From 95618a364fe8a2b49ec46787b339400495c4a61f Mon Sep 17 00:00:00 2001 From: Ramnique Singh <30795890+ramnique@users.noreply.github.com> Date: Thu, 23 Jul 2026 14:12:39 +0530 Subject: [PATCH] feat(x): sign Windows builds with Azure Trusted Signing in CI (#783) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(x): sign Windows builds with Azure Trusted Signing in CI Wire windowsSign (packager + Squirrel maker) through Azure Trusted Signing's signtool dlib. Signing activates only when the CI env vars are present; local and mac/linux builds are unaffected. The Windows job stages the dlib, metadata.json, and a modern SDK signtool under C:\azsign (space-free paths — @electron/windows-sign splits signWithParams on spaces). Requires repo secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_ENDPOINT, AZURE_CODE_SIGNING_NAME, AZURE_CERT_PROFILE_NAME. Co-Authored-By: Claude Fable 5 * fix(ci): use renamed Microsoft.ArtifactSigning.Client NuGet package Microsoft renamed Trusted Signing to Artifact Signing and delisted the old Microsoft.Trusted.Signing.Client package, which broke the setup step. The dlib inside kept its Azure.CodeSigning.Dlib.dll filename; locate it by search instead of a hardcoded path so future package reshuffles fail loudly rather than at a stale path. Co-Authored-By: Claude Fable 5 * fix(ci): don't run bare signtool in the signing setup step signtool with no arguments prints usage and exits 1, and the Actions pwsh wrapper propagates the last native exit code as the step result, failing the job after an otherwise successful setup. Log the signtool version from file metadata instead. Co-Authored-By: Claude Fable 5 * fix(x): stage only the current platform's node-pty prebuilds Every build shipped all platforms' prebuilt binaries. Windows code signing walks every .node file in the app and signtool hard-fails on the Mach-O darwin pty.node ("file format cannot be signed"). Filtering to the host platform fixes signing and drops dead weight from all installers. The Linux CI-compiled prebuild and the node-gyp self-heal path both still stage correctly. Co-Authored-By: Claude Fable 5 --------- Co-authored-by: Claude Fable 5 --- .github/workflows/electron-build.yml | 45 ++++++++++++++++++++++++++++ apps/x/apps/main/bundle.mjs | 12 +++++++- apps/x/apps/main/forge.config.cjs | 28 +++++++++++++++++ 3 files changed, 84 insertions(+), 1 deletion(-) diff --git a/.github/workflows/electron-build.yml b/.github/workflows/electron-build.yml index e68ce4f4..2177e9b7 100644 --- a/.github/workflows/electron-build.yml +++ b/.github/workflows/electron-build.yml @@ -243,8 +243,53 @@ jobs: run: pnpm install --frozen-lockfile working-directory: apps/x + - name: Setup Azure Trusted Signing + shell: pwsh + run: | + # Stage everything under a path WITHOUT spaces: @electron/windows-sign + # splits signWithParams on spaces, so the /dlib and /dmdf paths must be + # space-free. + $dir = "C:\azsign" + New-Item -ItemType Directory -Force -Path $dir | Out-Null + + # The signtool plugin that delegates signing to Azure Trusted Signing + # (renamed "Artifact Signing" — the old Microsoft.Trusted.Signing.Client + # package is gone from NuGet, but the dlib inside kept its filename). + nuget install Microsoft.ArtifactSigning.Client -x -OutputDirectory "$dir\nuget" + $dlib = Get-ChildItem "$dir\nuget" -Recurse -Filter "Azure.CodeSigning.Dlib.dll" | + Where-Object { $_.FullName -match '\\x64\\' } | + Select-Object -First 1 -ExpandProperty FullName + if (-not $dlib) { throw "x64 Azure.CodeSigning.Dlib.dll not found under $dir\nuget" } + echo "Using dlib: $dlib" + + # Tells the dlib which account/profile to sign with. + @{ + Endpoint = "${{ secrets.AZURE_ENDPOINT }}" + CodeSigningAccountName = "${{ secrets.AZURE_CODE_SIGNING_NAME }}" + CertificateProfileName = "${{ secrets.AZURE_CERT_PROFILE_NAME }}" + } | ConvertTo-Json | Out-File "$dir\metadata.json" -Encoding utf8 + + # Newest Windows SDK signtool (the one vendored by @electron/windows-sign + # is too old to load the dlib). Copied into the space-free dir. + $signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" | + Where-Object { $_.Directory.Parent.Name -match '^\d+(\.\d+)+$' } | + Sort-Object { [version]$_.Directory.Parent.Name } | Select-Object -Last 1 + if (-not $signtool) { throw "signtool.exe not found in Windows SDK" } + Copy-Item $signtool.FullName "$dir\signtool.exe" + # NOTE: don't run signtool bare to "print usage" — it exits 1 and the + # Actions pwsh wrapper turns the last native exit code into a step + # failure. Read the version from file metadata instead. + echo "Using signtool $((Get-Item "$dir\signtool.exe").VersionInfo.ProductVersion) from $($signtool.FullName)" + + echo "AZURE_CODE_SIGNING_DLIB=$dlib" >> $env:GITHUB_ENV + echo "AZURE_METADATA_JSON=$dir\metadata.json" >> $env:GITHUB_ENV + echo "SIGNTOOL_PATH=$dir\signtool.exe" >> $env:GITHUB_ENV + - name: Build electron app env: + AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} + AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} + AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }} VITE_PUBLIC_POSTHOG_KEY: ${{ secrets.VITE_PUBLIC_POSTHOG_KEY }} VITE_PUBLIC_POSTHOG_HOST: ${{ secrets.VITE_PUBLIC_POSTHOG_HOST }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/apps/x/apps/main/bundle.mjs b/apps/x/apps/main/bundle.mjs index cca7fdc4..f4c0357d 100644 --- a/apps/x/apps/main/bundle.mjs +++ b/apps/x/apps/main/bundle.mjs @@ -59,10 +59,20 @@ const ptySrc = fs.realpathSync(path.join(here, 'node_modules', 'node-pty')); const ptyDest = path.join(here, '.package', 'node_modules', 'node-pty'); fs.rmSync(ptyDest, { recursive: true, force: true }); fs.mkdirSync(ptyDest, { recursive: true }); -for (const item of ['package.json', 'lib', 'prebuilds']) { +for (const item of ['package.json', 'lib']) { fs.cpSync(path.join(ptySrc, item), path.join(ptyDest, item), { recursive: true, dereference: true }); } +// Stage only the CURRENT platform's prebuilds. Each OS packages natively in CI, +// so other platforms' binaries are dead weight — and worse: Windows code signing +// walks every .node file in the app and signtool hard-fails on the Mach-O darwin +// pty.node ("file format cannot be signed"). +const prebuildsSrc = path.join(ptySrc, 'prebuilds'); const prebuildsDir = path.join(ptyDest, 'prebuilds'); +fs.mkdirSync(prebuildsDir, { recursive: true }); +for (const dir of fs.readdirSync(prebuildsSrc)) { + if (!dir.startsWith(`${process.platform}-`)) continue; + fs.cpSync(path.join(prebuildsSrc, dir), path.join(prebuildsDir, dir), { recursive: true, dereference: true }); +} for (const dir of fs.readdirSync(prebuildsDir)) { const helper = path.join(prebuildsDir, dir, 'spawn-helper'); if (fs.existsSync(helper)) fs.chmodSync(helper, 0o755); diff --git a/apps/x/apps/main/forge.config.cjs b/apps/x/apps/main/forge.config.cjs index 581206a8..cc6c4dd6 100644 --- a/apps/x/apps/main/forge.config.cjs +++ b/apps/x/apps/main/forge.config.cjs @@ -12,6 +12,28 @@ const pkg = require('./package.json'); const SKIP_PACMAN = process.env.ROWBOAT_SKIP_PACMAN === '1'; const SKIP_CODE_SIGNING = process.env.ROWBOAT_SKIP_CODE_SIGNING === '1'; +// Windows code signing via Azure Trusted Signing — CI-only. The GitHub workflow +// downloads the Azure dlib, writes metadata.json, and exports these env vars; +// when they're absent (local builds, mac/linux jobs) Windows signing is skipped. +// signtool loads Azure.CodeSigning.Dlib.dll (/dlib), which reads metadata.json +// (/dmdf) for the endpoint/account/profile and authenticates via +// AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET. +// NOTE: @electron/windows-sign splits signWithParams on spaces, so the dlib and +// metadata paths must not contain spaces (the workflow stages them in C:\azsign). +const WINDOWS_SIGN = + !SKIP_CODE_SIGNING && + process.env.AZURE_CODE_SIGNING_DLIB && + process.env.AZURE_METADATA_JSON + ? { + // The signtool vendored by @electron/windows-sign is too old for the + // Azure dlib; the workflow points this at the Windows SDK's signtool. + ...(process.env.SIGNTOOL_PATH ? { signToolPath: process.env.SIGNTOOL_PATH } : {}), + signWithParams: `/v /debug /dlib ${process.env.AZURE_CODE_SIGNING_DLIB} /dmdf ${process.env.AZURE_METADATA_JSON}`, + timestampServer: 'http://timestamp.acs.microsoft.com', + hashes: ['sha256'], + } + : undefined; + // Stage the ACP coding-adapters (@agentclientprotocol/*-acp) and their full // production dependency closure into the packaged app. // @@ -202,6 +224,9 @@ module.exports = { NSAudioCaptureUsageDescription: 'Rowboat needs access to system audio to transcribe meetings from other apps (Zoom, Meet, etc.)', NSCameraUsageDescription: 'Rowboat uses your camera in video chat mode so the assistant can see you and give feedback (e.g. pitch practice).', }, + // Signs the packaged app's executables (rowboat.exe etc.); the Squirrel + // maker below separately signs the installer it produces. + ...(WINDOWS_SIGN ? { windowsSign: WINDOWS_SIGN } : {}), ...(SKIP_CODE_SIGNING ? {} : { osxSign: { batchCodesignCalls: true, @@ -260,6 +285,9 @@ module.exports = { // GitHub release page next to setup.exe and users grab the // wrong one (it neither launches the app nor auto-updates). noMsi: true, + // Sign the Squirrel installer (setup.exe) and the binaries it + // repackages. No-op unless the CI signing env vars are set. + ...(WINDOWS_SIGN ? { windowsSign: WINDOWS_SIGN } : {}), }) }, {