Skip to content

Commit 6fbde98

Browse files
seansesseanses
authored
git-xet Windows installer and code signing (#519)
This PR - adds to the git-xet release workflow to code-sign Windows executable "git-xet.exe" using the Microsoft Trusted Signing Service; - builds a Windows installer for git-xet to place "git-xet.exe" in the system, modify the system PATH environment variable, and run the command "git-xet install" to configure git-xet; On uninstallation from "Control Panel\Programs\Programs and Features", it first runs "git-xet uninstall --all" so it is deregistered from git-lfs custom transfer. - signs the built Windows installer msi file.
1 parent 28dd760 commit 6fbde98

File tree

5 files changed

+185
-1
lines changed

5 files changed

+185
-1
lines changed

‎.github/actions/windows-codesign/action.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Codesign with Microsoft Trusted Signing
2+
description: Sign Windows files with Microsoft Trusted Signing Service
3+
runs:
4+
using: "composite"
5+
steps:
6+
- uses: azure/trusted-signing-action@v0
7+
with:
8+
azure-tenant-id: ${{ inputs.azure_tenant_id }}
9+
azure-client-id: ${{ inputs.azure_client_id }}
10+
azure-client-secret: ${{ inputs.azure_client_secret }}
11+
endpoint: https://eus.codesigning.azure.net/
12+
trusted-signing-account-name: tsa-huggingface-apps
13+
certificate-profile-name: git-xet-windows
14+
files: ${{ inputs.file }}
15+
file-digest: SHA256
16+
timestamp-rfc3161: http://timestamp.acs.microsoft.com
17+
timestamp-digest: SHA256
18+
exclude-environment-credential: false
19+
exclude-workload-identity-credential: true
20+
exclude-managed-identity-credential: true
21+
exclude-shared-token-cache-credential: true
22+
exclude-visual-studio-credential: true
23+
exclude-visual-studio-code-credential: true
24+
exclude-azure-cli-credential: true
25+
exclude-azure-powershell-credential: true
26+
exclude-azure-developer-cli-credential: true
27+
exclude-interactive-browser-credential: true
28+
inputs:
29+
file:
30+
required: true
31+
type: string
32+
azure_tenant_id:
33+
required: true
34+
type: string
35+
azure_client_id:
36+
required: true
37+
type: string
38+
azure_client_secret:
39+
required: true
40+
type: string

‎.github/workflows/git-xet-release.yml‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,14 +88,43 @@ jobs:
8888
- name: Install Rust 1.89
8989
uses: dtolnay/[email protected]
9090
- uses: ./.github/actions/cache-rust-build
91+
- name: Install WiX
92+
run: |
93+
dotnet tool install --global wix
9194
- name: Build
9295
run: |
9396
cargo build --release
97+
mkdir dist
98+
cp target/release/git-xet.exe dist/
99+
- name: Codesign the executable file
100+
uses: ./.github/actions/windows-codesign
101+
with:
102+
file: ${{ github.workspace }}\dist\git-xet.exe
103+
azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
104+
azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
105+
azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }}
106+
- name: Build installer
107+
run: |
108+
cp git_xet/windows_installer/Package.wxs dist/
109+
cd dist
110+
wix build Package.wxs -o bin\git-xet-windows-installer -arch x64
111+
- name: Codesign the installer
112+
uses: ./.github/actions/windows-codesign
113+
with:
114+
file: ${{ github.workspace }}\dist\bin\git-xet-windows-installer.msi
115+
azure_tenant_id: ${{ secrets.AZURE_TENANT_ID }}
116+
azure_client_id: ${{ secrets.AZURE_CLIENT_ID }}
117+
azure_client_secret: ${{ secrets.AZURE_CLIENT_SECRET }}
94118
- name: Upload binary
95119
uses: actions/upload-artifact@v4
96120
with:
97121
name: git-xet-windows-${{ matrix.platform.target }}
98-
path: target/release/git-xet.exe
122+
path: dist/git-xet.exe
123+
- name: Upload installer
124+
uses: actions/upload-artifact@v4
125+
with:
126+
name: git-xet-windows-installer-${{ matrix.platform.target }}
127+
path: dist/bin/git-xet-windows-installer.msi
99128

100129
github-release:
101130
name: Create GitHub release

‎git_xet/windows_installer/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
bin
2+
*.exe

‎git_xet/windows_installer/Package.wxs‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
2+
<Package Name="Git-Xet"
3+
Manufacturer="Hugging Face"
4+
Version="0.1.0"
5+
Language="1033"
6+
UpgradeCode="1aedaf4a-9b02-44e5-be42-ef18ce3b5c28">
7+
8+
<!-- This tag ensures all installation files are compressed into a single .msi file. -->
9+
<MediaTemplate EmbedCab="yes" />
10+
11+
<MajorUpgrade DowngradeErrorMessage="A newer version of [ProductName] is already installed." />
12+
13+
<!-- Define the directory structure. -->
14+
<StandardDirectory Id="ProgramFiles64Folder">
15+
<Directory Id="INSTALLFOLDER" Name="Git-Xet" />
16+
</StandardDirectory>
17+
18+
<!--
19+
This is the Feature tree. We have one main feature.
20+
It contains the ComponentGroup we define below.
21+
-->
22+
<Feature Id="Main" Title="Main Feature" Level="1">
23+
<ComponentGroupRef Id="AppComponents" />
24+
<ComponentRef Id="UpdateSystemPath" />
25+
</Feature>
26+
27+
<!--
28+
Component Group for our application files.
29+
-->
30+
<ComponentGroup Id="AppComponents" Directory="INSTALLFOLDER">
31+
<Component Id="MyAppExeComponent" Guid="0eaa2c4c-3512-4c0f-975f-7bcd1394f315">
32+
<File Id="GitXet" Source="git-xet.exe" KeyPath="yes" Checksum="yes" />
33+
</Component>
34+
</ComponentGroup>
35+
36+
<!--
37+
This component modifies the system PATH environment variable.
38+
-->
39+
<Component Id="UpdateSystemPath" Directory="INSTALLFOLDER" Guid="74890476-4e17-4f81-891b-e0251380bfcb">
40+
<!--
41+
- Name='Path': Specifies we're modifying the PATH variable.
42+
- Action='set': We are setting a value.
43+
- Value='[INSTALLFOLDER]': The value to add, which is the installation directory.
44+
- Part='last': Appends our directory to the end of the existing PATH.
45+
- System='yes': Modifies the system-wide PATH, not just the user's.
46+
-->
47+
<Environment Id="PATH" Name="Path" Value="[INSTALLFOLDER]" Part="last" Action="set" System="yes" />
48+
49+
<!-- Every component needs a KeyPath. We create a dummy registry key for this non-file component. -->
50+
<RegistryValue Root="HKCU" Key="Software\[Manufacturer]\[ProductName]" Name="PathAdded" Type="integer" Value="1" KeyPath="yes" />
51+
</Component>
52+
53+
<!--
54+
Define the Custom Action to run the install command.
55+
- Execute="immediate": The action will run during normal processing time with user privileges.
56+
- Return="check": The installer will check the exit code and roll back if it fails.
57+
-->
58+
<CustomAction Id="RunInstallCommand"
59+
FileRef="GitXet"
60+
ExeCommand="install --concurrency 3"
61+
Execute="immediate"
62+
Return="check"
63+
Impersonate="yes"/>
64+
65+
<!--
66+
Define the Custom Action to run the uninstall command.
67+
- Execute="immediate": The action will run during normal processing time with user privileges.
68+
- Return="check": The installer will check the exit code and roll back if it fails.
69+
-->
70+
<CustomAction Id="RunUninstallCommand"
71+
FileRef="GitXet"
72+
ExeCommand="uninstall --all"
73+
Execute="immediate"
74+
Return="check"
75+
Impersonate="yes"/>
76+
77+
<!--
78+
Schedule the Custom Action in the installation sequence.
79+
-->
80+
<InstallExecuteSequence>
81+
<!--
82+
- Action="RunInstallCommand": The ID of the Custom Action we defined above.
83+
- After="InstallFinalize": Schedules the action to run late in the sequence, after all files and registry keys are in place.
84+
- Condition="NOT Installed": This condition ensures the action only runs during the initial installation, not during an uninstall or repair.
85+
-->
86+
<Custom Action="RunInstallCommand" After="InstallFinalize" Condition="NOT Installed"/>
87+
88+
<!--
89+
- Action="RunUninstallCommand": The ID of the Custom Action we defined above.
90+
- Before="RemoveFiles": Runs the command before the .exe is deleted from the disk.
91+
- Condition='REMOVE="ALL" AND NOT UPGRADINGPRODUCTCODE': Ensures this only runs on a clean uninstall, not during an upgrade.
92+
-->
93+
<Custom Action="RunUninstallCommand" Before="RemoveFiles" Condition='REMOVE="ALL" AND NOT UPGRADINGPRODUCTCODE' />
94+
</InstallExecuteSequence>
95+
96+
</Package>
97+
</Wix>

‎git_xet/windows_installer/sign_metadata.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"Endpoint": "https://eus.codesigning.azure.net/",
3+
"CodeSigningAccountName": "tsa-huggingface-apps",
4+
"CertificateProfileName": "git-xet-windows",
5+
"ExcludeCredentials": [
6+
"ManagedIdentityCredential",
7+
"WorkloadIdentityCredential",
8+
"SharedTokenCacheCredential",
9+
"VisualStudioCredential",
10+
"VisualStudioCodeCredential",
11+
"AzureCliCredential",
12+
"AzurePowerShellCredential",
13+
"AzureDeveloperCliCredential",
14+
"InteractiveBrowserCredential"
15+
]
16+
}

0 commit comments

Comments
 (0)