windows-msi: Replace build.wsf and build-and-package.ps1 with CMake

The JavaScript code had a limited implementation of
a make system. So instead replace it by using an actual
make system.

File dependencies are downloaded in the configuration
phase.

Also replace version.m4 with a version.cmake since I could
find no indication that it was used with m4 currently
(maybe it was useful in the distant past, but not today).

Github: Closes #1111
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>

Author: flichtenheld

.github/workflows/build.yaml

@@ -22,6 +22,7 @@ jobs:
       SigningKeyStore: ${{ secrets.GOOGLE_CLOUD_KMS_KEYRING }}
       SigningStoreKeyName: ${{ secrets.GOOGLE_CLOUD_KMS_KEY }}
       SigningCertificateFile: ${{ github.workspace }}/certificate.pem
+      ManifestTimestampRFC3161Url: http://timestamp.digicert.com
       VCPKG_BINARY_SOURCES: clear;files,${{ github.workspace }}/vcpkg_cache,readwrite
 
     name: 'openvpn-build'
@@ -83,9 +84,9 @@ jobs:
           $BuildVersion = 10000 + [int]$env:GITHUB_RUN_NUMBER
           $NewProductVersion = "2.7.$BuildVersion"
           echo $NewProductCode $NewProductVersion
-          $version_m4 = (Get-Content version.m4)
-          $version_m4 -replace '^define\(\[PRODUCT_CODE\], \[\{(?<ProductCode>.*)\}]\)', "define([PRODUCT_CODE], [{${NewProductCode}}])" `
-            -replace '^define\(\[PRODUCT_VERSION\], \[(.*?)\]\)', "define([PRODUCT_VERSION], [${NewProductVersion}])" | Out-File -Encoding ASCII version.m4
+          $version_cmake = (Get-Content version.cmake)
+          $version_cmake -replace '^set\(PRODUCT_CODE\s+"\{.*?\}"\)', "set(PRODUCT_CODE `"{${NewProductCode}}`")" `
+            -replace '^set\(PRODUCT_VERSION\s+".*?"\)', "set(PRODUCT_VERSION `"${NewProductVersion}`")" | Out-File -Encoding ASCII version.cmake
 
       - name: Authenticate to Google Cloud
         id: 'auth'
@@ -105,26 +106,28 @@ jobs:
         if: ${{ env.SigningKeyStore != '' }}
         run: |
           echo "${{ secrets.SIGNING_CERTIFICATE }}" >${{ github.workspace }}/certificate.pem
-          ./build-and-package.ps1 -sign -arch ${{ matrix.arch }}
+          cmake -B build -DOPENVPN_ARCH=${{ matrix.arch }} -DSIGN_BINARIES=ON
+          cmake --build build
 
       - name: Build
         working-directory: windows-msi
         if: ${{ env.SigningKeyStore == '' }}
         run: |
-          ./build-and-package.ps1 -arch ${{ matrix.arch }}
+          cmake -B build -DOPENVPN_ARCH=${{ matrix.arch }}
+          cmake --build build
 
       - name: Rename MSI
         run: |
           $commit = git -C ./src/openvpn rev-parse --short HEAD
           $dt = Get-Date -Format "yyyyMMddThhmm"
-          $orig_msi_name = (Get-Item .\windows-msi\image\*-${{ matrix.arch }}.msi).Name
+          $orig_msi_name = (Get-Item .\windows-msi\build\image\*-${{ matrix.arch }}.msi).Name
           $msi_name = $orig_msi_name -replace '^(OpenVPN-.*?)-(${{ matrix.arch }}\.msi)', "`$1+${dt}-${commit}-`$2"
-          mv .\windows-msi\image\$orig_msi_name .\windows-msi\image\$msi_name
+          mv .\windows-msi\build\image\$orig_msi_name .\windows-msi\build\image\$msi_name
 
       - name: Archive MSI
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          path: ${{ github.workspace }}\windows-msi\image\*-${{ matrix.arch }}.msi
+          path: ${{ github.workspace }}\windows-msi\build\image\*-${{ matrix.arch }}.msi
           archive: false
 
       - name: Save vcpkg cache

.gitignore

@@ -10,4 +10,4 @@ tmp
 *.cer
 *.crt
 release/vars.infrastructure
-windows-msi/build-and-package-env.ps1
+windows-msi/build-env.bat

release/version-and-tags.sh

@@ -88,11 +88,11 @@ popd
 
 pushd "$MSI"
 # Update user-visible version
-sed -E -i s/"define\(\[PACKAGE_VERSION\], \[(.+)\]\)"/"define\(\[PACKAGE_VERSION\], \[$BUILD_VERSION\]\)"/1 version.m4
-# if version.m4 was already updated, assume everything is fine as is
+sed -E -i s/'set\(PACKAGE_VERSION "(.+)"\)'/"set(PACKAGE_VERSION \"$BUILD_VERSION\")"/1 version.cmake
+# if version.cmake was already updated, assume everything is fine as is
 if ! git diff --exit-code; then
-    PRODUCT_VERSION_NEW="$PRODUCT_VERSION" ./bump-version.m4.sh
-    git add ./version.m4
+    PRODUCT_VERSION_NEW="$PRODUCT_VERSION" ./bump-version.sh
+    git add ./version.cmake
 fi
 
 popd

release/windows-installer-build.sh

@@ -21,24 +21,26 @@ pushd "$TOP_DIR"
 . "$SCRIPT_DIR/vars"
 . "$SCRIPT_DIR/vars.infrastructure"
 
-cat >build-and-package-env.ps1 <<EOF
-\$Env:JsignJar="$WINDOWS_MSI_WORKDIR/../jsign.jar"
-\$Env:SigningStoreType="GOOGLECLOUD"
-\$Env:SigningKeyStore="$GOOGLE_CLOUD_KMS_KEYRING"
-\$Env:SigningStoreKeyName="$GOOGLE_CLOUD_KMS_KEY"
-\$Env:SigningCertificateFile="$WINDOWS_MSI_WORKDIR/../signingCert.pem"
+cat >windows-msi/build-env.bat <<EOF
+@echo off
+set JsignJar=$WINDOWS_MSI_WORKDIR/../jsign.jar
+set SigningStoreType=GOOGLECLOUD
+set SigningKeyStore=$GOOGLE_CLOUD_KMS_KEYRING
+set SigningStoreKeyName=$GOOGLE_CLOUD_KMS_KEY
+set SigningCertificateFile=$WINDOWS_MSI_WORKDIR/../signingCert.pem
+set ManifestTimestampRFC3161Url=http://timestamp.digicert.com
 EOF
 if [ -n "${VCPKG_CACHE:-}" ]; then
-   echo "\$Env:VCPKG_BINARY_SOURCES=\"$VCPKG_CACHE\"" >>build-and-package-env.ps1
+   echo "set VCPKG_BINARY_SOURCES=$VCPKG_CACHE" >>windows-msi/build-env.bat
 fi
 
 ssh $WINDOWS_MSI_BUILDHOST "gcloud auth login --quiet --cred-file=$WINDOWS_MSI_WORKDIR\..\clientLibraryConfig.json"
 set +x
 ACCESS_TOKEN=$(ssh $WINDOWS_MSI_BUILDHOST "cd $WINDOWS_MSI_WORKDIR/windows-msi && gcloud auth print-access-token")
-echo "\$Env:SigningStorePass=\"$ACCESS_TOKEN\"" >>build-and-package-env.ps1
+echo "set SigningStorePass=$ACCESS_TOKEN" >>windows-msi/build-env.bat
 set -x
 
-scp build-and-package-env.ps1 "$WINDOWS_MSI_BUILDHOST":"$WINDOWS_MSI_WORKDIR/windows-msi/"
+scp windows-msi/build-env.bat "$WINDOWS_MSI_BUILDHOST":"$WINDOWS_MSI_WORKDIR/windows-msi/"
 
 ssh $WINDOWS_MSI_BUILDHOST git -C "$WINDOWS_MSI_WORKDIR" submodule update --init
 ssh $WINDOWS_MSI_BUILDHOST git -C "$WINDOWS_MSI_WORKDIR/src/openvpn" remote remove internal || true
@@ -47,10 +49,10 @@ ssh $WINDOWS_MSI_BUILDHOST git -C "$WINDOWS_MSI_WORKDIR" remote remove internal
 ssh $WINDOWS_MSI_BUILDHOST git -C "$WINDOWS_MSI_WORKDIR" tag -d "OpenVPN-$BUILD_VERSION" || true
 ssh $WINDOWS_MSI_BUILDHOST git -C "$WINDOWS_MSI_WORKDIR" remote add -f --tags internal "$INTERNAL_GIT_REPO_BUILD_RO"
 ssh $WINDOWS_MSI_BUILDHOST git -C "$WINDOWS_MSI_WORKDIR" checkout --recurse-submodules -f "OpenVPN-$BUILD_VERSION"
-ssh $WINDOWS_MSI_BUILDHOST "cd $WINDOWS_MSI_WORKDIR/windows-msi && \"C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvarsall.bat\" x64 && powershell ./build-and-package.ps1 -sign"
+ssh $WINDOWS_MSI_BUILDHOST "cd $WINDOWS_MSI_WORKDIR/windows-msi && \"C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvarsall.bat\" x64 && build-env.bat && cmake -B build -DSIGN_BINARIES=ON && cmake --build build"
 
 mkdir -p "$OUTPUT/upload/"
-scp "$WINDOWS_MSI_BUILDHOST":"$WINDOWS_MSI_WORKDIR/windows-msi/image/OpenVPN-${BUILD_VERSION}"-*.msi "$OUTPUT/upload/"
+scp "$WINDOWS_MSI_BUILDHOST":"$WINDOWS_MSI_WORKDIR/windows-msi/build/image/OpenVPN-${BUILD_VERSION}"-*.msi "$OUTPUT/upload/"
 read -p "Upload MSIs to $SECONDARY_WEBSERVER?"
 # upload MSIs
 $SCRIPT_DIR/sign-and-push.sh

renovate.json

@@ -56,10 +56,10 @@
         {
             "customType": "regex",
             "managerFilePatterns": [
-                "/windows-msi/version.m4$/"
+                "/windows-msi/version\\.cmake$/"
             ],
             "matchStrings": [
-                "datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\sdefine\\(\\[.*?\\],\\s*\\[(?<currentValue>.*?)\\]\\)\\s"
+                "datasource=(?<datasource>.*?) depName=(?<depName>.*?)( versioning=(?<versioning>.*?))?\\nset\\(\\w+\\s+\"(?<currentValue>.*?)\"\\)"
             ]
         }
     ]