fix: bundle modern ConPTY on Windows (#1828)

refs #1533
refs #1644

1 files changed, 53 insertions, 0 deletions

diff --git a/scripts/package_windows_conpty.ps1 b/scripts/package_windows_conpty.ps1
new file mode 100644
index 00000000..a94b609e
--- /dev/null
+++ b/scripts/package_windows_conpty.ps1
@@ -0,0 +1,53 @@
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$HerdrExe,
+
+    [Parameter(Mandatory = $true)]
+    [string]$PackagePath,
+
+    [Parameter(Mandatory = $true)]
+    [string]$StageDir,
+
+    [Parameter(Mandatory = $true)]
+    [string]$OutputPath
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+function Invoke-NativeChecked {
+    param(
+        [string]$Command,
+        [string[]]$Arguments
+    )
+
+    & $Command @Arguments
+    if ($LASTEXITCODE -ne 0) {
+        throw "$Command failed with exit code $LASTEXITCODE"
+    }
+}
+
+$packager = Join-Path $PSScriptRoot "package_windows_conpty.py"
+Invoke-NativeChecked python @(
+    $packager,
+    "stage",
+    "--package", $PackagePath,
+    "--herdr-exe", $HerdrExe,
+    "--output-dir", $StageDir
+)
+Invoke-NativeChecked dotnet @("nuget", "verify", "--all", $PackagePath)
+
+foreach ($relative in @("conpty\conpty.dll", "conpty\x64\OpenConsole.exe", "conpty\arm64\OpenConsole.exe")) {
+    $signature = Get-AuthenticodeSignature (Join-Path $StageDir $relative)
+    $subject = if ($null -eq $signature.SignerCertificate) { "" } else { $signature.SignerCertificate.Subject }
+    if ($signature.Status -ne "Valid" -or $subject -notlike "*Microsoft Corporation*") {
+        throw "Invalid Microsoft signature for $relative`: $($signature.Status) $subject"
+    }
+}
+
+Invoke-NativeChecked python @(
+    $packager,
+    "archive",
+    "--stage-dir", $StageDir,
+    "--output", $OutputPath
+)