feat(windows): renew code signing certificate

Author: JackuB

cliv2/scripts/sign_windows.sh

@@ -9,21 +9,25 @@ EXPORT_PATH=${1:-./bin}
 PRODUCT_NAME=${2:-snyk_windows_amd64.exe}
 APP_PATH="$EXPORT_PATH/$PRODUCT_NAME"
 APP_PATH_UNSIGNED="$APP_PATH.unsigned"
-SIGNING_SECRETS=secrets.p12
+SIGNING_CERTIFICATE_FILE=Certificate.cer
+SIGNING_KEY_FILE=Snyk_Limited.key
 
 LOG_PREFIX="--- $(basename "$0"):"
 echo "$LOG_PREFIX Signing \"$APP_PATH\""
 
 # create files as needed
-echo "$LOG_PREFIX Creating p12 file"
-echo "$SIGNING_SECRETS_BINARY" | base64 --decode > "$SIGNING_SECRETS"
+echo "$LOG_PREFIX Creating .key file"
+echo "$SIGNING_CERTIFICATE_BINARY" | base64 --decode > "$SIGNING_CERTIFICATE_FILE"
+
+echo "$LOG_PREFIX Creating .cer file"
+echo "$SIGNING_KEY_BINARY" | base64 --decode > "$SIGNING_KEY_FILE"
 
 echo "$LOG_PREFIX Signing binary $APP_PATH_UNSIGNED"
 mv "$APP_PATH" "$APP_PATH_UNSIGNED"
 
 osslsigncode sign -h sha512 \
-  -pkcs12 "$SIGNING_SECRETS" \
-  -pass "$SIGNING_SECRETS_PASSWORD" \
+  -certs "$SIGNING_CERTIFICATE_FILE" \
+  -key "$SIGNING_KEY_FILE" \
   -n "Snyk CLI" \
   -i "https://snyk.io" \
   -t "http://timestamp.comodoca.com/authenticode" \
@@ -32,4 +36,5 @@ osslsigncode sign -h sha512 \
 
 echo "$LOG_PREFIX Cleaning up"
 rm -f "$APP_PATH_UNSIGNED"
-rm -f "$SIGNING_SECRETS"
+rm -f "$SIGNING_CERTIFICATE_FILE"
+rm -f "$SIGNING_KEY_FILE"

release-scripts/sign-windows-binary.sh

@@ -1,23 +1,24 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# create files as needed
-CERT_FILE=cert.pem
-if [ ! -f "$CERT_FILE" ]; then
-  echo "$SIGNING_CERT" | base64 --decode >"$CERT_FILE"
-fi
+SIGNING_CERTIFICATE_FILE=Certificate.cer
+SIGNING_KEY_FILE=Snyk_Limited.key
 
 # create files as needed
-KEY_FILE=key.pem
-if [ ! -f "$KEY_FILE" ]; then
-  echo "$SIGNING_KEY" | base64 --decode >"$KEY_FILE"
-fi
+echo "Creating .key file"
+echo "$SIGNING_CERTIFICATE_BINARY" | base64 --decode > "$SIGNING_CERTIFICATE_FILE"
+
+echo "Creating .cer file"
+echo "$SIGNING_KEY_BINARY" | base64 --decode > "$SIGNING_KEY_FILE"
 
 osslsigncode sign -h sha512 \
-  -certs cert.pem \
-  -key key.pem \
+  -certs "$SIGNING_CERTIFICATE_FILE" \
+  -key "$SIGNING_KEY_FILE" \
   -n "Snyk CLI" \
   -i "https://snyk.io" \
   -t "http://timestamp.comodoca.com/authenticode" \
   -in binary-releases/snyk-win-unsigned.exe \
   -out binary-releases/snyk-win.exe
+
+rm -f "$SIGNING_CERTIFICATE_FILE"
+rm -f "$SIGNING_KEY_FILE"