blob: 43d2aec18c38e81323236f0b3230f21a40d1aa45 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
building signed updates
=======================
* run
```
build\download_externals.cmd
build\auto\build_openmpt_args.cmd vs2019 win10 Win32 Release 7z default
build\auto\build_openmpt_args.cmd vs2019 win10 x64 Release 7z default
build\auto\build_openmpt_args.cmd vs2019 win10 ARM Release 7z default
build\auto\build_openmpt_args.cmd vs2019 win10 ARM64 Release 7z default
build\auto\build_openmpt_args.cmd vs2019 win7 Win32 Release 7z default
build\auto\build_openmpt_args.cmd vs2019 win7 x64 Release 7z default
build\auto\build_openmpt_release_packages_multiarch.cmd
build\auto\build_openmpt_update_information.cmd
build\auto\package_openmpt_installer_multiarch_args.cmd vs2019 win10 Win32 Release 7z default
```
or just `build\auto\build_openmpt_release_manual.cmd`, which does all of the
above in one go.
* results are found in `bin\openmpt-pkg.win-multi.tar`
* `openmpt/pkg.win/${BRANCHVERSION}/OpenMPT-${VERSION}-update.json` contains
the update information that needs to be copied verbatim to the respective
update channel on update.openmpt.org. This file is not signed as it itself
is considered only informational and may be augmented with additional
information. The files it links that contain actual code and automated
update instructions are all signed.
* If the current user did not yet have a signing key on the local computer, a
new key will be automatically generated and stored for future re-use in the
encrypted Windows Key Store. The public key to verify the signatures is
exported on each packaging of builds alongside the other build artefacts at
`openmpt/pkg.win/${BRANCHVERSION}/OpenMPT-${VERSION}-update-publickey.jwk.json`
. Any such new key should be added to the set of allowed update signing keys
in the repository at `build/signingkeys/`, as an individual file named
appropriately to describe the key (in order to easier identify the
individual keys), and as a key in the jwkset of allowed keys in the file
`build/signingkeys/signingkeys.jwkset.json`. A jwkset file consists of a
JSON object containing a single array of all individual keys, named `"keys"`
. The updated `signingkeys.jwkset.json` then needs to be copied to the https
locations where the update check checks for the anchor keys. There is no
separate key handling for test and release builds.
|
