retry omnibus code signing (#29552)

omnibus/lib/project_extension.rb

@@ -41,26 +41,48 @@ def package_me
 
     def ddwcssign(file)
       log.info(self.class.name) { "Signing #{file}" }
-      cmd = Array.new.tap do |arr|
+
+      # Signing is inherently flaky as the timestamp server may not be available
+      # retry a few times
+      max_retries = 3
+      attempts = 0
+      delay = 2
+
+      begin
+        attempts += 1
+        cmd = Array.new.tap do |arr|
           arr << "dd-wcs"
           arr << "sign"
           arr << "\"#{file}\""
-      end.join(" ")
-      status = shellout(cmd)
-      if status.exitstatus != 0
-        log.warn(self.class.name) do
-        <<-EOH.strip
-          Failed to sign with dd-wcs
-
-          STDOUT
-          ------
-          #{status.stdout}
-
-          STDERR
-          ------
-          #{status.stderr}
-        EOH
+        end.join(" ")
+
+        status = shellout(cmd)
+        if status.exitstatus != 0
+          log.warn(self.class.name) do
+            <<-EOH.strip
+              Failed to sign with dd-wcs (Attempt #{attempts} of #{max_retries})
+    
+              STDOUT
+              ------
+              #{status.stdout}
+    
+              STDERR
+              ------
+              #{status.stderr}
+            EOH
+          end
+          raise "Failed to sign with dd-wcs"
+        else
+          log.info(self.class.name) { "Successfully signed #{file} after #{attempts} attempt(s)" }
+        end
+      rescue => e
+        # Retry logic: raise error after 3 attempts
+        if attempts < max_retries
+          log.info(self.class.name) { "Retrying signing #{file} (Attempt #{attempts + 1})" }
+          sleep(delay)
+          retry
         end
+        raise "Failed to sign with dd-wcs: #{e.message}"
       end
     end
 
@@ -78,4 +100,4 @@ class Project
     expose :inspect_binary
     expose :sign_file
   end
-end
+end