44 lines
2.4 KiB
Markdown
44 lines
2.4 KiB
Markdown
|
|
building signed updates
|
|
=======================
|
|
|
|
* run
|
|
```
|
|
build\download_externals.cmd
|
|
build\auto\build_openmpt_args.cmd vs2019 win10 Win32 Release 7z default
|
|
build\auto\build_openmpt_args.cmd vs2019 win10 x64 Release 7z default
|
|
build\auto\build_openmpt_args.cmd vs2019 win10 ARM Release 7z default
|
|
build\auto\build_openmpt_args.cmd vs2019 win10 ARM64 Release 7z default
|
|
build\auto\build_openmpt_args.cmd vs2019 win7 Win32 Release 7z default
|
|
build\auto\build_openmpt_args.cmd vs2019 win7 x64 Release 7z default
|
|
build\auto\build_openmpt_release_packages_multiarch.cmd
|
|
build\auto\build_openmpt_update_information.cmd
|
|
build\auto\package_openmpt_installer_multiarch_args.cmd vs2019 win10 Win32 Release 7z default
|
|
```
|
|
or just `build\auto\build_openmpt_release_manual.cmd`, which does all of the
|
|
above in one go.
|
|
|
|
* results are found in `bin\openmpt-pkg.win-multi.tar`
|
|
|
|
* `openmpt/pkg.win/${BRANCHVERSION}/OpenMPT-${VERSION}-update.json` contains
|
|
the update information that needs to be copied verbatim to the respective
|
|
update channel on update.openmpt.org. This file is not signed as it itself
|
|
is considered only informational and may be augmented with additional
|
|
information. The files it links that contain actual code and automated
|
|
update instructions are all signed.
|
|
|
|
* If the current user did not yet have a signing key on the local computer, a
|
|
new key will be automatically generated and stored for future re-use in the
|
|
encrypted Windows Key Store. The public key to verify the signatures is
|
|
exported on each packaging of builds alongside the other build artefacts at
|
|
`openmpt/pkg.win/${BRANCHVERSION}/OpenMPT-${VERSION}-update-publickey.jwk.json`
|
|
. Any such new key should be added to the set of allowed update signing keys
|
|
in the repository at `build/signingkeys/`, as an individual file named
|
|
appropriately to describe the key (in order to easier identify the
|
|
individual keys), and as a key in the jwkset of allowed keys in the file
|
|
`build/signingkeys/signingkeys.jwkset.json`. A jwkset file consists of a
|
|
JSON object containing a single array of all individual keys, named `"keys"`
|
|
. The updated `signingkeys.jwkset.json` then needs to be copied to the https
|
|
locations where the update check checks for the anchor keys. There is no
|
|
separate key handling for test and release builds.
|