feat(package): sing windows binaries

Author: sigilioso

.github/workflows/component_packages.yml

@@ -85,6 +85,7 @@ jobs:
         if: ${{ inputs.skip_sign }}
         run: |
           echo SKIP_SIGN="--skip=sign" >> $GITHUB_ENV
+          echo SKIP_WINDOWS_SIGN="true" >> $GITHUB_ENV
 
       - name: Release packages with GoReleaser
         uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
@@ -93,10 +94,13 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GPG_PASSPHRASE: ${{ secrets.OHAI_GPG_PASSPHRASE }}
+          PFX_CERTIFICATE_BASE64: ${{ secrets.OHAI_PFX_CERTIFICATE_BASE64 }} # base64 encoded
+          PFX_PASSPHRASE: ${{ secrets.OHAI_PFX_PASSPHRASE }}
           GPG_PRIVATE_KEY_BASE64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }} # base64 encoded
           GPG_MAIL: 'infrastructure-eng@newrelic.com'
           NR_RELEASE_TAG: ${{ inputs.tag_name }}
           GORELEASER_CURRENT_TAG: ${{ inputs.tag_name }}
+          SKIP_WINDOWS_SIGN: ${{ env.SKIP_WINDOWS_SIGN }}
 
       - name: Upload assets to pipeline
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4

.goreleaser.yml

@@ -48,6 +48,14 @@ builds:
       - AGENT_CONTROL_VERSION={{ .Version }}
       - NEWRELIC_INFRA_AGENT_VERSION={{ .Env.NEWRELIC_INFRA_AGENT_VERSION }}
       - NR_OTEL_COLLECTOR_VERSION={{ .Env.NR_OTEL_COLLECTOR_VERSION }}
+    hooks:
+      post:
+        - cmd: ./build/scripts/windows-exec-sign/sign.sh
+          env:
+            - SKIP_WINDOWS_SIGN={{ if index .Env "SKIP_WINDOWS_SIGN"}}{{ .Env.SKIP_WINDOWS_SIGN }}{{ else }}{{ end }}
+            - PFX_CERT_BASE64={{ if index .Env "PFX_CERT_BASE64"}}{{ .Env.PFX_CERT_BASE64 }}{{ else }}{{ end }}
+            - PFX_PASSPHRASE={{ if index .Env "PFX_PASSPHRASE"}}{{ .Env.PFX_PASSPHRASE }}{{ else }}{{ end }}
+            - EXECUTABLE={{ .Path }}
 
   # Linux builds for CLI
   - id: newrelic-agent-control-cli-linux
@@ -83,6 +91,13 @@ builds:
         # Wait for newrelic-agent-control to be ready (parallel executions of cargo-xwin can be problematic)
         - cmd: sh -c 'while [ ! -f target/x86_64-pc-windows-msvc/release/newrelic-agent-control.exe ]; do echo "Waiting for newrelic-agent-control-windows build to complete..."; sleep 5; done'
           output: true
+      post:
+        - cmd: ./build/scripts/windows-exec-sign/sign.sh
+          env:
+            - SKIP_WINDOWS_SIGN={{ if index .Env "SKIP_WINDOWS_SIGN"}}{{ .Env.SKIP_WINDOWS_SIGN }}{{ else }}{{ end }}
+            - PFX_CERT_BASE64={{ if index .Env "PFX_CERT_BASE64"}}{{ .Env.PFX_CERT_BASE64 }}{{ else }}{{ end }}
+            - PFX_PASSPHRASE={{ if index .Env "PFX_PASSPHRASE"}}{{ .Env.PFX_PASSPHRASE }}{{ else }}{{ end }}
+            - EXECUTABLE={{ .Path }}
 
 archives:
   - id: linux

build/scripts/windows-exec-sign/Dockerfile

@@ -0,0 +1,13 @@
+FROM debian:bullseye
+
+RUN apt-get update \
+    && apt-get -y install \
+        openssl \
+        libengine-pkcs11-openssl \
+        gnutls-bin \
+        xxd \
+        osslsigncode
+
+ADD cmd.sh /cmd.sh
+
+CMD ["/cmd.sh"]

build/scripts/windows-exec-sign/cmd.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Obtain the certificate from base64
+echo "$PFX_CERT_BASE64" | base64 -d > ./certificate.pfx
+
+# Sing the binary with the osslsigncode tool
+osslsigncode sign \
+    -pkcs12 ./certificate.pfx \
+    -pass "$PFX_PASSPHRASE" \
+    -n "$PFX_CERTIFICATE_DESCRIPTION" \
+    -in "$EXECUTABLE" \
+    -out "$EXECUTABLE.signed"
+
+# Replace the unsigned binary by the signed one
+mv "$EXECUTABLE.signed" "$EXECUTABLE"

build/scripts/windows-exec-sign/generate-testing-credentials.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+CURRENT_DIR="$( dirname $( readlink -f ${BASH_SOURCE[0]} ) )"
+LOCAL_DIR="$CURRENT_DIR/../../../local/testing-pfx-cert"
+IMAGE_NAME="testing-credentials"
+
+rm -rf $LOCAL_DIR && mkdir $LOCAL_DIR
+
+docker build -t $IMAGE_NAME "$CURRENT_DIR/."
+
+docker run --rm -v $LOCAL_DIR:/workdir -w /workdir $IMAGE_NAME bash -c '
+# Generate a private key
+openssl genrsa -out private.key 2048
+
+# Generate a self-signed certificate (valid for 365 days)
+openssl req -new -x509 -key private.key -out certificate.crt -days 365 \
+  -subj "/C=US/ST=TestST/L=TestL/O=TestO Org/OU=TestOrg Unit/CN=test.org.site
+
+PFX_PASSPHRASE="TestPassword123"
+PFX_FILE="certificate.pfx"
+
+# Convert to PFX format
+openssl pkcs12 -export -out $PFX_FILE \
+  -inkey private.key \
+  -in certificate.crt \
+  -passout pass:$PFX_PASSPHRASE
+
+# Encode as base64
+base64 $PFX_FILE > certificate_pfx_base64
+'
+
+echo "Testing pfx certificate generated:"
+echo "PFX_CERT_BASE64: $LOCAL_DIR/certificate_pfx_base64"
+echo "PFX_PASSPHRASE: TestPassword123"

build/scripts/windows-exec-sign/sign.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+set -e
+
+# Exit with no error if signing should be skipped
+if [ -n "$SKIP_WINDOWS_SIGN" ]; then
+    echo "Skipping Windows executable signing (SKIP_WINDOWS_SIGN is set)"
+    exit 0
+fi
+
+# Check that required env variables are set
+if [ -z "$EXECUTABLE" ] || [ -z "$PFX_CERT_BASE64" ] || [ -z "$PFX_PASSPHRASE" ]; then
+    echo "EXECUTABLE, PFX_CERT_BASE64 and PFX_PASSPHRASE env variables are required"
+    exit 1
+fi
+
+PFX_CERTIFICATE_DESCRIPTION="New Relic"
+
+# Build the docker image for windows signing
+CURRENT_DIR="$( dirname $( readlink -f ${BASH_SOURCE[0]} ) )"
+IMAGE_NAME="exec-windows-signer"
+docker build -t $IMAGE_NAME "$CURRENT_DIR/."
+
+# Sing the binary
+EXEC_PARENT_DIR="$(dirname "$EXECUTABLE")"
+EXEC_FILE_NAME="$(basename "$EXECUTABLE")"
+docker run --rm \
+    -v $EXEC_PARENT_DIR:/workdir \
+    -w /workdir \
+    -e PFX_CERT_BASE64="$PFX_CERT_BASE64" \
+    -e PFX_PASSPHRASE="$PFX_PASSPHRASE" \
+    -e PFX_CERTIFICATE_DESCRIPTION="$PFX_CERTIFICATE_DESCRIPTION" \
+    -e EXECUTABLE="$EXEC_FILE_NAME" \
+    $IMAGE_NAME