From fac4138bfa6e145ddc8f0e9b744f4b42a26f7cf3 Mon Sep 17 00:00:00 2001
From: Mooneer Salem <mooneer@gmail.com>
Date: Thu, 27 Jul 2023 00:41:36 -0700
Subject: [PATCH] Sign installer and uninstaller as well.

---
 CMakeLists.txt     | 6 ++++++
 src/CMakeLists.txt | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 381957fa..33317add 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -621,6 +621,12 @@ if(WIN32)
         set(CPACK_PACKAGE_FILE_NAME "FreeDV-${CPACK_PACKAGE_VERSION_MAJOR}.${CPACK_PACKAGE_VERSION_MINOR}.${CPACK_PACKAGE_VERSION_PATCH}-windows-${CMAKE_SYSTEM_PROCESSOR}")
     endif (FREEDV_USING_LLVM_MINGW)
 
+    if(SIGN_WINDOWS_BINARIES)
+        # Add finalize command for NSIS so the installer/uninstaller can be
+        # signed too.
+        set(CPACK_NSIS_FINALIZE_CMD "mv %1 %1.tmp; ${OSSLSIGNCODE_BIN} sign -pkcs11engine ${PKCS11_ENGINE} -pkcs11module ${PKCS11_MODULE} -certs ${CERTIFICATE_FILE} -key \\\"${PKCS11_KEY}\\\" -in %1.tmp -out %1")
+    endif(SIGN_WINDOWS_BINARIES)
+
     include(CPack)
 elseif(UNIX AND NOT APPLE)
     # Linux packaging
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 60e34531..24357710 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -173,10 +173,12 @@ endif(APPLE)
 
 # Custom commands for signing Windows binaries
 if(SIGN_WINDOWS_BINARIES)
+    # Add custom command to sign freedv.exe.
     add_custom_command(
         TARGET freedv 
         POST_BUILD
         COMMAND mv $<TARGET_FILE:freedv> $<TARGET_FILE:freedv>.tmp
         COMMAND ${OSSLSIGNCODE_BIN} ARGS sign -pkcs11engine ${PKCS11_ENGINE} -pkcs11module ${PKCS11_MODULE} -certs ${CERTIFICATE_FILE} -key "${PKCS11_KEY}" -in $<TARGET_FILE:freedv>.tmp -out $<TARGET_FILE:freedv>
+        COMMAND rm $<TARGET_FILE:freedv>.tmp
         VERBATIM)
 endif(SIGN_WINDOWS_BINARIES)