Skip to content

Commit 8269124

Browse files
sreyasreya
authored
feat: sign windows binaries (#13086)
1 parent 15157c1 commit 8269124

File tree

3 files changed

+84
-0
lines changed

3 files changed

+84
-0
lines changed

‎.github/workflows/release.yaml

+39
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,13 @@ jobs:
128128
- name: Setup Node
129129
uses: ./.github/actions/setup-node
130130

131+
# Necessary for signing Windows binaries.
132+
- name: Setup Java
133+
uses: actions/setup-java@v4
134+
with:
135+
distribution: "zulu"
136+
java-version: "11.0"
137+
131138
- name: Install nsis and zstd
132139
run: sudo apt-get install -y nsis zstd
133140

@@ -161,10 +168,32 @@ jobs:
161168
AC_CERTIFICATE_PASSWORD: ${{ secrets.AC_CERTIFICATE_PASSWORD }}
162169
AC_APIKEY_P8_BASE64: ${{ secrets.AC_APIKEY_P8_BASE64 }}
163170

171+
- name: Setup Windows EV Signing Certificate
172+
run: |
173+
set -euo pipefail
174+
touch /tmp/ev_cert.pem
175+
chmod 600 /tmp/ev_cert.pem
176+
echo "$EV_SIGNING_CERT" > /tmp/ev_cert.pem
177+
wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar -O /tmp/jsign-6.0.jar
178+
env:
179+
EV_SIGNING_CERT: ${{ secrets.EV_SIGNING_CERT }}
180+
164181
- name: Test migrations from current ref to main
165182
run: |
166183
make test-migrations
167184
185+
# Setup GCloud for signing Windows binaries.
186+
- name: Authenticate to Google Cloud
187+
id: gcloud_auth
188+
uses: google-github-actions/auth@v2
189+
with:
190+
workload_identity_provider: ${{ secrets.GCP_CODE_SIGNING_WORKLOAD_ID_PROVIDER }}
191+
service_account: ${{ secrets.GCP_CODE_SIGNING_SERVICE_ACCOUNT }}
192+
token_format: "access_token"
193+
194+
- name: Setup GCloud SDK
195+
uses: "google-github-actions/setup-gcloud@v2"
196+
168197
- name: Build binaries
169198
run: |
170199
set -euo pipefail
@@ -179,16 +208,26 @@ jobs:
179208
build/coder_helm_"$version".tgz \
180209
build/provisioner_helm_"$version".tgz
181210
env:
211+
CODER_SIGN_WINDOWS: "1"
182212
CODER_SIGN_DARWIN: "1"
183213
AC_CERTIFICATE_FILE: /tmp/apple_cert.p12
184214
AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt
185215
AC_APIKEY_ISSUER_ID: ${{ secrets.AC_APIKEY_ISSUER_ID }}
186216
AC_APIKEY_ID: ${{ secrets.AC_APIKEY_ID }}
187217
AC_APIKEY_FILE: /tmp/apple_apikey.p8
218+
EV_KEY: ${{ secrets.EV_KEY }}
219+
EV_KEYSTORE: ${{ secrets.EV_KEYSTORE }}
220+
EV_TSA_URL: ${{ secrets.EV_TSA_URL }}
221+
EV_CERTIFICATE_PATH: /tmp/ev_cert.pem
222+
GCLOUD_ACCESS_TOKEN: ${{ steps.gcloud_auth.outputs.access_token }}
223+
JSIGN_PATH: /tmp/jsign-6.0.jar
188224

189225
- name: Delete Apple Developer certificate and API key
190226
run: rm -f /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
191227

228+
- name: Delete Windows EV Signing Cert
229+
run: rm /tmp/ev_cert.pem
230+
192231
- name: Determine base image tag
193232
id: image-base-tag
194233
run: |

‎scripts/build_go.sh

+10
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ os="${GOOS:-linux}"
3535
arch="${GOARCH:-amd64}"
3636
slim="${CODER_SLIM_BUILD:-0}"
3737
sign_darwin="${CODER_SIGN_DARWIN:-0}"
38+
sign_windows="${CODER_SIGN_WINDOWS:-0}"
3839
output_path=""
3940
agpl="${CODER_BUILD_AGPL:-0}"
4041
boringcrypto=${CODER_BUILD_BORINGCRYPTO:-0}
@@ -106,6 +107,11 @@ if [[ "$sign_darwin" == 1 ]]; then
106107
requiredenvs AC_CERTIFICATE_FILE AC_CERTIFICATE_PASSWORD_FILE
107108
fi
108109

110+
if [[ "$sign_windows" == 1 ]]; then
111+
dependencies java
112+
requiredenvs JSIGN_PATH EV_KEYSTORE EV_KEY EV_CERTIFICATE_PATH EV_TSA_URL GCLOUD_ACCESS_TOKEN
113+
fi
114+
109115
ldflags=(
110116
-X "'github.com/coder/coder/v2/buildinfo.tag=$version'"
111117
)
@@ -176,4 +182,8 @@ if [[ "$sign_darwin" == 1 ]] && [[ "$os" == "darwin" ]]; then
176182
execrelative ./sign_darwin.sh "$output_path" 1>&2
177183
fi
178184

185+
if [[ "$sign_windows" == 1 ]] && [[ "$os" == "windows" ]]; then
186+
execrelative ./sign_windows.sh "$output_path" 1>&2
187+
fi
188+
179189
echo "$output_path"

‎scripts/sign_windows.sh

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/usr/bin/env bash
2+
3+
# This script signs the provided windows binary with an Extended Validation
4+
# code signing certificate.
5+
#
6+
# Usage: ./sign_windows.sh path/to/binary
7+
#
8+
# On success, the input file will be signed using the EV cert.
9+
#
10+
# Depends on the jsign utility (and thus Java). Requires the following environment variables
11+
# to be set:
12+
# - $JSIGN_PATH: The path to the jsign jar.
13+
# - $EV_KEYSTORE: The name of the keyring containing the private key
14+
# - $EV_KEY: The name of the key.
15+
# - $EV_CERTIFICATE_PATH: The path to the certificate.
16+
# - $EV_TSA_URL: The url of the timestamp server to use.
17+
18+
set -euo pipefail
19+
# shellcheck source=scripts/lib.sh
20+
source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
21+
22+
# Check dependencies
23+
dependencies java
24+
requiredenvs JSIGN_PATH EV_KEYSTORE EV_KEY EV_CERTIFICATE_PATH EV_TSA_URL GCLOUD_ACCESS_TOKEN
25+
26+
java -jar "$JSIGN_PATH" \
27+
--storetype GOOGLECLOUD \
28+
--storepass "$GCLOUD_ACCESS_TOKEN" \
29+
--keystore "$EV_KEYSTORE" \
30+
--alias "$EV_KEY" \
31+
--certfile "$EV_CERTIFICATE_PATH" \
32+
--tsmode RFC3161 \
33+
--tsaurl "$EV_TSA_URL" \
34+
"$@" \
35+
1>&2

0 commit comments

Comments
 (0)