apunkt/rowboat
1
0
Fork 0
mirror of https://github.com/rowboatlabs/rowboat.git synced 2026-07-24 21:41:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat(x): sign Windows builds with Azure Trusted Signing in CI (#783)

Browse source 
* feat(x): sign Windows builds with Azure Trusted Signing in CI

Wire windowsSign (packager + Squirrel maker) through Azure Trusted
Signing's signtool dlib. Signing activates only when the CI env vars
are present; local and mac/linux builds are unaffected. The Windows
job stages the dlib, metadata.json, and a modern SDK signtool under
C:\azsign (space-free paths — @electron/windows-sign splits
signWithParams on spaces).

Requires repo secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID,
AZURE_CLIENT_SECRET, AZURE_ENDPOINT, AZURE_CODE_SIGNING_NAME,
AZURE_CERT_PROFILE_NAME.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): use renamed Microsoft.ArtifactSigning.Client NuGet package

Microsoft renamed Trusted Signing to Artifact Signing and delisted the
old Microsoft.Trusted.Signing.Client package, which broke the setup
step. The dlib inside kept its Azure.CodeSigning.Dlib.dll filename;
locate it by search instead of a hardcoded path so future package
reshuffles fail loudly rather than at a stale path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(ci): don't run bare signtool in the signing setup step

signtool with no arguments prints usage and exits 1, and the Actions
pwsh wrapper propagates the last native exit code as the step result,
failing the job after an otherwise successful setup. Log the signtool
version from file metadata instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(x): stage only the current platform's node-pty prebuilds

Every build shipped all platforms' prebuilt binaries. Windows code
signing walks every .node file in the app and signtool hard-fails on
the Mach-O darwin pty.node ("file format cannot be signed"). Filtering
to the host platform fixes signing and drops dead weight from all
installers. The Linux CI-compiled prebuild and the node-gyp self-heal
path both still stage correctly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Ramnique Singh 2026-07-23 14:12:39 +05:30 • committed by GitHub
parent 873187805f
commit 95618a364f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 84 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

45
.github/workflows/electron-build.yml vendored
View file

@ -243,8 +243,53 @@ jobs:
run: pnpm install --frozen-lockfile
working-directory: apps/x
- name: Setup Azure Trusted Signing
shell: pwsh
run: |
# Stage everything under a path WITHOUT spaces: @electron/windows-sign
# splits signWithParams on spaces, so the /dlib and /dmdf paths must be
# space-free.
$dir = "C:\azsign"
New-Item -ItemType Directory -Force -Path $dir | Out-Null
# The signtool plugin that delegates signing to Azure Trusted Signing
# (renamed "Artifact Signing" — the old Microsoft.Trusted.Signing.Client
# package is gone from NuGet, but the dlib inside kept its filename).
nuget install Microsoft.ArtifactSigning.Client -x -OutputDirectory "$dir\nuget"
$dlib = Get-ChildItem "$dir\nuget" -Recurse -Filter "Azure.CodeSigning.Dlib.dll" |
Where-Object { $_.FullName -match '\\x64\\' } |
Select-Object -First 1 -ExpandProperty FullName
if (-not $dlib) { throw "x64 Azure.CodeSigning.Dlib.dll not found under $dir\nuget" }
echo "Using dlib: $dlib"
# Tells the dlib which account/profile to sign with.
@{
Endpoint = "${{ secrets.AZURE_ENDPOINT }}"
CodeSigningAccountName = "${{ secrets.AZURE_CODE_SIGNING_NAME }}"
CertificateProfileName = "${{ secrets.AZURE_CERT_PROFILE_NAME }}"
} | ConvertTo-Json | Out-File "$dir\metadata.json" -Encoding utf8
# Newest Windows SDK signtool (the one vendored by @electron/windows-sign
# is too old to load the dlib). Copied into the space-free dir.
$signtool = Get-ChildItem "C:\Program Files (x86)\Windows Kits\10\bin\*\x64\signtool.exe" |
Where-Object { $_.Directory.Parent.Name -match '^\d+(\.\d+)+$' } |
Sort-Object { [version]$_.Directory.Parent.Name } | Select-Object -Last 1
if (-not $signtool) { throw "signtool.exe not found in Windows SDK" }
Copy-Item $signtool.FullName "$dir\signtool.exe"
# NOTE: don't run signtool bare to "print usage" — it exits 1 and the
# Actions pwsh wrapper turns the last native exit code into a step
# failure. Read the version from file metadata instead.
echo "Using signtool $((Get-Item "$dir\signtool.exe").VersionInfo.ProductVersion) from $($signtool.FullName)"
echo "AZURE_CODE_SIGNING_DLIB=$dlib" >> $env:GITHUB_ENV
echo "AZURE_METADATA_JSON=$dir\metadata.json" >> $env:GITHUB_ENV
echo "SIGNTOOL_PATH=$dir\signtool.exe" >> $env:GITHUB_ENV
- name: Build electron app
env:
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
VITE_PUBLIC_POSTHOG_KEY: ${{ secrets.VITE_PUBLIC_POSTHOG_KEY }}
VITE_PUBLIC_POSTHOG_HOST: ${{ secrets.VITE_PUBLIC_POSTHOG_HOST }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}