tools: build.bat: make cab file from unsigned drivers

Changelog.md

@@ -1,6 +1,38 @@
 # Changelog
 
 
+## v1.12.22339 (2022.2 Update1)
+
+*Note: This release (`v1.12.22339`) is the same as the previous release (`v1.12`) except that: (1) the kernel-mode drivers are now digitally signed only with the Microsoft Attestation signature, and that: (2) no release assets are digitally signed with SHA-1. (This change was necessary to fix a problem in older versions of Windows such as Windows 7.)*
+
+- [NEW] WinFsp now supports mounting as directory using the Mount Manager. Use the syntax `\\.\C:\Path\To\Mount\Directory`.
+
+- [NEW] A new registry setting `MountUseMountmgrFromFSD` has been added. See [WinFsp Registry Settings](https://github.com/winfsp/winfsp/wiki/WinFsp-Registry-Settings) for details.
+
+- [FIX] A problem with Windows containers has been fixed. (GitHub issue #438.)
+
+- [FIX] File systems can now be mounted as directories on ARM64. (GitHub issue #448.)
+
+- [FIX] The passthrough file system now reports correct `IndexNumber`. (GitHub issue #325.)
+
+- [BUILD] Product configuration for the relative paths to the File System Driver, Network Provider and EventLog is now possible via the file `build.version.props` located in `build\VStudio`.
+
+
+## v1.12 (2022.2)
+
+- [NEW] WinFsp now supports mounting as directory using the Mount Manager. Use the syntax `\\.\C:\Path\To\Mount\Directory`.
+
+- [NEW] A new registry setting `MountUseMountmgrFromFSD` has been added. See [WinFsp Registry Settings](https://github.com/winfsp/winfsp/wiki/WinFsp-Registry-Settings) for details.
+
+- [FIX] A problem with Windows containers has been fixed. (GitHub issue #438.)
+
+- [FIX] File systems can now be mounted as directories on ARM64. (GitHub issue #448.)
+
+- [FIX] The passthrough file system now reports correct `IndexNumber`. (GitHub issue #325.)
+
+- [BUILD] Product configuration for the relative paths to the File System Driver, Network Provider and EventLog is now possible via the file `build.version.props` located in `build\VStudio`.
+
+
 ## v1.12B2 (2022.2 Beta2)
 
 - [NEW] WinFsp now supports mounting as directory using the Mount Manager. Use the syntax `\\.\C:\Path\To\Mount\Directory`.

build/VStudio/build.version.props

@@ -20,8 +20,8 @@
 
         <MyCanonicalVersion>1.12</MyCanonicalVersion>
 
-        <MyProductVersion>2022.2 Beta2</MyProductVersion>
+        <MyProductVersion>2022.2</MyProductVersion>
-        <MyProductStage>Beta</MyProductStage>
+        <MyProductStage>Gold</MyProductStage>
 
         <MyCrossCert>DigiCertGlobalG3CodeSigningECCSHA3842021CA1.cer</MyCrossCert>
         <MyCertIssuer>DigiCert</MyCertIssuer>

tools/build.bat

@@ -78,13 +78,19 @@ if X%SignedPackage%==X (
         launchctl-a64.exe launchctl-x64.exe launchctl-x86.exe^
         fsptool-a64.exe fsptool-x64.exe fsptool-x86.exe^
         memfs-a64.exe memfs-x64.exe memfs-x86.exe memfs-dotnet-msil.exe
-    signtool sign /ac %CrossCert% /i %Issuer% /n %Subject% /fd sha1 /t http://timestamp.digicert.com !signfiles!
+    signtool sign /ac %CrossCert% /i %Issuer% /n %Subject% /fd sha256 /tr http://timestamp.digicert.com /td sha256 !signfiles!
-    if errorlevel 1 set /a signfail=signfail+1
-    signtool sign /as /ac %CrossCert% /i %Issuer% /n %Subject% /fd sha256 /tr http://timestamp.digicert.com /td sha256 !signfiles!
     if errorlevel 1 set /a signfail=signfail+1
     popd
 
     pushd build\%Configuration%
+    mkdir unsigned
+    for %%f in (!signfiles!) do (
+        copy "%%f" unsigned >nul
+    )
+    pushd unsigned
+    signtool remove /q /s !signfiles!
+    if errorlevel 1 set /a signfail=signfail+1
+    popd
     echo .OPTION EXPLICIT >driver.ddf
     echo .Set CabinetFileCountThreshold=0 >>driver.ddf
     echo .Set FolderFileCountThreshold=0 >>driver.ddf
@@ -99,13 +105,13 @@ if X%SignedPackage%==X (
     echo .Set DiskDirectory1=. >>driver.ddf
     echo .Set DestinationDir=a64 >>driver.ddf
     echo driver-a64.inf >>driver.ddf
-    echo %MyProductFileName%-a64.sys >>driver.ddf
+    echo unsigned\%MyProductFileName%-a64.sys >>driver.ddf
     echo .Set DestinationDir=x64 >>driver.ddf
     echo driver-x64.inf >>driver.ddf
-    echo %MyProductFileName%-x64.sys >>driver.ddf
+    echo unsigned\%MyProductFileName%-x64.sys >>driver.ddf
     echo .Set DestinationDir=x86 >>driver.ddf
     echo driver-x86.inf >>driver.ddf
-    echo %MyProductFileName%-x86.sys >>driver.ddf
+    echo unsigned\%MyProductFileName%-x86.sys >>driver.ddf
     makecab /F driver.ddf
     signtool sign /ac %CrossCert% /i %Issuer% /n %Subject% /fd sha256 /tr http://timestamp.digicert.com /td sha256 driver.cab
     if errorlevel 1 set /a signfail=signfail+1
@@ -116,10 +122,8 @@ devenv winfsp.sln /build "Installer.%Configuration%|x86"
 if errorlevel 1 goto fail
 
 for %%f in (build\%Configuration%\%MyProductFileName%-*.msi) do (
-    signtool sign /ac %CrossCert% /i %Issuer% /n %Subject% /fd sha1 /t http://timestamp.digicert.com /d %MsiName% %%f
+    signtool sign /ac %CrossCert% /i %Issuer% /n %Subject% /fd sha256 /tr http://timestamp.digicert.com /td sha256 /d %MsiName% %%f
     if errorlevel 1 set /a signfail=signfail+1
-    REM signtool sign /ac %CrossCert% /i %Issuer% /n %Subject% /fd sha256 /tr http://timestamp.digicert.com /td sha256 /d %MsiName% %%f
-    REM if errorlevel 1 set /a signfail=signfail+1
 )
 
 if not %signfail%==0 echo SIGNING FAILED! The product has been successfully built, but not signed.

tools/make-release.ps1

@@ -0,0 +1,341 @@
+param (
+    [string]$StateFile = "release.state"
+)
+
+function Write-Stdout ($Message) {
+    [System.Console]::WriteLine($Message)
+}
+
+function Write-Stderr ($Message) {
+    [System.Console]::Error.WriteLine($Message)
+}
+
+function Git-Describe {
+    $GitDesc = git describe --long --dirty
+    if ($GitDesc -match "^(.+)-([0-9]+)-g([0-9A-Fa-f]+)-?(dirty)?$") {
+        $matches[1]
+        $matches[2]
+        $matches[3]
+        $matches[4]
+    }
+}
+
+function Git-Dirty {
+    $Dirty = $False
+    git status --porcelain=v2 2>$null | ForEach-Object {
+        $Dirty = $True
+    }
+    return $Dirty
+}
+
+function Git-LogGrep ($Tag) {
+    git log -n 1 --grep $Tag
+}
+
+function Get-ReleaseInfo ($Tag) {
+    $Found = 0
+    $ReleaseInfo = [PSCustomObject]@{
+        Tag = ""
+        ProductVersion = ""
+        Prerelease = $False
+        PreviousTag = ""
+        PreviousProductVersion = ""
+        Text = @()
+    }
+    foreach ($Line in Get-Content "$ProjectRoot\Changelog.md") {
+        if ($Line -match "^## (v[^ ]+) *\(([^)]+)\)") {
+            if ($Found) {
+                $Found = 2
+                $PreviousTag = $matches[1]
+                $PreviousProductVersion = $matches[2]
+                if ($PreviousTag -match "^v[0-9.]+$") {
+                    $ReleaseInfo.PreviousTag = $PreviousTag
+                    $ReleaseInfo.PreviousProductVersion = $PreviousProductVersion
+                    break
+                }
+            } elseif ($Tag -eq $matches[1]) {
+                $Found = 1
+                $ReleaseInfo.Tag = $matches[1]
+                $ReleaseInfo.ProductVersion = $matches[2]
+                $ReleaseInfo.Prerelease = !($ReleaseInfo.Tag -match "^v[0-9.]+$")
+            }
+        } elseif (1 -eq $Found) {
+            $ReleaseInfo.Text += $Line
+        }
+    }
+    if ($Found) {
+        return $ReleaseInfo
+    }
+}
+
+function Get-FileVersion ($FileName) {
+    return [System.Diagnostics.FileVersionInfo]::GetVersionInfo($FileName).FileVersion
+}
+
+function Task ($ScriptBlock) {
+    $Name = (Get-PSCallStack)[1].FunctionName
+    if ($State -contains $Name) {
+        return
+    }
+
+    Write-Stdout $Name
+    Invoke-Command -ScriptBlock $ScriptBlock
+    Write-Stdout "$Name COMPLETE"
+
+    Add-Content $StateFile -Value $Name
+
+    exit 0
+}
+
+function Check-Prerequisites {
+    $Name = (Get-PSCallStack)[0].FunctionName
+
+    # check git.exe
+    if (!(Get-Command "git.exe" -ErrorAction SilentlyContinue)) {
+        Write-Stderr "error: cannot find git.exe"
+        exit 1
+    }
+
+    # check gh.exe
+    if (!(Get-Command "gh.exe" -ErrorAction SilentlyContinue)) {
+        Write-Stderr "error: cannot find gh.exe"
+        exit 1
+    }
+
+    # check choco.exe
+    if (!(Get-Command "choco.exe" -ErrorAction SilentlyContinue)) {
+        Write-Stderr "error: cannot find choco.exe"
+        exit 1
+    }
+
+    # check git tag
+    $Tag, $CommitCount, $Commit, $_ = Git-Describe
+    if ("0" -ne $CommitCount) {
+        Write-Stderr "error: cannot find clean git tag"
+        exit 1
+    }
+
+    # check release info
+    $script:ReleaseInfo = Get-ReleaseInfo $Tag
+    if (!$script:ReleaseInfo) {
+        Write-Stderr "error: cannot get release info for tag $Tag"
+        exit 1
+    }
+
+    # check winfsp.sym
+    if (!(Test-Path "$ProjectRoot\..\winfsp.sym" -ErrorAction SilentlyContinue)) {
+        Write-Stderr "error: cannot find winfsp.sym repository"
+        exit 1
+    }
+
+    # check winfsp.sym git status
+    Push-Location "$ProjectRoot\..\winfsp.sym"
+    $SymDirty = Git-Dirty
+    Pop-Location
+    if ($SymDirty) {
+        Write-Stderr "error: winfsp.sym repository is dirty"
+        exit 1
+    }
+
+    if ($State -contains $Name) {
+        if (!($State -contains "$Tag-$CommitCount-g$Commit")) {
+            Write-Stderr "error: invalid state for tag $Tag"
+            exit 1
+        }
+    } else {
+        Add-Content $StateFile -Value $Name
+        Add-Content $StateFile -Value "$Tag-$CommitCount-g$Commit"
+    }
+}
+
+function Check-Assets {
+    # check winfsp.msi
+    if (!(Test-Path "$ProjectRoot\build\VStudio\build\Release\winfsp*.msi" -ErrorAction SilentlyContinue)) {
+        Write-Stderr "error: cannot find winfsp*.msi"
+        exit 1
+    }
+
+    # check winfsp-tests.zip
+    if (!(Test-Path "$ProjectRoot\build\VStudio\build\Release\winfsp-tests*.zip" -ErrorAction SilentlyContinue)) {
+        Write-Stderr "error: cannot find winfsp-tests*.zip"
+        exit 1
+    }
+
+    # check winfsp.nupkg
+    if (!(Test-Path "$ProjectRoot\build\VStudio\build\Release\winfsp*.nupkg" -ErrorAction SilentlyContinue)) {
+        Write-Stderr "error: cannot find winfsp*.nupkg"
+        exit 1
+    }
+
+    # check winfsp signature
+    if ("Valid" -ne (Get-AuthenticodeSignature "$ProjectRoot\build\VStudio\build\Release\winfsp-x64.sys" -ErrorAction SilentlyContinue).Status) {
+        Write-Stderr "error: invalid winfsp signature"
+        exit 1
+    }
+}
+
+function Build-AssetsPhase1 {
+    Task -ScriptBlock {
+        Push-Location "$ProjectRoot"
+        tools\build.bat Release
+        if ($LastExitCode -ne 0) {
+            Write-Stderr "error: cannot build assets"
+            exit 1
+        }
+        Pop-Location
+
+        Write-Stdout @"
+
+Upload file driver.cab to Microsoft Partner Center for attestation signing.
+When the file has been signed, download and extract to ~\Downloads\drivers
+
+"@
+    }
+}
+
+function Build-AssetsPhase2 {
+    Task -ScriptBlock {
+        Check-Assets
+
+        # check signed drivers folder
+        if (!(Test-Path ~\Downloads\drivers -ErrorAction SilentlyContinue)) {
+            Write-Stderr "error: cannot find ~\Downloads\drivers"
+            exit 1
+        }
+
+        $SignedPackage = Resolve-Path ~\Downloads\drivers
+
+        $VerX64 = Get-FileVersion "$ProjectRoot\build\VStudio\build\Release\winfsp-x64.sys"
+        if ($VerX64 -ne (Get-FileVersion "$SignedPackage\x64\winfsp-x64.sys")) {
+            Write-Stderr "error: incompatible versions in ~\Downloads\drivers"
+            exit 1
+        }
+
+        Push-Location "$ProjectRoot"
+        tools\build.bat Release $SignedPackage
+        if ($LastExitCode -ne 0) {
+            Write-Stderr "error: cannot build assets"
+            exit 1
+        }
+        Pop-Location
+
+        Write-Stdout @"
+
+Assets have been built and signed. You may want to perform some smoke testing.
+
+"@
+    }
+}
+
+function Make-GitHubRelease {
+    Task -ScriptBlock {
+        Check-Assets
+
+        if ((Resolve-Path "$ProjectRoot\build\VStudio\build\Release\winfsp*.msi") -match "\\winfsp-(.+)\.msi") {
+            $Version = $matches[1]
+        }
+
+        $DownloadColor = "blue"
+        $PrereleaseOpt = ""
+        if ($ReleaseInfo.Prerelease) {
+            $DownloadColor = "e52e4b"
+            $PrereleaseOpt = "-p"
+        }
+
+        $ReleaseNotes = @"
+[![Download WinFsp](https://img.shields.io/badge/-Download%20WinFsp-$DownloadColor.svg?style=for-the-badge&labelColor=grey&logo=data:image/svg%2bxml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA0ODAgNDgwIj48cGF0aCBkPSJNMzg3LjAwMiAyMDEuMDAxQzM3Mi45OTggMTMyLjAwMiAzMTIuOTk4IDgwIDI0MCA4MGMtNTcuOTk4IDAtMTA3Ljk5OCAzMi45OTgtMTMyLjk5OCA4MS4wMDFDNDcuMDAyIDE2Ny4wMDIgMCAyMTcuOTk4IDAgMjgwYzAgNjUuOTk2IDUzLjk5OSAxMjAgMTIwIDEyMGgyNjBjNTUgMCAxMDAtNDUgMTAwLTEwMCAwLTUyLjk5OC00MC45OTYtOTYuMDAxLTkyLjk5OC05OC45OTl6TTIwOCAyNTJ2LTc2aDY0djc2aDY4TDI0MCAzNTIgMTQwIDI1Mmg2OHoiIGZpbGw9IiNmZmYiLz48L3N2Zz4=)](https://github.com/billziss-gh/winfsp/releases/download/$($ReleaseInfo.Tag)/winfsp-$Version.msi)
+
+[VirusTotal Scan Results]()
+
+## CHANGES SINCE WINFSP $($ReleaseInfo.PreviousProductVersion)
+$($ReleaseInfo.Text -join "`n")
+"@
+
+        gh release create $ReleaseInfo.Tag --draft --title "WinFsp $($ReleaseInfo.ProductVersion)" --notes "$ReleaseNotes" $PrereleaseOpt (Resolve-Path "$ProjectRoot\build\VStudio\build\Release\winfsp*.msi") (Resolve-Path "$ProjectRoot\build\VStudio\build\Release\winfsp-tests*.zip")
+        if ($LastExitCode -ne 0) {
+            Write-Stderr "error: cannot create GitHub release"
+            exit 1
+        }
+
+        Write-Stdout @"
+
+Draft GitHub release for tag $($ReleaseInfo.Tag) has been created.
+Publish the release on GitHub and update the VirusTotal link.
+
+"@
+    }
+}
+
+function Upload-Symbols {
+    Task -ScriptBlock {
+        Check-Assets
+
+        # check winfsp.sym git log
+        Push-Location "$ProjectRoot\..\winfsp.sym"
+        $SymHasTag = Git-LogGrep $ReleaseInfo.Tag
+        Pop-Location
+        if ($SymHasTag) {
+            Write-Stderr "warning: winfsp.sym repository already has commit for tag $($ReleaseInfo.Tag)"
+        } else {
+            Push-Location "$ProjectRoot\..\winfsp.sym"
+            .\tools\symadd.ps1 ..\winfsp\build\VStudio\build\Release -PdbKind Private
+            if ($LastExitCode -ne 0) {
+                Write-Stderr "error: cannot add files to winfsp.sym repository"
+                exit 1
+            }
+            git add .
+            if ($LastExitCode -ne 0) {
+                Write-Stderr "error: cannot add files to winfsp.sym repository staging area"
+                exit 1
+            }
+            git commit -m $ReleaseInfo.Tag
+            if ($LastExitCode -ne 0) {
+                Write-Stderr "error: cannot commit files to winfsp.sym repository"
+                exit 1
+            }
+            Pop-Location
+
+            Write-Stdout @"
+
+Commit for $($ReleaseInfo.Tag) symbols has been created.
+Push the winfsp.sym repository to GitHub.
+
+"@
+        }
+    }
+}
+
+function Make-ChocoRelease {
+    Task -ScriptBlock {
+        Check-Assets
+
+        Push-Location "$ProjectRoot\build\VStudio\build\Release"
+        choco push
+        if ($LastExitCode -ne 0) {
+            Write-Stderr "error: cannot push to Chocolatey"
+            exit 1
+        }
+        Pop-Location
+
+        Write-Stdout @"
+
+Chocolatey release for $($ReleaseInfo.Tag) has been pushed.
+
+"@
+    }
+}
+
+$ProjectRoot = Split-Path $PSScriptRoot
+$StateFile = Join-Path $pwd $StateFile
+
+Write-Stdout "Using state file $StateFile"
+$State = @(Get-Content $StateFile -ErrorAction Ignore)
+
+Check-Prerequisites
+
+# Workflow tasks
+Build-AssetsPhase1
+Build-AssetsPhase2
+Make-GitHubRelease
+Upload-Symbols
+Make-ChocoRelease