KofTwentyTwo/gclo
2
0 Fork 0
Code Issues 28 Pull Requests 1 Actions Packages Projects Releases 22 Wiki Activity

feat(release): Authenticode-sign releases with Azure Artifact Signing over OIDC #93

Closed
KofTwentyTwo wants to merge 3 commits from feat/GH-57-release-signing into main
pull from: feat/GH-57-release-signing
merge into: KofTwentyTwo:main
Conversation 2 Commits 3 Files Changed 7
+369 -8
KofTwentyTwo commented 2026-10-10 18:54:22 +00:00 (Migrated from github.com)
Copy link
Copy source

What

Releases are now Authenticode-signed (K22-REL-05) through the standards' shared workflow, which already carries the signing steps behind sign (azure/login v3.1.0 and azure/artifact-signing-action v2.0.0, both SHA-pinned and current; vpk pack --azureTrustedSignFile). ADR 0008.

  • release.yml: sign: true; new verify-signatures job after release downloads the published Setup.exe, portable zip and CLI zip and runs signtool verify /pa /all + Get-AuthenticodeSignature on every gclo executable, failing on an invalid, untimestamped or foreign-publisher signature (TRUSTED_SIGNING_SUBJECT).
  • Authentication is GitHub OIDC: an Entra application gclo-release-signing with a federated credential for repo:KofTwentyTwo/gclo:environment:release and only Artifact Signing Certificate Profile Signer on the certificate profile. No secret, key or PFX anywhere. The identity is release-environment variables: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_SUBSCRIPTION_ID, TRUSTED_SIGNING_ENDPOINT, TRUSTED_SIGNING_ACCOUNT, TRUSTED_SIGNING_PROFILE, TRUSTED_SIGNING_SUBJECT.
  • .github/scripts/Set-ReleaseSigning.ps1: idempotent Azure configuration (reads the existing account and Active profile through ARM, ensures app + service principal + federated credential + profile-scoped role, prints the gh variable set lines). Run interactively by the owner; never creates secrets or touches the account, validation or profile.
  • Docs: RELEASING.md ("Code signing", local signing with SignTool + the Microsoft.ArtifactSigning.Client dlib, the verify job), SECURITY.md, README verify step 4, threat-model revision row.

Closes #57 (part of #62). After the first signed release verifies, EX-0002 closes for gclo in the standards register.

Azure configuration status

Pending the owner's interactive sign-in; the script output and signtool verify results of the first signed prerelease will be posted here before merge.

How it was tested

  • actionlint clean; PSScriptAnalyzer 0 findings.
  • Verification of a real signed build: pending the Azure configuration (recorded here when done).

🤖 Generated with Claude Code

## What Releases are now Authenticode-signed (K22-REL-05) through the standards' shared workflow, which already carries the signing steps behind `sign` (`azure/login` v3.1.0 and `azure/artifact-signing-action` v2.0.0, both SHA-pinned and current; `vpk pack --azureTrustedSignFile`). ADR 0008. - `release.yml`: `sign: true`; new `verify-signatures` job after `release` downloads the published Setup.exe, portable zip and CLI zip and runs `signtool verify /pa /all` + `Get-AuthenticodeSignature` on every gclo executable, failing on an invalid, untimestamped or foreign-publisher signature (`TRUSTED_SIGNING_SUBJECT`). - Authentication is GitHub OIDC: an Entra application `gclo-release-signing` with a federated credential for `repo:KofTwentyTwo/gclo:environment:release` and only *Artifact Signing Certificate Profile Signer* on the certificate profile. No secret, key or PFX anywhere. The identity is `release`-environment **variables**: `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_SUBSCRIPTION_ID`, `TRUSTED_SIGNING_ENDPOINT`, `TRUSTED_SIGNING_ACCOUNT`, `TRUSTED_SIGNING_PROFILE`, `TRUSTED_SIGNING_SUBJECT`. - `.github/scripts/Set-ReleaseSigning.ps1`: idempotent Azure configuration (reads the existing account and Active profile through ARM, ensures app + service principal + federated credential + profile-scoped role, prints the `gh variable set` lines). Run interactively by the owner; never creates secrets or touches the account, validation or profile. - Docs: RELEASING.md ("Code signing", local signing with SignTool + the `Microsoft.ArtifactSigning.Client` dlib, the verify job), SECURITY.md, README verify step 4, threat-model revision row. Closes #57 (part of #62). After the first signed release verifies, EX-0002 closes for gclo in the standards register. ## Azure configuration status Pending the owner's interactive sign-in; the script output and `signtool verify` results of the first signed prerelease will be posted here before merge. ## How it was tested - `actionlint` clean; PSScriptAnalyzer 0 findings. - Verification of a real signed build: pending the Azure configuration (recorded here when done). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
KofTwentyTwo commented 2026-10-10 19:09:26 +00:00 (Migrated from github.com)
Copy link
Copy source

Azure configuration done (2026-10-10, run by the owner's interactive session)

Verified against the deployed resources, not the setup notes:

Item Value
Tenant 4ebeb0ad-5782-487a-a1b4-5080255774cf (koftwentytwooutlook.onmicrosoft.com)
Subscription 8ef2479e-3346-4cba-93ad-101c6cd237a0 "Kof22 Signing Account"
Signing account kof22signing, rg-code-signing, eastus, endpoint https://eus.codesigning.azure.net
Certificate profile releases, PublicTrust, Active; certificate subject CN=James Maes, O=James Maes, L=Chester, S=il, C=US (thumbprint BAAA6D7D…31D3)
Entra application gclo-release-signing, client id 5fc7f572-6ffa-4538-bcf4-65282dd0859a (new; no existing identity existed in the tenant)
Federated credential issuer https://token.actions.githubusercontent.com, subject repo:KofTwentyTwo/gclo:environment:release, audience api://AzureADTokenExchange
Role Artifact Signing Certificate Profile Signer on …/certificateProfiles/releases only, for the service principal and (for local one-offs) the owner user. No subscription-level role for the application.

release environment variables set: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_SUBSCRIPTION_ID, TRUSTED_SIGNING_ENDPOINT, TRUSTED_SIGNING_ACCOUNT, TRUSTED_SIGNING_PROFILE, TRUSTED_SIGNING_SUBJECT=James Maes. No secret was created anywhere.

Signing test (local, same account and profile)

signtool sign /fd SHA256 /tr http://timestamp.acs.microsoft.com /td SHA256 /dlib Azure.CodeSigning.Dlib.dll /dmdf metadata.json gclo.exe gclo.dll → 2 signed, 0 warnings, 0 errors.

signtool verify /pa /all /v gclo.exe → exit 0; chain James Maes ← Microsoft ID Verified CS EOC CA 03 ← Microsoft ID Verified Code Signing PCA 2021 ← Microsoft Identity Verification Root CA 2020. Get-AuthenticodeSignature: Valid, subject CN=James Maes, O=James Maes, L=Chester, S=il, C=US, timestamper Microsoft Public RSA Time Stamping Authority.

The verify-signatures job expects the subject to contain "James Maes" (the validated publisher), which is what Windows will show.

Next: merge → v1.0.2-beta.2 (first CI-signed build, OIDC path exercised for real) → verify the published assets with signtool → v1.0.2 → close EX-0002 in the standards register.

## Azure configuration done (2026-10-10, run by the owner's interactive session) Verified against the deployed resources, not the setup notes: | Item | Value | | --- | --- | | Tenant | `4ebeb0ad-5782-487a-a1b4-5080255774cf` (`koftwentytwooutlook.onmicrosoft.com`) | | Subscription | `8ef2479e-3346-4cba-93ad-101c6cd237a0` "Kof22 Signing Account" | | Signing account | `kof22signing`, `rg-code-signing`, **eastus**, endpoint `https://eus.codesigning.azure.net` | | Certificate profile | `releases`, PublicTrust, **Active**; certificate subject `CN=James Maes, O=James Maes, L=Chester, S=il, C=US` (thumbprint `BAAA6D7D…31D3`) | | Entra application | `gclo-release-signing`, client id `5fc7f572-6ffa-4538-bcf4-65282dd0859a` (new; no existing identity existed in the tenant) | | Federated credential | issuer `https://token.actions.githubusercontent.com`, subject `repo:KofTwentyTwo/gclo:environment:release`, audience `api://AzureADTokenExchange` | | Role | *Artifact Signing Certificate Profile Signer* on `…/certificateProfiles/releases` only, for the service principal and (for local one-offs) the owner user. No subscription-level role for the application. | `release` environment variables set: `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_SUBSCRIPTION_ID`, `TRUSTED_SIGNING_ENDPOINT`, `TRUSTED_SIGNING_ACCOUNT`, `TRUSTED_SIGNING_PROFILE`, `TRUSTED_SIGNING_SUBJECT=James Maes`. No secret was created anywhere. ## Signing test (local, same account and profile) `signtool sign /fd SHA256 /tr http://timestamp.acs.microsoft.com /td SHA256 /dlib Azure.CodeSigning.Dlib.dll /dmdf metadata.json gclo.exe gclo.dll` → 2 signed, 0 warnings, 0 errors. `signtool verify /pa /all /v gclo.exe` → exit 0; chain *James Maes* ← Microsoft ID Verified CS EOC CA 03 ← Microsoft ID Verified Code Signing PCA 2021 ← Microsoft Identity Verification Root CA 2020. `Get-AuthenticodeSignature`: `Valid`, subject `CN=James Maes, O=James Maes, L=Chester, S=il, C=US`, timestamper Microsoft Public RSA Time Stamping Authority. The `verify-signatures` job expects the subject to contain **"James Maes"** (the validated publisher), which is what Windows will show. Next: merge → `v1.0.2-beta.2` (first CI-signed build, OIDC path exercised for real) → verify the published assets with signtool → `v1.0.2` → close EX-0002 in the standards register.
KofTwentyTwo commented 2026-10-10 19:23:37 +00:00 (Migrated from github.com)
Copy link
Copy source

Superseded by https://github.com/KofTwentyTwo/gclo/pull/95 (same commits cherry-picked onto main, signed and signed-off; the branch-update merge commit here had no DCO trailer).

Superseded by https://github.com/KofTwentyTwo/gclo/pull/95 (same commits cherry-picked onto main, signed and signed-off; the branch-update merge commit here had no DCO trailer).

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
.NET
Pull requests that update .NET code
 bug
Something isn't working
 deferred
Agreed follow-up, not scheduled
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 needs-owner
Blocked on an action only the owner can take
 priority
Owner-flagged: work this first
 quality
Standards, simplicity, enforcement
 question
Further information is requested
 refactor
Restructuring without behavior change
 release
Release pipeline / distribution
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#93