CHEF-5815: Update signing method for msi packages (uses smctl now)

.expeditor/adhoc-canary.omnibus.yml

@@ -75,9 +75,9 @@ builder-to-testers-map:
     - ubuntu-18.04-x86_64
     - ubuntu-20.04-x86_64
     - ubuntu-22.04-x86_64
-  windows-2012r2-x86_64:
+  windows-2022-x86_64:
     - windows-2012-x86_64
-    - windows-2012r2-x86_64
+    # - windows-2012r2-x86_64
     - windows-2016-x86_64
     - windows-2019-x86_64
     - windows-2022-x86_64

.expeditor/config.yml

@@ -48,7 +48,8 @@ pipelines:
         - ADHOC: true
         - IGNORE_CACHE: true
         - OMNIBUS_BUILDKITE_PLUGIN_VERSION: 3db0e86c940ba974612912e38333e498e26e4df8
-        - OMNIBUS_USE_INTERNAL_SOURCES: true
+        - OMNIBUS_USE_INTERNAL_SOURCES: false
+        - IGNORE_ARTIFACTORY_RUBY_PROXY: true
   - omnibus/angry-adhoc-canary:
       canary: true
       definition: .expeditor/angry-adhoc-canary.omnibus.yml

CHANGELOG.md

@@ -2,10 +2,18 @@ omnibus-toolchain CHANGELOG
 ==========================
 This file is used to list changes made in each version of the omnibus-toolchain.
 
-<!-- latest_release -->
+<!-- latest_release 3.0.18 -->
+## [3.0.18](https://github.com/chef/omnibus-toolchain/tree/3.0.18) (2023-09-25)
+
+#### Merged Pull Requests
+- Bump omnibus from `d6d4b0d` to `56015cb` [#248](https://github.com/chef/omnibus-toolchain/pull/248) ([dependabot[bot]](https://github.com/dependabot[bot]))
 <!-- latest_release -->
 
-<!-- release_rollup -->
+<!-- release_rollup since=3.0.17 -->
+### Changes since 3.0.17 release
+
+#### Merged Pull Requests
+- Bump omnibus from `d6d4b0d` to `56015cb` [#248](https://github.com/chef/omnibus-toolchain/pull/248) ([dependabot[bot]](https://github.com/dependabot[bot])) <!-- 3.0.18 -->
 <!-- release_rollup -->
 
 <!-- latest_stable_release -->

Gemfile

@@ -1,6 +1,7 @@
 source 'https://rubygems.org'
 
-gem "omnibus", github: ENV.fetch("OMNIBUS_GITHUB_REPO", "chef/omnibus"), branch: ENV.fetch("OMNIBUS_GITHUB_BRANCH", "main")
+# gem "omnibus", github: ENV.fetch("OMNIBUS_GITHUB_REPO", "chef/omnibus"), branch: ENV.fetch("OMNIBUS_GITHUB_BRANCH", "main")
+gem "omnibus", git: "https://github.com/chef/omnibus.git", branch: "ss/signing-cmd-requires-admin-privileges"
 gem "omnibus-software", github: ENV.fetch("OMNIBUS_SOFTWARE_GITHUB_REPO", "chef/omnibus-software"), branch: ENV.fetch("OMNIBUS_SOFTWARE_GITHUB_BRANCH", "main")
 gem 'artifactory'
 

Gemfile.lock

@@ -8,10 +8,10 @@ GIT
 
 GIT
   remote: https://github.com/chef/omnibus.git
-  revision: d6d4b0db7ada4815a8f2c6c381409de7a73b8798
-  branch: main
+  revision: b634c4deda6e07bf08504e4456b0b7bb5c20c076
+  branch: ss/signing-cmd-requires-admin-privileges
   specs:
-    omnibus (9.0.22)
+    omnibus (9.0.23)
       aws-sdk-s3 (~> 1.116.0)
       chef-cleanroom (~> 1.0)
       chef-utils (>= 15.4)
@@ -35,14 +35,14 @@ GEM
     ast (2.4.2)
     awesome_print (1.9.2)
     aws-eventstream (1.2.0)
-    aws-partitions (1.805.0)
-    aws-sdk-core (3.180.3)
+    aws-partitions (1.830.0)
+    aws-sdk-core (3.184.0)
       aws-eventstream (~> 1, >= 1.0.2)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.5)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.71.0)
-      aws-sdk-core (~> 3, >= 3.177.0)
+    aws-sdk-kms (1.72.0)
+      aws-sdk-core (~> 3, >= 3.184.0)
       aws-sigv4 (~> 1.1)
     aws-sdk-s3 (1.116.0)
       aws-sdk-core (~> 3, >= 3.127.0)
@@ -53,14 +53,14 @@ GEM
     bcrypt_pbkdf (1.1.0)
     builder (3.2.4)
     chef-cleanroom (1.0.5)
-    chef-config (18.2.7)
+    chef-config (18.3.0)
       addressable
-      chef-utils (= 18.2.7)
+      chef-utils (= 18.3.0)
       fuzzyurl
       mixlib-config (>= 2.2.12, < 4.0)
       mixlib-shellout (>= 2.0, < 4.0)
       tomlrb (~> 1.2)
-    chef-utils (18.2.7)
+    chef-utils (18.3.0)
       concurrent-ruby
     chefstyle (2.2.2)
       rubocop (= 1.25.1)
@@ -69,7 +69,7 @@ GEM
     contracts (0.16.1)
     ed25519 (1.3.0)
     erubi (1.12.0)
-    ffi (1.15.5)
+    ffi (1.16.1)
     ffi-yajl (2.6.0)
       libyajl2 (>= 1.2)
     fuzzyurl (0.9.0)
@@ -236,6 +236,7 @@ GEM
 PLATFORMS
   aarch64-linux
   arm64-darwin-20
+  arm64-darwin-21
   powerpc-aix-7
   powerpc64-linux
   powerpc64le-linux
@@ -259,4 +260,4 @@ DEPENDENCIES
   winrm-fs
 
 BUNDLED WITH
-   2.3.26
+   2.4.13

VERSION

@@ -1 +1 @@
-3.0.17
+3.0.18

config/projects/omnibus-toolchain.rb

@@ -109,10 +109,10 @@
   upgrade_code msi_upgrade_code
   wix_candle_extension "WixUtilExtension"
   wix_light_extension "WixUtilExtension"
-  signing_identity "13B510D1CF1B3467856A064F1BEA12D0884D2528", machine_store: true
+  signing_identity "769E6AF679126F184850AAC7C5C823A80DB3ADAA", machine_store: false, keypair_alias: "key_495941360"
   parameters ProjectLocationDir: project_location_dir
 end
 
 package :appx do
-  signing_identity "13B510D1CF1B3467856A064F1BEA12D0884D2528", machine_store: true
+  signing_identity "769E6AF679126F184850AAC7C5C823A80DB3ADAA", machine_store: false, keypair_alias: "key_495941360"
 end

omnibus-test.ps1

@@ -5,6 +5,9 @@ $Env:PATH = "C:\opscode\$Env:PRODUCT\embedded\bin;$Env:PATH"
 
 $embedded_bin_dir = "C:\opscode\$Env:PRODUCT\embedded\bin"
 
+# sync certs $
+smctl windows certsync --keypair-alias=key_495941360
+
 # Exercise various packaged tools to validate binstub shebangs
 & $embedded_bin_dir\ruby --version
 If ($lastexitcode -ne 0) { Throw $lastexitcode }

omnibus.rb

@@ -34,11 +34,11 @@
 env_omnibus_windows_arch = :x86 unless %w{x86 x64}.include?(env_omnibus_windows_arch)
 
 windows_arch   env_omnibus_windows_arch
-#use_internal_sources ENV.fetch("OMNIBUS_USE_INTERNAL_SOURCES", false)
+use_internal_sources ENV.fetch("OMNIBUS_USE_INTERNAL_SOURCES", false)
 
 # Enable S3 asset caching
 # ------------------------------
-use_s3_caching true
+use_s3_caching false
 s3_access_key  ENV['AWS_ACCESS_KEY_ID']
 s3_secret_key  ENV['AWS_SECRET_ACCESS_KEY']
 s3_bucket      'opscode-omnibus-cache'