Skip to content

Commit b1964c7

Browse files
nb-ccdnb-ccd
committed
fix: enable code signing
1 parent d629fc3 commit b1964c7

File tree

1 file changed

+58
-51
lines changed

1 file changed

+58
-51
lines changed

‎.github/workflows/test-windows-code-signing.yaml‎

Lines changed: 58 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ jobs:
8080
8181
node-windows:
8282
runs-on: windows-latest
83-
# environment: release # This step needs to use the release context to access credentials for code signing.
83+
environment: release # This step needs to use the release context to access credentials for code signing.
8484
needs: [validate-preconditions]
8585
if: contains(fromJSON('["rc", "alpha", "node-windows"]'), needs.validate-preconditions.outputs.release_type)
8686
defaults:
@@ -102,35 +102,31 @@ jobs:
102102
id: digicert_client
103103
uses: digicert/[email protected]
104104

105-
# Disabling these to test the windows-y commandline file manipulation stuff.
106-
# - name: Import Windows certificate (Windows only)
107-
# id: windows_certificate
108-
# env:
109-
# # Base64 encoding of the pfx/p12 certificate for Windows code signing.
110-
# SM_CLIENT_CERT_FILE_B64: ${{ secrets.WINDOWS_SM_CLIENT_CERT_FILE_B64 }}
111-
# run: |
112-
# $CERTIFICATE_PATH_BASE64="$env:RUNNER_TEMP\cert-b64.txt"
113-
# $CERTIFICATE_PATH="$env:RUNNER_TEMP\cert.pfx"
114-
115-
# Set-Content -Path $CERTIFICATE_PATH_BASE64 -Value $env:SM_CLIENT_CERT_FILE_B64
116-
# certutil -decode $CERTIFICATE_PATH_BASE64 $CERTIFICATE_PATH
117-
# echo "CERTIFICATE_PATH=$CERTIFICATE_PATH" >> $env:GITHUB_OUTPUT
118-
119-
# - name: Run smctl healthcheck to confirm if the tool is configured properly.
120-
# working-directory: ${{steps.build.outputs.bin_dir}}
121-
# env:
122-
# # windows signing
123-
# # FILE_TO_SIGN: ${{ steps.build.outputs.FILE_TO_SIGN }}
124-
# WINDOWS_PKCS11_CONFIG: ${{ steps.digicert_client.outputs.PKCS11_CONFIG }}
125-
# WINDOWS_SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SM_KEYPAIR_ALIAS }}
126-
# SM_HOST: ${{ vars.WINDOWS_SM_HOST }}
127-
# SM_API_KEY: ${{ secrets.WINDOWS_SM_API_KEY }}
128-
# SM_CLIENT_CERT_FILE: ${{ steps.windows_certificate.outputs.CERTIFICATE_PATH }}
129-
# SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SM_CLIENT_CERT_PASSWORD }}
130-
# run: |
131-
# smctl healthcheck --all
132-
# # smctl sign --verbose --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ${{ env.FILE_TO_SIGN }} --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} --verbose --exit-non-zero-on-fail --failfast
133-
# shell: cmd
105+
- name: Import Windows certificate (Windows only)
106+
id: windows_certificate
107+
env:
108+
# Base64 encoding of the pfx/p12 certificate for Windows code signing.
109+
SM_CLIENT_CERT_FILE_B64: ${{ secrets.WINDOWS_SM_CLIENT_CERT_FILE_B64 }}
110+
run: |
111+
$CERTIFICATE_PATH_BASE64="$env:RUNNER_TEMP\cert-b64.txt"
112+
$CERTIFICATE_PATH="$env:RUNNER_TEMP\cert.pfx"
113+
114+
Set-Content -Path $CERTIFICATE_PATH_BASE64 -Value $env:SM_CLIENT_CERT_FILE_B64
115+
certutil -decode $CERTIFICATE_PATH_BASE64 $CERTIFICATE_PATH
116+
echo "CERTIFICATE_PATH=$CERTIFICATE_PATH" >> $env:GITHUB_OUTPUT
117+
118+
- name: Run smctl healthcheck to confirm if the tool is configured properly.
119+
working-directory: ${{steps.build.outputs.bin_dir}}
120+
env:
121+
WINDOWS_PKCS11_CONFIG: ${{ steps.digicert_client.outputs.PKCS11_CONFIG }}
122+
WINDOWS_SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SM_KEYPAIR_ALIAS }}
123+
SM_HOST: ${{ vars.WINDOWS_SM_HOST }}
124+
SM_API_KEY: ${{ secrets.WINDOWS_SM_API_KEY }}
125+
SM_CLIENT_CERT_FILE: ${{ steps.windows_certificate.outputs.CERTIFICATE_PATH }}
126+
SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SM_CLIENT_CERT_PASSWORD }}
127+
run: |
128+
smctl healthcheck --all
129+
shell: cmd
134130

135131
- name: Install dependencies
136132
run: |
@@ -207,25 +203,25 @@ jobs:
207203
mv ./Node/NodeCollector ./Node/NodeCollector.exe
208204
mv ./Node/ConcordiumNode ./Node/ConcordiumNode.exe
209205
210-
# - name: Sign files with smctl
211-
# working-directory: ${{steps.build.outputs.bin_dir}}
212-
# env:
213-
# WINDOWS_PKCS11_CONFIG: ${{ steps.digicert_client.outputs.PKCS11_CONFIG }}
214-
# WINDOWS_SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SM_KEYPAIR_ALIAS }}
215-
# SM_HOST: ${{ vars.WINDOWS_SM_HOST }}
216-
# SM_API_KEY: ${{ secrets.WINDOWS_SM_API_KEY }}
217-
# SM_CLIENT_CERT_FILE: ${{ steps.windows_certificate.outputs.CERTIFICATE_PATH }}
218-
# SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SM_CLIENT_CERT_PASSWORD }}
219-
# SM_ARGS: "--verbose --exit-non-zero-on-fail --failfast"
220-
# run: |
221-
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumConsensusDLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
222-
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumBaseDLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
223-
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumSmartContractEngineDLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
224-
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/Sha2DLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
225-
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/NodeRunnerService.exe --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
226-
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/NodeCollector.exe --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
227-
# smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumNode.exe --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
228-
# shell: cmd
206+
- name: Sign files with smctl
207+
working-directory: ${{steps.build.outputs.bin_dir}}
208+
env:
209+
WINDOWS_PKCS11_CONFIG: ${{ steps.digicert_client.outputs.PKCS11_CONFIG }}
210+
WINDOWS_SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SM_KEYPAIR_ALIAS }}
211+
SM_HOST: ${{ vars.WINDOWS_SM_HOST }}
212+
SM_API_KEY: ${{ secrets.WINDOWS_SM_API_KEY }}
213+
SM_CLIENT_CERT_FILE: ${{ steps.windows_certificate.outputs.CERTIFICATE_PATH }}
214+
SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SM_CLIENT_CERT_PASSWORD }}
215+
SM_ARGS: "--verbose --exit-non-zero-on-fail --failfast"
216+
run: |
217+
smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumConsensusDLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
218+
smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumBaseDLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
219+
smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumSmartContractEngineDLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
220+
smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/Sha2DLL.dll --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
221+
smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/NodeRunnerService.exe --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
222+
smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/NodeCollector.exe --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
223+
smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./Node/ConcordiumNode.exe --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
224+
shell: cmd
229225

230226
- name: Rename files back to their original form without extension.
231227
run: |
@@ -243,15 +239,26 @@ jobs:
243239
makecab.exe /D MaxDiskSize=0 /D Cabinet=ON /D Compress=ON /D CabinetName1=Node.cab /D SourceDir=Node /f cabfiles.txt
244240
shell: cmd
245241

246-
247242
- name: Repackage the cabinet file.
248243
run: |
249244
rm Node.cab
250245
mv disk1\Node.cab .
251246
MsiDb.exe -d ./service/windows/installer/Node.msi -k Node.cab
252247
MsiDb.exe -d ./service/windows/installer/Node.msi -a Node.cab
253248
254-
# Here we would sign the installer
249+
- name: Sign files with smctl
250+
working-directory: ${{steps.build.outputs.bin_dir}}
251+
env:
252+
WINDOWS_PKCS11_CONFIG: ${{ steps.digicert_client.outputs.PKCS11_CONFIG }}
253+
WINDOWS_SM_KEYPAIR_ALIAS: ${{ secrets.WINDOWS_SM_KEYPAIR_ALIAS }}
254+
SM_HOST: ${{ vars.WINDOWS_SM_HOST }}
255+
SM_API_KEY: ${{ secrets.WINDOWS_SM_API_KEY }}
256+
SM_CLIENT_CERT_FILE: ${{ steps.windows_certificate.outputs.CERTIFICATE_PATH }}
257+
SM_CLIENT_CERT_PASSWORD: ${{ secrets.WINDOWS_SM_CLIENT_CERT_PASSWORD }}
258+
SM_ARGS: "--verbose --exit-non-zero-on-fail --failfast"
259+
run: |
260+
smctl sign --keypair-alias ${{ env.WINDOWS_SM_KEYPAIR_ALIAS }} --input ./service/windows/installer/Node.msi --config-file ${{ env.WINDOWS_PKCS11_CONFIG }} ${{ env.SM_ARGS }}
261+
shell: cmd
255262

256263
- name: Rename the package to target filename.
257264
run: |

0 commit comments

Comments
 (0)