The first real `sign: true` run (gclo v1.0.2-beta.2) hit the signing action's
300 s default timeout: the step signed every exe/dll under publish, ~285 files
in a self-contained publish, 239 of which already carried Microsoft/.NET
signatures. A step now selects the binaries without a valid signature and
passes them through the action's `files` input (third-party signatures are
preserved, nothing is signed twice), with `timeout: 1800`.
vpk's built-in `--azureTrustedSignFile` path hung for over ten minutes on nine
files in local testing; vpk now calls a `--signTemplate` wrapper that uses the
SignTool and Artifact Signing client the signing step installed, with the
Azure CLI login, and skips already-signed files. A verification step runs
`signtool verify /pa /all` on Setup.exe and every exe/dll in the portable zip
before anything is drafted.
Reproduced locally end to end with gclo's publish output and the live
kof22signing account: 48 of 287 files signed in 192 s, vpk pack with the
wrapper in 36 s, Setup.exe/Update.exe/app signed and timestamped, 0 unsigned
libraries left.
Closes#26
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
james.maesandClaude Fable 5.1