Skip to content

Commit eedbcf4

Browse files
GoncaloGarciaGoncaloGarcia
committed
TUN-9863: Introduce Code Signing for Windows Builds
* TUN-9863: Introduce Code Signing for Windows Builds This commit adds a signing step to the build script for windows binaries. Since we package the MSI on Linux, this commit adds another CI step that depends on package-windows and signs all of the windows packages. To do so, we use azuresigntool which relies on a certificate stored in Azure Vault. Closes TUN-9863
1 parent a8fdbb8 commit eedbcf4

File tree

4 files changed

+77
-8
lines changed

4 files changed

+77
-8
lines changed

‎.ci/release.gitlab-ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ release-cloudflared-to-github:
7777
- ci-image-get-image-ref
7878
- linux-packaging
7979
- linux-packaging-fips
80-
- package-windows
80+
- windows-package-sign
8181
script:
8282
- ./.ci/scripts/release-target.sh github-release
8383

‎.ci/scripts/windows/builds.ps1‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ $ProgressPreference = "SilentlyContinue"
44

55
$env:TARGET_OS = "windows"
66
$env:LOCAL_OS = "windows"
7+
$TIMESTAMP_RFC3161 = "http://timestamp.digicert.com"
78

89
New-Item -Path ".\artifacts" -ItemType Directory
910

@@ -13,6 +14,8 @@ $env:LOCAL_ARCH = "amd64"
1314
$env:CGO_ENABLED = 1
1415
& make cloudflared
1516
if ($LASTEXITCODE -ne 0) { throw "Failed to build cloudflared for amd64" }
17+
# Sign build
18+
azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\cloudflared.exe
1619
copy .\cloudflared.exe .\artifacts\cloudflared-windows-amd64.exe
1720

1821
Write-Output "Building for 386"
@@ -21,4 +24,6 @@ $env:LOCAL_ARCH = "386"
2124
$env:CGO_ENABLED = 0
2225
& make cloudflared
2326
if ($LASTEXITCODE -ne 0) { throw "Failed to build cloudflared for 386" }
27+
## Sign build
28+
azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\cloudflared.exe
2429
copy .\cloudflared.exe .\artifacts\cloudflared-windows-386.exe

‎.ci/scripts/windows/sign-msi.ps1‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Sign Windows artifacts using azuretool
2+
# This script processes MSI files from the artifacts directory
3+
4+
$ErrorActionPreference = "Stop"
5+
6+
# Define paths
7+
$ARTIFACT_DIR = "artifacts"
8+
$TIMESTAMP_RFC3161 = "http://timestamp.digicert.com"
9+
10+
Write-Host "Looking for Windows artifacts to sign in $ARTIFACT_DIR..."
11+
12+
# Find all Windows MSI files
13+
$msiFiles = Get-ChildItem -Path $ARTIFACT_DIR -Filter "cloudflared-windows-*.msi" -ErrorAction SilentlyContinue
14+
15+
if ($msiFiles.Count -eq 0) {
16+
Write-Host "No Windows MSI files found in $ARTIFACT_DIR"
17+
exit 1
18+
}
19+
20+
Write-Host "Found $($msiFiles.Count) file(s) to sign:"
21+
foreach ($file in $msiFiles) {
22+
Write-Host "Running azuretool sign for $($file.Name)"
23+
azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\\$ARTIFACT_DIR\\$($file.Name)
24+
}
25+
26+
Write-Host "Signing process completed"

‎.ci/windows.gitlab-ci.yml‎

Lines changed: 45 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ include:
1414
##########################################
1515
### Build Cloudflared Windows Binaries ###
1616
##########################################
17-
build-cloudflared-windows:
17+
windows-build-cloudflared:
1818
<<: *windows-build-defaults
1919
stage: build
2020
script:
@@ -26,7 +26,7 @@ build-cloudflared-windows:
2626
######################################################
2727
### Load Environment Variables for Component Tests ###
2828
######################################################
29-
load-windows-env-variables:
29+
windows-load-env-variables:
3030
stage: pre-build
3131
extends: .component-tests
3232
script:
@@ -35,8 +35,29 @@ load-windows-env-variables:
3535
- echo "DNS_API_TOKEN=$DNS_API_TOKEN" >> windows.env
3636
# We have to encode the `COMPONENT_TESTS_ORIGINCERT` secret, because it content is a file, otherwise we can't export it using gitlab
3737
- echo "COMPONENT_TESTS_ORIGINCERT=$(echo "$COMPONENT_TESTS_ORIGINCERT" | base64 -w0)" >> windows.env
38+
- echo "KEY_VAULT_URL=$KEY_VAULT_URL" >> windows.env
39+
- echo "KEY_VAULT_CLIENT_ID=$KEY_VAULT_CLIENT_ID" >> windows.env
40+
- echo "KEY_VAULT_TENANT_ID=$KEY_VAULT_TENANT_ID" >> windows.env
41+
- echo "KEY_VAULT_SECRET=$KEY_VAULT_SECRET" >> windows.env
42+
- echo "KEY_VAULT_CERTIFICATE=$KEY_VAULT_CERTIFICATE" >> windows.env
3843
variables:
3944
COMPONENT_TESTS_CONFIG_CONTENT: Y2xvdWRmbGFyZWRfYmluYXJ5OiAuL2Nsb3VkZmxhcmVkLmV4ZQpjcmVkZW50aWFsc19maWxlOiBjcmVkLmpzb24Kb3JpZ2luY2VydDogY2VydC5wZW0Kem9uZV9kb21haW46IGFyZ290dW5uZWx0ZXN0LmNvbQp6b25lX3RhZzogNDg3OTZmMWU3MGJiNzY2OWMyOWJiNTFiYTI4MmJmNjU=
45+
secrets:
46+
KEY_VAULT_URL:
47+
vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/app_info/key_vault_url@kv
48+
file: false
49+
KEY_VAULT_CLIENT_ID:
50+
vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/app_info/key_vault_client_id@kv
51+
file: false
52+
KEY_VAULT_TENANT_ID:
53+
vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/app_info/key_vault_tenant_id@kv
54+
file: false
55+
KEY_VAULT_SECRET:
56+
vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/secret/key_vault_secret@kv
57+
file: false
58+
KEY_VAULT_CERTIFICATE:
59+
vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/certificate/key_vault_certificate@kv
60+
file: false
4061
artifacts:
4162
access: 'none'
4263
reports:
@@ -45,12 +66,12 @@ load-windows-env-variables:
4566
###################################
4667
### Run Windows Component Tests ###
4768
###################################
48-
component-tests-cloudflared-windows:
69+
windows-component-tests-cloudflared:
4970
<<: *windows-build-defaults
5071
stage: test
51-
needs: ["load-windows-env-variables"]
72+
needs: ["windows-load-env-variables"]
5273
script:
53-
# We have to decode the secret we encoded on the `load-windows-env-variables` job
74+
# We have to decode the secret we encoded on the `windows-load-env-variables` job
5475
- $env:COMPONENT_TESTS_ORIGINCERT = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($env:COMPONENT_TESTS_ORIGINCERT))
5576
- powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\go-wrapper.ps1" "${GO_VERSION}" ".\.ci\scripts\windows\component-test.ps1"
5677
artifacts:
@@ -60,17 +81,34 @@ component-tests-cloudflared-windows:
6081
################################
6182
### Package Windows Binaries ###
6283
################################
63-
package-windows:
84+
windows-package:
6485
rules:
6586
- !reference [.default-rules, run-on-master]
6687
stage: package
6788
needs:
6889
- ci-image-get-image-ref
69-
- build-cloudflared-windows
90+
- windows-build-cloudflared
7091
image: $BUILD_IMAGE
7192
script:
7293
- .ci/scripts/package-windows.sh
7394
cache: {}
7495
artifacts:
7596
paths:
7697
- artifacts/*
98+
99+
#############################
100+
### Sign Windows Binaries ###
101+
#############################
102+
windows-package-sign:
103+
<<: *windows-build-defaults
104+
rules:
105+
- !reference [.default-rules, run-on-master]
106+
stage: package
107+
needs:
108+
- windows-package
109+
- windows-load-env-variables
110+
script:
111+
- powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\sign-msi.ps1"
112+
artifacts:
113+
paths:
114+
- artifacts/*

0 commit comments

Comments
 (0)