We can't use osslsignencode because it doesn't support google cloud HSM. We will probably want to use jsign instead: https://ebourg.github.io/jsign/

This is how the GitHub CLI does it:
https://github.com/cli/cli/blob/trunk/.github/workflows/releases.yml#L32-L38

Not sure if it's entirely applicable though...

If we're ok with not doing extended validation signing then osslsignencode will be OK.

Ahhhh

depends on if we want extended validation or not... this is probably a 3 if not but could be up to an 8 if so

https://github.com/cli/cli/blob/ebcf3a10225a9b7c9422f6b63ff798d695f7f0a2/.github/workflows/deployment.yml#L187-L196

Kyle wants this :)

@kylecarbs - i just noticed this on windows machines that want to use VSCode Desktop, as it fails to run the coder cli. Hopefully this fixes this issue!

Slotting this in as a candidate for our next sprint as several folks need this as a long-term solution for rolling out Coder to Windows users.

Seems like the GitHub CLI does this pretty cleanly now: https://github.com/cli/cli/blob/c465d465a5c60dae4e4759b4383292dab3f77504/.github/workflows/deployment.yml#L136

Game plan:

• Test whether Google Cloud HSM can sign Windows artifacts with a self-signed cert (needs owner)
• Pick a vendor or tool we feel good with (needs owner)
• Do the paperwork (@bpmct)
• Modify our CI pipeline to sign Windows binaries (needs owner)

• Beers 🍻

@kylecarbs i think we need some instructions on how to allow for these new signed exes in tools like Cyberark. So far this is not working

@michaelbrewer could you elaborate on what's not working?

Unfortunately i don't have a windows machine or am the person responsible for approving signed exe. But users are still getting an Application Blocked error

@kylecarbs @sreya - looks like it was signed as Coder Technologies Inc. and previous Coder Technologies Inc.

In the future exactness matter :)

@michaelbrewer is all working now after that change?

No unfortunately it is still being flagged and blocked by CyberArk. I am not sure how to resolve this. We tried both names.

@kylecarbs good news, we where able to get the signed exec working, waiting on how to document a standard working instructions.