Skip to content

Commit 059259a

Browse files
faratechclaude
faratech
and
claude
committed
feat: Add Sigstore keyless code signing and comprehensive dependency updates
- 🔐 Added Sigstore integration with GitHub Actions workflow - 📦 Updated all dependencies to latest versions using * pattern - 🏗️ Fixed breaking changes for latest dependency compatibility - 🎯 Added comprehensive icon assets (16x16, 180x180, 192x192, 512x512) - 📝 Optimized .gitignore for modern Tauri development - ✅ Updated executable to v2.0.8 with latest security fixes - 🛠️ Added PowerShell scripts for local signing and verification - 📋 Comprehensive documentation in SIGSTORE_SETUP.md Key improvements: - Keyless code signing via GitHub OIDC tokens - Automatic signature generation for releases - Build artifact attestations for supply chain security - Latest Rust 1.89.0 and all npm dependencies updated - Fixed RngCore import issues in encryption module - Enhanced build process with proper asset management 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 4207b8b commit 059259a

26 files changed

+1978
-1386
lines changed

‎.claude/settings.local.json‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,21 @@
11
{
22
"permissions": {
33
"allow": [
4-
"Bash(dir)"
4+
"Bash(dir)",
5+
"Bash(cargo build:*)",
6+
"Bash(ls:*)",
7+
"Bash(npm run tauri build:*)",
8+
"Bash(source:*)",
9+
"Bash(export PATH=\"$PATH:$HOME/.cargo/bin\")",
10+
"Bash(/root/.cargo/bin/cargo build)",
11+
"Bash(npx tsc:*)",
12+
"Bash(npm run build:*)",
13+
"Bash(cargo audit:*)",
14+
"Read(D:\\temp\\wfdiag\\src/**)"
515
],
6-
"deny": []
16+
"deny": [],
17+
"additionalDirectories": [
18+
"d:\\temp\\wfdiag-tauri"
19+
]
720
}
821
}

‎.github/workflows/sigstore-sign.yml‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
name: Build and Sign with Sigstore
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
tags: [ 'v*' ]
7+
pull_request:
8+
branches: [ main ]
9+
release:
10+
types: [ published ]
11+
12+
jobs:
13+
build-and-sign:
14+
runs-on: windows-latest
15+
permissions:
16+
contents: read
17+
id-token: write # Required for OIDC authentication with Sigstore
18+
attestations: write # For GitHub attestations
19+
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@v4
23+
24+
- name: Setup Node.js
25+
uses: actions/setup-node@v4
26+
with:
27+
node-version: '20'
28+
cache: 'npm'
29+
30+
- name: Setup Rust
31+
uses: actions-rust-lang/setup-rust-toolchain@v1
32+
with:
33+
toolchain: stable
34+
35+
- name: Install Cosign
36+
uses: sigstore/cosign-installer@v3
37+
with:
38+
cosign-release: 'v2.5.3'
39+
40+
- name: Install dependencies
41+
run: npm ci
42+
43+
- name: Build frontend
44+
run: npm run build
45+
46+
- name: Build Tauri app
47+
run: |
48+
cd src-tauri
49+
cargo build --release
50+
51+
- name: Build Tauri bundles
52+
run: npm run tauri build
53+
54+
- name: List build artifacts
55+
run: |
56+
Get-ChildItem -Recurse src-tauri/target/release/bundle/ -File | Select-Object FullName, Length
57+
58+
- name: Sign executables and installers with Sigstore
59+
env:
60+
COSIGN_EXPERIMENTAL: 1 # Enable experimental features
61+
run: |
62+
# Sign the main executable
63+
if (Test-Path "src-tauri/target/release/wfdiag-tauri.exe") {
64+
cosign-windows-amd64 sign-blob --yes --output-signature wfdiag-tauri.exe.sig --output-certificate wfdiag-tauri.exe.pem src-tauri/target/release/wfdiag-tauri.exe
65+
}
66+
67+
# Sign MSI installer if it exists
68+
$msiPath = Get-ChildItem -Path "src-tauri/target/release/bundle/msi" -Filter "*.msi" -Recurse | Select-Object -First 1
69+
if ($msiPath) {
70+
cosign-windows-amd64 sign-blob --yes --output-signature "$($msiPath.BaseName).msi.sig" --output-certificate "$($msiPath.BaseName).msi.pem" $msiPath.FullName
71+
}
72+
73+
# Sign NSIS installer if it exists
74+
$nsisPath = Get-ChildItem -Path "src-tauri/target/release/bundle/nsis" -Filter "*.exe" -Recurse | Select-Object -First 1
75+
if ($nsisPath) {
76+
cosign-windows-amd64 sign-blob --yes --output-signature "$($nsisPath.BaseName).nsis.sig" --output-certificate "$($nsisPath.BaseName).nsis.pem" $nsisPath.FullName
77+
}
78+
79+
- name: Generate GitHub attestation
80+
if: github.event_name == 'release'
81+
uses: actions/attest-build-provenance@v1
82+
with:
83+
subject-path: |
84+
src-tauri/target/release/wfdiag-tauri.exe
85+
src-tauri/target/release/bundle/msi/*.msi
86+
src-tauri/target/release/bundle/nsis/*.exe
87+
88+
- name: Upload signatures as artifacts
89+
uses: actions/upload-artifact@v4
90+
with:
91+
name: sigstore-signatures
92+
path: |
93+
*.sig
94+
*.pem
95+
retention-days: 30
96+
97+
- name: Upload build artifacts
98+
uses: actions/upload-artifact@v4
99+
with:
100+
name: tauri-builds
101+
path: |
102+
src-tauri/target/release/wfdiag-tauri.exe
103+
src-tauri/target/release/bundle/
104+
retention-days: 30
105+
106+
verify-signatures:
107+
needs: build-and-sign
108+
runs-on: ubuntu-latest
109+
steps:
110+
- name: Install Cosign
111+
uses: sigstore/cosign-installer@v3
112+
113+
- name: Download signatures
114+
uses: actions/download-artifact@v4
115+
with:
116+
name: sigstore-signatures
117+
118+
- name: Download build artifacts
119+
uses: actions/download-artifact@v4
120+
with:
121+
name: tauri-builds
122+
123+
- name: Verify signatures
124+
env:
125+
COSIGN_EXPERIMENTAL: 1
126+
run: |
127+
# Verify executable signature
128+
if [ -f "wfdiag-tauri.exe.sig" ] && [ -f "wfdiag-tauri.exe" ]; then
129+
cosign verify-blob --signature wfdiag-tauri.exe.sig --certificate wfdiag-tauri.exe.pem wfdiag-tauri.exe
130+
fi
131+
132+
# Verify MSI signature
133+
if ls *.msi.sig 1> /dev/null 2>&1; then
134+
for sig in *.msi.sig; do
135+
msi="${sig%.sig}"
136+
pem="${msi}.pem"
137+
if [ -f "$msi" ] && [ -f "$pem" ]; then
138+
cosign verify-blob --signature "$sig" --certificate "$pem" "$msi"
139+
fi
140+
done
141+
fi

‎.gitignore‎

Lines changed: 72 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,7 @@ lerna-debug.log*
3636
.env.production.local
3737
.env.*.local
3838

39-
# IDE files
40-
.vscode/
39+
# IDE files (allow some .vscode config)
4140
.idea/
4241
*.swp
4342
*.swo
@@ -50,11 +49,12 @@ lerna-debug.log*
5049
# Tauri specific
5150
src-tauri/target/
5251
src-tauri/gen/
52+
src-tauri/Cargo.lock
53+
.tauri/
5354

5455
# Security sensitive files
5556
*.pfx
5657
*.p12
57-
*.pem
5858
*.key
5959
*.crt
6060
*.cer
@@ -72,6 +72,14 @@ certificates/
7272
*.rsa
7373
*.dsa
7474

75+
# Sigstore signatures (local development only)
76+
signatures/
77+
*.sig
78+
*.pem
79+
*.bundle
80+
*.rekor
81+
*-signature.json
82+
7583
# Temporary and cache files
7684
.cache/
7785
.tmp/
@@ -98,24 +106,37 @@ tempstats_app/
98106
*.rpm
99107
*.tar.gz
100108

101-
# Allow release artifacts in release directory
109+
# Allow versioned release artifacts in release directory only
102110
!release/
103111
!release/*.zip
104112
!release/*.exe
105113
!release/*.msi
114+
!release/*.sig
115+
!release/*.pem
106116

107117
# Windows specific
108118
*.stackdump
109119
*.lnk
110120

111121
# Build outputs that shouldn't be versioned
112122
src-tauri/target/release/
113-
src-tauri/target/debug/
123+
src-tauri/target/debug/
114124
src-tauri/bundle/
115125
WFDiagnostics_*.msix
116126
*.nsis
127+
*.appx
128+
*.msixbundle
129+
130+
# PowerShell build scripts (auto-generated)
117131
rebuild-msix-signed.ps1
118132
sign-*.ps1
133+
build-*.ps1
134+
create-*cert.ps1
135+
136+
# Rust build artifacts
137+
**/*.rs.bk
138+
*.orig
139+
Cargo.lock.orig
119140

120141
# Local configuration and user data
121142
config.json
@@ -133,4 +154,49 @@ apikey.txt
133154
token.txt
134155
oauth_tokens.json
135156
credentials.json
136-
auth_tokens.json
157+
auth_tokens.json
158+
159+
# Development tools and artifacts
160+
.claude/
161+
.vscode/settings.json
162+
.vscode/launch.json
163+
*.code-workspace
164+
.history/
165+
.devcontainer/
166+
.dockerignore
167+
docker-compose.override.yml
168+
169+
# Package manager locks (keep main package-lock.json but ignore temp ones)
170+
.pnpm-store/
171+
pnpm-lock.yaml
172+
yarn.lock
173+
.yarn/
174+
.pnp.*
175+
176+
# GitHub Codespaces
177+
.devcontainer/
178+
.github/ISSUE_TEMPLATE/
179+
.github/PULL_REQUEST_TEMPLATE/
180+
181+
# Performance and profiling
182+
.clinic/
183+
profile/
184+
*.cpuprofile
185+
*.heapprofile
186+
*.heapsnapshot
187+
*.perf
188+
189+
# Modern build tools
190+
.turbo/
191+
.next/
192+
.nuxt/
193+
.output/
194+
.vercel/
195+
.netlify/
196+
197+
# Backup and recovery files
198+
*.backup
199+
*.bak
200+
*.swp
201+
*.swo
202+
~$*

0 commit comments

Comments
 (0)