ci: Sign Windows binaries using Digicert Keylocker #2321
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
taratatach
force-pushed
the
ci/use-digicert-keylocker-to-get-code-signing-certificate
branch
3 times, most recently
from
e88ae7c
to
76ba265
Compare
taratatach
force-pushed
the
feat/hide-realtime-behind-flag
branch
2 times, most recently
from
e5fa6cc
to
697b803
Compare
taratatach
force-pushed
the
ci/use-digicert-keylocker-to-get-code-signing-certificate
branch
16 times, most recently
from
04120b3
to
63933e7
Compare
To get access to the `signtool` version tested locally, and get upgrades for other pre-installed software, we bump the base image of our builds from `Visual Studio 2017` to `Visual Studio 2022`.
taratatach
force-pushed
the
ci/use-digicert-keylocker-to-get-code-signing-certificate
branch
5 times, most recently
from
7d2ca1e
to
6672cda
Compare
We used to build binaries at the end of the `scenarios` job, in an `after_test` block to make sure it is executed even in case the scenarios fail, but this means we cannot retry by itself if it the only failing part of the build. Using a dedicated job gives us this freedom and prevents excessive generations in case we have to retry the scenarios job. We take this opportunity to simplify the syntax to store the generated artifacts.
taratatach
force-pushed
the
ci/use-digicert-keylocker-to-get-code-signing-certificate
branch
from
6672cda
to
a351b98
Compare
taratatach
changed the title
Following changes to the internation recommandations regarding code signing certificates issuance and storage, DigiCert does not allow simply downloading a certificate and use it to sign binaries. Instead, we need to store it in a HSM or, as we chose, in a cloud-based HSM such as DigiCert Keylocker. This means we need to install tools to fetch the certificate from the HSM prior to signing our software and also use a custom signing script as `electron-builder` does not support Keylocker out of the box. The process is split into 3 phases: 1. download the DigiCert client and the certificate 2. sign our binaries 3. verify the signature
taratatach
force-pushed
the
ci/use-digicert-keylocker-to-get-code-signing-certificate
branch
from
a351b98
to
ed3d626
Compare
taratatach
deleted the
ci/use-digicert-keylocker-to-get-code-signing-certificate
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Following changes to the internation recommandations regarding code
signing certificates issuance and storage, DigiCert does not allow
simply downloading a certificate and use it to sign binaries.
Instead, we need to store it in a HSM or, as we chose, in a
cloud-based HSM such as DigiCert Keylocker.
This means we need to install tools to fetch the certificate from the
HSM prior to signing our software and also use a custom signing script
as
electron-builderdoes not support Keylocker out of the box.The process is split into 3 phases:
Please make sure the following boxes are checked: