar jsign/jsign-4.1.jar \
+    --keystore jsign/eToken.cfg \
+    --storepass "${process.env.WINDOWS_TOKEN_PASSWORD}" \
+    --storetype PKCS11 \
+    --tsaurl http://timestamp.digicert.com \
+    --alias "${process.env.WINDOWS_TOKEN_ALIAS}" \
+    "${configuration.path}"
+    `,
+    {
+      stdio: 'inherit',
+    },
+  )
+}