ci: sign Windows packages with Certum SimplySign - #2972
Draft
wgqqqqq wants to merge 2 commits into
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows release installers currently have Tauri/minisign update signatures but no Authenticode publisher signature. Add Certum SimplySign login on the hosted Windows runner and sign the Desktop EXE, NSIS updater installer, and custom installer before publishing.
Compile before opening the cloud session, then run Tauri's bundler with SHA-256/RFC3161 signing. Tauri restores the unsigned raw EXE after bundling, so explicitly sign it again before the custom installer builds its payload manifest. Verify Windows trust, the expected certificate fingerprint, and a timestamp; publication fails on missing credentials or invalid signatures. Preserve the existing updater signing keys and never modify the NSIS installer after Tauri generates its updater signature.
Login uses a pinned community action with diagnostic screenshots disabled. Document the credential setup and add credential-free Windows checks for signing configuration and failure handling.
Validation: GitHub YAML check passed; 55 Node tests passed, 1 existing skip; 8 mocked PowerShell contract cases passed on macOS; confirmed
tauri bundleoptions against the pinned 2.11.4 CLI. The credential-free Windows Signing Checks workflow passed on commit 16da5c6 (run 34576480404), including the Node and mocked PowerShell tests. Actual Windows cloud signing, certificate trust, and PIN behavior have not been exercised yet. Remote runtime scenarios are unaffected; these are packaging-only changes.Draft until provisioning is complete: CERTUM_KEY_ID has been configured, but CERTUM_USERNAME and CERTUM_OTP_URI are still needed. The user has not retained the TOTP provisioning data. Do not merge and publish until credentials are supplied and a real signed Windows build is verified.