Skip to content

Commit 8cf646f

Browse files
pivotalgeorgemoleskea-b
committed
Change windows release build and sign to use Digicert Keylocker signing mechanism
Co-Authored-By: Michael Oleske <[email protected]> Co-Authored-By: Al Berez <[email protected]>
1 parent 485c489 commit 8cf646f

File tree

2 files changed

+49
-43
lines changed

2 files changed

+49
-43
lines changed

‎.github/win/sign-windows-binary.ps1

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎.github/workflows/release-build-sign-upload.yml

Lines changed: 49 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -296,7 +296,7 @@ jobs:
296296
run: |
297297
set -ex
298298
set -o pipefail
299-
299+
300300
root=$PWD
301301
302302
mkdir -pv $root/packaged-deb
@@ -654,31 +654,32 @@ jobs:
654654
make out/cf-cli_win32.exe
655655
make out/cf-cli_winx64.exe
656656
657-
- name: write windows cert
658-
env:
659-
SIGNING_KEY_WINDOWS_PASSPHRASE: ${{ secrets.SIGNING_KEY_WINDOWS_PASSPHRASE }}
660-
SIGNING_KEY_WINDOWS_PFX: ${{ secrets.SIGNING_KEY_WINDOWS_PFX }}
657+
- name: Set up certificate
661658
run: |
662-
$pass = convertto-securestring -string "${env:SIGNING_KEY_WINDOWS_PASSPHRASE}" -asplaintext
663-
[convert]::frombase64string(${env:SIGNING_KEY_WINDOWS_PFX}) | set-content -path $env:runner_temp\cert.pfx -asbytestream
664-
659+
echo "${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CLIENT_CERT_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
660+
shell: bash
665661

666-
- name: Sign windows binaries
667-
env:
668-
SIGNING_KEY_WINDOWS_PASSPHRASE: ${{ secrets.SIGNING_KEY_WINDOWS_PASSPHRASE }}
669-
run: |
670-
.\.github\win\sign-windows-binary.ps1 -BinaryFilePath out\cf-cli_win32.exe
671-
.\.github\win\sign-windows-binary.ps1 -BinaryFilePath out\cf-cli_winx64.exe
672-
673-
- name: View binary signatures
662+
- name: Set variables
663+
id: variables
674664
run: |
675-
Get-AuthenticodeSignature -Verbose -ErrorAction Stop .\out\cf-cli_win32.exe
676-
Get-AuthenticodeSignature -Verbose -ErrorAction Stop .\out\cf-cli_winx64.exe
677-
678-
- name: Make symlinks
665+
echo "SM_HOST=${{ vars.SIGNING_KEY_WINDOWS_DIGICERT_HOST }}" >> "$GITHUB_ENV"
666+
echo "SM_API_KEY=${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_API_KEY }}" >> "$GITHUB_ENV"
667+
echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
668+
echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CLIENT_CERT_INSTALLATION_PASSWORD }}" >> "$GITHUB_ENV"
669+
echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
670+
echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
671+
echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
672+
shell: bash
673+
674+
- name: Setup Keylocker KSP on Windows
679675
run: |
680-
New-Item -ItemType SymbolicLink -Target .\out\cf-cli_win32.exe -Path .\out\cf-cli_win32-link.exe
681-
New-Item -ItemType SymbolicLink -Target .\out\cf-cli_winx64.exe -Path .\out\cf-cli_winx64-link.exe
676+
curl -X GET https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi
677+
msiexec /i Keylockertools-windows-x64.msi /quiet /qn
678+
smksp_registrar.exe list
679+
smctl.exe keypair ls
680+
C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
681+
smctl windows certsync
682+
shell: cmd
682683

683684
# This is for debugging windows
684685
# - name: enable ssh
@@ -698,6 +699,22 @@ jobs:
698699
# sleep 3600
699700
# Stop-Service sshd
700701

702+
- name: Sign Windows binaries
703+
run: |
704+
smctl healthcheck --all
705+
smctl sign --fingerprint ${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input out\cf-cli_win32.exe
706+
smctl sign --fingerprint ${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input out\cf-cli_winx64.exe
707+
708+
- name: View binary signatures
709+
run: |
710+
Get-AuthenticodeSignature -Verbose -ErrorAction Stop .\out\cf-cli_win32.exe
711+
Get-AuthenticodeSignature -Verbose -ErrorAction Stop .\out\cf-cli_winx64.exe
712+
713+
- name: Make symlinks
714+
run: |
715+
New-Item -ItemType SymbolicLink -Target .\out\cf-cli_win32.exe -Path .\out\cf-cli_win32-link.exe
716+
New-Item -ItemType SymbolicLink -Target .\out\cf-cli_winx64.exe -Path .\out\cf-cli_winx64-link.exe
717+
701718
- name: Save signed binaries as a GitHub Action Artifact
702719
uses: actions/upload-artifact@v4
703720
with:
@@ -715,36 +732,34 @@ jobs:
715732
mkdir "${env:RUNNER_TEMP}\win32"
716733
.\.github\win\run-innosetup.ps1 -InnoSetupConfig ".github\win\windows-installer-v${env:VERSION_MAJOR}-x86.iss" -CfBinary "out\cf-cli_win32.exe" -InstallerOutput "${env:RUNNER_TEMP}\win32\cf${env:VERSION_MAJOR}_installer.exe"
717734
718-
- name: Sign windows installer
719-
env:
720-
SIGNING_KEY_WINDOWS_PASSPHRASE: ${{ secrets.SIGNING_KEY_WINDOWS_PASSPHRASE }}
735+
- name: Sign Windows installers
721736
run: |
722-
.\.github\win\sign-windows-binary.ps1 -BinaryFilePath "${env:RUNNER_TEMP}\winx64\cf${env:VERSION_MAJOR}_installer.exe"
723-
.\.github\win\sign-windows-binary.ps1 -BinaryFilePath "${env:RUNNER_TEMP}\win32\cf${env:VERSION_MAJOR}_installer.exe"
737+
smctl sign --fingerprint ${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input "${env:RUNNER_TEMP}\win32\cf${env:VERSION_MAJOR}_installer.exe"
738+
smctl sign --fingerprint ${{ secrets.SIGNING_KEY_WINDOWS_DIGICERT_CERT_FINGERPRINT }} --tool signtool --input "${env:RUNNER_TEMP}\winx64\cf${env:VERSION_MAJOR}_installer.exe"
724739
725740
- name: View installer signature
726741
run: |
727-
Get-AuthenticodeSignature -Verbose -ErrorAction Stop "${env:RUNNER_TEMP}\winx64\cf${env:VERSION_MAJOR}_installer.exe"
728742
Get-AuthenticodeSignature -Verbose -ErrorAction Stop "${env:RUNNER_TEMP}\win32\cf${env:VERSION_MAJOR}_installer.exe"
743+
Get-AuthenticodeSignature -Verbose -ErrorAction Stop "${env:RUNNER_TEMP}\winx64\cf${env:VERSION_MAJOR}_installer.exe"
729744
730745
- name: Arrange files for upload
731746
# note the -Path flag takes comma-delimited args
732747
run: |
733-
Copy-Item -Destination "${env:RUNNER_TEMP}\winx64" -Path .github\win\LICENSE,.github\win\NOTICE
734748
Copy-Item -Destination "${env:RUNNER_TEMP}\win32" -Path .github\win\LICENSE,.github\win\NOTICE
749+
Copy-Item -Destination "${env:RUNNER_TEMP}\winx64" -Path .github\win\LICENSE,.github\win\NOTICE
735750
736-
- name: Zip windows artifact
751+
- name: Zip Windows artifact
737752
run: |
738753
# strip leading v to go from tag -> semver
739754
$installer_release_version="$(cat BUILD_VERSION)".Replace("v", "")
740-
pushd "${env:RUNNER_TEMP}\winx64"
741-
$installer_zip_filename="${env:RUNNER_TEMP}\cf${env:VERSION_MAJOR}-cli-installer_${installer_release_version}_winx64.zip"
742-
Compress-Archive -DestinationPath "$installer_zip_filename" -Path *
743-
popd
744755
pushd "${env:RUNNER_TEMP}\win32"
745756
$installer_zip_filename="${env:RUNNER_TEMP}\cf${env:VERSION_MAJOR}-cli-installer_${installer_release_version}_win32.zip"
746757
Compress-Archive -DestinationPath "$installer_zip_filename" -Path *
747758
popd
759+
pushd "${env:RUNNER_TEMP}\winx64"
760+
$installer_zip_filename="${env:RUNNER_TEMP}\cf${env:VERSION_MAJOR}-cli-installer_${installer_release_version}_winx64.zip"
761+
Compress-Archive -DestinationPath "$installer_zip_filename" -Path *
762+
popd
748763
Get-ChildItem "${env:RUNNER_TEMP}"
749764
750765
# - name: Setup tmate session

0 commit comments

Comments
 (0)