async function unpack(packager: PlatformPackager<any>, out: string, platform: string, options: any) {
  const dist = packager.config.electronDist
  if (dist == null) {
    const zipPath = (await BluebirdPromise.all<any>([
      downloadElectron(options),
      emptyDir(out)
    ]))[0]

    await spawn(path7za, debug7zArgs("x").concat(zipPath, `-o${out}`))
  }
  else {
    const source = packager.getElectronSrcDir(dist)
    const destination = packager.getElectronDestDir(out)
    log(`Copying Electron from "${source}" to "${destination}"`)
    await emptyDir(out)
    await copyDir(source, destination)
  }

  if (platform === "linux") {
    // https://github.com/electron-userland/electron-builder/issues/786
    // fix dir permissions — opposite to extract-zip, 7za creates dir with no-access for other users, but dir must be readable for non-root users
    await BluebirdPromise.all([
      chmod(path.join(out, "locales"), "0755"),
      chmod(path.join(out, "resources"), "0755")
    ])
  }
}

export async function buildInstaller(options: SquirrelOptions, outputDirectory: string, setupExe: string, packager: WinPackager, appOutDir: string, outDir: string, arch: Arch) {
  const appUpdate = await packager.getTempFile("Update.exe")
  await BluebirdPromise.all([
    copyFile(path.join(options.vendorPath, "Update.exe"), appUpdate)
      .then(() => packager.sign(appUpdate)),
    BluebirdPromise.all([remove(`${outputDirectory.replace(/\\/g, "/")}/*-full.nupkg`), remove(path.join(outputDirectory, "RELEASES"))])
      .then(() => ensureDir(outputDirectory))
  ])

  if (options.remoteReleases) {
    await syncReleases(outputDirectory, options)
  }

  const embeddedArchiveFile = await packager.getTempFile("setup.zip")
  const embeddedArchive = archiver("zip", {zlib: {level: options.packageCompressionLevel == null ? 6 : options.packageCompressionLevel}})
  const embeddedArchiveOut = createWriteStream(embeddedArchiveFile)
  const embeddedArchivePromise = new BluebirdPromise((resolve, reject) => {
    embeddedArchive.on("error", reject)
    embeddedArchiveOut.on("close", resolve)
  })
  embeddedArchive.pipe(embeddedArchiveOut)

  embeddedArchive.file(appUpdate, {name: "Update.exe"})
  embeddedArchive.file(options.loadingGif ? path.resolve(packager.projectDir, options.loadingGif) : path.join(options.vendorPath, "install-spinner.gif"), {name: "background.gif"})

  const version = convertVersion(options.version)
  const packageName = `${options.name}-${version}-full.nupkg`
  const nupkgPath = path.join(outputDirectory, packageName)
  const setupPath = path.join(outputDirectory, setupExe)

  await BluebirdPromise.all<any>([
    pack(options, appOutDir, appUpdate, nupkgPath, version, packager),
    copyFile(path.join(options.vendorPath, "Setup.exe"), setupPath),
  ])

  embeddedArchive.file(nupkgPath, {name: packageName})

  const releaseEntry = await releasify(options, nupkgPath, outputDirectory, packageName)

  embeddedArchive.append(releaseEntry, {name: "RELEASES"})
  embeddedArchive.finalize()
  await embeddedArchivePromise

  await execWine(path.join(options.vendorPath, "WriteZipToSetup.exe"), [setupPath, embeddedArchiveFile])

  await packager.signAndEditResources(setupPath, arch, outDir)
  if (options.msi && process.platform === "win32") {
    const outFile = setupExe.replace(".exe", ".msi")
    await msi(options, nupkgPath, setupPath, outputDirectory, outFile)
    // rcedit can only edit .exe resources
    await packager.sign(path.join(outputDirectory, outFile))
  }
}

  packed: async context => {
    const pkgPath = path.join(context.outDir, "Test App ßW-1.1.0.pkg")
    const fileList = pathSorter(parseFileList(await exec("pkgutil", ["--payload-files", pkgPath]), false))
    expect(fileList).toMatchSnapshot()

    const unpackedDir = path.join(context.outDir, "pkg-unpacked")
    await exec("pkgutil", ["--expand", pkgPath, unpackedDir])

    const m: any = BluebirdPromise.promisify(parseString)
    const info = await m(await readFile(path.join(unpackedDir, "Distribution"), "utf8"), {
      explicitRoot: false,
      explicitArray: false,
      mergeAttrs: true,
    })
    delete info["pkg-ref"][0]["bundle-version"].bundle.CFBundleVersion
    delete info["pkg-ref"][1].installKBytes
    delete info.product.version
    expect(info).toMatchSnapshot()

    const scriptDir = path.join(unpackedDir, "org.electron-builder.testApp.pkg", "Scripts")
    await BluebirdPromise.all([
      assertThat(path.join(scriptDir, "postinstall")).isFile(),
      assertThat(path.join(scriptDir, "preinstall")).isFile(),
    ])
  }

 packed: context => {
   const resources = path.join(context.getResources(Platform.LINUX), "app")
   return BluebirdPromise.all([
     assertThat(path.join(resources, "ignoreMe")).doesNotExist(),
     assertThat(path.join(resources, "ignoreEmptyDir")).doesNotExist(),
   ])
 },

  async prepareWine(wineDir: string) {
    await emptyDir(wineDir)
    //noinspection SpellCheckingInspection
    const env = Object.assign({}, process.env, {
      WINEDLLOVERRIDES: "winemenubuilder.exe=d",
      WINEPREFIX: wineDir
    })

    await exec("wineboot", ["--init"], {env: env})

    // regedit often doesn't modify correctly
    let systemReg = await readFile(path.join(wineDir, "system.reg"), "utf8")
    systemReg = systemReg.replace('"CSDVersion"="Service Pack 3"', '"CSDVersion"=" "')
    systemReg = systemReg.replace('"CurrentBuildNumber"="2600"', '"CurrentBuildNumber"="10240"')
    systemReg = systemReg.replace('"CurrentVersion"="5.1"', '"CurrentVersion"="10.0"')
    systemReg = systemReg.replace('"ProductName"="Microsoft Windows XP"', '"ProductName"="Microsoft Windows 10"')
    systemReg = systemReg.replace('"CSDVersion"=dword:00000300', '"CSDVersion"=dword:00000000')
    await writeFile(path.join(wineDir, "system.reg"), systemReg)

    // remove links to host OS
    const desktopDir = path.join(this.userDir, "Desktop")
    await BluebirdPromise.all([
      unlinkIfExists(desktopDir),
      unlinkIfExists(path.join(this.userDir, "My Documents")),
      unlinkIfExists(path.join(this.userDir, "My Music")),
      unlinkIfExists(path.join(this.userDir, "My Pictures")),
      unlinkIfExists(path.join(this.userDir, "My Videos")),
    ])

    await ensureDir(desktopDir)
    return env
  }

async function deleteOldElectronVersion(): Promise<any> {
  if (!isCi) {
    return
  }

  const cacheDir = require("env-paths")("electron", {suffix: ""}).cache
  try {
    const deletePromises: Array<Promise<any>> = []
    for (const file of (await readdir(cacheDir))) {
      if (file.endsWith(".zip") && !file.includes(ELECTRON_VERSION)) {
        console.log(`Remove old electron ${file}`)
        deletePromises.push(unlink(path.join(cacheDir, file)))
      }
    }
    return await BluebirdPromise.all(deletePromises)
  }
  catch (e) {
    if (e.code === "ENOENT") {
      return []
    }
    else {
      throw e
    }
  }
}

export async function createKeychain({tmpDir, cscLink, cscKeyPassword, cscILink, cscIKeyPassword, currentDir}: CreateKeychainOptions): Promise<CodeSigningInfo> {
  // travis has correct AppleWWDRCA cert
  if (process.env.TRAVIS !== "true") {
    await bundledCertKeychainAdded.value
  }

  const keychainFile = await tmpDir.getTempFile({suffix: ".keychain", disposer: removeKeychain})

  const certLinks = [cscLink]
  if (cscILink != null) {
    certLinks.push(cscILink)
  }

  const certPaths = new Array(certLinks.length)
  const keychainPassword = randomBytes(8).toString("base64")
  const securityCommands = [
    ["create-keychain", "-p", keychainPassword, keychainFile],
    ["unlock-keychain", "-p", keychainPassword, keychainFile],
    ["set-keychain-settings", keychainFile]
  ]

  // https://stackoverflow.com/questions/42484678/codesign-keychain-gets-ignored
  // https://github.com/electron-userland/electron-builder/issues/1457
  const list = await listUserKeychains()
  if (!list.includes(keychainFile)) {
    securityCommands.push(["list-keychains", "-d", "user", "-s", keychainFile].concat(list))
  }

  await BluebirdPromise.all([
    // we do not clear downloaded files - will be removed on tmpDir cleanup automatically. not a security issue since in any case data is available as env variables and protected by password.
    BluebirdPromise.map(certLinks, (link, i) => downloadCertificate(link, tmpDir, currentDir).then(it => certPaths[i] = it)),
    BluebirdPromise.mapSeries(securityCommands, it => exec("security", it))
  ])
  return await importCerts(keychainFile, certPaths, [cscKeyPassword, cscIKeyPassword].filter(it => it != null) as Array<string>)
}

export async function installAppDeps(args: any) {
  try {
    log("electron-builder " + PACKAGE_VERSION)
  }
  catch (e) {
    // error in dev mode without babel
    if (!(e instanceof ReferenceError)) {
      throw e
    }
  }

  const projectDir = process.cwd()
  const config = await getConfig(projectDir, null, null, null)
  const muonVersion = config.muonVersion
  const results = await BluebirdPromise.all<string>([
    computeDefaultAppDirectory(projectDir, use(config.directories, it => it!.app)),
    muonVersion == null ? getElectronVersion(projectDir, config) : BluebirdPromise.resolve(muonVersion),
  ])

  // if two package.json — force full install (user wants to install/update app deps in addition to dev)
  await installOrRebuild(config, results[0], {
    frameworkInfo: {version: results[1], useCustomDist: muonVersion == null},
    platform: args.platform,
    arch: args.arch,
    productionDeps: createLazyProductionDeps(results[0]),
  }, results[0] !== projectDir)
}

  packed: async context => {
    const pkgPath = path.join(context.outDir, "Test App ßW-1.1.0.pkg")
    const fileList = pathSorter(parseFileList(await exec("pkgutil", ["--payload-files", pkgPath]), false))
    expect(fileList).toMatchSnapshot()

    const unpackedDir = path.join(context.outDir, "pkg-unpacked")
    await exec("pkgutil", ["--expand", pkgPath, unpackedDir])

    const info = parseXml(await readFile(path.join(unpackedDir, "Distribution"), "utf8"))
    for (const element of info.getElements("pkg-ref")) {
      element.removeAttribute("installKBytes")
      const bundleVersion = element.elementOrNull("bundle-version")
      if (bundleVersion != null) {
        bundleVersion.element("bundle").removeAttribute("CFBundleVersion")
      }
    }

    // delete info.product.version
    info.element("product").removeAttribute("version")

    expect(info).toMatchSnapshot()

    const scriptDir = path.join(unpackedDir, "org.electron-builder.testApp.pkg", "Scripts")
    await BluebirdPromise.all([
      assertThat(path.join(scriptDir, "postinstall")).isFile(),
      assertThat(path.join(scriptDir, "preinstall")).isFile(),
    ])
  }

    packed: async context => {
      const base = path.join(context.outDir, `${platform.buildConfigurationKey}-unpacked`)
      let resourcesDir = path.join(base, "resources")
      if (platform === Platform.MAC) {
        resourcesDir = path.join(base, "TestApp.app", "Contents", "Resources")
      }
      const appDir = path.join(resourcesDir, "app")

      await BluebirdPromise.all([
        assertThat(path.join(resourcesDir, "foo")).isDirectory(),
        assertThat(path.join(appDir, "foo")).doesNotExist(),

        assertThat(path.join(resourcesDir, "foo", "nameWithoutDot")).isFile(),
        assertThat(path.join(appDir, "foo", "nameWithoutDot")).doesNotExist(),

        assertThat(path.join(resourcesDir, "bar", "hello.txt")).isFile(),
        assertThat(path.join(resourcesDir, "bar", `${process.arch}.txt`)).isFile(),
        assertThat(path.join(appDir, "bar", `${process.arch}.txt`)).doesNotExist(),

        assertThat(path.join(resourcesDir, osName, `${process.arch}.txt`)).isFile(),
        assertThat(path.join(resourcesDir, "platformSpecificR")).isFile(),
        assertThat(path.join(resourcesDir, "ignoreMe.txt")).doesNotExist(),

        allCan(path.join(resourcesDir, "executable"), true),
        allCan(path.join(resourcesDir, "executableOnlyOwner"), true),

        allCan(path.join(resourcesDir, "bar", "hello.txt"), false),
      ])

      expect(await readFile(path.join(resourcesDir, "bar", "hello.txt"), "utf-8")).toEqual("data")
    },