[Windows] Add support for code signing the final binaries.

The option is controlled with the WITH_WINDOWS_CODESIGN option and needs:

- Signtool must be found on the system, the standard windows sdk folders will be searched for it.
- The path to the pfx file (WINDOWS_CODESIGN_PFX)
- The password for the pfx , this can either be set by the WINDOWS_CODESIGN_PFX_PASSWORD variable but given that ends up in CMakeCache.txt (which might be undesirable) there is a backup option of setting the PFXPASSWORD environment variable on the system.

Reviewers: sergey, juicyfruit

Reviewed By: juicyfruit

Tags: #bf_blender, #platform:_windows

Differential Revision: https://developer.blender.org/D2182

2 files changed, 35 insertions, 0 deletions

diff --git a/build_files/cmake/macros.cmake b/build_files/cmake/macros.cmake
index dc8b158f5c0..fabb35c539e 100644
--- a/build_files/cmake/macros.cmake
+++ b/build_files/cmake/macros.cmake
@@ -1578,3 +1578,26 @@ macro(openmp_delayload
 			endif(WITH_OPENMP)
 		endif(MSVC)
 endmacro()
+
+MACRO(WINDOWS_SIGN_TARGET target)
+	if (WITH_WINDOWS_CODESIGN)
+		if (!SIGNTOOL_EXE)
+			error("Codesigning is enabled, but signtool is not found")
+		else()
+			if (WINDOWS_CODESIGN_PFX_PASSWORD)
+				set(CODESIGNPASSWORD /p ${WINDOWS_CODESIGN_PFX_PASSWORD})
+			else()
+				if ($ENV{PFXPASSWORD})
+					set(CODESIGNPASSWORD /p $ENV{PFXPASSWORD})
+				else()
+					message( FATAL_ERROR "WITH_WINDOWS_CODESIGN is on but WINDOWS_CODESIGN_PFX_PASSWORD not set, and environment variable PFXPASSWORD not found, unable to sign code.")
+				endif()
+			endif()
+			add_custom_command(TARGET ${target}
+						POST_BUILD
+						COMMAND ${SIGNTOOL_EXE} sign /f ${WINDOWS_CODESIGN_PFX} ${CODESIGNPASSWORD} $<TARGET_FILE:${target}>
+						VERBATIM
+				)
+		endif()
+	endif()
+ENDMACRO()
\ No newline at end of file
diff --git a/build_files/cmake/platform/platform_win32_msvc.cmake b/build_files/cmake/platform/platform_win32_msvc.cmake
index eaa6e41c9c3..2772944214b 100644
--- a/build_files/cmake/platform/platform_win32_msvc.cmake
+++ b/build_files/cmake/platform/platform_win32_msvc.cmake
@@ -471,3 +471,15 @@ endif()
 
 # used in many places so include globally, like OpenGL
 blender_include_dirs_sys("${PTHREADS_INCLUDE_DIRS}")
+
+#find signtool  
+SET(ProgramFilesX86_NAME "ProgramFiles(x86)") #env dislikes the ( ) 
+find_program(SIGNTOOL_EXE signtool
+HINTS
+  "$ENV{${ProgramFilesX86_NAME}}/Windows Kits/10/bin/x86/"
+  "$ENV{ProgramFiles}/Windows Kits/10/bin/x86/"
+  "$ENV{${ProgramFilesX86_NAME}}/Windows Kits/8.1/bin/x86/"
+  "$ENV{ProgramFiles}/Windows Kits/8.1/bin/x86/"
+  "$ENV{${ProgramFilesX86_NAME}}/Windows Kits/8.0/bin/x86/"
+  "$ENV{ProgramFiles}/Windows Kits/8.0/bin/x86/"
+)