Skip to content

Commit c917d37

Browse files
chore: updated windows code signing (#8668)
* updated windows code signing * pfx cert fix * removed pass * added find to see what's going on * set working directory and used more verbose ls * shuffled lines around * alpha7 * added no-revoke * added -k * little cleanup * revert: version bump --------- Co-authored-by: Begoña Alvarez <[email protected]>
1 parent abfc9f9 commit c917d37

1 file changed

Lines changed: 40 additions & 2 deletions

File tree

.github/workflows/build-and-release-desktop.yml

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -150,9 +150,47 @@ jobs:
150150

151151
- name: Build Electron app (Windows)
152152
run: yarn compile:${env:STAGE}:win
153+
working-directory: packages/desktop
154+
if: matrix.os == 'windows-2019'
155+
156+
- name: Restore client certificates for signing
157+
shell: bash
153158
env:
154-
CSC_LINK: ${{ secrets.WIN_CERT_BASE64 }}
155-
CSC_KEY_PASSWORD: ${{ secrets.WIN_CERT_PASSWORD }}
159+
SIGNING_CLIENT_CERT: ${{ secrets.SIGNING_CLIENT_CERT }}
160+
SIGNING_CLIENT_KEY: ${{ secrets.SIGNING_CLIENT_KEY }}
161+
SIGNING_CA_CERT: ${{ secrets.SIGNING_CA_CERT }}
162+
run: |
163+
echo "${SIGNING_CLIENT_CERT}" | base64 -d > client.crt
164+
echo "${SIGNING_CLIENT_KEY}" | base64 -d > client.key
165+
echo "${SIGNING_CA_CERT}" | base64 -d > ca.crt
166+
chmod 600 client.key # curl/OpenSSL insists
167+
168+
openssl pkcs12 -export -out client.pfx \
169+
-inkey client.key -in client.crt \
170+
-passout pass:
171+
working-directory: packages/desktop
172+
if: matrix.os == 'windows-2019'
173+
174+
- name: Code-sign Windows binary
175+
shell: bash
176+
env:
177+
SIGNING_API_URL: ${{ secrets.SIGNING_API_URL }}
178+
SIGNING_API_KEY: ${{ secrets.SIGNING_API_KEY }}
179+
NETWORK_CODE: ${{ env.NETWORK_CODE }}
180+
VERSION: ${{ env.VERSION }}
181+
run: |
182+
unsigned="./out/firefly-${NETWORK_CODE}-desktop-${VERSION}.exe"
183+
signed="$unsigned" # overwrite so downstream steps see the signed file
184+
185+
echo "🖊️ Signing $unsigned ..."
186+
curl --fail --show-error --silent \
187+
--cert client.pfx --cert-type P12 \
188+
--cacert ca.crt -k --ssl-no-revoke \
189+
-H "X-API-Key: ${SIGNING_API_KEY}" \
190+
--data-binary @"$unsigned" \
191+
-o "$signed" \
192+
"${SIGNING_API_URL}/sign"
193+
echo "✅ Signing complete"
156194
working-directory: packages/desktop
157195
if: matrix.os == 'windows-2019'
158196

0 commit comments

Comments
 (0)