Skip to content

Commit 4658ef5

Browse files
nb-ccdnb-ccd
committed
chore: test Windows code signing credentials are available in the build
1 parent c0c6d60 commit 4658ef5

File tree

2 files changed

+195
-2
lines changed

2 files changed

+195
-2
lines changed

‎.github/workflows/build-test.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,11 @@ on:
3838
branches: main
3939
types: [opened, synchronize, reopened, ready_for_review]
4040
paths:
41-
- '.github/workflows/build-test.yaml'
41+
# - '.github/workflows/build-test.yaml' # Don't trigger normal tests on this branch, it is only for code signing logic
4242
- '**/Cargo.toml'
4343
- '**/Cargo.lock'
4444
- '**.rs'
45-
- '**.yaml'
45+
# - '**.yaml' # Don't trigger normal tests on this branch, it is only for code signing logic
4646
- '**.hs'
4747
- 'concordium-base'
4848
- 'concordium-consensus/smart-contracts'

‎.github/workflows/test-windows-code-signing.yaml‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
name: Test Windows certificate setup
2+
3+
on:
4+
push:
5+
branches: SRE-1219/windows
6+
7+
env:
8+
UBUNTU_VERSION: '24.04'
9+
STATIC_LIBRARIES_IMAGE_TAG: 'rust-1.82_ghc-9.6.6-0'
10+
RUST_VERSION: '1.82'
11+
STACK_VERSION: '3.1.1'
12+
FLATBUFFERS_VERSION: '23.5.26'
13+
GHC_VERSION: '9.6.6'
14+
PROTOC_VERSION: '28.3'
15+
STATIC_NODE_BINARY_IMAGE_NAME: 'static-node-binaries'
16+
DOCKER_ARTIFACT_NAME: 'image'
17+
AWS_ROLE_TO_ASSUME: 'arn:aws:iam::192549843005:role/github_concordium-node'
18+
S3_ARN_TEMPLATES: '{
19+
\"database-exporter\": {\"bucket\": \"distribution.concordium.software\", \"dir\": \"tools/linux\", \"name\": \"database-exporter_${VERSION}.deb\"},
20+
\"p2p-bootstrapper\": {\"bucket\": \"distribution.concordium.software\", \"dir\": \"tools/linux\", \"name\": \"p2p-bootstrapper_${VERSION}.deb\"},
21+
\"node-stagenet-linux\": {\"bucket\": \"distribution.stagenet.concordium.com\", \"dir\": \"deb\", \"name\": \"concordium-stagenet-node_${VERSION}_amd64.deb\"},
22+
\"node-flynet-linux\": {\"bucket\": \"distribution.flynet.concordium.com\", \"dir\": \"deb\", \"name\": \"concordium-flynet-node_${VERSION}_amd64.deb\"},
23+
\"node-testnet-linux\": {\"bucket\": \"distribution.testnet.concordium.com\", \"dir\": \"deb\", \"name\": \"concordium-testnet-node_${VERSION}_amd64.deb\"},
24+
\"node-mainnet-linux\": {\"bucket\": \"distribution.mainnet.concordium.software\", \"dir\": \"deb\", \"name\": \"concordium-mainnet-node_${VERSION}_amd64.deb\"},
25+
\"node-macos\": {\"bucket\": \"distribution.concordium.software\", \"dir\": \"macos\", \"name\": \"concordium-node-${VERSION}.pkg\"},
26+
\"node-windows\": {\"bucket\": \"distribution.concordium.software\", \"dir\": \"windows\", \"name\": \"Node-${VERSION}.msi\"}
27+
}'
28+
DOCKER_TAGS_TEMPLATES: '{
29+
\"docker-stagenet\": \"concordium/stagenet-node:${VERSION}\",
30+
\"docker-testnet\": \"concordium/testnet-node:${VERSION}\",
31+
\"docker-mainnet\": \"concordium/mainnet-node:${VERSION}\",
32+
\"docker-bootstrapper\": \"concordium/bootstrapper:${VERSION}\"
33+
}'
34+
REGISTRY: docker.io
35+
SERVICE: "node-windows"
36+
37+
permissions:
38+
id-token: write
39+
contents: read
40+
41+
jobs:
42+
43+
validate-preconditions:
44+
runs-on: ubuntu-latest
45+
outputs:
46+
s3_arns: ${{ steps.render.outputs.s3_arns }}
47+
docker_tags: ${{ steps.render.outputs.docker_tags }}
48+
release_type: ${{ steps.versions_derivation.outputs.release_type }}
49+
base_version: ${{ steps.versions_derivation.outputs.base_version }}
50+
version: ${{ steps.versions_derivation.outputs.version }}
51+
steps:
52+
- name: Checkout Repository
53+
uses: actions/checkout@v4
54+
55+
- name: Validate version
56+
id: versions_derivation
57+
run: |
58+
CARGO_VERSION=$(yq .package.version concordium-node/Cargo.toml)
59+
if [ -z "${{ env.SERVICE }}" ]; then
60+
IFS='-' read -r VERSION BUILD RELEASE_TYPE <<< "${{ github.ref_name }}"
61+
if [ ! "$VERSION" = "$CARGO_VERSION" ]; then
62+
echo "::error::${CARGO_VERSION} does not match ${VERSION}."
63+
exit 1
64+
fi
65+
else
66+
RELEASE_TYPE="${{ env.SERVICE }}"
67+
BUILD=$(git rev-parse --short HEAD)
68+
fi
69+
echo "::notice::RELEASE_TYPE=${RELEASE_TYPE}"
70+
echo "release_type=${RELEASE_TYPE}" >> "$GITHUB_OUTPUT"
71+
echo "version=${CARGO_VERSION}-${BUILD}" >> "$GITHUB_OUTPUT"
72+
echo "base_version=${CARGO_VERSION}" >> "$GITHUB_OUTPUT"
73+
- name: Templates rendering
74+
id: render
75+
run: |
76+
export VERSION="${{ steps.versions_derivation.outputs.version }}"
77+
echo "s3_arns=${{ env.S3_ARN_TEMPLATES }}" >> $GITHUB_OUTPUT
78+
echo "docker_tags=${{ env.DOCKER_TAGS_TEMPLATES }}" >> $GITHUB_OUTPUT
79+
80+
node-windows:
81+
runs-on: windows-latest
82+
needs: [validate-preconditions]
83+
if: contains(fromJSON('["rc", "alpha", "node-windows"]'), needs.validate-preconditions.outputs.release_type)
84+
defaults:
85+
run:
86+
shell: pwsh
87+
steps:
88+
- name: Checkout Repository
89+
uses: actions/checkout@v4
90+
with:
91+
submodules: recursive
92+
93+
- name: Extrapolate artifact name
94+
run: |
95+
ARTIFACT_NAME=$(echo '${{ needs.validate-preconditions.outputs.s3_arns }}' | jq -r '.["${{ github.job }}"].name')
96+
echo "ARTIFACT_NAME=${ARTIFACT_NAME}" >> $GITHUB_ENV
97+
shell: bash
98+
99+
- name: Install DigiCert Client tools (Windows only)
100+
id: digicert_client
101+
uses: digicert/[email protected]
102+
103+
- name: Import Windows certificate (Windows only)
104+
id: windows_certificate
105+
env:
106+
# Base64 encoding of the pfx/p12 certificate for Windows code signing.
107+
SM_CLIENT_CERT_FILE_B64: ${{ secrets.WINDOWS_SM_CLIENT_CERT_FILE_B64 }}
108+
run: |
109+
$CERTIFICATE_PATH_BASE64="$env:RUNNER_TEMP\cert-b64.txt"
110+
$CERTIFICATE_PATH="$env:RUNNER_TEMP\cert.pfx"
111+
112+
Set-Content -Path $CERTIFICATE_PATH_BASE64 -Value $env:SM_CLIENT_CERT_FILE_B64
113+
certutil -decode $CERTIFICATE_PATH_BASE64 $CERTIFICATE_PATH
114+
echo "CERTIFICATE_PATH=$CERTIFICATE_PATH" >> $env:GITHUB_OUTPUT
115+
116+
- name: Run smctl healthcheck to confirm if the tool is configured properly.
117+
working-directory: ${{steps.build.outputs.bin_dir}}
118+
env:
119+
# windows signing
120+
# FILE_TO_SIGN: ${{ steps.build.outputs.FILE_TO_SIGN }}
121+
WINDOWS_PKCS11_CONFIG: ${{ steps.digicert_client.outputs.PKCS11_CONFIG }}
122+
WINDOWS_SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SM_KEYPAIR_ALIAS }}
123+
SM_HOST: ${{ vars.WINDOWS_SM_HOST }}
124+
SM_API_KEY: ${{ secrets.WINDOWS_SM_API_KEY }}
125+
SM_CLIENT_CERT_FILE: ${{ steps.windows_certificate.outputs.CERTIFICATE_PATH }}
126+
SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SM_CLIENT_CERT_PASSWORD }}
127+
run: |
128+
smctl healthcheck --tools --verbose
129+
# smctl sign --verbose --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ${{ env.FILE_TO_SIGN }} --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} --verbose --exit-non-zero-on-fail --failfast
130+
shell: cmd
131+
132+
# - name: Install dependencies
133+
# run: |
134+
# choco install yq jq -y
135+
# shell: bash
136+
137+
# - name: Install Rust
138+
# uses: actions-rust-lang/setup-rust-toolchain@v1
139+
# with:
140+
# toolchain: ${{ env.RUST_VERSION }}-x86_64-pc-windows-msvc
141+
142+
# - name: Install Rust
143+
# uses: actions-rust-lang/setup-rust-toolchain@v1
144+
# with:
145+
# toolchain: ${{ env.RUST_VERSION }}-x86_64-pc-windows-gnu
146+
147+
# - name: Setup node folder
148+
# run: |
149+
# mkdir -p "C:/Program Files/node/include"
150+
# Add-Content -Path $env:GITHUB_PATH -Value "C:/Program Files/node"
151+
152+
# - name: Install flatbuffers
153+
# run: |
154+
# curl -L -O https://github.com/google/flatbuffers/releases/download/v${{ env.FLATBUFFERS_VERSION }}/Windows.flatc.binary.zip
155+
# unzip Windows.flatc.binary.zip
156+
# mv flatc.exe "C:/Program Files/node/"
157+
158+
# - name: Install protobuf (protoc)
159+
# run: |
160+
# curl -L -O https://github.com/protocolbuffers/protobuf/releases/download/v${{ env.PROTOC_VERSION }}/protoc-${{ env.PROTOC_VERSION }}-win64.zip
161+
# unzip protoc-${{ env.PROTOC_VERSION }}-win64.zip
162+
# mv bin/protoc.exe "C:/Program Files/node/"
163+
# mv include/* "C:/Program Files/node/include"
164+
165+
# - name: Setup Haskell
166+
# uses: haskell-actions/setup@v2
167+
# with:
168+
# ghc-version: ${{ env.GHC_VERSION }}
169+
# enable-stack: true
170+
# stack-version: ${{ env.STACK_VERSION }}
171+
172+
# - uses: milliewalky/setup-7-zip@v1
173+
174+
# - name: Install GCC
175+
# run: |
176+
# curl -L -O https://github.com/brechtsanders/winlibs_mingw/releases/download/14.2.0posix-19.1.1-12.0.0-msvcrt-r2/winlibs-x86_64-posix-seh-gcc-14.2.0-llvm-19.1.1-mingw-w64msvcrt-12.0.0-r2.7z
177+
# 7z x winlibs-x86_64-posix-seh-gcc-14.2.0-llvm-19.1.1-mingw-w64msvcrt-12.0.0-r2.7z -oC:/gcc
178+
# Add-Content -Path $env:GITHUB_PATH -Value "C:/gcc/mingw64/bin"
179+
180+
# - name: Install LMDB
181+
# run: stack exec -- pacman -S --noconfirm mingw-w64-x86_64-lmdb
182+
183+
# - name: Build Windows Node
184+
# run: |
185+
# ./scripts/distribution/windows/build-all.ps1 -nodeVersion ${{ needs.validate-preconditions.outputs.version }} -rustVersion ${{ env.RUST_VERSION }}
186+
# cp ./service/windows/installer/Node.msi ./${{ env.ARTIFACT_NAME }}
187+
188+
# - name: Upload artifact
189+
# uses: actions/upload-artifact@v4
190+
# with:
191+
# name: ${{ github.job }}
192+
# path: ${{ env.ARTIFACT_NAME }}
193+

0 commit comments

Comments
 (0)