Add code signing framework and config

Author: Juff-Ma

Config.cs

@@ -178,6 +178,71 @@ public class InstallationConfig : ITomlMetadataProvider
         [DataMember(Name = "source_dirs_are_recursive")]
         public bool? DirsRecursive { get; set; }
 
+        /// <summary>
+        /// Configuration for code signing the MSI and installed files.
+        /// </summary>
+        [DataMember(Name = "signing")]
+        public SigningConfig? Signing { get; set; }
+        public class SigningConfig : ITomlMetadataProvider
+        {
+            [IgnoreDataMember]
+            public TomlPropertiesMetadata? PropertiesMetadata { get; set; }
+
+            /// <summary>
+            /// Name of the PFX File or the certificate in the certificate store to use for signing.
+            /// </summary>
+            [DataMember(IsRequired = true, Name = "cert_name")]
+            public string CertificateName { get; set; } = "";
+
+            /// <summary>
+            /// PFX file password. Shouldn't be provided in the config for security reasons.
+            /// </summary>
+            [IgnoreDataMember] public string? Password { get; set; } = null;
+
+            /// <summary>
+            /// Description to include in the signature. E.g. My Company MyApp.
+            /// </summary>
+            [DataMember(IsRequired = true, Name = "description")]
+            public string Description { get; set; } = "";
+
+            /// <summary>
+            /// URL to the timestamping server.
+            /// </summary>
+            [DataMember(Name = "time_url")]
+            public string? TimeUrl { get; set; }
+
+            /// <summary>
+            /// Type of the certificate store. May be "sha1", "name" or "pfx". Defaults to "pfx".
+            /// </summary>
+            [DataMember(Name = "store_type")]
+            public string? StoreType { get; set; }
+
+            /// <summary>
+            /// Hash algorithm to use for signing. May be "sha1" or "sha256". Defaults to "sha256".
+            /// </summary>
+            [DataMember(Name = "algorithm")]
+            public string? HashAlgorithm { get; set; }
+
+            /// <summary>
+            /// Additional arguments to pass to signtool
+            /// </summary>
+            [DataMember(Name = "extra_arguments")]
+            public string? ExtraArguments { get; set; }
+
+            /// <summary>
+            /// Folder where signtool.exe is located. If not specified, it is assumed to be in the PATH. May include multiple ; separated paths.
+            /// </summary>
+            [DataMember(Name = "signtool_location")]
+            public string? SignToolLocation { get; set; }
+
+            /// <summary>
+            /// Sign all files embedded in the MSI as well. This includes Program files and DLLs of the App you're shipping unless they are already signed.
+            /// Note: The signing is performed in place on your source files, so make sure to have backups if needed.
+            /// </summary>
+            [DataMember(Name = "sign_embedded")]
+            public bool? SignEmbeddedFiles { get; set; }
+        }
+
         [DataMember(Name = "env_vars")]
         public List<EnvVarConfig> EnvironmentVariables { get; } = [];
         public class EnvVarConfig : ITomlMetadataProvider

ConfigExtensions.cs

@@ -120,4 +120,39 @@ internal static class ConfigExtensions
             _ => null
         };
     }
+
+    /// <summary>
+    /// Determines the hash algorithm type specified by the file hash configuration.
+    /// </summary>
+    /// <remarks>If the configuration specifies an unrecognized algorithm, the method defaults to
+    /// HashAlgorithmType.sha1.</remarks>
+    /// <param name="config">The file hash configuration from which to determine the hash algorithm. Cannot be null.</param>
+    /// <returns>A value of the HashAlgorithmType enumeration that corresponds to the algorithm specified in the configuration.
+    /// Returns HashAlgorithmType.sha1 if the algorithm is not recognized.</returns>
+    public static HashAlgorithmType? GetHashAlgorithm(this Config.InstallationConfig.SigningConfig config)
+    {
+        return config.HashAlgorithm switch
+        {
+            "sha1" => HashAlgorithmType.sha1,
+            "sha256" => HashAlgorithmType.sha256,
+
+            // default to sha1
+            null => HashAlgorithmType.sha256,
+            _ => null
+        };
+    }
+
+    public static StoreType? GetStoreType(this Config.InstallationConfig.SigningConfig config)
+    {
+        return config.StoreType switch
+        {
+            "sha1" => StoreType.sha1Hash,
+            "name" => StoreType.commonName,
+            "pfx" => StoreType.file,
+
+            // default to file
+            null => StoreType.file,
+            _ => null
+        };
+    }
 }

MsiEngine.cs

@@ -117,6 +117,38 @@ public void ConfigureMsi(Config config)
 
         _msi.ResolveWildCards();
 
+        print.VerboseLine("Configuring code signing...");
+        if (config.Installation?.Signing is not null)
+        {
+            var signature = new DigitalSignature()
+            {
+                CertificateId = config.Installation.Signing.CertificateName,
+                Password = config.Installation.Signing.Password,
+                Description = config.Installation.Signing.Description,
+
+                WellKnownLocations = config.Installation.Signing.SignToolLocation,
+                OptionalArguments = config.Installation.Signing.ExtraArguments,
+
+                OutputLevel = print.IsVerbose ? SignOutputLevel.Verbose : SignOutputLevel.Standard
+            };
+
+            if (config.Installation.Signing.TimeUrl is {} url)
+            {
+                if (!Uri.IsWellFormedUriString(url, UriKind.Absolute))
+                    throw new ArgumentException("Timestamp URL is not valid", nameof(config));
+
+                signature.TimeUrl = new Uri(url);
+            }
+
+            signature.HashAlgorithm = config.Installation.Signing.GetHashAlgorithm() ??
+                                          throw new ArgumentException("Signing has algorithm is invalid", nameof(config));
+            signature.CertificateStore = config.Installation.Signing.GetStoreType() ?? 
+                                          throw new ArgumentException("Signing certificate store is invalid", nameof(config));
+
+            _msi.DigitalSignature = signature;
+            _msi.SignAllFiles = config.Installation.Signing.SignEmbeddedFiles == true;
+        }
+
         foreach (var shortcut in config.Installation?.Shortcuts ?? [])
         {
             var files = _msi.FindFile(f => f.Name.EndsWith(shortcut.TargetFile));