33 workflow_dispatch :
44 release :
55 types : [created]
6-
76jobs :
87 build :
9- runs-on : ubuntu -latest
8+ runs-on : macos -latest
109 steps :
1110 - name : Checkout
1211 uses : actions/checkout@v4
@@ -27,83 +26,11 @@ jobs:
2726 make package
2827 mv spice.taco spice_unsigned.taco
2928
30- - name : Upload unsigned artifact
31- uses : actions/upload-artifact@v4
32- with :
33- name : spice_unsigned.taco
34- path : spice_unsigned.taco
35- if-no-files-found : error
36-
37- - name : Upload to release (unsigned)
38- uses : softprops/action-gh-release@v2
39- if : startsWith(github.ref, 'refs/tags/')
40- with :
41- draft : true
42- prerelease : true
43- fail_on_unmatched_files : true
44- files : spice_unsigned.taco
45-
46- sign :
47- runs-on : ubuntu-latest
48- needs : build
49- environment : signed_release
50- steps :
51- - name : Download unsigned artifact
52- uses : actions/download-artifact@v4
53- with :
54- name : spice_unsigned.taco
55- path : .
56-
57- - name : Set up Java for signing
58- uses : actions/setup-java@v3
59- with :
60- java-version : ' 11'
61- distribution : ' zulu'
62-
63- - name : Prepare for DigiCert signing
64- run : |
65- mkdir -p signing_utility
66- cp /tmp/smpkcs11.so /tmp/smpkcs11.so || echo "Creating empty file" > /tmp/smpkcs11.so
67- echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /tmp/Certificate_pkcs12.p12
68- echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
69- echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
70- echo "SM_CLIENT_CERT_FILE=/tmp/Certificate_pkcs12.p12" >> "$GITHUB_ENV"
71- echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
72- echo "DIGICERT_KEY_ALIAS=${{ secrets.DIGICERT_KEY_ALIAS }}" >> "$GITHUB_ENV"
73- shell : bash
74-
75- - name : Create PKCS11 config
76- run : |
77- cat > pkcs11properties.cfg << EOF
78- name=SmToken
79- library=/tmp/smpkcs11.so
80- slotListIndex=0
81- EOF
82- shell : bash
83-
84- - name : Sign connector package
85- run : |
86- jarsigner -keystore NONE -storepass NONE -storetype PKCS11 \
87- -sigalg SHA256withRSA \
88- -providerClass sun.security.pkcs11.SunPKCS11 \
89- -providerArg pkcs11properties.cfg \
90- -signedjar spice_signed.taco spice_unsigned.taco \
91- $DIGICERT_KEY_ALIAS \
92- -tsa http://timestamp.digicert.com
93- shell : bash
94-
95- - name : Upload signed artifact
96- uses : actions/upload-artifact@v4
97- with :
98- name : spice_signed.taco
99- path : spice_signed.taco
100- if-no-files-found : error
101-
102- - name : Upload to release (signed)
29+ - name : Upload
10330 uses : softprops/action-gh-release@v2
10431 if : startsWith(github.ref, 'refs/tags/')
10532 with :
10633 draft : true
10734 prerelease : true
10835 fail_on_unmatched_files : true
109- files : spice_signed .taco
36+ files : spice_unsigned .taco
0 commit comments