From 6930a6f91f63091b478283dbd2d27b6de90d53f6 Mon Sep 17 00:00:00 2001
From: Adam Brousseau <adam.brousseau88@gmail.com>
Date: Mon, 28 Jun 2021 19:20:10 -0400
Subject: [PATCH] Allow UCL sign option for Windows installer

Related adoptium/temurin-build#2525

Signed-off-by: Adam Brousseau <adam.brousseau88@gmail.com>
---
 wix/Build.OpenJDK_generic.cmd | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/wix/Build.OpenJDK_generic.cmd b/wix/Build.OpenJDK_generic.cmd
index c70cf3e25..2b6d09cb9 100644
--- a/wix/Build.OpenJDK_generic.cmd
+++ b/wix/Build.OpenJDK_generic.cmd
@@ -326,9 +326,14 @@ FOR %%A IN (%ARCH%) DO (
             for /F %%s IN (serverTimestamp.config) do (
 	        ECHO try !timestampErrors! / sha256 / timestamp server : %%s
 		REM Always hide password here
-		@ECHO OFF
-                "%ProgramFiles(x86)%\Windows Kits\%WIN_SDK_MAJOR_VERSION%\bin\%WIN_SDK_FULL_VERSION%\x64\signtool.exe" sign -f "%SIGNING_CERTIFICATE%" -p "%SIGN_PASSWORD%" -fd sha256 -d "Adoptium" -t %%s "ReleaseDir\!OUTPUT_BASE_FILENAME!.msi"
-		@ECHO ON
+        IF "%SIGN_TOOL%" == "ucl" (
+            ECHO Using UCL sign tool
+            ucl sign-code --file "ReleaseDir\!OUTPUT_BASE_FILENAME!.msi" -n WindowsSHA -t %%s --hash SHA256
+        ) ELSE (
+            @ECHO OFF
+            "%ProgramFiles(x86)%\Windows Kits\%WIN_SDK_MAJOR_VERSION%\bin\%WIN_SDK_FULL_VERSION%\x64\signtool.exe" sign -f "%SIGNING_CERTIFICATE%" -p "%SIGN_PASSWORD%" -fd sha256 -d "AdoptOpenJDK" -t %%s "ReleaseDir\!OUTPUT_BASE_FILENAME!.msi"
+            @ECHO ON
+        )
 		IF NOT "%DEBUG%" == "true" @ECHO OFF
 
                 REM check the return value of the timestamping operation and retry a max of ten times...