Skip to content

Commit 38b14b1

Browse files
jo-toolsjo-tools
authored
Azure Trusted Signing (#18)
* Fix Quit Menu Item * Update InnoSetup Scripts * Update CodeSign Scripts * Remove PFX HowTo * Update Workflows * Update docs: Azure Trusted Signing * Version 1.4.0
1 parent c88b672 commit 38b14b1

19 files changed

+53
-56
lines changed

‎.github/workflows/beta-build.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,5 +53,7 @@ jobs:
5353
MACOS_NOTARIZATION_ACCOUNT: ${{ secrets.MACOS_NOTARIZATION_ACCOUNT }}
5454
MACOS_NOTARIZATION_TEAMID: ${{ secrets.MACOS_NOTARIZATION_TEAMID }}
5555
MACOS_NOTARIZATION_APPSPECIFIC_PASSWORD: ${{ secrets.MACOS_NOTARIZATION_APPSPECIFIC_PASSWORD }}
56-
WINDOWS_CODESIGN_CERTIFICATE: ${{ secrets.WINDOWS_CODESIGN_CERTIFICATE }}
57-
WINDOWS_CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_PASSWORD }}
56+
WINDOWS_CODESIGN_AZURE_TENANT_ID: ${{ secrets.WINDOWS_CODESIGN_AZURE_TENANT_ID }}
57+
WINDOWS_CODESIGN_AZURE_CLIENT_ID: ${{ secrets.WINDOWS_CODESIGN_AZURE_CLIENT_ID }}
58+
WINDOWS_CODESIGN_AZURE_CLIENT_SECRET: ${{ secrets.WINDOWS_CODESIGN_AZURE_CLIENT_SECRET }}
59+
WINDOWS_CODESIGN_ACS_JSON: ${{ secrets.WINDOWS_CODESIGN_ACS_JSON }}

‎.github/workflows/xojo.yaml‎

Lines changed: 23 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,13 @@ on:
4646
required: true
4747
MACOS_NOTARIZATION_APPSPECIFIC_PASSWORD:
4848
required: true
49-
WINDOWS_CODESIGN_CERTIFICATE:
49+
WINDOWS_CODESIGN_AZURE_TENANT_ID:
5050
required: true
51-
WINDOWS_CODESIGN_CERTIFICATE_PASSWORD:
51+
WINDOWS_CODESIGN_AZURE_CLIENT_ID:
52+
required: true
53+
WINDOWS_CODESIGN_AZURE_CLIENT_SECRET:
54+
required: true
55+
WINDOWS_CODESIGN_ACS_JSON:
5256
required: true
5357
outputs:
5458
buildmac-xojobuilds-folder:
@@ -265,10 +269,14 @@ jobs:
265269
needs: [build, postbuild]
266270
if: ${{ inputs.build-windows-x86-32bit == true || inputs.build-windows-x86-64bit == true }}
267271
env:
268-
SIGNTOOL_EXE: C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe
269-
SIGNTOOL_EXE_CMD: C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe
270-
CERTIFICATE_PFX: certificate\certificate.pfx
271-
TIMESTAMP_SERVER: http://timestamp.digicert.com
272+
SIGNTOOL_EXE: C:/Program Files (x86)/Windows Kits/10/bin/10.0.22000.0/x64/signtool.exe
273+
SIGNTOOL_EXE_CMD: C:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x64\signtool.exe
274+
AZURE_TENANT_ID: ${{ secrets.WINDOWS_CODESIGN_AZURE_TENANT_ID }}
275+
AZURE_CLIENT_ID: ${{ secrets.WINDOWS_CODESIGN_AZURE_CLIENT_ID }}
276+
AZURE_CLIENT_SECRET: ${{ secrets.WINDOWS_CODESIGN_AZURE_CLIENT_SECRET }}
277+
ACS_DLIB: ${{ github.workspace }}\.azure-trusted-signing\bin\x64\Azure.CodeSigning.Dlib.dll
278+
ACS_JSON: ${{ github.workspace }}\.azure-trusted-signing\acs.json
279+
TIMESTAMP_SERVER: http://timestamp.acs.microsoft.com
272280
outputs:
273281
artifact-id-XojoBuilds-TargetWindows-Processed-x86-32bit: ${{ steps.upload-xojo-builds-processed-windows-x86-32bit.outputs.artifact-id }}
274282
artifact-id-XojoBuilds-TargetWindows-Processed-x86-64bit: ${{ steps.upload-xojo-builds-processed-windows-x86-64bit.outputs.artifact-id }}
@@ -283,17 +291,18 @@ jobs:
283291
uses: actions/download-artifact@v4
284292
with:
285293
name: XojoBuilds-TargetWindows-x86-64bit
286-
- name: Create Code Signing Certificate
294+
- name: Setup Azure Trusted Signing
287295
shell: powershell
288296
run: |
289-
New-Item -ItemType directory -Path certificate
290-
Set-Content -Path certificate\certificate.txt -Value '${{ secrets.WINDOWS_CODESIGN_CERTIFICATE }}'
291-
certutil -decode certificate\certificate.txt ${{ env.CERTIFICATE_PFX }}
297+
New-Item -ItemType directory -Path .\.azure-trusted-signing
298+
Set-Content -Path ${{ env.ACS_JSON }} -Value '${{ secrets.WINDOWS_CODESIGN_ACS_JSON }}'
299+
Invoke-WebRequest https://www.nuget.org/api/v2/package/Microsoft.Trusted.Signing.Client/1.0.76 -OutFile .\.azure-trusted-signing\microsoft_trustedsigningclient.zip
300+
Expand-Archive .\.azure-trusted-signing\microsoft_trustedsigningclient.zip -DestinationPath .\.azure-trusted-signing
292301
- name: Code Sign 32Bit Executable and DLLs
293302
if: ${{ inputs.build-windows-x86-32bit == true }}
294303
shell: powershell
295304
run: |
296-
& "${{ env.BUILD_WINDOWS_X86_32BIT_CODESIGNSCRIPT }}" "${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_PASSWORD }}"
305+
& "${{ env.BUILD_WINDOWS_X86_32BIT_CODESIGNSCRIPT }}"
297306
- name: Create ZIP of 32Bit Executable
298307
if: ${{ inputs.build-windows-x86-32bit == true }}
299308
shell: powershell
@@ -303,12 +312,12 @@ jobs:
303312
if: ${{ inputs.build-windows-x86-32bit == true }}
304313
shell: powershell
305314
run: |
306-
& "${env:ProgramFiles(x86)}/Inno Setup 6/iscc.exe" "/SCodeSignSHA1=${{ env.SIGNTOOL_EXE_CMD }} sign /f `"${{ github.workspace }}\${{ env.CERTIFICATE_PFX }}`" /p `"${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_PASSWORD }}`" /fd sha1 /t ${{ env.TIMESTAMP_SERVER }} /v `$f" "/SCodeSignSHA256=${{ env.SIGNTOOL_EXE_CMD }} sign /as /f `"${{ github.workspace }}\${{ env.CERTIFICATE_PFX }}`" /p `"${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_PASSWORD }}`" /fd sha256 /tr ${{ env.TIMESTAMP_SERVER }} /td sha256 /v `$f" /O"${{ github.workspace }}\${{ env.FOLDER_BUILDS }}\${{ env.FOLDER_BUILDS_WINDOWS_X86_32BIT }}" /Dsourcepath="${{ github.workspace }}\${{ env.FOLDER_BUILDS }}\${{ env.FOLDER_BUILDS_WINDOWS_X86_32BIT }}\${{ env.BUILD_WINDOWS_APP_FOLDER_NAME }}" "${{ github.workspace }}\_build\windows\innosetup_x86-32bit.iss"
315+
& "${env:ProgramFiles(x86)}/Inno Setup 6/iscc.exe" "/SCodeSignSHA256=${{ env.SIGNTOOL_EXE_CMD }} sign /fd sha256 /tr ${{ env.TIMESTAMP_SERVER }} /td sha256 /v /dlib ${{ env.ACS_DLIB }} /dmdf ${{ env.ACS_JSON }} `$f" /O"${{ github.workspace }}\${{ env.FOLDER_BUILDS }}\${{ env.FOLDER_BUILDS_WINDOWS_X86_32BIT }}" /Dsourcepath="${{ github.workspace }}\${{ env.FOLDER_BUILDS }}\${{ env.FOLDER_BUILDS_WINDOWS_X86_32BIT }}\${{ env.BUILD_WINDOWS_APP_FOLDER_NAME }}" "${{ github.workspace }}\_build\windows\innosetup_x86-32bit.iss"
307316
- name: Code Sign 64Bit Executable and DLLs
308317
if: ${{ inputs.build-windows-x86-64bit == true }}
309318
shell: powershell
310319
run: |
311-
& "${{ env.BUILD_WINDOWS_X86_64BIT_CODESIGNSCRIPT }}" "${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_PASSWORD }}"
320+
& "${{ env.BUILD_WINDOWS_X86_64BIT_CODESIGNSCRIPT }}"
312321
- name: Create ZIP of 64Bit Executable
313322
if: ${{ inputs.build-windows-x86-64bit == true }}
314323
shell: powershell
@@ -318,7 +327,7 @@ jobs:
318327
if: ${{ inputs.build-windows-x86-64bit == true }}
319328
shell: powershell
320329
run: |
321-
& "${env:ProgramFiles(x86)}/Inno Setup 6/iscc.exe" "/SCodeSignSHA1=${{ env.SIGNTOOL_EXE_CMD }} sign /f `"${{ github.workspace }}\${{ env.CERTIFICATE_PFX }}`" /p `"${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_PASSWORD }}`" /fd sha1 /t ${{ env.TIMESTAMP_SERVER }} /v `$f" "/SCodeSignSHA256=${{ env.SIGNTOOL_EXE_CMD }} sign /as /f `"${{ github.workspace }}\${{ env.CERTIFICATE_PFX }}`" /p `"${{ secrets.WINDOWS_CODESIGN_CERTIFICATE_PASSWORD }}`" /fd sha256 /tr ${{ env.TIMESTAMP_SERVER }} /td sha256 /v `$f" /O"${{ github.workspace }}\${{ env.FOLDER_BUILDS }}\${{ env.FOLDER_BUILDS_WINDOWS_X86_64BIT }}" /Dsourcepath="${{ github.workspace }}\${{ env.FOLDER_BUILDS }}\${{ env.FOLDER_BUILDS_WINDOWS_X86_64BIT }}\${{ env.BUILD_WINDOWS_APP_FOLDER_NAME }}" "${{ github.workspace }}\_build\windows\innosetup_x86-64bit.iss"
330+
& "${env:ProgramFiles(x86)}/Inno Setup 6/iscc.exe" "/SCodeSignSHA256=${{ env.SIGNTOOL_EXE_CMD }} sign /fd sha256 /tr ${{ env.TIMESTAMP_SERVER }} /td sha256 /v /dlib ${{ env.ACS_DLIB }} /dmdf ${{ env.ACS_JSON }} `$f" /O"${{ github.workspace }}\${{ env.FOLDER_BUILDS }}\${{ env.FOLDER_BUILDS_WINDOWS_X86_64BIT }}" /Dsourcepath="${{ github.workspace }}\${{ env.FOLDER_BUILDS }}\${{ env.FOLDER_BUILDS_WINDOWS_X86_64BIT }}\${{ env.BUILD_WINDOWS_APP_FOLDER_NAME }}" "${{ github.workspace }}\_build\windows\innosetup_x86-64bit.iss"
322331
- name: Upload Xojo Builds for Windows x86 32Bit
323332
id: upload-xojo-builds-processed-windows-x86-32bit
324333
uses: actions/upload-artifact@v4

‎Xojo-GitHub-Actions.xojo_project‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@ MenuBar=MainMenuBar;example-app/MainMenuBar.xojo_menu;&h000000005ECE7FFF;&h00000
1313
DefaultWindow=Window1
1414
AppMenuBar=MainMenuBar
1515
MajorVersion=1
16-
MinorVersion=3
16+
MinorVersion=4
1717
SubVersion=0
1818
NonRelease=0
1919
Release=2
2020
InfoVersion=Xojo GitHub Actions
2121
LongVersion=jo-tools.ch
22-
ShortVersion=1.3.0
22+
ShortVersion=1.4.0
2323
WinCompanyName=jo-tools.ch
2424
WinInternalName=
2525
WinProductName=

‎_build/windows/codesign_x86-32bit.ps1‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,29 @@
22
$PFX_PASSWORD = $args[0];
33

44
# This script requires the following Environment Variables:
5-
# ${env:INNOSETUP_EXE}
5+
# Signtool
66
# ${env:SIGNTOOL_EXE}
7-
# ${env:CERTIFICATE_PFX}
87
# ${env:TIMESTAMP_SERVER}
8+
#
9+
# Azure Trusted Signing
10+
# ${env:AZURE_TENANT_ID}
11+
# ${env:AZURE_CLIENT_ID}
12+
# ${env:AZURE_CLIENT_SECRET}
13+
# ${env:ACS_DLIB}
14+
# ${env:ACS_JSON}
915
#
16+
# Build Location
1017
# ${env:FOLDER_BUILDS}
1118
# ${env:FOLDER_BUILDS_WINDOWS_X86_32BIT}
1219
# ${env:BUILD_WINDOWS_APP_FOLDER_NAME}
1320

1421
$FOLDER_CODESIGN = "${env:FOLDER_BUILDS}\${env:FOLDER_BUILDS_WINDOWS_X86_32BIT}\${env:BUILD_WINDOWS_APP_FOLDER_NAME}"
1522

16-
# Perform CodeSign: SHA1 and SHA256
23+
# Perform CodeSign: SHA256
1724
function Do-Codesign([string] $toBeSigned) {
18-
& "${env:SIGNTOOL_EXE}" sign /f ${env:CERTIFICATE_PFX} /p "$PFX_PASSWORD" /fd sha1 /t ${env:TIMESTAMP_SERVER} /v "$FOLDER_CODESIGN\$toBeSigned"
25+
& "${env:SIGNTOOL_EXE}" sign /fd sha256 /tr ${env:TIMESTAMP_SERVER} /td sha256 /v /dlib "${env:ACS_DLIB}" /dmdf "${env:ACS_JSON}" "$FOLDER_CODESIGN\$toBeSigned"
1926
if ($LASTEXITCODE -ne 0) {
20-
Write-Host "CodeSign SHA1 of '$toBeSigned' failed."
21-
exit 1;
22-
}
23-
& "${env:SIGNTOOL_EXE}" sign /as /f ${env:CERTIFICATE_PFX} /p "$PFX_PASSWORD" /fd sha256 /tr ${env:TIMESTAMP_SERVER} /td sha256 /v "$FOLDER_CODESIGN\$toBeSigned"
24-
if ($LASTEXITCODE -ne 0) {
25-
Write-Host "CodeSign SHA256 of '$toBeSigned' failed."
27+
Write-Host "Azure Trusted Signing: CodeSign SHA256 of '$toBeSigned' failed."
2628
exit 1;
2729
}
2830
}

‎_build/windows/codesign_x86-64bit.ps1‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,29 @@
22
$PFX_PASSWORD = $args[0];
33

44
# This script requires the following Environment Variables:
5-
# ${env:INNOSETUP_EXE}
5+
# Signtool
66
# ${env:SIGNTOOL_EXE}
7-
# ${env:CERTIFICATE_PFX}
87
# ${env:TIMESTAMP_SERVER}
98
#
9+
# Azure Trusted Signing
10+
# ${env:AZURE_TENANT_ID}
11+
# ${env:AZURE_CLIENT_ID}
12+
# ${env:AZURE_CLIENT_SECRET}
13+
# ${env:ACS_DLIB}
14+
# ${env:ACS_JSON}
15+
#
16+
# Build Location
1017
# ${env:FOLDER_BUILDS}
1118
# ${env:FOLDER_BUILDS_WINDOWS_X86_64BIT}
1219
# ${env:BUILD_WINDOWS_APP_FOLDER_NAME}
1320

1421
$FOLDER_CODESIGN = "${env:FOLDER_BUILDS}\${env:FOLDER_BUILDS_WINDOWS_X86_64BIT}\${env:BUILD_WINDOWS_APP_FOLDER_NAME}"
1522

16-
# Perform CodeSign: SHA1 and SHA256
23+
# Perform CodeSign: SHA256
1724
function Do-Codesign([string] $toBeSigned) {
18-
& "${env:SIGNTOOL_EXE}" sign /f ${env:CERTIFICATE_PFX} /p "$PFX_PASSWORD" /fd sha1 /t ${env:TIMESTAMP_SERVER} /v "$FOLDER_CODESIGN\$toBeSigned"
25+
& "${env:SIGNTOOL_EXE}" sign /fd sha256 /tr ${env:TIMESTAMP_SERVER} /td sha256 /v /dlib "${env:ACS_DLIB}" /dmdf "${env:ACS_JSON}" "$FOLDER_CODESIGN\$toBeSigned"
1926
if ($LASTEXITCODE -ne 0) {
20-
Write-Host "CodeSign SHA1 of '$toBeSigned' failed."
21-
exit 1;
22-
}
23-
& "${env:SIGNTOOL_EXE}" sign /as /f ${env:CERTIFICATE_PFX} /p "$PFX_PASSWORD" /fd sha256 /tr ${env:TIMESTAMP_SERVER} /td sha256 /v "$FOLDER_CODESIGN\$toBeSigned"
24-
if ($LASTEXITCODE -ne 0) {
25-
Write-Host "CodeSign SHA256 of '$toBeSigned' failed."
27+
Write-Host "Azure Trusted Signing: CodeSign SHA256 of '$toBeSigned' failed."
2628
exit 1;
2729
}
2830
}

‎_build/windows/innosetup_x86-32bit.iss‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ ChangesAssociations=yes
5656
; Require Windows 8.1 with Update 1
5757
MinVersion=6.3.9600
5858

59-
Signtool=CodeSignSHA1
6059
Signtool=CodeSignSHA256
6160
SignedUninstaller=yes
6261

‎_build/windows/innosetup_x86-64bit.iss‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,6 @@ ChangesAssociations=yes
5959
; Require Windows 8.1 with Update 1
6060
MinVersion=6.3.9600
6161

62-
Signtool=CodeSignSHA1
6362
Signtool=CodeSignSHA256
6463
SignedUninstaller=yes
6564

‎_build/windows/pfx2secret-howto.txt‎

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎docs/10_Repository-Actions-Secrets.png‎

105 KB
Loading

‎docs/11_Secret_Windows-pfx.png‎

-328 KB
Binary file not shown.

0 commit comments

Comments
 (0)