ci(release-velopack): sign only unsigned files; verify before packing #29

2026-10-10T20:25:35Z

KofTwentyTwo commented

2026-10-10 20:25:35 +00:00

(Migrated from github.com)

What

First real sign: true run (gclo v1.0.2-beta.2, run 38080813985): OIDC login worked, signing started, and the step died after 320 s because it signs every exe/dll under publish (~285 in a self-contained publish, 239 already signed by Microsoft/.NET) and azure/artifact-signing-action stops at its 300 s default timeout.

Select the binaries to sign: only files whose Get-AuthenticodeSignature status is not Valid go to the action's files input; fails if the main exe (or the CLI exe) is not among them. Third-party signatures are preserved, nothing is signed twice. timeout: 1800.
vpk: its built-in --azureTrustedSignFile path hung >10 min on nine files locally (it skips signed files itself, so the count was never the issue). vpk now calls a --signTemplate wrapper (written into RUNNER_TEMP) that uses the SignTool and the Microsoft.ArtifactSigning.Client dlib the action installed, with the Azure CLI credential, and skips already-signed files.
Verify before packaging further: signtool verify /pa /all on Setup.exe and every exe/dll inside the portable zip; nothing unsigned reaches the draft release (K22-REL-05).

Closes #26.

How it was tested

Reproduced the package job locally with gclo's real publish output against the live kof22signing account (releases profile): 48 of 287 binaries selected and signed in 192 s, all verify (Valid, timestamped, CN=James Maes); vpk pack with the wrapper: 9 files + Setup.exe signed, 36 s; Setup.exe, Update.exe, gclo.exe and gclo_ExecutionStub.exe valid; 282 DLLs in the portable zip, 0 unsigned (45 ours, the rest Microsoft's untouched); CLI exe valid. actionlint clean. First CI run will be gclo v1.0.2-beta.3 after re-pinning.

Generated with Claude Code

## What First real `sign: true` run (gclo `v1.0.2-beta.2`, run 38080813985): OIDC login worked, signing started, and the step died after 320 s because it signs **every** exe/dll under `publish` (~285 in a self-contained publish, 239 already signed by Microsoft/.NET) and `azure/artifact-signing-action` stops at its 300 s default `timeout`. - **Select the binaries to sign**: only files whose `Get-AuthenticodeSignature` status is not `Valid` go to the action's `files` input; fails if the main exe (or the CLI exe) is not among them. Third-party signatures are preserved, nothing is signed twice. `timeout: 1800`. - **vpk**: its built-in `--azureTrustedSignFile` path hung >10 min on nine files locally (it skips signed files itself, so the count was never the issue). vpk now calls a `--signTemplate` wrapper (written into `RUNNER_TEMP`) that uses the SignTool and the `Microsoft.ArtifactSigning.Client` dlib the action installed, with the Azure CLI credential, and skips already-signed files. - **Verify before packaging further**: `signtool verify /pa /all` on Setup.exe and every exe/dll inside the portable zip; nothing unsigned reaches the draft release (K22-REL-05). Closes #26. ## How it was tested Reproduced the package job locally with gclo's real publish output against the live `kof22signing` account (`releases` profile): 48 of 287 binaries selected and signed in 192 s, all verify (Valid, timestamped, CN=James Maes); `vpk pack` with the wrapper: 9 files + Setup.exe signed, 36 s; Setup.exe, Update.exe, gclo.exe and gclo_ExecutionStub.exe valid; 282 DLLs in the portable zip, 0 unsigned (45 ours, the rest Microsoft's untouched); CLI exe valid. `actionlint` clean. First CI run will be gclo `v1.0.2-beta.3` after re-pinning. Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#29