Skip to content

fix: sign the windows setup .exe COMPASS-8945 COMPASS-8950 #6709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Feb 12, 2025
Merged

fix: sign the windows setup .exe COMPASS-8945 COMPASS-8950 #6709

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
dcf9b1e
log checksums before and after signing
lerouxb Feb 11, 2025
71da39d
add assertions on the required env vars
lerouxb Feb 11, 2025
208ca42
error out if signing didn't work
lerouxb Feb 11, 2025
3ed8b04
also print the error
lerouxb Feb 11, 2025
2a328a0
log, don't error
lerouxb Feb 11, 2025
32fae9d
add electron-windows-installer debug
lerouxb Feb 11, 2025
7e16bc0
combined output
lerouxb Feb 11, 2025
dea07ea
hack hack hack
lerouxb Feb 11, 2025
bd17d95
hack some more
lerouxb Feb 12, 2025
3890616
remove debug info
lerouxb Feb 12, 2025
431dfd5
cleanup
lerouxb Feb 12, 2025
183b795
fail if the file is not signed on windows
lerouxb Feb 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 23 additions & 21 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 3 additions & 1 deletion packages/compass/.depcheckrc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,7 @@ ignores: [
'mongodb-client-encryption',
'interruptor',
# webpack always externalizes 'clipboard' for legacy reasons
'clipboard'
'clipboard',
# include signing-utils so that signtool.go can get to it
'@mongodb-js/signing-utils'
]
1 change: 1 addition & 0 deletions packages/compass/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,7 @@
"@mongodb-js/my-queries-storage": "^0.22.0",
"@mongodb-js/prettier-config-compass": "^1.2.0",
"@mongodb-js/sbom-tools": "^0.7.0",
"@mongodb-js/signing-utils": "^0.3.7",
Copy link
Contributor Author

@lerouxb lerouxb Feb 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So the bug was that signtool.go is doing node -e 'require("@mongodb-js/signing-utils")' from the packages/compass folder and that node module doesn't exist there.

In the past it probably worked because the dep was hoisted and then it broke because now it is not.

Copy link
Contributor Author

@lerouxb lerouxb Feb 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think doing something like npx run sign -w @mongodb-js/hadron-build -- path-to-file from signtool.go would be a cleaner fix. I'll try that in a follow-up.

"@mongodb-js/testing-library-compass": "^1.2.0",
"@mongodb-js/tsconfig-compass": "^1.2.0",
"@mongodb-js/webpack-config-compass": "^1.6.0",
Expand Down
Binary file modified packages/hadron-build/signtool/signtool.exe
View file
Open in desktop
Binary file not shown.
13 changes: 10 additions & 3 deletions packages/hadron-build/signtool/signtool.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,10 @@ func main() {
}

allowedExtensions := []string{
"GARASIGN_USERNAME",
"GARASIGN_PASSWORD",
"ARTIFACTORY_USERNAME",
"ARTIFACTORY_PASSWORD",
"SIGNING_SERVER_HOSTNAME",
"SIGNING_SERVER_PRIVATE_KEY",
"SIGNING_SERVER_USERNAME",
Expand Down Expand Up @@ -55,12 +59,15 @@ func main() {
cmd := exec.Command("node", "-e", script)
fmt.Println("Running command:", cmd.String())

cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
stdoutStderr, err := cmd.CombinedOutput()

err := cmd.Run()
if err != nil {
fmt.Println("Error signing the file")
fmt.Printf("%s\n", stdoutStderr)
log.Println(err)
Copy link
Contributor Author

@lerouxb lerouxb Feb 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally this would be log.fatal(err) but then we don't see any of the logging and electron winstaller throws a huge error, none of which is helpful. Maybe it doesn't flush its subprocess's output? I'm not sure.

// if we error out then we won't see much because of how
// electron-windows-installer fails. We'll have to rely on package
// verification elsewhere to fail CI
return
}

Expand Down
Loading