packaging: include git-x509-cert and replace fake windows msi

.github/workflows/build-binaries.yml

@@ -31,20 +31,18 @@ jobs:
       - name: Build macos binary
         run: |
           go build -o build/macos/smimesign -ldflags "-X main.versionString=${{ env.GIT_VERSION }}" .
-      - name: Create DMG
-        run: |
-          # Placeholder for DMG creation. This would typically involve a tool like create-dmg or a custom script.
-          # For now, we'll just create a dummy file.
-          echo "Dummy DMG content" > build/macos/smimesign-${{ env.GIT_VERSION }}.dmg
+          go build -o build/macos/git-x509-cert ./cmd/git-x509-cert
       - name: Tar the macOS binary
         run: |
-          cd build/macos && tar -czvf smimesign-macos-${{ env.GIT_VERSION }}.tgz smimesign
+          mkdir -p build/macos/package
+          cp build/macos/smimesign build/macos/package/smimesign
+          cp build/macos/git-x509-cert build/macos/package/git-x509-cert
+          cd build/macos && tar -czvf smimesign-macos-${{ env.GIT_VERSION }}.tgz -C package smimesign git-x509-cert
       - name: Upload macOS files to the release
         uses: softprops/action-gh-release@v2
         with:
           files: |
             build/macos/smimesign-macos-${{ env.GIT_VERSION }}.tgz
-            build/macos/smimesign-${{ env.GIT_VERSION }}.dmg
   build-linux:
     strategy:
       matrix:
@@ -84,8 +82,10 @@ jobs:
       - name: Build linux binary
         run: |
           go build -o build/linux/smimesign-${{ matrix.arch }} -ldflags "-X main.versionString=${{ env.GIT_VERSION }}" .
+          GOOS=linux GOARCH=${{ matrix.arch }} CGO_ENABLED=0 go build -o build/linux/git-x509-cert-${{ matrix.arch }} ./cmd/git-x509-cert
           if [ "${{ matrix.arch }}" = "amd64" ]; then
             cp build/linux/smimesign-${{ matrix.arch }} build/linux/smimesign
+            cp build/linux/git-x509-cert-${{ matrix.arch }} build/linux/git-x509-cert
           fi
       - name: Install nfpm
         run: |
@@ -97,7 +97,10 @@ jobs:
           VERSION=${{ env.BARE_GIT_VERSION }} nfpm package -p rpm --target build/linux/smimesign-${{ env.BARE_GIT_VERSION }}-1.x86_64.rpm
       - name: Tar the Linux binary
         run: |
-          cd build/linux && tar -czvf smimesign-linux-${{ matrix.arch }}-${{ env.GIT_VERSION }}.tgz smimesign-${{ matrix.arch }}
+          mkdir -p build/linux/package-${{ matrix.arch }}
+          cp build/linux/smimesign-${{ matrix.arch }} build/linux/package-${{ matrix.arch }}/smimesign
+          cp build/linux/git-x509-cert-${{ matrix.arch }} build/linux/package-${{ matrix.arch }}/git-x509-cert
+          cd build/linux && tar -czvf smimesign-linux-${{ matrix.arch }}-${{ env.GIT_VERSION }}.tgz -C package-${{ matrix.arch }} smimesign git-x509-cert
       - name: Upload Linux files to the release
         uses: softprops/action-gh-release@v2
         with:
@@ -109,11 +112,9 @@ jobs:
       matrix:
         go-version: ["1.25"]
         os: [windows-latest]
-        arch: [amd64]
     runs-on: ${{ matrix.os }}
     env:
       CGO_ENABLED: 1
-      GOARCH: ${{ matrix.arch }}
       PFX_PASSWORD: ${{ secrets.PFX_PASSWORD }}
     steps:
       - name: Install Go
@@ -138,34 +139,51 @@ jobs:
             echo "Could not calculate the bare git version (e.g. \`v1.1.0-rc1-28-g8a54734\` -> \`1.1.0\`) for: ${GIT_VERSION}"
             exit 1
           fi
-      - name: Build binary
+      - name: Build binaries
         shell: bash
         run: |
-          go build -o "build/${{ matrix.arch }}/smimesign.exe" -ldflags "-X main.versionString=${{ env.GIT_VERSION }}"
-      - name: Sign binary
+          GOOS=windows GOARCH=amd64 go build -o build/amd64/smimesign.exe -ldflags "-X main.versionString=${{ env.GIT_VERSION }}" .
+          GOOS=windows GOARCH=386 go build -o build/386/smimesign.exe -ldflags "-X main.versionString=${{ env.GIT_VERSION }}" .
+          GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -o build/amd64/git-x509-cert.exe ./cmd/git-x509-cert
+          GOOS=windows GOARCH=386 CGO_ENABLED=0 go build -o build/386/git-x509-cert.exe ./cmd/git-x509-cert
+      - name: Sign binaries
         if: ${{ env.PFX_PASSWORD != '' }}
         run: |
-          .\windows-installer\signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /p ${{ env.PFX_PASSWORD }} /f windows-installer\codesign.pfx build\${{ matrix.arch }}\smimesign.exe
-      - name: Create installer (MSI)
-        if: ${{ matrix.arch == 'amd64' }}
-        run: |
-          # Placeholder for MSI creation. This would typically involve a tool like WiX Toolset or a custom script.
-          # For now, we'll just create a dummy file.
-          New-Item -ItemType Directory -Force -Path build/installer | Out-Null
-          echo "Dummy MSI content" > build/installer/smimesign-windows-amd64-${{ env.GIT_VERSION }}.msi
-      - name: Create zip for release upload
+          .\windows-installer\signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /p ${{ env.PFX_PASSWORD }} /f windows-installer\codesign.pfx build\amd64\smimesign.exe
+          .\windows-installer\signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /p ${{ env.PFX_PASSWORD }} /f windows-installer\codesign.pfx build\386\smimesign.exe
+          .\windows-installer\signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /p ${{ env.PFX_PASSWORD }} /f windows-installer\codesign.pfx build\amd64\git-x509-cert.exe
+          .\windows-installer\signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /p ${{ env.PFX_PASSWORD }} /f windows-installer\codesign.pfx build\386\git-x509-cert.exe
+      - name: Install Inno Setup
+        run: |
+          choco install innosetup --no-progress -y
+      - name: Create installer (EXE)
+        shell: powershell
+        run: |
+          New-Item -ItemType Directory -Force -Path build\installer | Out-Null
+          $env:GIT_VERSION = "${{ env.GIT_VERSION }}"
+          $env:BARE_GIT_VERSION = "${{ env.BARE_GIT_VERSION }}"
+          & "${env:ProgramFiles(x86)}\Inno Setup 6\ISCC.exe" windows-installer\inno-setup-smimesign-installer.iss
+      - name: Sign installer
+        if: ${{ env.PFX_PASSWORD != '' }}
         run: |
-          Compress-Archive -Path build\${{ matrix.arch }}\smimesign.exe -DestinationPath build\${{ matrix.arch }}\smimesign.zip
-      - name: Rename zip for release upload
+          .\windows-installer\signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /p ${{ env.PFX_PASSWORD }} /f windows-installer\codesign.pfx build\installer\smimesign-windows-${{ env.GIT_VERSION }}.exe
+      - name: Create zip archives for release upload
         shell: bash
         run: |
-          mv build/${{ matrix.arch }}/smimesign.zip build/${{ matrix.arch }}/smimesign-windows-${{ matrix.arch }}-${{ env.GIT_VERSION }}.zip
+          mkdir -p build/amd64/package build/386/package
+          cp build/amd64/smimesign.exe build/amd64/package/smimesign.exe
+          cp build/amd64/git-x509-cert.exe build/amd64/package/git-x509-cert.exe
+          cp build/386/smimesign.exe build/386/package/smimesign.exe
+          cp build/386/git-x509-cert.exe build/386/package/git-x509-cert.exe
+          powershell -Command "Compress-Archive -Path build/amd64/package/* -DestinationPath build/amd64/smimesign-windows-amd64-${{ env.GIT_VERSION }}.zip"
+          powershell -Command "Compress-Archive -Path build/386/package/* -DestinationPath build/386/smimesign-windows-386-${{ env.GIT_VERSION }}.zip"
       - name: Upload Windows files to the release
         uses: softprops/action-gh-release@v2
         with:
           files: |
-            build/${{ matrix.arch }}/smimesign-windows-${{ matrix.arch }}-${{ env.GIT_VERSION }}.zip
-            ${{ (matrix.arch == 'amd64' && format('build/installer/smimesign-windows-amd64-{0}.msi', env.GIT_VERSION)) || '' }}
+            build/amd64/smimesign-windows-amd64-${{ env.GIT_VERSION }}.zip
+            build/386/smimesign-windows-386-${{ env.GIT_VERSION }}.zip
+            build/installer/smimesign-windows-${{ env.GIT_VERSION }}.exe
   build-container-image:
     runs-on: ubuntu-latest
     permissions:

nfpm.yaml

@@ -13,4 +13,6 @@ license: MIT
 contents:
   - src: ./build/linux/smimesign
     dst: /usr/bin/smimesign
+  - src: ./build/linux/git-x509-cert
+    dst: /usr/bin/git-x509-cert
     type: file

windows-installer/inno-setup-smimesign-installer.iss

@@ -13,6 +13,16 @@
   #pragma error PathToX64Binary + " does not exist, please build it first."
 #endif
 
+#define PathToX86Helper "../build/386/git-x509-cert.exe"
+#ifnexist PathToX86Helper
+  #pragma error PathToX86Helper + " does not exist, please build it first."
+#endif
+
+#define PathToX64Helper "../build/amd64/git-x509-cert.exe"
+#ifnexist PathToX64Helper
+  #pragma error PathToX64Helper + " does not exist, please build it first."
+#endif
+
 #define MyAppPublisher "GitHub, Inc."
 #define MyAppURL "https://github.com/droren/smimesign"
 #define MyAppFilePrefix "smimesign-windows"
@@ -49,6 +59,8 @@ Name: "english"; MessagesFile: "compiler:Default.isl"
 [Files]
 Source: {#PathToX86Binary}; DestDir: "{app}"; Flags: ignoreversion; DestName: "smimesign.exe"; Check: not Is64BitInstallMode
 Source: {#PathToX64Binary}; DestDir: "{app}"; Flags: ignoreversion; DestName: "smimesign.exe"; Check: Is64BitInstallMode
+Source: {#PathToX86Helper}; DestDir: "{app}"; Flags: ignoreversion; DestName: "git-x509-cert.exe"; Check: not Is64BitInstallMode
+Source: {#PathToX64Helper}; DestDir: "{app}"; Flags: ignoreversion; DestName: "git-x509-cert.exe"; Check: Is64BitInstallMode
 
 [Registry]
 Root: HKLM; Subkey: "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"; ValueType: expandsz; ValueName: "Path"; ValueData: "{olddata};{app}"; Check: IsAdminLoggedOn and NeedsAddPath('{app}')