shadowdaoandClaude Opus 5.5
cc274f39a8
Secret Scan / scan (push) Successful in 8s
Build App (Preview) / compute-version (pull_request) Successful in 12s
Secret Scan / scan (pull_request) Successful in 5s
Build App (Preview) / create-release (pull_request) Successful in 1s
Build App (Preview) / build-macos (pull_request) Successful in 2m48s
Build App (Preview) / test (pull_request) Successful in 3m41s
Build App (Preview) / build-linux (pull_request) Successful in 7m8s
Build App (Preview) / build-windows (pull_request) Failing after 8m53s
Build App (Preview) / prune-previews (pull_request) Skipped
The first signing run built nothing signed, and "Verify signatures" failed it as intended. The Tauri 2 CLI never reads TAURI_CONFIG. It only sets that variable for tauri-build, so the sign command was dropped silently, just as the inline beforeBuildCommand override had been for as long as the Windows jobs have set it. The setup now writes a config file, and the build passes it with `cargo tauri build --config`. Review follow-ups: - The NSIS uninstaller is written to %TEMP% and signed from 32-bit makensis. SYSTEM's %TEMP% sits under System32, which WOW64 redirects for makensis but not for the x64 signtool, so they would disagree about where the file is. %TEMP% and %TMP% now point into the workspace. makensis ignores the sign command's exit code for the uninstaller, so windows-sign.ps1 logs every file it signs, and the verify step requires a logged signature under that temp directory. - The signing client is pinned by SHA-512, so the pin can be checked against nuget.org's published packageHash. - tauri-cli on Windows is pinned to =2.11.0 --locked, the @tauri-apps/cli version the Linux and macOS jobs run from the lockfile, instead of "^2". Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
62 lines
2.8 KiB
PowerShell
62 lines
2.8 KiB
PowerShell
# windows-sign.ps1 <file> - sign one file with Azure Artifact Signing.
|
|
#
|
|
# Tauri's bundle.windows.signCommand, set up by windows-signing-setup.ps1.
|
|
# Tauri calls it once per file it signs and fails the build on a non-zero exit.
|
|
#
|
|
# This may run as 32-bit PowerShell: the NSIS uninstaller is signed from inside
|
|
# makensis, which is 32-bit and resolves `powershell` to the SysWOW64 copy. So
|
|
# nothing here depends on $env:ProgramFiles or other per-bitness paths - every
|
|
# path comes in absolute from the setup script, and signtool is always the x64
|
|
# build, since that is what loads the x64 dlib.
|
|
#
|
|
# Credentials never touch a command line: the dlib reads AZURE_TENANT_ID,
|
|
# AZURE_CLIENT_ID and AZURE_CLIENT_SECRET from the environment itself.
|
|
|
|
param([Parameter(Mandatory = $true)][string]$Path)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
foreach ($name in 'TRIPLE_C_SIGNTOOL', 'TRIPLE_C_SIGN_DLIB', 'TRIPLE_C_SIGN_METADATA', 'TRIPLE_C_SIGN_TIMESTAMP',
|
|
'AZURE_TENANT_ID', 'AZURE_CLIENT_ID', 'AZURE_CLIENT_SECRET') {
|
|
if (-not [Environment]::GetEnvironmentVariable($name)) {
|
|
throw "$name is not set - run windows-signing-setup.ps1 first and pass the AZURE_* secrets to this step"
|
|
}
|
|
}
|
|
if (-not (Test-Path -LiteralPath $Path)) { throw "No such file to sign: $Path" }
|
|
|
|
# /d names the product in the UAC prompt, which for an MSI would otherwise show
|
|
# a temporary file name. The timestamp is what keeps the signature valid after
|
|
# the short-lived Artifact Signing certificate expires, so it is not optional.
|
|
$arguments = @(
|
|
'sign', '/v',
|
|
'/fd', 'SHA256',
|
|
'/tr', $env:TRIPLE_C_SIGN_TIMESTAMP, '/td', 'SHA256',
|
|
'/d', 'Triple-C',
|
|
'/dlib', $env:TRIPLE_C_SIGN_DLIB,
|
|
'/dmdf', $env:TRIPLE_C_SIGN_METADATA,
|
|
$Path
|
|
)
|
|
|
|
# Timestamp servers and the signing endpoint both fail transiently now and
|
|
# then; a retry is cheaper than a failed three-platform release.
|
|
#
|
|
# Stop is relaxed around the call: Tauri captures this script's output, and
|
|
# PowerShell 5.1 turns a native command's stderr into error records when its
|
|
# own streams are redirected - under Stop, signtool's first warning would kill
|
|
# the script before its exit code is read.
|
|
$ErrorActionPreference = 'Continue'
|
|
for ($attempt = 1; $attempt -le 3; $attempt++) {
|
|
& $env:TRIPLE_C_SIGNTOOL @arguments 2>&1 | ForEach-Object { "$_" }
|
|
if ($LASTEXITCODE -eq 0) {
|
|
# The evidence "Verify signatures" needs for files it cannot see
|
|
# afterwards - the NSIS uninstaller is embedded in the installer.
|
|
if ($env:TRIPLE_C_SIGN_LOG) {
|
|
[IO.File]::AppendAllText($env:TRIPLE_C_SIGN_LOG, "$Path`n", (New-Object System.Text.UTF8Encoding $false))
|
|
}
|
|
exit 0
|
|
}
|
|
Write-Host "signtool exited $LASTEXITCODE signing $Path (attempt $attempt of 3)"
|
|
if ($attempt -lt 3) { Start-Sleep -Seconds (10 * $attempt) }
|
|
}
|
|
exit 1
|