build-wine: build our own pyinstaller bootloader

This seems to reduce anti-virus false positives.

based on:
Electron-Cash/Electron-Cash@1ac12e41114b509be90c75213829a73621f1610e
Electron-Cash/Electron-Cash@9726498e95166801ac1e6326ae5833b965df72e3
Electron-Cash/Electron-Cash@40b1139d67013b90b983dc3f9185a771d38e57ff

contrib/build-wine/prepare-wine.sh

@@ -13,6 +13,10 @@ LIBUSB_FILENAME=libusb-1.0.22.7z
 LIBUSB_URL=https://prdownloads.sourceforge.net/project/libusb/libusb-1.0/libusb-1.0.22/$LIBUSB_FILENAME?download
 LIBUSB_SHA256=671f1a420757b4480e7fadc8313d6fb3cbb75ca00934c417c1efa6e77fb8779b
 
+PYINSTALLER_REPO="https://github.com/SomberNight/pyinstaller.git"
+PYINSTALLER_COMMIT=d1cdd726d6a9edc70150d5302453fb90fdd09bf2
+# ^ tag 3.4, plus a custom commit that fixes cross-compilation with MinGW
+
 PYTHON_VERSION=3.6.8
 
 ## These settings probably don't need change
@@ -56,9 +60,6 @@ info "Installing dependencies specific to binaries."
 # note that this also installs pinned versions of both pip and setuptools
 $PYTHON -m pip install -r "$CONTRIB"/deterministic-build/requirements-binaries.txt
 
-info "Installing PyInstaller."
-$PYTHON -m pip install pyinstaller==3.4 --no-use-pep517
-
 info "Installing ZBar."
 download_if_not_exist "$CACHEDIR/$ZBAR_FILENAME" "$ZBAR_URL"
 verify_hash "$CACHEDIR/$ZBAR_FILENAME" "$ZBAR_SHA256"
@@ -78,4 +79,34 @@ cp libusb/MS32/dll/libusb-1.0.dll $WINEPREFIX/drive_c/$PYTHON_FOLDER/
 mkdir -p $WINEPREFIX/drive_c/tmp
 cp "$CACHEDIR/secp256k1/libsecp256k1.dll" $WINEPREFIX/drive_c/tmp/
 
+
+info "Building PyInstaller."
+# we build our own PyInstaller boot loader as the default one has high
+# anti-virus false positives
+(
+    cd "$WINEPREFIX/drive_c/electrum"
+    ELECTRUM_COMMIT_HASH=$(git rev-parse HEAD)
+    cd "$CACHEDIR"
+    rm -rf pyinstaller
+    mkdir pyinstaller
+    cd pyinstaller
+    # Shallow clone
+    git init
+    git remote add origin $PYINSTALLER_REPO
+    git fetch --depth 1 origin $PYINSTALLER_COMMIT
+    git checkout FETCH_HEAD
+    rm -fv PyInstaller/bootloader/Windows-*/run*.exe || true
+    # add reproducible randomness. this ensures we build a different bootloader for each commit.
+    # if we built the same one for all releases, that might also get anti-virus false positives
+    echo "const char *electrum_tag = \"tagged by Electrum@$ELECTRUM_COMMIT_HASH\";" >> ./bootloader/src/pyi_main.c
+    pushd bootloader
+    # cross-compile to Windows using host python
+    python3 ./waf all CC=i686-w64-mingw32-gcc CFLAGS="-Wno-stringop-overflow -static"
+    popd
+    # sanity check bootloader is there:
+    [[ -e PyInstaller/bootloader/Windows-32bit/runw.exe ]] || fail "Could not find runw.exe in target dir!"
+) || fail "PyInstaller build failed"
+info "Installing PyInstaller."
+$PYTHON -m pip install ./pyinstaller
+
 info "Wine is configured."