release-velopack: signing step times out signing already-signed runtime files; sign only unsigned binaries and verify before packing #26

New Issue

2026-10-10T19:58:04Z

KofTwentyTwo commented

2026-10-10 19:58:04 +00:00

(Migrated from github.com)

First real run of sign: true (gclo v1.0.2-beta.2, run 38080813985): the OIDC login worked and signing started, but the Sign published binaries step died after 320 s with exit 1 and no message. Cause: the step signs every .exe/.dll under publish recursively, and a self-contained .NET + Windows App SDK publish has ~285 of them, ~2 s each; azure/artifact-signing-action stops after its default timeout of 300 s. Of those 285, 239 already carry Microsoft/.NET signatures that re-signing would replace (and K22-REL-05 does not ask for that); only 46 are unsigned, 4 of them the app's own.

Proposed change to release-velopack.yml:

a step that lists the .exe/.dll files under publish whose Get-AuthenticodeSignature status is not Valid (third-party signatures preserved, nothing signed twice) and passes them through the action's files input, failing if the main exe or the CLI exe is not in the list;
timeout raised (e.g. 1800 s) so a large unsigned set cannot hit the default;
a signtool verify /pa over the selected files before packing, so a partial signing cannot reach vpk pack.

gclo's caller-side verify-signatures job already checks the published assets; this moves the guarantee before the publish.

First real run of `sign: true` (gclo v1.0.2-beta.2, run 38080813985): the OIDC login worked and signing started, but the `Sign published binaries` step died after 320 s with exit 1 and no message. Cause: the step signs **every** `.exe`/`.dll` under `publish` recursively, and a self-contained .NET + Windows App SDK publish has ~285 of them, ~2 s each; `azure/artifact-signing-action` stops after its default `timeout` of 300 s. Of those 285, 239 already carry Microsoft/.NET signatures that re-signing would replace (and K22-REL-05 does not ask for that); only 46 are unsigned, 4 of them the app's own. Proposed change to `release-velopack.yml`: - a step that lists the `.exe`/`.dll` files under `publish` whose `Get-AuthenticodeSignature` status is not `Valid` (third-party signatures preserved, nothing signed twice) and passes them through the action's `files` input, failing if the main exe or the CLI exe is not in the list; - `timeout` raised (e.g. 1800 s) so a large unsigned set cannot hit the default; - a `signtool verify /pa` over the selected files before packing, so a partial signing cannot reach `vpk pack`. gclo's caller-side `verify-signatures` job already checks the published assets; this moves the guarantee before the publish.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#26