Updates in light of review of uninstaller signing by kkolinko

- ensure the installer can be built without access to the code signing service - keep all files within the build tree git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1630890 13f79535-47bb-0310-9956-ffa450edef68
linsheng9731 · Oct 10, 2014 · 7d46c3d · 7d46c3d
1 parent 1cd1f8a
commit 7d46c3d
Show file tree

Hide file tree

Showing 3 changed files with 70 additions and 63 deletions.
diff --git a/build.xml b/build.xml
@@ -31,7 +31,6 @@
   <property file="${user.home}/build.properties"/>
   <property file="build.properties"/>
   <property file="build.properties.default"/>
-  <property environment="env"/>
 
   <!-- Project Name -->
   <property name="project"               value="apache-tomcat" />
@@ -2079,9 +2078,9 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
     </copy>
   </target>
 
-  <target name="installer" description="Create Windows installer"
-      unless="skip.installer" depends="dist-static">
-    <echo message="Builds a Windows installer based on Nullsoft Installer"/>
+  <target name="-installer-prep"
+      description="Prepares file structure required to buidl installer"
+      depends="dist-static">
     <copy todir="${tomcat.dist}">
       <fileset dir="res">
         <include name="INSTALLLICENSE" />
@@ -2096,37 +2095,83 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
     <copy file="res/tomcat.nsi" tofile="${tomcat.dist}/tomcat.nsi" overwrite="true" encoding="ISO-8859-1">
       <filterset refid="version.filters"/>
     </copy>
-
     <fixcrlf srcdir="${tomcat.dist}" eol="crlf"
         encoding="ISO-8859-1" fixlast="false" >
       <patternset refid="text.files" />
     </fixcrlf>
+  </target>
 
+  <target name="-installer-create-tempinstaller"
+      description="Creates the temporary installer"
+      depends="-installer-prep">
     <exec dir="${tomcat.dist}" executable="${nsis.exe}" osfamily="windows">
+      <arg value="/DUNINSTALLONLY" />
       <arg value="/DNSISDIR=${nsis.home}" />
       <arg value="/V2" />
       <arg value="tomcat.nsi" />
     </exec>
     <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
       <arg value="${nsis.exe}" />
+      <arg value="/DUNINSTALLONLY" />
       <arg value="/DNSISDIR=${nsis.home}" />
       <arg value="/V2" />
       <arg value="tomcat.nsi" />
     </exec>
+  </target>
 
-    <move file="${tomcat.dist}/tomcat-installer.exe" tofile="${tomcat.release}/v${version}/bin/${final.name}.exe" />
+  <target name="-installer-create-uninstaller"
+    description="Execute the temporary installer to create the uninstaller"
+    depends="-installer-create-tempinstaller">
+    <!-- Execute the temporary installer to create the uninstaller -->
+    <exec dir="${tomcat.dist}" executable="${tomcat.dist}/tempinstaller.exe"
+        osfamily="windows"  />
+    <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
+      <arg value="${tomcat.dist}/tempinstaller.exe" />
+    </exec>
+
+  </target>
+
+  <target name="-installer-sign-uninstaller"
+      description="Sign the uninstaller executable"
+      depends="-installer-create-uninstaller"
+      if="${do.codesigning}">
+    <taskdef name="signcode"
+        classname="org.apache.tomcat.buildutil.SignCode"
+        classpath="${tomcat.classes}" />
+    <signcode userName="${codesigning.user}" password="${codesigning.pwd}"
+        partnerCode="${codesigning.partnercode}"
+        applicationName="Apache Tomcat ${version.major.minor} Uninstaller"
+        applicationversion="${version}"
+        signingService="${codesigning.service}">
+      <fileset dir="${tomcat.dist}">
+        <filename name="Uninstall.exe"/>
+      </fileset>
+    </signcode>
+  </target>
 
+  <target name="-installer" description="Builds Windows installer"
+      unless="skip.installer" depends="-installer-sign-uninstaller">
+    <exec dir="${tomcat.dist}" executable="${nsis.exe}" osfamily="windows">
+      <arg value="/DNSISDIR=${nsis.home}" />
+      <arg value="/V2" />
+      <arg value="tomcat.nsi" />
+    </exec>
+    <exec dir="${tomcat.dist}" executable="wine" osfamily="unix">
+      <arg value="${nsis.exe}" />
+      <arg value="/DNSISDIR=${nsis.home}" />
+      <arg value="/V2" />
+      <arg value="tomcat.nsi" />
+    </exec>
+    <move file="${tomcat.dist}/tomcat-installer.exe" tofile="${tomcat.release}/v${version}/bin/${final.name}.exe" />
     <antcall target="md5sum">
       <param name="file" value="${tomcat.release}/v${version}/bin/${final.name}.exe" />
     </antcall>
   </target>
 
-  <target name="sign-windows-binaries" depends="installer" if="${do.codesigning}" >
-
+  <target name="installer-sign" depends="-installer" if="${do.codesigning}" >
     <taskdef name="signcode"
-             classname="org.apache.tomcat.buildutil.SignCode"
-             classpath="${tomcat.classes}" />
-
+        classname="org.apache.tomcat.buildutil.SignCode"
+        classpath="${tomcat.classes}" />
     <signcode userName="${codesigning.user}" password="${codesigning.pwd}"
               partnerCode="${codesigning.partnercode}"
               applicationName="Apache Tomcat ${version.major.minor}"
@@ -2136,37 +2181,16 @@ Apache Tomcat ${version} native binaries for Win64 AMD64/EMT64 platform.
         <filename name="v${version}/bin/${final.name}.exe"/>
       </fileset>
     </signcode>
-
     <!-- .exe has changed so need to redo MD5 and OpenPGP signature -->
     <delete file="${tomcat.release}/v${version}/bin/${final.name}.exe.md5" />
     <delete file="${tomcat.release}/v${version}/bin/${final.name}.exe.asc" />
     <antcall target="md5sum">
       <param name="file" value="${tomcat.release}/v${version}/bin/${final.name}.exe" />
     </antcall>
-
-  </target>
-
-  <!-- Called by the Windows installer to sign the uninstaller -->
-  <target name="sign-windows-uninstaller">
-
-    <taskdef name="signcode"
-             classname="org.apache.tomcat.buildutil.SignCode"
-             classpath="${tomcat.classes}" />
-
-    <signcode userName="${codesigning.user}" password="${codesigning.pwd}"
-              partnerCode="${codesigning.partnercode}"
-              applicationName="Apache Tomcat ${version.major.minor} Uninstaller"
-              applicationversion="${version}"
-              signingService="${codesigning.service}">
-      <fileset dir="${env.TEMP}">
-        <filename name="uninstall.exe"/>
-      </fileset>
-    </signcode>
-
   </target>
 
   <target name="release"
-    depends="clean,release-init,dist-deployer,sign-windows-binaries,package-zip,package-winzip,package-tgz,package-deployer-zip,package-deployer-tgz,javadoc,package-docs-tgz,package-src-zip,package-src-tgz,package-src-jar"
+    depends="clean,release-init,dist-deployer,installer-sign,package-zip,package-winzip,package-tgz,package-deployer-zip,package-deployer-tgz,javadoc,package-docs-tgz,package-src-zip,package-src-tgz,package-src-jar"
     description="Create a Tomcat packaged distribution">
 
     <copy file="KEYS"

diff --git a/java/org/apache/tomcat/buildutil/SignCode.java b/java/org/apache/tomcat/buildutil/SignCode.java
@@ -62,7 +62,7 @@ public class SignCode extends Task {
 
     static {
         try {
-            SIGNING_SERVICE_URL = new URL("https://api.ws.symantec.com/webtrust/SigningService");
+            SIGNING_SERVICE_URL = new URL("https://test-api.ws.symantec.com/webtrust/SigningService");
         } catch (MalformedURLException e) {
             throw new IllegalArgumentException(e);
         }

diff --git a/res/tomcat.nsi b/res/tomcat.nsi
@@ -15,29 +15,10 @@
 
 ; Tomcat script for Nullsoft Installer
 
-!ifdef INNER
+!ifdef UNINSTALLONLY
   OutFile "tempinstaller.exe"
-  SetCompressor /SOLID lzma
 !else
-  ; Call makensis again, defining INNER.  This writes an installer for us which, when
-  ; it is invoked, will just write the uninstaller to some location, and then exit.
-  ; Be sure to substitute the name of this script here.
-
-  !system "$\"${NSISDIR}\makensis$\" /DINNER tomcat.nsi" = 0
-
-  ; So now run that installer we just created as tempinstaller.exe.  Since it
-  ; calls quit the return value isn't zero.
-
-  !system "tempinstaller.exe" = 2
-
-  ; That will have written an uninstaller binary for us.  Now we sign it with your
-  ; favourite code signing tool.
-  !system "ant -f ..\..\build.xml sign-windows-uninstaller" = 0
-
-  ; Good.  Now we can carry on writing the real installer.
-
   OutFile tomcat-installer.exe
-  SetCompressor /SOLID lzma
 !endif
 
   ;Compression options
@@ -151,9 +132,11 @@ Var ServiceInstallLog
   Page custom CheckUserType
   !insertmacro MUI_PAGE_FINISH
 
-  ;Uninstall Page order
-  !insertmacro MUI_UNPAGE_CONFIRM
-  !insertmacro MUI_UNPAGE_INSTFILES
+  !ifdef UNINSTALLONLY
+    ;Uninstall Page order
+    !insertmacro MUI_UNPAGE_CONFIRM
+    !insertmacro MUI_UNPAGE_INSTFILES
+  !endif
 
   ;Component-selection page
     ;Descriptions
@@ -361,10 +344,10 @@ Section -post
     Call createShortcuts
   ${EndIf}
 
-  !ifndef INNER
+  !ifndef UNINSTALLONLY
     SetOutPath $INSTDIR
     ; this packages the signed uninstaller
-    File $%TEMP%\uninstall.exe
+    File Uninstall.exe
   !endif
 
   WriteRegStr HKLM "SOFTWARE\Apache Software Foundation\Tomcat\@VERSION_MAJOR_MINOR@\$TomcatServiceName" "InstallPath" $INSTDIR
@@ -381,11 +364,11 @@ Section -post
 SectionEnd
 
 Function .onInit
-  !ifdef INNER
-    ; If INNER is defined, then we aren't supposed to do anything except write out
+  !ifdef UNINSTALLONLY
+    ; If UNINSTALLONLY is defined, then we aren't supposed to do anything except write out
     ; the installer.  This is better than processing a command line option as it means
     ; this entire code path is not present in the final (real) installer.
-    WriteUninstaller "$%TEMP%\uninstall.exe"
+    WriteUninstaller "$EXEDIR\Uninstall.exe"
     Quit
   !endif
 
@@ -1119,7 +1102,7 @@ FunctionEnd
 ;--------------------------------
 ;Uninstaller Section
 
-!ifdef INNER
+!ifdef UNINSTALLONLY
   Section Uninstall
 
     ${If} $TomcatServiceName == ""