Auto embed public key during build. Could only test build-ce.bat myself.

Components/TrustFunc.AllowedPublicKeys.inc

@@ -1,8 +1,10 @@
 { Inno Setup build: the second key in this file should be replaced by your
-  own.
+  own and this will happen automatically when using build.bat or build-ce.bat.
+  To ignore this change consider using Git's assume-unchanged or skip-worktree
+  functionality.
   
   Other builds: if you need only one key you can set AllowedPublicKey2Text To
-  an empty string. }
+  an empty string and remove the '//end' marker. }
 
 AllowedPublicKey1Text := '''
 format issig-public-key
@@ -18,4 +20,4 @@ key-id def020edee3c4835fd54d85eff8b66d4d899b22a777353ca4a114b652e5e7a28
 public-x 515dc7d6c16d4a46272ceb3d158c5630a96466ab4d948e72c2029d737c823097
 public-y f3c21f6b5156c52a35f6f28016ee3e31a3ded60c325b81fb7b1f88c221081a61
 
-''';
+''';//end

build-ce.bat

@@ -29,6 +29,20 @@ cd /d %~dp0
 if "%1"=="setup" goto setup
 if not "%1"=="" goto failed
 
+if not exist files\issigtool.exe (
+  echo Missing ISSigTool
+  echo Now open Projects\Projects.groupproj and build ISSigTool in Release mode
+
+  echo Waiting for file...
+  call :waitforfile files\issigtool.exe
+  echo Compiling ISSigTool done
+)
+
+call .\issig.bat embed
+if errorlevel 1 goto failed
+echo ISSigTool embed done
+
+echo.
 call :deletefile files\compil32.exe
 call :deletefile files\iscc.exe
 call :deletefile files\iscmplr.dll
@@ -38,7 +52,6 @@ call :deletefile files\setupldr.e32
 call :deletefile files\issigtool.exe
 call :deletefile ishelp\ishelpgen\ishelpgen.exe
 
-echo.
 echo Clearing compilation output done
 echo Now open Projects\Projects.groupproj and build all projects in Release mode
 
@@ -60,9 +73,9 @@ if exist .\setup-presign.bat (
   call .\setup-presign.bat Files\ISCmplr.dll Files\ISPP.dll
 )
 
-call .\issig.bat
+call .\issig.bat sign
 if errorlevel 1 goto failed
-echo ISSigTool done
+echo ISSigTool sign done
 pause
 
 cd ishelp

build.bat

@@ -48,6 +48,17 @@ if errorlevel 1 goto failed
 echo Compiling ISetup*.chm done
 pause
 
+if not exist files\issigtool.exe (
+  echo Missing ISSigTool
+  call .\compile.bat issigtool
+  if errorlevel 1 goto failed
+  echo Compiling ISSigTool done
+)
+
+call .\issig.bat embed
+if errorlevel 1 goto failed
+echo ISSigTool embed done
+
 call .\compile.bat
 if errorlevel 1 goto failed
 echo Compiling Inno Setup done
@@ -56,10 +67,10 @@ if exist .\setup-presign.bat (
   call .\setup-presign.bat Files\ISCmplr.dll Files\ISPP.dll
 ) 
 
-call .\issig.bat
+call .\issig.bat sign
 if errorlevel 1 goto failed
-echo ISSigTool done
-paue
+echo ISSigTool sign done
+pause
 
 :setup
 echo - Setup.exe

compile.bat

@@ -26,6 +26,9 @@ if "%DELPHIXEROOT%"=="" goto compilesettingserror
 
 rem -------------------------------------------------------------------------
 
+if "%1"=="issigtool" goto issigtool
+if not "%1"=="" goto failed
+
 rem  Compile each project separately because it seems Delphi
 rem  carries some settings (e.g. $APPTYPE) between projects
 rem  if multiple projects are specified on the command line.
@@ -65,11 +68,6 @@ mkdir Dcu\Setup.dpr 2>nul
 "%DELPHIXEROOT%\bin\dcc32.exe" --no-config -NSSystem;System.Win;Winapi;Vcl -Q -B -W %DELPHIXEDISABLEDWARNINGS% %1 -U"%DELPHIXEROOT%\lib\win32\release;..\Components\UniPs\Source" -E..\Files -NUDcu\Setup.dpr -DSETUPPROJ;PS_MINIVCL;PS_NOGRAPHCONST;PS_PANSICHAR;PS_NOINTERFACEGUIDBRACKETS Setup.dpr
 if errorlevel 1 goto failed
 
-echo - ISSigTool.dpr
-mkdir Dcu\ISSigTool.dpr 2>nul
-"%DELPHIXEROOT%\bin\dcc32.exe" --no-config -NSSystem;System.Win;Winapi -Q -B -H -W %DELPHIXEDISABLEDWARNINGS% %1 -U"%DELPHIXEROOT%\lib\win32\release" -E..\Files -NUDcu\ISSigTool.dpr ISSigTool.dpr
-if errorlevel 1 goto failed
-
 echo - Renaming E32 files
 cd ..\Files
 if errorlevel 1 goto failed
@@ -77,6 +75,14 @@ move SetupLdr.exe SetupLdr.e32
 if errorlevel 1 goto failed
 move Setup.exe Setup.e32
 if errorlevel 1 goto failed
+cd ..\Projects
+if errorlevel 1 goto failed
+
+:issigtool
+echo - ISSigTool.dpr
+mkdir Dcu\ISSigTool.dpr 2>nul
+"%DELPHIXEROOT%\bin\dcc32.exe" --no-config -NSSystem;System.Win;Winapi -Q -B -H -W %DELPHIXEDISABLEDWARNINGS% %1 -U"%DELPHIXEROOT%\lib\win32\release" -E..\Files -NUDcu\ISSigTool.dpr ISSigTool.dpr
+if errorlevel 1 goto failed
 
 cd ..
 if errorlevel 1 goto failed

issig.bat

@@ -5,7 +5,7 @@ rem  Copyright (C) 1997-2025 Jordan Russell
 rem  Portions by Martijn Laan
 rem  For conditions of distribution and use, see LICENSE.TXT.
 rem
-rem  Batch file to create extra .issig files required by Inno Setup
+rem  Batch file to embed the public key in TrustFunc.AllowedPublicKeys.inc (before compilation) or to create ISCmplr.dll.issig and ISPP.dll.issig (after compilation)
 
 setlocal
 
@@ -28,6 +28,30 @@ goto failed2
 
 rem -------------------------------------------------------------------------
 
+if "%1"=="embed" goto embed
+if "%1"=="sign" goto sign
+if not "%1"=="" goto failed
+
+:embed
+cd Files
+if errorlevel 1 goto failed
+set targetfile=..\Components\TrustFunc.AllowedPublicKeys.inc
+if not exist "%targetfile%" goto failed
+set publickeyfile=_temp.ispublickey
+ISSigTool export-public-key "%publickeyfile%"
+if errorlevel 1 goto failed
+if not exist "%publickeyfile%" goto failed
+powershell -NoProfile -Command "& { $filePath = '%targetfile%'; $replacementFilePath = '%publickeyfile%'; $startMarker = \"AllowedPublicKey2Text := '''\"; $endMarker = \"''';//end\"; try { $content = Get-Content -Raw -Path $filePath; $replacementText = Get-Content -Raw -Path $replacementFilePath; [string] $pattern = '(?s)' + [regex]::Escape($startMarker) + '.*?' + [regex]::Escape($endMarker); if ($content -match $pattern) { $replacement = $startMarker + \"`r`n\" + $replacementText + \"`r`n\" + $endMarker; $newContent = $content -replace $pattern, $replacement; $utf8NoBomEncoding = New-Object System.Text.UTF8Encoding($false); [System.IO.File]::WriteAllText($filePath, $newContent, $utf8NoBomEncoding); Write-Host 'Embedded key.'; } else { Write-Host 'Markers not found.'; exit 1; } } catch { Write-Error ('Error: ' + $_.Exception.Message); exit 1; } }"
+if errorlevel 1 goto failed
+del "%publickeyfile%"
+if errorlevel 1 goto failed
+cd ..
+if errorlevel 1 goto failed
+
+echo Success!
+goto exit
+
+:sign
 cd Files
 if errorlevel 1 goto failed
 ISSigTool sign ISCmplr.dll ISPP.dll