Skip to content

Update code signing with latest Azure Trusted Signing tools/tasks #1644

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mjcheetham merged 2 commits into from
Jun 27, 2024
Merged

Update code signing with latest Azure Trusted Signing tools/tasks #1644

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c724c8d
release: use trusted-signing-action
mjcheetham Jun 25, 2024
e3facc5
release: use custom Sign.Cli tool for signing
mjcheetham Jun 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 16 additions & 30 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,10 +177,10 @@ jobs:
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- name: Sign payload files with Azure Code Signing
uses: azure/azure-code-[email protected].1
uses: azure/trusted-[email protected].20
with:
endpoint: https://wus2.codesigning.azure.net/
code-signing-account-name: git-fundamentals-signing
trusted-signing-account-name: git-fundamentals-signing
certificate-profile-name: git-fundamentals-windows-signing
files-folder: ${{ github.workspace }}\payload
files-folder-filter: exe,dll
Expand All @@ -204,10 +204,10 @@ jobs:
-Destination $env:GITHUB_WORKSPACE\installers

- name: Sign installers with Azure Code Signing
uses: azure/azure-code-[email protected].1
uses: azure/trusted-[email protected].20
with:
endpoint: https://wus2.codesigning.azure.net/
code-signing-account-name: git-fundamentals-signing
trusted-signing-account-name: git-fundamentals-signing
certificate-profile-name: git-fundamentals-windows-signing
files-folder: ${{ github.workspace }}\installers
files-folder-filter: exe
Expand Down Expand Up @@ -353,27 +353,20 @@ jobs:
env:
AST: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
ASC: ${{ secrets.AZURE_STORAGE_CONTAINER }}
SCT: ${{ secrets.SIGN_CLI_TOOL }}
SCT: 'Sign.Cli-alpha.zip'
run: |
az storage blob download --file sign-cli.zip --auth-mode login `
--account-name $env:AST --container-name $env:ASC --name $env:SCT
Expand-Archive -Path sign-cli.zip -DestinationPath .\sign-cli

- name: Sign payload
env:
ACST: ${{ secrets.AZURE_TENANT_ID }}
ACSI: ${{ secrets.AZURE_CLIENT_ID }}
ACSS: ${{ secrets.AZURE_CLIENT_SECRET }}
run: |
./sign-cli/sign.exe code azcodesign payload/* `
-acsu https://wus2.codesigning.azure.net/ `
-acsa git-fundamentals-signing `
-acscp git-fundamentals-windows-signing `
./sign-cli/sign.exe code trusted-signing payload/* `
-tse https://wus2.codesigning.azure.net/ `
-tsa git-fundamentals-signing `
-tscp git-fundamentals-windows-signing `
-d "Git Fundamentals Windows Signing Certificate" `
-u "https://github.com/git-ecosystem/git-credential-manager" `
-acst $env:ACST `
-acsi $env:ACSI `
-acss $env:ACSS
-u "https://github.com/git-ecosystem/git-credential-manager"

- name: Lay out signed payload, images, and symbols
shell: bash
Expand Down Expand Up @@ -444,28 +437,21 @@ jobs:
env:
AST: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
ASC: ${{ secrets.AZURE_STORAGE_CONTAINER }}
SCT: ${{ secrets.SIGN_CLI_TOOL }}
SCT: 'Sign.Cli-alpha.zip'
run: |
az storage blob download --file sign-cli.zip --auth-mode login `
--account-name $env:AST --container-name $env:ASC --name $env:SCT
Expand-Archive -Path sign-cli.zip -DestinationPath .\sign-cli

- name: Sign package
env:
ACST: ${{ secrets.AZURE_TENANT_ID }}
ACSI: ${{ secrets.AZURE_CLIENT_ID }}
ACSS: ${{ secrets.AZURE_CLIENT_SECRET }}
run: |
./sign-cli/sign.exe code azcodesign nupkg/* `
-acsu https://wus2.codesigning.azure.net/ `
-acsa git-fundamentals-signing `
-acscp git-fundamentals-windows-signing `
./sign-cli/sign.exe code trusted-signing nupkg/* `
-tse https://wus2.codesigning.azure.net/ `
-tsa git-fundamentals-signing `
-tscp git-fundamentals-windows-signing `
-d "Git Fundamentals Windows Signing Certificate" `
-u "https://github.com/git-ecosystem/git-credential-manager" `
-acst $env:ACST `
-acsi $env:ACSI `
-acss $env:ACSS `
-acsc nuget-signing-certificate.cer
-co nuget-signing-certificate.cer

mv nupkg/* .

Expand Down