Skip to content

Commit 43c1463

Browse files
sreyasreya
committed
feat: sign windows binaries
1 parent 74f2771 commit 43c1463

File tree

3 files changed

+211
-0
lines changed

3 files changed

+211
-0
lines changed

‎.github/workflows/test.yaml

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
# GitHub release workflow.
2+
name: TestRelease
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
# Required to publish a release
8+
contents: write
9+
# Necessary to push docker images to ghcr.io.
10+
packages: write
11+
# Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage)
12+
id-token: write
13+
14+
concurrency: ${{ github.workflow }}-${{ github.ref }}
15+
16+
jobs:
17+
release:
18+
name: Build and publish
19+
runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-8vcpu-ubuntu-2204' || 'ubuntu-latest' }}
20+
env:
21+
# Necessary for Docker manifest
22+
DOCKER_CLI_EXPERIMENTAL: "enabled"
23+
outputs:
24+
version: ${{ steps.version.outputs.version }}
25+
steps:
26+
- name: Authenticate to Google Cloud
27+
uses: google-github-actions/auth@v2
28+
with:
29+
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_ID_PROVIDER }}
30+
service_account: ${{ secrets.GCP_CODE_SIGNING_SERVICE_ACCOUNT }}
31+
32+
- name: Setup GCloud SDK
33+
uses: "google-github-actions/setup-gcloud@v2"
34+
35+
- name: Checkout
36+
uses: actions/checkout@v4
37+
with:
38+
fetch-depth: 0
39+
40+
# If the event that triggered the build was an annotated tag (which our
41+
# tags are supposed to be), actions/checkout has a bug where the tag in
42+
# question is only a lightweight tag and not a full annotated tag. This
43+
# command seems to fix it.
44+
# https://github.com/actions/checkout/issues/290
45+
- name: Fetch git tags
46+
run: git fetch --tags --force
47+
48+
- name: Print version
49+
id: version
50+
run: |
51+
set -euo pipefail
52+
version="0.0.1-rc.1"
53+
echo "version=$version" >> $GITHUB_OUTPUT
54+
# Speed up future version.sh calls.
55+
echo "CODER_FORCE_VERSION=$version" >> $GITHUB_ENV
56+
echo "$version"
57+
58+
- name: Docker Login
59+
uses: docker/login-action@v3
60+
with:
61+
registry: ghcr.io
62+
username: ${{ github.actor }}
63+
password: ${{ secrets.GITHUB_TOKEN }}
64+
65+
- name: Setup Go
66+
uses: ./.github/actions/setup-go
67+
68+
- name: Setup Node
69+
uses: ./.github/actions/setup-node
70+
71+
- name: Setup Java
72+
uses: sudo apt-get install -y default-jre
73+
74+
- name: Install nsis and zstd
75+
run: sudo apt-get install -y nsis zstd
76+
77+
- name: Install nfpm
78+
run: |
79+
set -euo pipefail
80+
wget -O /tmp/nfpm.deb https://github.com/goreleaser/nfpm/releases/download/v2.35.1/nfpm_2.35.1_amd64.deb
81+
sudo dpkg -i /tmp/nfpm.deb
82+
rm /tmp/nfpm.deb
83+
84+
- name: Install rcodesign
85+
run: |
86+
set -euo pipefail
87+
wget -O /tmp/rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-x86_64-unknown-linux-musl.tar.gz
88+
sudo tar -xzf /tmp/rcodesign.tar.gz \
89+
-C /usr/bin \
90+
--strip-components=1 \
91+
apple-codesign-0.22.0-x86_64-unknown-linux-musl/rcodesign
92+
rm /tmp/rcodesign.tar.gz
93+
94+
- name: Setup Apple Developer certificate and API key
95+
run: |
96+
set -euo pipefail
97+
touch /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
98+
chmod 600 /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
99+
echo "$AC_CERTIFICATE_P12_BASE64" | base64 -d > /tmp/apple_cert.p12
100+
echo "$AC_CERTIFICATE_PASSWORD" > /tmp/apple_cert_password.txt
101+
echo "$AC_APIKEY_P8_BASE64" | base64 -d > /tmp/apple_apikey.p8
102+
env:
103+
AC_CERTIFICATE_P12_BASE64: ${{ secrets.AC_CERTIFICATE_P12_BASE64 }}
104+
AC_CERTIFICATE_PASSWORD: ${{ secrets.AC_CERTIFICATE_PASSWORD }}
105+
AC_APIKEY_P8_BASE64: ${{ secrets.AC_APIKEY_P8_BASE64 }}
106+
107+
- name: Setup Windows EV Signing Certificate
108+
run: |
109+
set -euo pipefail
110+
touch /tmp/ev_cert.pem
111+
chmod 600 /tmp/ev_cert.pem
112+
echo "$EV_SIGNING_CERT" > /tmp/ev_cert.pem
113+
wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar -o /tmp/jsign-6.0.jar
114+
env:
115+
EV_SIGNING_CERT: ${{ secrets.EV_SIGNING_CERT }}
116+
117+
- name: Build binaries
118+
run: |
119+
set -euo pipefail
120+
go mod download
121+
122+
version="$(./scripts/version.sh)"
123+
make gen/mark-fresh
124+
make -j \
125+
build/coder_"$version"_linux_{amd64,armv7,arm64}.{tar.gz,apk,deb,rpm} \
126+
build/coder_"$version"_{darwin,windows}_{amd64,arm64}.zip \
127+
build/coder_"$version"_windows_amd64_installer.exe \
128+
build/coder_helm_"$version".tgz \
129+
build/provisioner_helm_"$version".tgz
130+
env:
131+
CODER_SIGN_WINDOWS: "1"
132+
CODER_SIGN_DARWIN: "1"
133+
AC_CERTIFICATE_FILE: /tmp/apple_cert.p12
134+
AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt
135+
AC_APIKEY_ISSUER_ID: ${{ secrets.AC_APIKEY_ISSUER_ID }}
136+
AC_APIKEY_ID: ${{ secrets.AC_APIKEY_ID }}
137+
AC_APIKEY_FILE: /tmp/apple_apikey.p8
138+
EV_KEY: ${{ secrets.EV_KEY }}
139+
EV_KEYSTORE: ${{ secrets.EV_KEYSTORE }}
140+
EV_TSA_URL: ${{ secrets.EV_TSA_URL }}
141+
EV_CERTIFICATE_PATH: /tmp/ev_cert.pem
142+
JSIGN_PATH: /tmp/jsign-6.0.jar
143+
144+
- name: Delete Apple Developer certificate and API key
145+
run: rm -f /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
146+
147+
- name: Delete Windows EV Signing Cert
148+
run: rm /tmp/ev_cert.pem
149+
150+
- name: Upload artifacts to actions (if dry-run)
151+
uses: actions/upload-artifact@v4
152+
with:
153+
name: release-artifacts
154+
path: |
155+
./build/*_installer.exe
156+
./build/*.zip
157+
./build/*.tar.gz
158+
./build/*.tgz
159+
./build/*.apk
160+
./build/*.deb
161+
./build/*.rpm
162+
retention-days: 1

‎scripts/build_go.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ os="${GOOS:-linux}"
3535
arch="${GOARCH:-amd64}"
3636
slim="${CODER_SLIM_BUILD:-0}"
3737
sign_darwin="${CODER_SIGN_DARWIN:-0}"
38+
sign_windows="${CODER_SIGN_WINDOWS:-0}"
3839
output_path=""
3940
agpl="${CODER_BUILD_AGPL:-0}"
4041
boringcrypto=${CODER_BUILD_BORINGCRYPTO:-0}
@@ -106,6 +107,11 @@ if [[ "$sign_darwin" == 1 ]]; then
106107
requiredenvs AC_CERTIFICATE_FILE AC_CERTIFICATE_PASSWORD_FILE
107108
fi
108109

110+
if [[ "$sign_windows" == 1 ]]; then
111+
dependencies java
112+
requiredenvs JSIGN_PATH EV_KEYSTORE EV_KEY EV_CERTIFICATE_PATH EV_TSA_URL
113+
fi
114+
109115
ldflags=(
110116
-X "'github.com/coder/coder/v2/buildinfo.tag=$version'"
111117
)
@@ -176,4 +182,8 @@ if [[ "$sign_darwin" == 1 ]] && [[ "$os" == "darwin" ]]; then
176182
execrelative ./sign_darwin.sh "$output_path" 1>&2
177183
fi
178184

185+
if [[ "$sign_windows" == 1 ]] && [[ "$os" == "windows" ]]; then
186+
execrelative ./sign_windows.sh "$output_path" 1>&2
187+
fi
188+
179189
echo "$output_path"

‎scripts/sign_windows.sh

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env bash
2+
3+
# This script signs the provided windows binary with an Extended Validation
4+
# code signing certificate.
5+
#
6+
# Usage: ./sign_windows.sh path/to/binary
7+
#
8+
# On success, the input file will be signed using the EV cert.
9+
#
10+
# You can also run the following command to verify the signature on other
11+
# systems, but it may be less accurate:
12+
# rcodesign verify path/to/binary
13+
#
14+
# Depends on the jsign utility (and thus Java). Requires the following environment variables
15+
# to be set:
16+
# - $JSIGN_PATH: The path to the jsign jar.
17+
# - $EV_KEYSTORE: The name of the keyring containing the private key
18+
# - $EV_KEY: The name of the key.
19+
# - $EV_CERTIFICATE_PATH: The path to the certificate.
20+
# - $EV_TSA_URL: The url of the timestamp server to use.
21+
22+
set -euo pipefail
23+
# shellcheck source=scripts/lib.sh
24+
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
25+
26+
# Check dependencies
27+
dependencies java
28+
requiredenvs JSIGN_PATH EV_KEYSTORE EV_KEY EV_CERTIFICATE_PATH EV_TSA_URL
29+
30+
java -jar "$JSIGN_PATH" \
31+
--storetype GOOGLECLOUD \
32+
--storepass "$(gcloud auth print-access-token)" \
33+
--keystore "$EV_KEYSTORE" \
34+
--alias "$EV_KEY" \
35+
--certfile "$EV_CERTIFICATE_PATH" \
36+
--tsmode RFC3161 \
37+
--tsaurl "$EV_TSA_URL" \
38+
"$@" \
39+
1>&2

0 commit comments

Comments
 (0)