Code-signing MSI installers? Support hooks in msi: stanza?

[levinalex-samedi]

Hi,

I want to use goreleaser-pro to simplify our home-grown release scripts. We ship windows binaries and msi installers.

We use osslsigncode to sign those binaries. It was straightforward to add signing of exe files using post-build hooks:

build:
  - id: ...
    hooks:
      post:
        - cmd: codesign "{{ .Path }}"
          output: true
          if: '{{ index .Env "CODESIGN" }}'

I want to also sign our installers. But the msi stanza does not support hooks.

Should it support hooks? What would be a way to release codesigned MSI files?

[caarlos0]

its on my todo list to support signing MSIs natively, but maybe adding hooks is enough? 🤔

[levinalex-samedi]

Hooks are at least a useful escape hatch to add additional functionality. They certainly would be enough for me.

Right now I think am kind of stuck because there doesn't seem to be an alternative place to call that signing script from.