From 79dcde676b2c1ffabd245a3728c0bdb42f31adbb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Moreau?= Date: Wed, 30 Aug 2023 16:55:51 -0400 Subject: [PATCH] migrate to use AzureSignTool + Azure Key Vault for code signing --- .github/workflows/build-tools.yml | 38 ++++++--------- .github/workflows/package.yml | 66 +++++++++++---------------- .github/workflows/publish-clients.yml | 4 +- .github/workflows/release.yml | 6 +-- ci/tlk.ps1 | 28 +----------- 5 files changed, 47 insertions(+), 95 deletions(-) diff --git a/.github/workflows/build-tools.yml b/.github/workflows/build-tools.yml index 51000ebc9..58b37464a 100644 --- a/.github/workflows/build-tools.yml +++ b/.github/workflows/build-tools.yml @@ -91,7 +91,7 @@ jobs: name: sign ${{ matrix.tool }} [${{ matrix.platform }} ${{ matrix.arch }}] runs-on: ${{ matrix.runner }} needs: [ build, lipo ] - environment: build-and-publish + environment: publish-prod strategy: matrix: arch: [ x86_64, aarch64, universal ] @@ -121,17 +121,11 @@ jobs: $Path += ".exe" } echo "binary-path=$Path" >> $Env:GITHUB_OUTPUT - - - name: Configure certificates + + - name: Install AzureSignTool if: matrix.platform == 'pc-windows-msvc' - env: - CODE_SIGN_CERT: ${{ secrets.WINDOWS_CODE_SIGNING_CERTIFICATE }} - CODE_SIGN_CERT_PASSWORD: ${{ secrets.WINDOWS_CODE_SIGNING_PASSWORD }} run: | - $CertificatePath = Join-Path -Path $Env:RUNNER_TEMP -ChildPath CodeSigningCertificate.pfx - [IO.File]::WriteAllBytes($CertificatePath, ([Convert]::FromBase64String($Env:CODE_SIGN_CERT))) - $SecurePassword = ConvertTo-SecureString "$Env:CODE_SIGN_CERT_PASSWORD" -AsPlainText -Force - Import-PfxCertificate -FilePath "$CertificatePath" -CertStoreLocation Cert:\CurrentUser\My -Password $SecurePassword + dotnet tool install --global AzureSignTool - name: Configure certificates if: matrix.platform == 'apple-darwin' @@ -160,16 +154,15 @@ jobs: shell: pwsh run: | if ('${{ matrix.platform }}' -Eq 'pc-windows-msvc') { - $SignCmd = $(@( - 'signtool', - 'sign', - '/fd', 'SHA256', - '/v', - '/n', 'Devolutions', - '/tr', 'http://timestamp.comodoca.com/?td=sha256', - '/td', 'sha256', - '${{ steps.get-binary-path.outputs.binary-path }}' - )) -Join ' ' + $Params = @('sign', + '-kvt', '${{ secrets.AZURE_TENANT_ID }}', + '-kvu', '${{ secrets.CODE_SIGNING_KEYVAULT_URL }}', + '-kvi', '${{ secrets.CODE_SIGNING_CLIENT_ID }}', + '-kvs', '${{ secrets.CODE_SIGNING_CLIENT_SECRET }}', + '-kvc', '${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}', + '-tr', '${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}', + '-v') + AzureSignTool @Params '${{ steps.get-binary-path.outputs.binary-path }}' } elseif ('${{ matrix.platform }}' -Eq 'apple-darwin') { $SignCmd = $(@( 'codesign', @@ -180,11 +173,10 @@ jobs: '-v', '${{ steps.get-binary-path.outputs.binary-path }}' )) -Join ' ' + Write-Host $SignCmd + Invoke-Expression $SignCmd } - Write-Host $SignCmd - Invoke-Expression $SignCmd - - name: Verification shell: pwsh run: | diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index 091858962..e220e14ac 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -130,7 +130,7 @@ jobs: codesign: name: Codesign runs-on: ${{ matrix.runner }} - environment: build-and-publish + environment: publish-prod needs: preflight strategy: matrix: @@ -179,18 +179,12 @@ jobs: $Destination = Join-Path ${{ runner.temp }} ${{ matrix.project }} if ('${{ matrix.project }}' -Eq 'jetsocat') { Get-ChildItem "$Destination" -Exclude ${{ matrix.os }} | Remove-Item -Recurse - } + } - - name: Configure certificates (Windows) + - name: Install AzureSignTool if: matrix.os == 'windows' - env: - CODE_SIGN_CERT: ${{ secrets.WINDOWS_CODE_SIGNING_CERTIFICATE }} - CODE_SIGN_CERT_PASSWORD: ${{ secrets.WINDOWS_CODE_SIGNING_PASSWORD }} run: | - $CertificatePath = Join-Path -Path $Env:RUNNER_TEMP -ChildPath CodeSigningCertificate.pfx - [IO.File]::WriteAllBytes($CertificatePath, ([Convert]::FromBase64String($Env:CODE_SIGN_CERT))) - $SecurePassword = ConvertTo-SecureString "$Env:CODE_SIGN_CERT_PASSWORD" -AsPlainText -Force - Import-PfxCertificate -FilePath "$CertificatePath" -CertStoreLocation Cert:\CurrentUser\My -Password $SecurePassword + dotnet tool install --global AzureSignTool - name: Configure certificates (macOS) if: matrix.os == 'macos' @@ -227,16 +221,15 @@ jobs: } Get-ChildItem -Path ${{ runner.temp }} -Recurse -Include "$Pattern" | % { if ('${{ matrix.os }}' -Eq 'windows') { - $SignCmd = $(@( - 'signtool', - 'sign', - '/fd', 'SHA256', - '/v', - '/n', 'Devolutions', - '/tr', 'http://timestamp.comodoca.com/?td=sha256', - '/td', 'sha256', - $_.FullName - )) -Join ' ' + $Params = @('sign', + '-kvt', '${{ secrets.AZURE_TENANT_ID }}', + '-kvu', '${{ secrets.CODE_SIGNING_KEYVAULT_URL }}', + '-kvi', '${{ secrets.CODE_SIGNING_CLIENT_ID }}', + '-kvs', '${{ secrets.CODE_SIGNING_CLIENT_SECRET }}', + '-kvc', '${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}', + '-tr', '${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}', + '-v') + AzureSignTool @Params $_.FullName } elseif ('${{ matrix.os }}' -Eq 'macos') { $SignCmd = $(@( 'codesign', @@ -246,14 +239,11 @@ jobs: '-v', $_.FullName )) -Join ' ' + Write-Host $SignCmd + Invoke-Expression $SignCmd } else { echo "::debug::nothing to do for ${{ matrix.os }}" } - - if ($SignCmd) { - Write-Host $SignCmd - Invoke-Expression $SignCmd - } } - name: Add msbuild to PATH @@ -280,21 +270,17 @@ jobs: if: matrix.project == 'devolutions-gateway' shell: pwsh run: | - Get-ChildItem -Path ${{ runner.temp }} -Recurse -Include '*.msi' | % { - $SignCmd = $(@( - 'signtool', - 'sign', - '/fd', 'SHA256', - '/v', - '/n', 'Devolutions', - '/tr', 'http://timestamp.comodoca.com/?td=sha256', - '/d', '"Devolutions Gateway"', - '/td', 'sha256', - $_.FullName - )) -Join ' ' - - Write-Host $SignCmd - Invoke-Expression $SignCmd + Get-ChildItem -Path ${{ runner.temp }} -Recurse -Include '*.msi' | % { + $Params = @('sign', + '-kvt', '${{ secrets.AZURE_TENANT_ID }}', + '-kvu', '${{ secrets.CODE_SIGNING_KEYVAULT_URL }}', + '-kvi', '${{ secrets.CODE_SIGNING_CLIENT_ID }}', + '-kvs', '${{ secrets.CODE_SIGNING_CLIENT_SECRET }}', + '-kvc', '${{ secrets.CODE_SIGNING_CERTIFICATE_NAME }}', + '-tr', '${{ vars.CODE_SIGNING_TIMESTAMP_SERVER }}', + '-d', 'Devolutions Gateway', + '-v') + AzureSignTool @Params $_.FullName } - name: Verification diff --git a/.github/workflows/publish-clients.yml b/.github/workflows/publish-clients.yml index c5a5c5a98..0ca51e830 100644 --- a/.github/workflows/publish-clients.yml +++ b/.github/workflows/publish-clients.yml @@ -98,7 +98,7 @@ jobs: nuget-publish: name: Publish NuGet packages runs-on: ubuntu-20.04 - environment: build-and-publish + environment: publish-prod if: needs.preflight.outputs.dry-run == 'false' needs: - preflight @@ -139,7 +139,7 @@ jobs: npm-publish: name: Publish NPM packages runs-on: ubuntu-20.04 - environment: build-and-publish + environment: publish-prod if: needs.preflight.outputs.dry-run == 'false' needs: - preflight diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 29d17e65b..c4cee49c2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -102,7 +102,7 @@ jobs: containers: name: Containers [${{ matrix.os }} ${{ matrix.base-image }}] runs-on: ${{ matrix.runner }} - environment: build-and-publish + environment: publish-prod needs: preflight if: needs.preflight.outputs.skip-publishing == 'false' || github.event.inputs.dry-run == 'true' strategy: @@ -209,7 +209,7 @@ jobs: github-release: name: GitHub release runs-on: ubuntu-20.04 - environment: build-and-publish + environment: publish-prod needs: preflight if: needs.preflight.outputs.skip-publishing == 'false' || github.event.inputs.dry-run == 'true' @@ -286,7 +286,7 @@ jobs: psgallery-release: name: PowerShell release runs-on: ubuntu-20.04 - environment: build-and-publish + environment: publish-prod needs: preflight if: needs.preflight.outputs.skip-publishing == 'false' || github.event.inputs.dry-run == 'true' diff --git a/ci/tlk.ps1 b/ci/tlk.ps1 index e5632ba15..5fd9d169c 100644 --- a/ci/tlk.ps1 +++ b/ci/tlk.ps1 @@ -336,19 +336,6 @@ class TlkRecipe if ($DestinationExecutable) { Copy-Item -Path $SrcExecutablePath -Destination $DestinationExecutable - - if (Test-Path Env:SIGNTOOL_NAME) { - $SignToolName = $Env:SIGNTOOL_NAME - $TimestampServer = 'http://timestamp.comodoca.com/?td=sha256' - $SignToolArgs = @( - 'sign', '/fd', 'SHA256', '/v', - '/n', $SignToolName, - '/tr', $TimestampServer, - '/td', 'sha256', - $DestinationExecutable - ) - & 'signtool' $SignToolArgs | Out-Host - } } Pop-Location @@ -449,19 +436,6 @@ class TlkRecipe if (Test-Path Env:DGATEWAY_PACKAGE) { $DGatewayPackage = $Env:DGATEWAY_PACKAGE Copy-Item -Path "$($this.PackageName).msi" -Destination $DGatewayPackage - - if (Test-Path Env:SIGNTOOL_NAME) { - $SignToolName = $Env:SIGNTOOL_NAME - $TimestampServer = 'http://timestamp.comodoca.com/?td=sha256' - $SignToolArgs = @( - 'sign', '/fd', 'SHA256', '/v', - '/n', $SignToolName, - '/tr', $TimestampServer, - '/td', 'sha256', - $DGatewayPackage - ) - & 'signtool' $SignToolArgs | Out-Host - } } Pop-Location @@ -471,7 +445,7 @@ class TlkRecipe $DebianArchitecture = $this.Target.DebianArchitecture() $Packager = "Devolutions Inc." $Email = "support@devolutions.net" - $Website = "http://wayk.devolutions.net" + $Website = "https://devolutions.net" $PackageVersion = $this.Version $DistroCodeName = "xenial" # Ubuntu 16.04 $Dependencies = @('liblzma5', 'liblz4-1', '${shlibs:Depends}', '${misc:Depends}')