mirror of
https://github.com/fergalmoran/picard.git
synced 2026-01-01 22:27:31 +00:00
892693be67
A libwebp vulnerarbility allows arbitrary code execution when loading a manipulated image. Disable the Qt webp imageformat plugin for binary builds for macOS and Windows for now. WebP images still can be loaded and saved, but they will not be displayed.
61 lines
1.9 KiB
PowerShell
61 lines
1.9 KiB
PowerShell
# Common functions for Windows packaging scripts
|
|
|
|
Param(
|
|
[ValidateScript({ (Test-Path $_ -PathType Leaf) -or (-not $_) })]
|
|
[String]
|
|
$CertificateFile,
|
|
[SecureString]
|
|
$CertificatePassword
|
|
)
|
|
|
|
# RFC 3161 timestamp server for code signing
|
|
$TimeStampServer = 'http://ts.ssl.com'
|
|
|
|
Function CodeSignBinary {
|
|
Param(
|
|
[ValidateScript({Test-Path $_ -PathType Leaf})]
|
|
[String]
|
|
$BinaryPath
|
|
)
|
|
If ($CertificateFile) {
|
|
SignTool sign /v /fd SHA256 /tr "$TimeStampServer" /td sha256 `
|
|
/f "$CertificateFile" /p (ConvertFrom-SecureString -AsPlainText $CertificatePassword) `
|
|
$BinaryPath
|
|
ThrowOnExeError "SignTool failed"
|
|
} Else {
|
|
Write-Output "Skip signing $BinaryPath"
|
|
}
|
|
}
|
|
|
|
Function ThrowOnExeError {
|
|
Param( [String]$Message )
|
|
If ($LastExitCode -ne 0) {
|
|
Throw $Message
|
|
}
|
|
}
|
|
|
|
Function FinalizePackage {
|
|
Param(
|
|
[ValidateScript({Test-Path $_ -PathType Container})]
|
|
[String]
|
|
$Path
|
|
)
|
|
|
|
CodeSignBinary -BinaryPath (Join-Path -Path $Path -ChildPath picard.exe) -ErrorAction Stop
|
|
CodeSignBinary -BinaryPath (Join-Path -Path $Path -ChildPath fpcalc.exe) -ErrorAction Stop
|
|
CodeSignBinary -BinaryPath (Join-Path -Path $Path -ChildPath discid.dll) -ErrorAction Stop
|
|
|
|
# Move all Qt5 DLLs into the main folder to avoid conflicts with system wide
|
|
# versions of those dependencies. Since some version PyInstaller tries to
|
|
# maintain the file hierarchy of imported modules, but this easily breaks
|
|
# DLL loading on Windows.
|
|
# Workaround for https://tickets.metabrainz.org/browse/PICARD-2736
|
|
$Qt5BinDir = (Join-Path -Path $Path -ChildPath PyQt5\Qt5\bin)
|
|
Move-Item -Path (Join-Path -Path $Qt5BinDir -ChildPath *.dll) -Destination $Path -Force
|
|
Remove-Item -Path $Qt5BinDir
|
|
|
|
# Mitigate libwebp vulnerability allowing for arbitrary code execution (CVE-2023-4863).
|
|
# Disable the Qt webp imageformat plugin.
|
|
Remove-Item -Path (Join-Path -Path $Path -ChildPath PyQt5\Qt5\plugins\imageformats\qwebp.dll)
|
|
}
|