mirror of
https://github.com/bherbruck/solidcraft.git
synced 2026-11-07 12:31:56 +00:00
bherbruck
9e4dc48165
* Release: sign the Windows binaries and MSI through SignPath Foundation When the SIGNPATH_API_TOKEN secret exists, each Windows job sends the three .exe files to SignPath before packaging, then the MSI built from them, using the GitHub artifact flow from SignPath's docs. The policy is test-signing unless the signpath_signing_policy dispatch input or the SIGNPATH_SIGNING_POLICY repository variable says otherwise. Without the secret the jobs build unsigned exactly as before. package.ps1 gains -Phase stage|package so signing can sit between the build and the MSI; the artifact configuration to paste into SignPath is packaging/windows/signpath-artifact-configuration.xml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * SignPath: drop the description attributes the Foundation plan doesn't allow SignPath Foundation projects get an automatic signature description (its watermark); the artifact configuration may not override it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
36 lines
1.6 KiB
XML
36 lines
1.6 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
SignPath artifact configuration for the Windows release (project `solidcraft`).
|
|
|
|
This file is the source of truth: paste it into SignPath (Projects > solidcraft > Artifact
|
|
Configurations > the default configuration > Edit) whenever it changes, so the two stay in sync.
|
|
|
|
.github/workflows/release.yml submits two signing requests per architecture. GitHub stores every
|
|
workflow artifact as a zip, so the root element is a zip-file and the files sit at its top level:
|
|
|
|
1. the binaries, before they are packed: solidcraft.exe, solidcraft-cli.exe, solvecraft-cli.exe
|
|
2. the installer built from those signed binaries: solidcraft-<version>-windows-<arch>.msi
|
|
|
|
Each set is optional (min-matches="0") because each request carries only one of the two shapes.
|
|
The workflow checks afterwards that every file it sent came back with an Authenticode signature,
|
|
so a request that matched nothing fails the build instead of shipping unsigned files.
|
|
-->
|
|
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
|
|
<zip-file>
|
|
<pe-file-set>
|
|
<include path="solidcraft.exe" min-matches="0" />
|
|
<include path="solidcraft-cli.exe" min-matches="0" />
|
|
<include path="solvecraft-cli.exe" min-matches="0" />
|
|
<for-each>
|
|
<authenticode-sign />
|
|
</for-each>
|
|
</pe-file-set>
|
|
<msi-file-set>
|
|
<include path="solidcraft-*-windows-*.msi" min-matches="0" />
|
|
<for-each>
|
|
<authenticode-sign />
|
|
</for-each>
|
|
</msi-file-set>
|
|
</zip-file>
|
|
</artifact-configuration>
|