3 Commits

Include renames

Author	SHA1	Message	Date
shadowdaoandClaude Opus 5.5	08cd05000c	fix(ci): verify the binary inside the installers, not the loose target copy ... The first fully signed run (signer CN=OLS Digital LLC) signed the app binary, the MSI, the NSIS installer and the uninstaller, and skipped the seven build-time DLLs. It still failed verification on target\release\triple-c.exe. Tauri patches that file with bundle-type information before each bundle, signs it, packages it, and patches it again, so the loose copy is unsigned by design and is not what ships. Verification now: - checks the installers themselves; - unpacks the MSI with `msiexec /a` and checks the binaries inside it; - for NSIS, which can't be unpacked that way, requires the signing log to show that the app binary and the uninstaller were signed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 18:53:58 -07:00
shadowdaoandClaude Opus 5.5	cc274f39a8	fix(ci): pass the sign command with --config and prove the uninstaller was signed ... The first signing run built nothing signed, and "Verify signatures" failed it as intended. The Tauri 2 CLI never reads TAURI_CONFIG. It only sets that variable for tauri-build, so the sign command was dropped silently, just as the inline beforeBuildCommand override had been for as long as the Windows jobs have set it. The setup now writes a config file, and the build passes it with `cargo tauri build --config`. Review follow-ups: - The NSIS uninstaller is written to %TEMP% and signed from 32-bit makensis. SYSTEM's %TEMP% sits under System32, which WOW64 redirects for makensis but not for the x64 signtool, so they would disagree about where the file is. %TEMP% and %TMP% now point into the workspace. makensis ignores the sign command's exit code for the uninstaller, so windows-sign.ps1 logs every file it signs, and the verify step requires a logged signature under that temp directory. - The signing client is pinned by SHA-512, so the pin can be checked against nuget.org's published packageHash. - tauri-cli on Windows is pinned to =2.11.0 --locked, the @tauri-apps/cli version the Linux and macOS jobs run from the lockfile, instead of "^2". Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 18:05:03 -07:00
shadowdaoandClaude Opus 5.5	44e9bd2916	ci: sign Windows builds with Azure Artifact Signing ... Releases and PR previews now sign the app binary, the MSI, the NSIS installer and its uninstaller. "Verify signatures" fails the job on any unsigned or untimestamped .exe/.msi, so an unsigned installer can't ship quietly. - windows-signing-setup.ps1 fetches Microsoft.ArtifactSigning.Client 1.0.128 and a job-local .NET 10.0.12 runtime, each pinned by hash. Nothing is installed on the build VM. It also writes the dlib metadata and exports TAURI_CONFIG with bundle.windows.signCommand. - windows-sign.ps1 runs the installed signtool with /dlib, SHA-256 and the Microsoft timestamp server, with retries. Credentials come only from the AZURE_* environment. The metadata excludes every credential type except EnvironmentCredential, because InteractiveBrowserCredential would hang a job running as SYSTEM. - The signing files go in the workspace, not %TEMP%, because the uninstaller is signed from 32-bit makensis and WOW64 redirects SYSTEM's %TEMP%. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-23 17:57:32 -07:00