CyberCoveLLC/Triple-C
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 50 Wiki Activity

ci: sign Windows builds with Azure Artifact Signing
Build App (Preview) / compute-version (pull_request) Successful in 5s
Details
Secret Scan / scan (pull_request) Successful in 4s
Details
Secret Scan / scan (push) Successful in 6s
Details
Build App (Preview) / create-release (pull_request) Successful in 2s
Details
Build App (Preview) / build-macos (pull_request) Successful in 3m19s
Details
Build App (Preview) / test (pull_request) Successful in 4m59s
Details
Build App (Preview) / build-linux (pull_request) Successful in 5m18s
Details
Build App (Preview) / build-windows (pull_request) Failing after 5m32s
Details
Build App (Preview) / prune-previews (pull_request) Skipped
Details

Browse Source 
Releases and PR previews now sign the app binary, the MSI, the NSIS
installer and its uninstaller. "Verify signatures" fails the job on any
unsigned or untimestamped .exe/.msi, so an unsigned installer can't ship
quietly.

- windows-signing-setup.ps1 fetches Microsoft.ArtifactSigning.Client 1.0.128
  and a job-local .NET 10.0.12 runtime, each pinned by hash. Nothing is
  installed on the build VM. It also writes the dlib metadata and exports
  TAURI_CONFIG with bundle.windows.signCommand.
- windows-sign.ps1 runs the installed signtool with /dlib, SHA-256 and the
  Microsoft timestamp server, with retries. Credentials come only from the
  AZURE_* environment. The metadata excludes every credential type except
  EnvironmentCredential, because InteractiveBrowserCredential would hang a
  job running as SYSTEM.
- The signing files go in the workspace, not %TEMP%, because the uninstaller
  is signed from 32-bit makensis and WOW64 redirects SYSTEM's %TEMP%.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
shadowdao
2026-09-23 17:57:32 -07:00
co-authored by Claude Opus 5.5
parent 85901d8a80
commit 44e9bd2916
7 changed files with 338 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+3
View File
@@ -16,3 +16,6 @@ screenshot_for_fix/
# Package files pulled in by ad-hoc verification runs.
*.deb
# Windows CI code signing (scripts/windows-signing-setup.ps1)
.code-signing/