def OmahaCertificateTag(env, target, source):
  """Adds a superfluous certificate with a magic signature to an EXE or MSI.

  The file must be signed with Authenticode in order for Certificate Tagging to
  succeed.

  Args:
    env: The environment.
    target: Name of the certificate-tagged file.
    source: Name of the file to be certificate-tagged.

  Returns:
    Output node list from env.Command().
  """

  certificate_tag = ('"' + env['ENV']['GOROOT'] + '/bin/go.exe' + '"' +
                     ' run ' +
                     '$MAIN_DIR/../common/certificate_tag/certificate_tag.go')
  magic_bytes = 'Gact2.0Omaha'
  padded_length = len(magic_bytes) + 2 + 8192
  certificate_tag_cmd = env.Command(
      target=target,
      source=source,
      action=certificate_tag + ' -set-superfluous-cert-tag=' + magic_bytes +
      ' -padded-length=' + str(padded_length) + ' -out $TARGET $SOURCE',
  )

  return certificate_tag_cmd