= Building The Windows Client =

Windows licensing means we can't just simply provide a build vm via vagrant as
we've done for linux.  So there's more hoops to jump through here, but it's as
automated as possible.

== Building Templates ==

First you need to make sdists from the GRR source (which requires a protobuf compiler) and get them to the windows build machine. We do this on linux with this script which uses google cloud storage to copy the files to the windows machine (note you'll need to use a different cloud storage bucket name):

----
BUCKET=mybucketname scripts/make_sdist_for_templates.sh
----

On your Windows/VM with git and the Google cloud SDK installed, run this as admin:

----
mkdir C:\grr_src
git clone https://github.com/google/grr.git C:\grr_src
C:\grr_src\vagrant\windows\install_for_build.bat
----

Then as a regular user you can download the sdists and build the templates from that:

----
C:\Python27-x64\python.exe C:\grr_src\vagrant\windows\build_windows_templates.py --grr_src=C:\grr_src --cloud_storage_sdist_bucket=mybucketname --cloud_storage_output_bucket=mybucketname
----

Download the built templates and components from cloud storage to your linux vm ready for repacking. Put them under `grr/executables/windows/templates`.

== Setting Up For Windows EXE Signing ==

To make automation easier we now sign the windows installer executable on linux
using osslsigncode.  To set up for signing, install osslsigncode:

----
sudo apt-get install libcurl4-openssl-dev
wget http://downloads.sourceforge.net/project/osslsigncode/osslsigncode/osslsigncode-1.7.1.tar.gz
tar zxvf osslsigncode-1.7.1.tar.gz
cd osslsigncode-1.7.1/
./configure
make
sudo make install
----

Get your signing key into the .pvk and .spc format, example commands below (will
vary based on who you buy the signing cert from):
----
openssl pkcs12 -in authenticode.pfx -nocerts -nodes -out key.pem
openssl rsa -in key.pem -outform PVK -pvk-strong -out authenticode.pvk
openssl pkcs12 -in authenticode.pfx -nokeys -nodes -out cert.pem
cat Thawte_Primary_Root_CA_Cross.cer >> cert.pem
openssl crl2pkcs7 -nocrl -certfile cert.pem -outform DER -out authenticode.spc
shred -u key.pem
----

Link to wherever your key lives. This allows you to keep it on removable media
and have different people use different keys with the same grr config.
----
sudo ln -s /path/to/authenticode.pvk /etc/alternatives/grr_windows_signing_key
sudo ln -s /path/to/authenticode.spc /etc/alternatives/grr_windows_signing_cert
----
