feat(win): trusted signinging with azure

this may require proile name, azure permissions and secrets to be adjusted
before it actually works

Author: lidel

.github/workflows/ci.yml

@@ -230,9 +230,6 @@ jobs:
           max_attempts: 2
           # GH token for attaching atrifacts to release draft on tag build
           github_token: ${{ secrets.github_token }}
-          # Windows signing
-          windows_certs: ${{ secrets.windows_certs }}
-          windows_certs_password: ${{ secrets.windows_certs_password }}
           # Apple signing
           mac_certs: ${{ secrets.mac_certs }}
           mac_certs_password: ${{ secrets.mac_certs_password }}
@@ -244,6 +241,10 @@ jobs:
           # Apple notarization
           APPLEID: ${{ secrets.apple_id }}
           APPLEIDPASS: ${{ secrets.apple_id_pass }}
+          # Windows Azure Trusted Signing
+          AZURE_TENANT_ID: ${{secrets.AZURE_TENANT_ID}}
+          AZURE_CLIENT_ID: ${{secrets.AZURE_CLIENT_ID}}
+          AZURE_CLIENT_SECRET: ${{secrets.AZURE_CLIENT_SECRET}}
 
       - name: Show dist/
         run: du -sh dist/ && ls -l dist/

electron-builder.yml

@@ -43,14 +43,29 @@ dmg:
       type: link
       path: /Applications
 
+win:
+  target:
+    - nsis
+    # TODO - portable
+  publisherName: 'IPFS Project'
+  rfc3161TimeStampServer: 'http://timestamp.acs.microsoft.com'
+  azureSignOptions:
+    endpoint: 'https://eus.codesigning.azure.net'
+    certificateProfileName: 'ipfs-desktop'
+    codeSigningAccountName: 'pl-code-signing'
+
 nsis:
+  artifactName: ${name}-setup-${version}-${os}-${arch}.${ext}
   include: assets/build/nsis.nsh
   oneClick: false
   warningsAsErrors: false
   perMachine: false
   allowElevation: true
   allowToChangeInstallationDirectory: true
 
+portable:
+  artifactName: ${name}-portable-${version}-${os}-${arch}.${ext}
+
 linux:
   artifactName: ${name}-${version}-${os}-${arch}.${ext}
   executableName: ipfs-desktop