Merge branch 'master' into jgrpp-beta

# Conflicts:
#	.github/workflows/commit-checker.yml
#	src/company_cmd.cpp
#	src/console_cmds.cpp
#	src/crashlog.cpp
#	src/lang/english.txt
#	src/lang/german.txt
#	src/lang/indonesian.txt
#	src/lang/japanese.txt
#	src/lang/korean.txt
#	src/lang/swedish.txt
#	src/linkgraph/linkgraphjob.cpp
#	src/linkgraph/mcf.cpp
#	src/network/core/tcp.cpp
#	src/network/core/tcp.h
#	src/network/core/tcp_game.h
#	src/network/core/udp.h
#	src/network/network.cpp
#	src/network/network_admin.cpp
#	src/network/network_admin.h
#	src/network/network_chat_gui.cpp
#	src/network/network_client.cpp
#	src/network/network_client.h
#	src/network/network_func.h
#	src/network/network_internal.h
#	src/network/network_server.cpp
#	src/network/network_server.h
#	src/newgrf.cpp
#	src/newgrf_station.cpp
#	src/order_gui.cpp
#	src/rail_cmd.cpp
#	src/saveload/saveload.cpp
#	src/settings.cpp
#	src/settings_gui.cpp
#	src/settings_internal.h
#	src/settings_type.h
#	src/station_cmd.cpp
#	src/stdafx.h
#	src/table/currency_settings.ini
#	src/table/misc_settings.ini
#	src/table/settings.h.preamble
#	src/table/settings.ini
#	src/terraform_cmd.cpp
#	src/timetable_gui.cpp
#	src/train_cmd.cpp
#	src/tree_cmd.cpp
#	src/water_cmd.cpp

.github/workflows/release.yml

@@ -750,6 +750,21 @@ jobs:
       with:
         arch: ${{ matrix.host }}
 
+    - name: Import code signing certificate
+      shell: powershell
+      # If this is run on a fork, there may not be a certificate set up - continue in this case
+      continue-on-error: true
+      run: |
+        $tempFile = [System.IO.Path]::GetTempFileName()
+        $bytes = [System.Convert]::FromBase64String($env:WINDOWS_CERTIFICATE_P12)
+        [IO.File]::WriteAllBytes($tempFile, $bytes)
+        $pwd = ConvertTo-SecureString $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force
+        Import-PfxCertificate -FilePath $tempFile -CertStoreLocation Cert:\CurrentUser\My -Password $pwd
+        Remove-Item $tempFile
+      env:
+        WINDOWS_CERTIFICATE_P12: ${{ secrets.WINDOWS_CERTIFICATE_P12 }}
+        WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+
     - name: Build (with installer)
       if: needs.source.outputs.is_tag == 'true'
       shell: bash
@@ -765,12 +780,15 @@ jobs:
           -DOPTION_USE_NSIS=ON \
           -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \
           -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DWINDOWS_CERTIFICATE_COMMON_NAME="${WINDOWS_CERTIFICATE_COMMON_NAME}" \
           # EOF
         echo "::endgroup::"
 
         echo "::group::Build"
         cmake --build .
         echo "::endgroup::"
+      env:
+        WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }}
 
     - name: Build (without installer)
       if: needs.source.outputs.is_tag != 'true'
@@ -786,12 +804,15 @@ jobs:
           -DCMAKE_TOOLCHAIN_FILE="c:\vcpkg\scripts\buildsystems\vcpkg.cmake" \
           -DHOST_BINARY_DIR=${GITHUB_WORKSPACE}/build-host \
           -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+          -DWINDOWS_CERTIFICATE_COMMON_NAME="${WINDOWS_CERTIFICATE_COMMON_NAME}" \
           # EOF
         echo "::endgroup::"
 
         echo "::group::Build"
         cmake --build .
         echo "::endgroup::"
+      env:
+        WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }}
 
     - name: Create bundles
       shell: bash
@@ -813,6 +834,17 @@ jobs:
         rm -f bundles/*.sha256
         echo "::endgroup::"
 
+    - name: Sign installer
+      if: needs.source.outputs.is_tag == 'true'
+      shell: bash
+      # If this is run on a fork, there may not be a certificate set up - continue in this case
+      continue-on-error: true
+      run: |
+        cd ${GITHUB_WORKSPACE}/build/bundles
+        ../../os/windows/sign.bat *.exe "${WINDOWS_CERTIFICATE_COMMON_NAME}"
+      env:
+        WINDOWS_CERTIFICATE_COMMON_NAME: ${{ secrets.WINDOWS_CERTIFICATE_COMMON_NAME }}
+
     - name: Store bundles
       uses: actions/upload-artifact@v2
       with: