Skip to content

Commit a4e3f6c

Browse files
fdennisfdennis
committed
Merge PR #714 
2 parents fcf206a + b628be2 commit a4e3f6c

File tree

4 files changed

+199
-0
lines changed

4 files changed

+199
-0
lines changed

‎.github/scribe-sign-exe-dll.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
stub: ykman
2+
releaseType: public
3+
jobs:
4+
- name: sign-source
5+
platform: linux
6+
steps:
7+
- id: 1
8+
action: windows
9+
description: YubiKey Manager
10+
files:
11+
- ykman-builds-windows/ykman/ykman.exe
12+
- ykman-builds-windows/ykman/_internal/pywin32_system32/pythoncom314.dll
13+
- ykman-builds-windows/ykman/_internal/pywin32_system32/pywintypes314.dll

‎.github/scribe-sign-msi.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
stub: ykman
2+
releaseType: public
3+
jobs:
4+
- name: sign-source
5+
platform: linux
6+
steps:
7+
- id: 1
8+
action: windows
9+
description: YubiKey Manager
10+
files:
11+
- ykman-builds-windows/ykman-installer-windows/ykman.msi

‎.github/workflows/windows.yml‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,3 +73,163 @@ jobs:
7373
with:
7474
name: ykman-builds-windows
7575
path: dist
76+
77+
sign-exe-dll:
78+
if: startsWith(github.ref, 'refs/tags/')
79+
needs: [build]
80+
runs-on: ubuntu-latest
81+
steps:
82+
- name: Check tag format
83+
run: |
84+
if [[ "${GITHUB_REF}" =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+-rc\.[0-9]+$ ]]; then
85+
echo "Tag matches format"
86+
else
87+
echo "Invalid tag format"
88+
exit 1
89+
fi
90+
91+
- uses: actions/checkout@v6
92+
93+
- name: download artifacts
94+
uses: actions/download-artifact@v5
95+
with:
96+
path: ykman-builds-windows
97+
98+
- name: docker login
99+
uses: docker/login-action@v3
100+
with:
101+
registry: ghcr.io
102+
username: ci@yubico.com
103+
password: ${{ secrets.GITHUB_TOKEN }}
104+
105+
- name: write service account credentials
106+
env:
107+
GAC: ${{ secrets.SCRIBE_SA }}
108+
run: |
109+
echo "${GAC}" > scribe_sa.json
110+
echo "GOOGLE_APPLICATION_CREDENTIALS=/scribe/scribe_sa.json" >> $GITHUB_ENV
111+
112+
- name: run scribe sign exe and dlls
113+
run: >
114+
docker run
115+
--user $(id -u):$(id -g)
116+
--volume $(pwd):/scribe
117+
--env-file <(env)
118+
ghcr.io/yubico/scribe-ci:v1
119+
--project-id scribe-prod-987134
120+
--bucket scribe-u-pub-ykman-fqj0hy
121+
--config /scribe/.github/scribe-sign-exe-dll.yml
122+
submit .
123+
--synchronous
124+
--download-artifacts
125+
126+
- name: unpack signed exe and dlls
127+
run: |
128+
mkdir -p signed
129+
mv scribe-download/*/sign-source/1.zip signed/
130+
rm -rf scribe-download
131+
cd signed
132+
unzip -j 1.zip || true
133+
rm 1.zip
134+
cd ..
135+
cp signed/ykman.exe ykman-builds-windows/ykman/ykman.exe
136+
cp signed/pythoncom314.dll ykman-builds-windows/ykman/_internal/pywin32_system32/pythoncom314.dll
137+
cp signed/pywintypes314.dll ykman-builds-windows/ykman/_internal/pywin32_system32/pywintypes314.dll
138+
139+
- name: upload signed artifacts
140+
uses: actions/upload-artifact@v4
141+
with:
142+
name: signed-files
143+
path: ykman-builds-windows
144+
145+
build-msi:
146+
needs: [sign-exe-dll]
147+
runs-on: windows-latest
148+
steps:
149+
- uses: actions/checkout@v6
150+
151+
- name: download artifacts
152+
uses: actions/download-artifact@v5
153+
with:
154+
path: ykman-builds-windows
155+
156+
- name: Build installer
157+
working-directory: .\ykman-builds-windows\signed-files\
158+
run: .\scripts\make_msi.ps1
159+
160+
- name: Upload installer
161+
uses: actions/upload-artifact@v4
162+
with:
163+
name: ykman-installer-windows
164+
path: .\ykman-builds-windows\signed-files\
165+
166+
sign-msi:
167+
needs: [build-msi]
168+
runs-on: ubuntu-latest
169+
steps:
170+
- name: checkout repo
171+
uses: actions/checkout@v6
172+
173+
- name: download artifacts
174+
uses: actions/download-artifact@v5
175+
with:
176+
path: ykman-builds-windows
177+
178+
- name: docker login
179+
uses: docker/login-action@v3
180+
with:
181+
registry: ghcr.io
182+
username: ci@yubico.com
183+
password: ${{ secrets.GITHUB_TOKEN }}
184+
185+
- name: write service account credentials
186+
env:
187+
GAC: ${{ secrets.SCRIBE_SA }}
188+
run: |
189+
echo "${GAC}" > scribe_sa.json
190+
echo "GOOGLE_APPLICATION_CREDENTIALS=/scribe/scribe_sa.json" >> $GITHUB_ENV
191+
192+
- name: run scribe sign msi
193+
run: >
194+
docker run
195+
--user $(id -u):$(id -g)
196+
--volume $(pwd):/scribe
197+
--env-file <(env)
198+
ghcr.io/yubico/scribe-ci:v1
199+
--project-id scribe-prod-987134
200+
--bucket scribe-u-pub-ykman-fqj0hy
201+
--config /scribe/.github/scribe-sign-msi.yml
202+
submit .
203+
--synchronous
204+
--download-artifacts
205+
206+
- name: unpack signed msi
207+
run: |
208+
mkdir -p signed
209+
mv scribe-download/*/sign-source/1.zip signed/
210+
rm -rf scribe-download
211+
cd signed
212+
unzip -j 1.zip || true
213+
rm 1.zip
214+
cd ..
215+
cp signed/ykman.msi ykman-builds-windows/ykman-installer-windows/ykman.msi
216+
217+
- name: upload signed artifacts
218+
uses: actions/upload-artifact@v4
219+
with:
220+
name: signed-files-and-msi
221+
path: ykman-builds-windows/ykman-installer-windows
222+
223+
verify-signatures:
224+
needs: [sign-msi]
225+
runs-on: windows-latest
226+
steps:
227+
- name: Download artifacts
228+
uses: actions/download-artifact@v5
229+
with:
230+
name: signed-files-and-msi
231+
path: ykman-builds-windows/ykman-installer-windows
232+
233+
- name: Check for unsigned DLLs
234+
working-directory: .\ykman-builds-windows\ykman-installer-windows
235+
run: .\scripts\verify_dll.ps1

‎resources/win/verify_dll.ps1‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Set-PSDebug -Trace 1
2+
3+
$ErrorActionPreference = "Stop"
4+
5+
$unsignedDlls = Get-ChildItem -Path "ykman" -Recurse -Filter *.dll |
6+
Where-Object { (Get-AuthenticodeSignature $_.FullName).Status -ne 'Valid' } |
7+
Select-Object -ExpandProperty FullName
8+
9+
if ($unsignedDlls) {
10+
Write-Host "ERROR: Found unsigned DLL(s):"
11+
$unsignedDlls | ForEach-Object { Write-Host " - $_" }
12+
exit 1
13+
} else {
14+
Write-Host "SUCCESS: All DLLs are signed."
15+
}

0 commit comments

Comments
 (0)