Skip to content

Add support for Azure Artifact Signing #263

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pierotofy merged 2 commits into from
Mar 13, 2026
Merged

Add support for Azure Artifact Signing #263

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
da32cc1
Add support for Azure Artifact Signing
sylveon Mar 13, 2026
37a17ba
Specify cmd as shell
sylveon Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion .github/workflows/publish-windows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,14 @@ on:
tags:
- v*

permissions:
contents: read
id-token: write

jobs:
build:
runs-on: windows-latest
environment: azuresigning
steps:
- name: Checkout
uses: actions/checkout@v2
Expand All @@ -21,9 +26,22 @@ jobs:
run: |
npm i
npm i -g nexe@4.0.0-rc.7
- name: Retrieve the metadata and decode it to a file
env:
AZURESIGNING_METADATA: ${{ secrets.AZURESIGNING_METADATA }}
run: |
echo $AZURESIGNING_METADATA | base64 --decode > "$RUNNER_TEMP\metadata.json"
shell: bash
- name: Azure login
uses: azure/login@v1
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- name: Build bundle
run: |
npm run winbundle
npm run winbundle -- --signtool-path "C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64\signtool.exe" --azure-signing-metadata "%RUNNER_TEMP%\metadata.json"
Copy link
Copy Markdown
Contributor

@pierotofy pierotofy Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fine, but note that this path will break very soon. Long term you'll want to find a more reliable way to invoke signtool.

Copy link
Copy Markdown
Contributor Author

@sylveon sylveon Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Windows SDK path is very consistent, it hasn't changed since the original release of Windows 10 besides the version number increment. Being more smart about this requires bringing a lot more tooling (e.g. VS developer cmd, not really documented registry reads, or installing the SDK at runtime), there isn't an easy environment variable documented unfortunately :(

Thankfully, this should only break when the SDK 26100 is removed from the CI image (which shouldn't happen anytime soon), and fixing it should be merely just updating this path. That's why I made it a parameter, to make that easier.

Copy link
Copy Markdown
Contributor

@pierotofy pierotofy Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One simple idea, instead of an exact path to signtool, pass a path to C:\Program Files (x86)\Windows Kits\10\bin\ and recursively search for signtool.exe. Just a thought.

Copy link
Copy Markdown
Contributor Author

@sylveon sylveon Mar 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The artifact signing dlib requires at least SDK 19041, so a naive search could pick up a version that's too old. It could also pick up the ARM64 or x86 signtool, which we don't want.

shell: cmd
- name: Upload Bundle File
uses: actions/upload-artifact@v4
with:
Expand Down
34 changes: 33 additions & 1 deletion scripts/winbundle.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,12 @@ const request = require('request');
const async = require('async');
const nodeUnzip = require('node-unzip-2');
const archiver = require('archiver');
const os = require('os');

const bundleName = "nodeodm-windows-x64.zip";

const scratch = 'RUNNER_TEMP' in process.env ? process.env.RUNNER_TEMP : os.tmpdir();

const download = function(uri, filename, callback) {
console.log(`Downloading ${uri}`);
request.head(uri, function(err, res, body) {
Expand Down Expand Up @@ -68,13 +71,42 @@ async.series([
cb => {
downloadApp(path.join("apps", "unzip"), "https://github.com/OpenDroneMap/NodeODM/releases/download/v2.1.0/unzip600.zip", cb);
},
cb => {
downloadApp(path.join(scratch, "azuresigning"), "https://www.nuget.org/api/v2/package/Microsoft.ArtifactSigning.Client/1.0.115", cb);
},
cb => {
console.log("Building executable");
const code = spawnSync('nexe.cmd', ['index.js', '-t', 'windows-x64-12.16.3', '-o', 'nodeodm.exe'], { stdio: "pipe"}).status;
const code = spawnSync('nexe.cmd', ['index.js', '-t', 'windows-x64-12.16.3', '-o', 'nodeodm.exe'], { stdio: "inherit", shell: true }).status;

if (code === 0) cb();
else cb(new Error(`nexe returned non-zero error code: ${code}`));
},
cb => {
let signtoolPath = null;
let metadataPath = null;

const signtoolPathArgIndex = process.argv.indexOf("--signtool-path");
if (signtoolPathArgIndex !== -1 && signtoolPathArgIndex + 1 < process.argv.length) {
signtoolPath = process.argv[signtoolPathArgIndex + 1];
}

const metadataPathArgIndex = process.argv.indexOf("--azure-signing-metadata");
if (metadataPathArgIndex !== -1 && metadataPathArgIndex + 1 < process.argv.length) {
metadataPath = process.argv[metadataPathArgIndex + 1];
}

if (signtoolPath && metadataPath) {
console.log("Signing executable");

const dlibPath = path.join(scratch, "azuresigning", "bin", "x64", "Azure.CodeSigning.Dlib.dll");
const code = spawnSync(signtoolPath, ['sign', '/v', '/debug', '/fd', 'SHA256', '/tr', 'http://timestamp.acs.microsoft.com', '/td', 'SHA256', '/dlib', dlibPath, '/dmdf', metadataPath, 'nodeodm.exe'], { stdio: "inherit" }).status;

if (code === 0) cb();
else cb(new Error(`signtool returned non-zero error code: ${code}`));
} else {
cb();
}
},
cb => {
// Zip
const outFile = path.join("dist", bundleName);
Expand Down
Loading
⚡