Refactor unpacking of Windows build tar files

.gitattributes

@@ -1,2 +1 @@
 *.patch linguist-language=C++
-.github/workflows/object/*.tar.gz filter=lfs diff=lfs merge=lfs -text

.github/workflows/alpha.yml

@@ -317,23 +317,16 @@ jobs:
         with:
           submodules: recursive
           token: ${{ secrets.DEPLOY_KEY }}
-          lfs: true
 
       - name: Git Pull
         run: |
           git pull
-          git lfs pull
 
       - uses: actions/download-artifact@v4
 
       - name: List
         run: find .
 
-      - name: Unpack windows build (.tar.gz)
-        run: |
-          tar -xvf .github/workflows/object/windows-x64-signed-generic.tar.gz -C .
-          tar -xvf .github/workflows/object/windows-x64-signed-specific.tar.gz -C .
-
       - name: Clone updates repo
         uses: actions/checkout@v4
         with:
@@ -348,8 +341,8 @@ jobs:
           cp -a ../linux_update_manifest_generic/.  updates/
           cp -a ../linux_update_manifest_specific/.  updates/
 
-          cp -a ../windows-x64-signed-generic/update_manifest/.  updates/
-          cp -a ../windows-x64-signed-specific/update_manifest/.  updates/
+          cp -a ../.github/workflows/object/windows-x64-signed-generic/update_manifest/.  updates/
+          cp -a ../.github/workflows/object/windows-x64-signed-specific/update_manifest/.  updates/
 
           cp -a ../macos_update_manifest_aarch64/.  updates/
           cp -a ../macos_update_manifest_x64/.  updates/
@@ -376,16 +369,16 @@ jobs:
             zen-generic.AppImage.zsync
             zen-specific.AppImage
             zen-specific.AppImage.zsync
-            windows-x64-signed-generic/zen.win-generic.zip
-            windows-x64-signed-specific/zen.win-specific.zip
+            .github/workflows/object/windows-x64-signed-generic/zen.win-generic.zip
+            .github/workflows/object/windows-x64-signed-specific/zen.win-specific.zip
             linux.mar
             linux-generic.mar
-            windows-x64-signed-generic/windows-generic.mar
-            windows-x64-signed-specific/windows.mar
+            .github/workflows/object/windows-x64-signed-generic/windows-generic.mar
+            .github/workflows/object/windows-x64-signed-specific/windows.mar
             macos-x64.mar
             macos-aarch64.mar
-            windows-x64-signed-specific/zen.installer.exe
-            windows-x64-signed-generic/zen.installer-generic.exe
+            .github/workflows/object/windows-x64-signed-specific/zen.installer.exe
+            .github/workflows/object/windows-x64-signed-generic/zen.installer-generic.exe
             zen.macos-x64.dmg
             zen.macos-aarch64.dmg
 

.github/workflows/object/windows-x64-signed-generic.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:6eae13d446c4326d555f9470e7773b367e7d9e2f3ef2b051a8fbd64bf7ebffaf
-size 237737135

.github/workflows/object/windows-x64-signed-generic/update_manifest/browser/WINNT_x86_64-msvc-x64/alpha-generic/update.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<updates>
+  <update type="minor" displayVersion="1.0.1-a" appVersion="1.0.1-a" platformVersion="130.0" buildID="20240916093302">
+    <patch type="complete" URL="https://github.com/zen-browser/desktop/releases/download/1.0.1-a/windows-generic.mar" hashFunction="sha512" hashValue="1d57da64dfe08f84093cb58ee28037880740541757a2cab73e5ac2adcc5ea67b33783e2947c955bca50e74d8b7203ba54f71e61395d95fa2c43f2a9ce2c7b1c6" size="72337408"/>
+  </update>
+</updates>

.github/workflows/object/windows-x64-signed-generic/update_manifest/browser/WINNT_x86_64-msvc/alpha-generic/update.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<updates>
+  <update type="minor" displayVersion="1.0.1-a" appVersion="1.0.1-a" platformVersion="130.0" buildID="20240916093302">
+    <patch type="complete" URL="https://github.com/zen-browser/desktop/releases/download/1.0.1-a/windows-generic.mar" hashFunction="sha512" hashValue="1d57da64dfe08f84093cb58ee28037880740541757a2cab73e5ac2adcc5ea67b33783e2947c955bca50e74d8b7203ba54f71e61395d95fa2c43f2a9ce2c7b1c6" size="72337408"/>
+  </update>
+</updates>

.github/workflows/object/windows-x64-signed-specific.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:474d09353b1ef5e8f16d4785d8084b264630a7a8072a6cd4532904f923fff7ba
-size 237641008

.github/workflows/object/windows-x64-signed-specific/update_manifest/browser/WINNT_x86_64-msvc-x64/alpha-generic/update.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<updates>
+  <update type="minor" displayVersion="1.0.1-a" appVersion="1.0.1-a" platformVersion="130.0" buildID="20240916093142">
+    <patch type="complete" URL="https://github.com/zen-browser/desktop/releases/download/1.0.1-a/windows-generic.mar" hashFunction="sha512" hashValue="ed11d2af249f3c6290943c9a8bc7a4eab7a2bfc24268b927a4ea003e168cf509760782d01e974492b4af477ec649d627c6c69290f1e0c91849f44b09cc85febe" size="72214812"/>
+  </update>
+</updates>

.github/workflows/object/windows-x64-signed-specific/update_manifest/browser/WINNT_x86_64-msvc/alpha-generic/update.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<updates>
+  <update type="minor" displayVersion="1.0.1-a" appVersion="1.0.1-a" platformVersion="130.0" buildID="20240916093142">
+    <patch type="complete" URL="https://github.com/zen-browser/desktop/releases/download/1.0.1-a/windows-generic.mar" hashFunction="sha512" hashValue="ed11d2af249f3c6290943c9a8bc7a4eab7a2bfc24268b927a4ea003e168cf509760782d01e974492b4af477ec649d627c6c69290f1e0c91849f44b09cc85febe" size="72214812"/>
+  </update>
+</updates>

build/winsign/sign.ps1

@@ -34,8 +34,11 @@ function SignAndPackage($name) {
     $env:MAR="$PWD\\build\\winsign\\mar.exe"
     if ($name -eq "generic") {
         $env:SURFER_COMPAT="true"
+    } else {
+        Clear-Variable -Name SURFER_COMPAT -ErrorAction SilentlyContinue
     }
 
+    echo "Compat Mode? $env:SURFER_COMPAT"
     pnpm surfer package --verbose
 
     # In the release script, we do the following:
@@ -67,14 +70,22 @@ function SignAndPackage($name) {
     # Move the zip
     mv (Get-Item .\dist\*.en-US.win64.zip) windsign-temp\windows-x64-signed-$name\zen.win-$name.zip
 
+    # Extract the zip, sign everything inside, and repackage it
+    Expand-Archive -Path windsign-temp\windows-x64-signed-$name\zen.win-$name.zip -DestinationPath windsign-temp\windows-x64-signed-$name\zen.win-$name
+    rm windsign-temp\windows-x64-signed-$name\zen.win-$name.zip
+    $files = Get-ChildItem windsign-temp\windows-x64-signed-$name\zen.win-$name -Recurse -Include *.exe
+    $files += Get-ChildItem windsign-temp\windows-x64-signed-$name\zen.win-$name -Recurse -Include *.dll
+    signtool.exe sign /n "$SignIdentity" /t http://time.certum.pl/ /fd sha1 /v $files
+    Compress-Archive -Path windsign-temp\windows-x64-signed-$name\zen.win-$name -DestinationPath windsign-temp\windows-x64-signed-$name\zen.win-$name.zip
+    rmdir windsign-temp\windows-x64-signed-$name\zen.win-$name -Recurse -ErrorAction SilentlyContinue
+
     # Move the manifest
-    foreach ($file in Get-ChildItem .\dist\update\) {
-        mv ".\\dist\\update\\$file" windsign-temp\windows-x64-signed-$name\update_manifest
-    }
+    mv .\dist\update\. windsign-temp\windows-x64-signed-$name\update_manifest
 
     echo "Invoking tar for $name"
     # note: We need to sign it into a parent folder, called windows-x64-signed-$name
-    tar -czvf .\.github\workflows\object\windows-x64-signed-$name.tar.gz -C .\windsign-temp\ windows-x64-signed-$name
+    rmdir .\.github\workflows\object\windows-x64-signed-$name -Recurse -ErrorAction SilentlyContinue
+    mv .\windsign-temp\windows-x64-signed-$name .\.github\workflows\object\windows-x64-signed-$name -Force
 
     echo "Finished $name"
 }