Skip to content

Commit a53f431

Browse files
muruganishekarmuruganishekar
authored
ci: Signtool path & MSBuild path for windows-2025 runner (#2084)
* ci: signtool path & MSBuild path
1 parent ba07693 commit a53f431

File tree

11 files changed

+81
-38
lines changed

11 files changed

+81
-38
lines changed

‎.github/workflows/component_windows_packaging.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,19 +61,20 @@ jobs:
6161

6262
- name: Import PFX certificate
6363
shell: pwsh
64-
run: build\windows\scripts\import_certificates.ps1 -pfx_passphrase "$env:PFX_PASSPHRASE" -pfx_certificate_description "$env:PFX_CERTIFICATE_DESCRIPTION"
64+
run: |
65+
build\windows\scripts\set_cert_thumbprint_env.ps1 -PfxPassphrase "$env:PFX_PASSPHRASE" -PfxCertificateDescription "$env:PFX_CERTIFICATE_DESCRIPTION"
6566
6667
- name: Set date environment variable for buildDate metadata
6768
run: echo buildDate=$(date -u +"%Y-%m-%dT%H:%M:%SZ") >> $GITHUB_ENV
6869
shell: bash
6970

7071
- name: Build executables ${{ matrix.goarch }}
7172
shell: pwsh
72-
run: build\windows\build.ps1 -arch ${{ matrix.goarch }} -version ${{env.TAG}} -commit "$env:GITHUB_SHA" -date ${{env.buildDate}}
73+
run: build\windows\build.ps1 -arch ${{ matrix.goarch }} -version ${{env.TAG}} -commit "$env:GITHUB_SHA" -date ${{env.buildDate}} -certThumbprint "$env:certThumbprint"
7374

7475
- name: Create MSI package ${{ matrix.goarch }}
7576
shell: pwsh
76-
run: build\windows\package_msi.ps1 -arch ${{ matrix.goarch }} -version ${{env.TAG}}
77+
run: build\windows\package_msi.ps1 -arch ${{ matrix.goarch }} -version ${{env.TAG}} -certThumbprint "$env:certThumbprint"
7778

7879
- name: Create zip package ${{ matrix.goarch }}
7980
shell: pwsh

‎.github/workflows/prerelease_windows.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,19 +58,20 @@ jobs:
5858

5959
- name: Import PFX certificate
6060
shell: pwsh
61-
run: build\windows\scripts\import_certificates.ps1 -pfx_passphrase "$env:PFX_PASSPHRASE" -pfx_certificate_description "$env:PFX_CERTIFICATE_DESCRIPTION"
61+
run: |
62+
build\windows\scripts\set_cert_thumbprint_env.ps1 -PfxPassphrase "$env:PFX_PASSPHRASE" -PfxCertificateDescription "$env:PFX_CERTIFICATE_DESCRIPTION"
6263
6364
- name: Set date environment variable for buildDate metadata
6465
run: echo buildDate=$(date -u +"%Y-%m-%dT%H:%M:%SZ") >> $GITHUB_ENV
6566
shell: bash
6667

6768
- name: Build executables ${{ matrix.goarch }}
6869
shell: pwsh
69-
run: build\windows\build.ps1 -arch ${{ matrix.goarch }} -version ${{env.TAG}} -commit "$env:GITHUB_SHA" -date ${{env.buildDate}}
70+
run: build\windows\build.ps1 -arch ${{ matrix.goarch }} -version ${{env.TAG}} -commit "$env:GITHUB_SHA" -date ${{env.buildDate}} -certThumbprint "$env:certThumbprint"
7071

7172
- name: Create MSI package ${{ matrix.goarch }}
7273
shell: pwsh
73-
run: build\windows\package_msi.ps1 -arch ${{ matrix.goarch }} -version ${{env.TAG}}
74+
run: build\windows\package_msi.ps1 -arch ${{ matrix.goarch }} -version ${{env.TAG}} -certThumbprint "$env:certThumbprint"
7475

7576
- name: Create zip package ${{ matrix.goarch }}
7677
shell: pwsh

‎.github/workflows/prerelease_windows_on_demand.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -59,19 +59,20 @@ jobs:
5959

6060
- name: Import PFX certificate
6161
shell: pwsh
62-
run: build\windows\scripts\import_certificates.ps1 -pfx_passphrase "$env:PFX_PASSPHRASE" -pfx_certificate_description "$env:PFX_CERTIFICATE_DESCRIPTION"
62+
run: |
63+
build\windows\scripts\set_cert_thumbprint_env.ps1 -PfxPassphrase "$env:PFX_PASSPHRASE" -PfxCertificateDescription "$env:PFX_CERTIFICATE_DESCRIPTION"
6364
6465
- name: Set date environment variable for buildDate metadata
6566
run: echo buildDate=$(date -u +"%Y-%m-%dT%H:%M:%SZ") >> $GITHUB_ENV
6667
shell: bash
6768

6869
- name: Build executables ${{ matrix.goarch }}
6970
shell: pwsh
70-
run: build\windows\build.ps1 -arch ${{ matrix.goarch }} -version ${{env.FAKE_TAG}} -commit "$env:GITHUB_SHA" -date ${{env.buildDate}}
71+
run: build\windows\build.ps1 -arch ${{ matrix.goarch }} -version ${{env.FAKE_TAG}} -commit "$env:GITHUB_SHA" -date ${{env.buildDate}} -certThumbprint "$env:certThumbprint"
7172

7273
- name: Create MSI package ${{ matrix.goarch }}
7374
shell: pwsh
74-
run: build\windows\package_msi.ps1 -arch ${{ matrix.goarch }} -version ${{env.FAKE_TAG}}
75+
run: build\windows\package_msi.ps1 -arch ${{ matrix.goarch }} -version ${{env.FAKE_TAG}} -certThumbprint "$env:certThumbprint"
7576

7677
- name: Create zip package ${{ matrix.goarch }}
7778
shell: pwsh
@@ -84,7 +85,7 @@ jobs:
8485
files_path: './${{ env.REPO_WORKDIR }}/dist'
8586

8687
- name: Archive production artifacts
87-
uses: actions/upload-artifact@v2 #v3 just got released and was not working in windows
88+
uses: actions/upload-artifact@v4
8889
with:
8990
name: windows-assets
9091
path: dist
@@ -101,7 +102,7 @@ jobs:
101102

102103
steps:
103104
- name: Download a single artifact
104-
uses: actions/download-artifact@v2
105+
uses: actions/download-artifact@v4
105106
with:
106107
name: windows-assets
107108

‎build/package/windows/newrelic-infra-386-installer/newrelic-infra/newrelic-infra-installer.wixproj‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,19 @@
88
<SchemaVersion>2.0</SchemaVersion>
99
<OutputName>newrelic-infra-386</OutputName>
1010
<OutputType>Package</OutputType>
11-
<SignToolPath>C:\Program Files (x86)\Windows Kits\10\bin\x64\</SignToolPath>
11+
<SignToolPath>C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\</SignToolPath>
1212
<WixTargetsPath Condition=" '$(WixTargetsPath)' == '' AND '$(MSBuildExtensionsPath32)' != '' ">$(MSBuildExtensionsPath32)\Microsoft\WiX\v3.x\Wix.targets</WixTargetsPath>
1313
<WixTargetsPath Condition=" '$(WixTargetsPath)' == '' ">$(MSBuildExtensionsPath)\Microsoft\WiX\v3.x\Wix.targets</WixTargetsPath>
1414
<Name>newrelic-infra-installer</Name>
1515
<DefineSolutionProperties>false</DefineSolutionProperties>
16+
</PropertyGroup>
17+
<!-- NEW: Define default values for SignToolArgs and SkipSigning -->
18+
<PropertyGroup>
19+
<!-- Define a default for SignToolArgs if it's not passed from MSBuild -->
20+
<!-- Using SHA256 as a recommended default -->
21+
<SignToolArgs Condition="'$(SignToolArgs)' == ''">/fd SHA256 /tr http://timestamp.digicert.com /td SHA256</SignToolArgs>
22+
<!-- Define a default for SkipSigning if it's not passed -->
23+
<SkipSigning Condition="'$(SkipSigning)' == ''">false</SkipSigning>
1624
</PropertyGroup>
1725
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|x86' ">
1826
<OutputPath>bin\$(Configuration)\</OutputPath>
@@ -46,8 +54,8 @@
4654
<Output TaskParameter="Value" PropertyName="DefineConstants" />
4755
</CreateProperty>
4856
</Target>
49-
<Target Name="SignInstaller">
50-
<Exec Command="&quot;$(SignToolPath)signtool.exe&quot; sign /d &quot;New Relic Infrastructure Agent&quot; /n &quot;New Relic, Inc.&quot; &quot;$(OutputPath)$(OutputName).msi&quot;" />
57+
<Target Name="SignInstaller" Condition="'$(SkipSigning)' != 'true'">
58+
<Exec Command="&quot;$(SignToolPath)signtool.exe&quot; sign $(SignToolArgs) /d &quot;New Relic Infrastructure Agent&quot; /n &quot;New Relic, Inc.&quot; &quot;$(OutputPath)$(OutputName).msi&quot;" />
5159
<Copy SourceFiles="$(OutputPath)$(OutputName).msi" DestinationFiles="$(OutputPath)$(OutputName).1.0.NNN.msi" />
5260
<!-- <Delete Files="$(OutputPath)$(OutputName).msi" /> -->
5361
</Target>

‎build/package/windows/newrelic-infra-amd64-installer/newrelic-infra/newrelic-infra-installer.wixproj‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,19 @@
88
<SchemaVersion>2.0</SchemaVersion>
99
<OutputName>newrelic-infra-amd64</OutputName>
1010
<OutputType>Package</OutputType>
11-
<SignToolPath>C:\Program Files (x86)\Windows Kits\10\bin\x64\</SignToolPath>
11+
<SignToolPath>C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\</SignToolPath>
1212
<WixTargetsPath Condition=" '$(WixTargetsPath)' == '' AND '$(MSBuildExtensionsPath32)' != '' ">$(MSBuildExtensionsPath32)\Microsoft\WiX\v3.x\Wix.targets</WixTargetsPath>
1313
<WixTargetsPath Condition=" '$(WixTargetsPath)' == '' ">$(MSBuildExtensionsPath)\Microsoft\WiX\v3.x\Wix.targets</WixTargetsPath>
1414
<Name>newrelic-infra-installer</Name>
1515
<DefineSolutionProperties>false</DefineSolutionProperties>
16+
</PropertyGroup>
17+
<!-- NEW: Define default values for SignToolArgs and SkipSigning -->
18+
<PropertyGroup>
19+
<!-- Define a default for SignToolArgs if it's not passed from MSBuild -->
20+
<!-- Using SHA256 as a recommended default -->
21+
<SignToolArgs Condition="'$(SignToolArgs)' == ''">/fd SHA256 /tr http://timestamp.digicert.com /td SHA256</SignToolArgs>
22+
<!-- Define a default for SkipSigning if it's not passed -->
23+
<SkipSigning Condition="'$(SkipSigning)' == ''">false</SkipSigning>
1624
</PropertyGroup>
1725
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|x86' ">
1826
<OutputPath>bin\$(Configuration)\</OutputPath>
@@ -46,8 +54,8 @@
4654
<Output TaskParameter="Value" PropertyName="DefineConstants" />
4755
</CreateProperty>
4856
</Target>
49-
<Target Name="SignInstaller">
50-
<Exec Command="&quot;$(SignToolPath)signtool.exe&quot; sign /d &quot;New Relic Infrastructure Agent&quot; /n &quot;New Relic, Inc.&quot; &quot;$(OutputPath)$(OutputName).msi&quot;" />
57+
<Target Name="SignInstaller" Condition="'$(SkipSigning)' != 'true'">
58+
<Exec Command="&quot;$(SignToolPath)signtool.exe&quot; sign $(SignToolArgs) /d &quot;New Relic Infrastructure Agent&quot; /n &quot;New Relic, Inc.&quot; &quot;$(OutputPath)$(OutputName).msi&quot;" />
5159
<Copy SourceFiles="$(OutputPath)$(OutputName).msi" DestinationFiles="$(OutputPath)$(OutputName).1.0.NNN.msi" />
5260
<!-- <Delete Files="$(OutputPath)$(OutputName).msi" /> -->
5361
</Target>

‎build/windows/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Building New Relic Infrastructure agent on windows.
22
## Requirements
33
1. [Go](https://golang.org/dl/)
4-
2. [MSBuild](https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild?view=vs-2019)
4+
2. [MSBuild](https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild?view=vs-2022)
55
3. [Wix Toolset](https://wixtoolset.org/)
66

77
## Compile and build the agent msi package

‎build/windows/build.ps1‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,9 @@ param (
1414
# Skip signing
1515
[switch]$skipSigning=$false,
1616
# Signing tool
17-
[string]$signtool='"C:\Program Files (x86)\Windows Kits\10\bin\x64\signtool.exe"'
17+
[string]$signtool='"C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\signtool.exe"',
18+
# Certificate thumbprint
19+
[string]$certThumbprint=""
1820
)
1921
$scriptPath = split-path -parent $MyInvocation.MyCommand.Definition
2022
$workspace = "$scriptPath\..\.."
@@ -92,7 +94,7 @@ Foreach ($pkg in $goMains)
9294
$exe = "$workspace\target\bin\windows_$arch\$fileName.exe"
9395
go build -ldflags "-X 'main.buildVersion=$version' -X 'main.gitCommit=$commit' -X 'main.buildDate=$date'" -o $exe $pkg
9496
if (-Not $skipSigning) {
95-
SignExecutable -executable "$exe"
97+
SignExecutable -executable "$exe" -certThumbprint "$certThumbprint"
9698
}
9799
}
98100

@@ -107,7 +109,7 @@ Foreach ($pkg in $goMainsBuildInFolder)
107109
go mod download
108110
go build -ldflags "-X 'main.buildVersion=$version' -X 'main.gitCommit=$commit' -X 'main.buildDate=$date'" -o $exe
109111
if (-Not $skipSigning) {
110-
SignExecutable -executable "$exe"
112+
SignExecutable -executable "$exe" -certThumbprint "$certThumbprint"
111113
}
112114
cd "$workspace"
113115
}

‎build/windows/package_msi.ps1‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,10 @@ param (
1010
[string]$version="0.0.0",
1111

1212
# Skip signing
13-
[switch]$skipSigning=$false
13+
[switch]$skipSigning=$false,
14+
# Certificate thumbprint
15+
[string]$certThumbprint=""
16+
1417
)
1518

1619
$scriptPath = split-path -parent $MyInvocation.MyCommand.Definition
@@ -19,7 +22,7 @@ $workspace = "$scriptPath\..\.."
1922
$buildYear = (Get-Date).Year
2023

2124
Write-Output "===> Embeding integrations"
22-
Invoke-expression -Command "$scriptPath\scripts\embed_ohis.ps1 -arch $arch $(If ($skipSigning) {"-skipSigning"})"
25+
Invoke-expression -Command "$scriptPath\scripts\embed_ohis.ps1 -arch $arch -certThumbprint $certThumbprint $(If ($skipSigning) {"-skipSigning"})"
2326
if ($lastExitCode -ne 0) {
2427
Write-Output "Failed to embed integration"
2528
exit -1
@@ -35,9 +38,9 @@ Write-Output $msBuild
3538

3639
Write-Output "===> Building msi Installer"
3740

38-
$env:path = "$env:path;C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin"
41+
$env:path = "$env:path;C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin"
3942
$WixPrjPath = "$scriptPath\..\package\windows\newrelic-infra-$arch-installer\newrelic-infra"
40-
. $msBuild/MSBuild.exe "$WixPrjPath\newrelic-infra-installer.wixproj" /p:AgentVersion=${version} /p:Year=$buildYear /p:SkipSigning=${skipSigning}
43+
. $msBuild/MSBuild.exe "$WixPrjPath\newrelic-infra-installer.wixproj" /p:AgentVersion=${version} /p:Year=$buildYear /p:SkipSigning=${skipSigning} /p:SignToolArgs="/fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /sha1 $certThumbprint"
4144

4245
if (-not $?)
4346
{

‎build/windows/scripts/embed_ohis.ps1‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ param (
1111
# Skip signing
1212
[switch]$skipSigning=$false,
1313
# Signing tool
14-
[string]$signtool='"C:\Program Files (x86)\Windows Kits\10\bin\x64\signtool.exe"'
14+
[string]$signtool='"C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\signtool.exe"',
15+
# Certificate thumbprint
16+
[string]$certThumbprint=""
1517
)
1618

1719
# Source build Functions.
@@ -27,7 +29,7 @@ Function EmbedFlex {
2729
DownloadAndExtractZip -dest:"$downloadPath\nri-flex" -url:"$url"
2830

2931
if (-Not $skipSigning) {
30-
SignExecutable -executable "$downloadPath\nri-flex\nri-flex.exe"
32+
SignExecutable -executable "$downloadPath\nri-flex\nri-flex.exe" -certThumbprint "$certThumbprint"
3133
}
3234
}
3335

@@ -44,8 +46,8 @@ Function EmbedWindowsServices {
4446
DownloadAndExtractZip -dest:"$downloadPath\nri-winservices" -url:"$url"
4547

4648
if (-Not $skipSigning) {
47-
SignExecutable -executable "$downloadPath\nri-winservices\nri-winservices.exe"
48-
SignExecutable -executable "$downloadPath\nri-winservices\windows_exporter.exe"
49+
SignExecutable -executable "$downloadPath\nri-winservices\nri-winservices.exe" -certThumbprint "$certThumbprint"
50+
SignExecutable -executable "$downloadPath\nri-winservices\windows_exporter.exe" -certThumbprint "$certThumbprint"
4951
}
5052
}
5153

@@ -65,7 +67,7 @@ Function EmbedPrometheus {
6567
Remove-Item -Path "$downloadPath\nri-prometheus\New Relic" -Force -Recurse
6668

6769
if (-Not $skipSigning) {
68-
SignExecutable -executable "$downloadPath\nri-prometheus\nri-prometheus.exe"
70+
SignExecutable -executable "$downloadPath\nri-prometheus\nri-prometheus.exe" -certThumbprint "$certThumbprint"
6971
}
7072
}
7173

@@ -97,9 +99,9 @@ Function EmbedFluentBit {
9799

98100
if (-Not $skipSigning) {
99101
# <To be removed on removal of the ff fluent_bit_19>
100-
SignExecutable -executable "$downloadPath\logging\nrfb\fluent-bit.exe"
102+
SignExecutable -executable "$downloadPath\logging\nrfb\fluent-bit.exe" -certThumbprint "$certThumbprint"
101103
# </To be removed on removal of the ff fluent_bit_19>
102-
SignExecutable -executable "$downloadPath\logging\nrfb2\fluent-bit.exe"
104+
SignExecutable -executable "$downloadPath\logging\nrfb2\fluent-bit.exe" -certThumbprint "$certThumbprint"
103105
}
104106
}
105107

@@ -115,7 +117,7 @@ Function EmbedWinpkg {
115117
DownloadAndExtractZip -dest:"$downloadPath" -url:"$url"
116118

117119
if (-Not $skipSigning) {
118-
SignExecutable -executable "$downloadPath\winpkg\nr-winpkg.exe"
120+
SignExecutable -executable "$downloadPath\winpkg\nr-winpkg.exe" -certThumbprint "$certThumbprint"
119121
}
120122
}
121123

‎build/windows/scripts/functions.ps1‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,17 @@
55
Function SignExecutable {
66
param (
77
# Signing tool
8-
[string]$signtool='"C:\Program Files (x86)\Windows Kits\10\bin\x64\signtool.exe"',
9-
[string]$executable=$(throw "-executable path is required")
8+
[string]$signtool='"C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\signtool.exe"',
9+
[string]$executable=$(throw "-executable path is required"),
10+
[string]$certThumbprint=$(throw "-certThumbprint is required")
1011
)
1112

12-
Invoke-Expression "& $signtool sign /d 'New Relic Infrastructure Agent' /n 'New Relic, Inc.' $executable"
13-
if ($lastExitCode -ne 0) {
14-
throw "Failed to sign $executable"
13+
14+
# Use the certificate thumbprint directly from the imported certificate
15+
$certThumbprint = $certThumbprint.Trim()
16+
Invoke-Expression "& $signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /d 'New Relic Infrastructure Agent' /sha1 $certThumbprint $executable"
17+
if ($LASTEXITCODE -ne 0) {
18+
throw "Failed to sign $executable"
1519
}
1620
}
1721

0 commit comments

Comments
 (0)