Skip to content

Commit ab43264

Browse files
tiwarishubham635tiwarishubham635
authored
chore: added digicert certificate for windows release (#582)
* chore: added digicert certificate for windows release * Update windows-executable-release.yml
1 parent c714e58 commit ab43264

File tree

2 files changed

+94
-34
lines changed

2 files changed

+94
-34
lines changed

‎.github/workflows/windows-executable-draft-release.yml‎

Lines changed: 37 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,23 +49,53 @@ jobs:
4949
steps:
5050
- uses: actions/checkout@v2
5151
- run: make install
52-
- name: import certificate
53-
if: ${{ github.repository_owner == 'twilio' }}
54-
run: |
55-
New-Item -ItemType directory -Path certificate
56-
Set-Content -Path certificate\certificate.txt -Value '${{ secrets.WINDOWS_CERTIFICATE }}'
57-
certutil -decode certificate\certificate.txt certificate\certificate.pfx
5852
- name: import Executable
5953
id: download
6054
uses: actions/download-artifact@v2
6155
with:
6256
name: ${{env.FORMULA_NAME}}-${{ needs.get-tag.outputs.TAG_NAME }}.exe
6357
- name: 'Echo download path'
6458
run: ls ${{steps.download.outputs.download-path}}
59+
60+
- name: Setup Certificate
61+
run: |
62+
echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
63+
shell: bash
64+
65+
- name: Set variables
66+
id: variables
67+
run: |
68+
dir
69+
echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
70+
echo "::set-output name=KEYPAIR_NAME::gt-standard-keypair"
71+
echo "::set-output name=CERTIFICATE_NAME::gt-certificate"
72+
echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
73+
echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
74+
echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
75+
echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
76+
echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
77+
echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
78+
echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
79+
shell: bash
80+
81+
- name: Setup Keylocker KSP on windows
82+
run: |
83+
curl -X GET https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi
84+
msiexec /i Keylockertools-windows-x64.msi /quiet /qn
85+
smksp_registrar.exe list
86+
smctl.exe keypair ls
87+
C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
88+
shell: cmd
89+
90+
- name: Certificates Sync
91+
run: |
92+
smctl windows certsync
93+
shell: cmd
94+
6595
- name: Code Sign The Executable
6696
if: ${{ github.repository_owner == 'twilio' }}
6797
run: |
68-
& 'C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe' sign /f certificate\certificate.pfx /p '${{ secrets.WINDOWS_CERTIFICATE_PASS }}' /t http://timestamp.digicert.com ${{steps.download.outputs.download-path}}/${{env.FORMULA_NAME}}-v${{ needs.get-tag.outputs.TAG_NAME }}-x86.exe
98+
& 'C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe' sign /sha1 ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 ${{steps.download.outputs.download-path}}/${{env.FORMULA_NAME}}-v${{ needs.get-tag.outputs.TAG_NAME }}-x86.exe
6999
- name: Upload binaries to release
70100
run: node .github/scripts/update-platform-executables.js
71101
env:

‎.github/workflows/windows-executable-release.yml‎

Lines changed: 57 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -45,33 +45,63 @@ jobs:
4545
needs: [pack-windows-release, get-tag, get-sha]
4646
runs-on: windows-latest
4747
steps:
48-
- uses: actions/checkout@v2
49-
- run: make install
50-
- name: import certificate
51-
if: ${{ github.repository_owner == 'twilio' }}
52-
run: |
53-
New-Item -ItemType directory -Path certificate
54-
Set-Content -Path certificate\certificate.txt -Value '${{ secrets.WINDOWS_CERTIFICATE }}'
55-
certutil -decode certificate\certificate.txt certificate\certificate.pfx
56-
- name: import Executable
57-
id: download
58-
uses: actions/download-artifact@v2
59-
with:
60-
name: ${{env.FORMULA_NAME}}-${{ needs.get-tag.outputs.TAG_NAME }}.exe
61-
- name: 'Echo download path'
62-
run: ls ${{steps.download.outputs.download-path}}
63-
- name: Code Sign The Executable
64-
if: ${{ github.repository_owner == 'twilio' }}
65-
run: |
66-
& 'C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe' sign /f certificate\certificate.pfx /p '${{ secrets.WINDOWS_CERTIFICATE_PASS }}' /t http://timestamp.digicert.com ${{steps.download.outputs.download-path}}/${{env.FORMULA_NAME}}-v${{ needs.get-tag.outputs.TAG_NAME }}-${{ needs.get-sha.outputs.SHA_SHORT }}-x86.exe
67-
- name: Upload binaries to release
68-
run: node .github/scripts/update-platform-executables.js
69-
env:
70-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
71-
FILE: ${{steps.download.outputs.download-path}}\${{env.FORMULA_NAME}}-v${{ needs.get-tag.outputs.TAG_NAME }}-${{ needs.get-sha.outputs.SHA_SHORT }}-x86.exe
72-
ASSET_NAME: ${{env.FORMULA_NAME}}-${{ needs.get-tag.outputs.TAG_NAME }}.exe
73-
TAG_NAME: ${{ needs.get-tag.outputs.TAG_NAME }}
74-
REPO_NAME: ${{ github.repository }}
48+
- uses: actions/checkout@v2
49+
- run: make install
50+
- name: import Executable
51+
id: download
52+
uses: actions/download-artifact@v2
53+
with:
54+
name: ${{env.FORMULA_NAME}}-${{ needs.get-tag.outputs.TAG_NAME }}.exe
55+
- name: 'Echo download path'
56+
run: ls ${{steps.download.outputs.download-path}}
57+
58+
- name: Setup Certificate
59+
run: |
60+
echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
61+
shell: bash
62+
63+
- name: Set variables
64+
id: variables
65+
run: |
66+
dir
67+
echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
68+
echo "::set-output name=KEYPAIR_NAME::gt-standard-keypair"
69+
echo "::set-output name=CERTIFICATE_NAME::gt-certificate"
70+
echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
71+
echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
72+
echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
73+
echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
74+
echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
75+
echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
76+
echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
77+
shell: bash
78+
79+
- name: Setup Keylocker KSP on windows
80+
run: |
81+
curl -X GET https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi
82+
msiexec /i Keylockertools-windows-x64.msi /quiet /qn
83+
smksp_registrar.exe list
84+
smctl.exe keypair ls
85+
C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
86+
shell: cmd
87+
88+
- name: Certificates Sync
89+
run: |
90+
smctl windows certsync
91+
shell: cmd
92+
93+
- name: Code Sign The Executable
94+
if: ${{ github.repository_owner == 'twilio' }}
95+
run: |
96+
& 'C:/Program Files (x86)/Windows Kits/10/bin/10.0.17763.0/x86/signtool.exe' sign /sha1 ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 ${{steps.download.outputs.download-path}}/${{env.FORMULA_NAME}}-v${{ needs.get-tag.outputs.TAG_NAME }}-${{ needs.get-sha.outputs.SHA_SHORT }}-x86.exe
97+
- name: Upload binaries to release
98+
run: node .github/scripts/update-platform-executables.js
99+
env:
100+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
101+
FILE: ${{steps.download.outputs.download-path}}\${{env.FORMULA_NAME}}-v${{ needs.get-tag.outputs.TAG_NAME }}-${{ needs.get-sha.outputs.SHA_SHORT }}-x86.exe
102+
ASSET_NAME: ${{env.FORMULA_NAME}}-${{ needs.get-tag.outputs.TAG_NAME }}.exe
103+
TAG_NAME: ${{ needs.get-tag.outputs.TAG_NAME }}
104+
REPO_NAME: ${{ github.repository }}
75105

76106
notify-complete-fail:
77107
if: ${{ failure() || cancelled() }}

0 commit comments

Comments
 (0)