Repository navigation
ci(release): sign Windows with Azure Artifact Signing over OIDC - #104
Merged
Merged
Conversation
The sign-windows job now runs in the `release` environment with `id-token: write`, logs in with azure/login right before each signing step (the OIDC token lives minutes), and signs with signtool and the Microsoft.ArtifactSigning.Client dlib through script/sign-windows.ps1. The dlib metadata excludes every credential a runner cannot satisfy, so a missing login fails in seconds instead of waiting on a browser. Detection reads ARTIFACT_SIGNING_ENDPOINT, ARTIFACT_SIGNING_ACCOUNT and ARTIFACT_SIGNING_CERT_PROFILE alone: all unset leaves the binaries unsigned with a warning, a partial set is an error. The PFX fallback (WIN_CSC_LINK / WIN_CSC_KEY_PASSWORD) and the AZURE_ARTIFACT_SIGNING_* names are gone, as is the NotTrusted/UnknownError allowance: every file is read back with `signtool verify /pa /v` and Get-AuthenticodeSignature must be Valid with signer CN=McKinley Rice, Inc., logged as `<file> signed by <Subject>`. Mirrors redrob-launcher #20 and redrob-cad #45.
The first dry run signed every file but the read-back rejected the signer: the Subject renders as `CN="McKinley Rice, Inc.", O=...` (quoted, because the name contains a comma), so a regex over the raw string never matched and the job recorded the binaries as unsigned. GetNameInfo(SimpleName) yields the CN value itself.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens Windows code signing to Azure Artifact Signing authenticated with the job's OpenID Connect token, the same shape as redrob-launcher #20 and redrob-cad #45.
sign-windowsruns inenvironment: releasewithpermissions: contents: read, id-token: write.azure/login@v3(AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_SUBSCRIPTION_ID,if: env.AZURE_CLIENT_ID != '') runs after the artifact download and immediately before each signing step; a second login precedes the installer signing since the installer build sits between them. GitHub's OIDC token lives minutes.script/sign-windows.ps1is rewritten: signtool + theMicrosoft.ArtifactSigning.Clientdlib (Azure.CodeSigning.Dlib.dll, x64) with ametadata.jsonwhoseExcludeCredentialslists InteractiveBrowser, ManagedIdentity, SharedTokenCache, VisualStudio, VisualStudioCode, AzurePowerShell, AzureDeveloperCli and WorkloadIdentity, so a missing login fails in seconds instead of waiting on a browser. It reads back every file withsigntool verify /pa /vandGet-AuthenticodeSignature(Status must beValid) and prints<file> signed by <Subject>.ARTIFACT_SIGNING_ENDPOINT,ARTIFACT_SIGNING_ACCOUNT,ARTIFACT_SIGNING_CERT_PROFILEonly. All unset: unsigned with a warning (unchanged behaviour). Some set: error. This is what tripped the v0.6.4 release yesterday with the old six-name check.WIN_CSC_LINK,WIN_CSC_KEY_PASSWORD), theAZURE_ARTIFACT_SIGNING_*names,azure/artifact-signing-action, and theNotTrusted/UnknownErrorallowance. The workflow verify steps additionally require the signer to beCN=McKinley Rice, Inc..docs/BRANCHING.mddescribes the new setup and secret names.The
releaseenvironment was created on the repository (it had none).Verification
Dry run of the release workflow from this branch (
dry_run: true,bump: patch): run 38578721967. Thesign-windowsjob is green end to end; its log shows, for each ofredrob-windows-x64,redrob-windows-x64-baseline,redrob-windows-arm64redrob.exeandredrob-code-x64-setup.exe:An earlier dry run (38577750093) signed the same files but the read-back rejected the signer because the Subject renders the CN quoted; the second commit compares the parsed CN instead.