Skip to content

Commit f9de769

Browse files
paulsavoiepaulsavoie
committed
merge main back to feature branch
2 parents 63c5705 + 7d32ee6 commit f9de769

3 files changed

Lines changed: 77 additions & 6 deletions

File tree

‎.github/workflows/build-and-sign.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
# This workflow is a demo of how to use the Gihub Actions workflow steps for SignPath. For a complete documentation,
2-
# view https://github.com/SignPath/github-actions
1+
# see /README.md
32

43
name: build-and-sign
54
run-name: Demo workflow signing with SignPath
@@ -35,7 +34,7 @@ jobs:
3534
.\_BuildResult-unsigned\bom.xml
3635
3736
- name: sign
38-
uses: signpath/github-action-submit-signing-request@v0.4
37+
uses: signpath/github-action-submit-signing-request@v1
3938
env:
4039
# select release-signing policy for main and release branches
4140
SIGNPATH_SIGNING_POLICY_SLUG: |

‎.signpath/artifact-configurations/default.xml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
3+
<zip-file>
4+
5+
<msi-file path="DemoExample.msi">
6+
<directory path="application/SignPath Demo">
7+
8+
<pe-file-set>
9+
<include path="Microsoft.*.dll" min-matches="0" max-matches="unbounded" />
10+
<include path="Microsoft.*.exe" min-matches="0" max-matches="unbounded" />
11+
<for-each>
12+
<authenticode-verify />
13+
</for-each>
14+
</pe-file-set>
15+
16+
<pe-file-set>
17+
<include path="Serilog.dll" product-name="Serilog" min-matches="0" />
18+
<include path="Serilog.AspNetCore.dll" product-name="Serilog" product-version="7.0.0" min-matches="0" />
19+
</pe-file-set>
20+
21+
<pe-file-set>
22+
<include path="DemoExample.dll" />
23+
<include path="DemoExample.exe" />
24+
<for-each>
25+
<authenticode-sign />
26+
</for-each>
27+
</pe-file-set>
28+
29+
</directory>
30+
<authenticode-sign />
31+
</msi-file>
32+
33+
<xml-file path="bom.xml" root-element-namespace="http://cyclonedx.org/schema/bom/1.5" root-element-name="bom">
34+
<xml-sign/>
35+
</xml-file>
36+
37+
</zip-file>
38+
</artifact-configuration>

‎README.md‎

Lines changed: 37 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,39 @@
1-
This is a demo of the Github Actions for signing software with [SignPath.io](https://about.signpath.io).
1+
# Using SignPath with GitHub Actions
22

3-
The sample workflow can be viewed at [.github/workflows/build-and-sign.yml](.github/workflows/build-and-sign.yml).
3+
This project demonstrates signing artifacts using [SignPath](https://about.signpath.io) from GitHub Actions workflows.
44

5-
For a full documentation, view [github.com/SignPath/github-actions](https://github.com/SignPath/github-actions)
5+
Signing is invoked in the `sign` step of [.github/workflows/build-and-sign.yml](.github/workflows/build-and-sign.yml).
6+
7+
See [github.com/SignPath/github-actions](https://github.com/SignPath/github-actions) for a full documentation of SignPath actions.
8+
9+
## Policy demonstrations
10+
11+
This project demonstrates the following attempts to violate SignPath policies and how they are averted on the control plane:
12+
13+
* This step selects the appropriate [signing policy] depending on the branch name. The actual branch must match the branch condition of the selected signing policy. The [`attempt-signing-release`] branch demonstrates how SignPath will detect incorrect attempts.
14+
* The [`release/malicious-dll`] branch demonstrates how SignPath will detect content-level violations of the [artifact configuration].
15+
16+
## Configuration
17+
18+
To use this demo with your own SignPath subscription, you need to get access to SignPath's GitHub Actions preview. Please contact support@signpath.io.
19+
20+
* Fork this repository
21+
* Uncheck _Copy the main branch only_
22+
* In your SignPath organization, create a project with
23+
* Slug: `Demo_Application`
24+
* Repository URLs: Your forked GitHub repository, e.g. `https://github.com/my/github-actions-demo`
25+
* Trusted Build Systems: Link _GitHub.com_
26+
* Add the following artifact configuration as default: [.signpath/artifact-configurations/default.xml](.signpath/artifact-configurations/default.xml)
27+
* Add a `test-signing` signing policy
28+
* Add a `release-signing` signing policy with origin verification enabled and restricted to `main` and `release/*` branches
29+
* Create an [API token] in SignPath and add it as a GitHub Actions secret `SIGNPATH_API_TOKEN` (make sure the user is a submitter in your signing policies)
30+
* Add your SignPath _Organization ID_ as a GitHub Actions variable `SIGNPATH_ORGANIZATION_ID` (click your organization's name at the upper right corner)
31+
* Enable Actions for your GitHub repository
32+
33+
34+
[signing policy]: https://about.signpath.io/documentation/projects#signing-policies
35+
[artifact configuration]: https://about.signpath.io/documentation/projects#artifact-configurations
36+
[`attempt-signing-release`]: https://github.com/SignPath/github-actions-demo/blob/feature/attempt-signing-release/.github/workflows/build-and-sign.yml#L46
37+
[`release/malicious-dll`]: https://github.com/SignPath/github-actions-demo/blob/release/malicious-dll/src/Build.ps1#L4
38+
39+
[API token]: https://about.signpath.io/documentation/users#interactive-api-token

0 commit comments

Comments
 (0)