Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Automate code-signing as part of our release process #1580

Closed
phargogh opened this issue May 21, 2024 · 1 comment · Fixed by #1763
Closed

Automate code-signing as part of our release process #1580

phargogh opened this issue May 21, 2024 · 1 comment · Fixed by #1763
Assignees
@phargogh
Labels
enhancement New feature or request
Milestone
3.15.0

Comments

@phargogh
Copy link
Member

In #1523 we were able to set up a yubikey to sign our binaries. The process for signing binaries was pretty manual: download binary, sign binary, upload binary. It would be fantastic to be able to do this in the cloud as a part of our usual build automation.
@phargogh phargogh added the enhancement New feature or request label May 21, 2024
@phargogh phargogh added this to the 3.15.0 milestone May 21, 2024
@phargogh phargogh mentioned this issue May 21, 2024
Closed
@davemfish
Copy link
Contributor

From @phargogh :

We now have a host machine at a Stanford data center with our YubiKey installed.

Option 1: Install a GHA runner on a VM on this data center machine. This is discouraged by GitHub, due to the potential for running untrusted code on hardware on a trusted network.

Option 2, the preferred option.: Ping a cloud function with list of binaries on GCS that need to be signed, adding them to a queue. The VM would pull from the queue to download, sign, & upload.

phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Starting a readme for codesigning. RE:natcap#1580
fa56af4
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Starting a readme for the cloud function. RE:natcap#1580
64f9d39
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Adding python code for the cloud function.
a8448c3 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Correcting package name. RE:natcap#1580
50c6612
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Adding codesigning worker config.
d19e906 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Bumping down memory, specifying project.
63c1b18 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Handling the case where there are no items in the queue.
7eeffa4 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Updating bash service script. RE:natcap#1580
c432faf
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Correcting filepaths. RE:natcap#1580
5805b47
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Always reloading service. RE:natcap#1580
2212f79
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Adding json body to request. RE:natcap#1580
595254b
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Restructuring the shell script. RE:natcap#1580
ab1eb56
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Trying a different approach to trimming whitespace. RE:natcap#1580
d9ba157
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Trying another way to trim whitespace. RE:natcap#1580
673e16d
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Reworking codesigning service to be mostly python.
943c507 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Forgot the certificate argument. RE:natcap#1580
5f2f3e5
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Removing unnecessary function parameter. RE:natcap#1580
1c123dc
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Loading access token from a file. RE:natcap#1580
adaf945
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Clarifying path to the token file. RE:natcap#1580
0a62247
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Raising errors when we find them. RE:natcap#1580
bf6e595
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Using POST method always. RE:natcap#1580
e6656f7
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Fixing how I make my request. RE:natcap#1580
f8ebe38
phargogh added a commit to phargogh/invest that referenced this issue Jan 30, 2025
@phargogh
Polling every 60s. RE:natcap#1580
6d680ac
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Correcting a filepath. RE:natcap#1580
0abd959
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
restarting the systemd service. RE:natcap#1580
840dfaa
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Adding a shell script to enqueue the target binary.
af9fc47 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Adding codesigning step to binary actions workflow. RE:natcap#1580
ad9a35c
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Correcting directory name. RE:natcap#1580
3cf4a19
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Correcting order of operations on a missing file.
59ba67a 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Reqorking enqueue script to use requests. RE:natcap#1580
a69804b
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Improving GCP cloud logging in function. RE:natcap#1580
6e948be
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Fixing syntaxerror. RE:natcap#1580
96c3e86
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Queueing binary for codesigning after make deploy.
279bc4f 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Attempting to improve logging for debugging. RE:natcap#1580
dde4a29
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Fixing multi-line issue in make invocation.
7ff3567 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Fleshing out docs and cleaning up. RE:natcap#1580
19c7909
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Adding docstrings. RE:natcap#1580
651e715
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Removing old windows codesigning stuff. RE:natcap#1580
8b5e7f8
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Adding docstrings. RE:natcap#1580
a93d918
@phargogh phargogh mentioned this issue Jan 31, 2025
Merged
3 tasks
phargogh added a commit to phargogh/invest that referenced this issue Jan 31, 2025
@phargogh
Noting change in HISTORY. RE:natcap#1580
38cfd23
phargogh added a commit to phargogh/invest that referenced this issue Feb 1, 2025
@phargogh
Updating the cloud function docstring. RE:natcap#1580
0e64389
phargogh added a commit to phargogh/invest that referenced this issue Feb 1, 2025
@phargogh
Always restarting the service. RE:natcap#1580
33a60e5
phargogh added a commit to phargogh/invest that referenced this issue Feb 1, 2025
@phargogh
Improving osslsigncode comments. RE:natcap#1580
dfc275a
phargogh added a commit to phargogh/invest that referenced this issue Feb 3, 2025
@phargogh
Using the signed binary in the github release. RE:natcap#1580
782dbd1
phargogh added a commit to phargogh/invest that referenced this issue Feb 4, 2025
@phargogh
Adding posting to slack to the signing worker. RE:natcap#1580
de9ee0c
phargogh added a commit to phargogh/invest that referenced this issue Feb 4, 2025
@phargogh
Not using the shell script any longer.
4077f02 
RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Feb 4, 2025
@phargogh
Writing out the signature information to a separate file. RE:natcap#1580
8464659
phargogh added a commit to phargogh/invest that referenced this issue Feb 4, 2025
@phargogh
Correcting slack markdown link syntax. RE:natcap#1580
1cfc9c2
phargogh added a commit to phargogh/invest that referenced this issue Feb 4, 2025
@phargogh
Refactoring to handle signature files.
8277d5f 
Signature files are now pushed to the bucket alongside the .exe file,
and we check whether the file exists before enqueueing the exe.

RE:natcap#1580
phargogh added a commit to phargogh/invest that referenced this issue Feb 4, 2025
@phargogh
Changing status code to 204 from 400. RE:natcap#1580
334bc1d
phargogh added a commit to phargogh/invest that referenced this issue Feb 4, 2025
@phargogh
Correcting http error code checking. RE:natcap#1580
951f93c
phargogh added a commit to phargogh/invest that referenced this issue Feb 4, 2025
@phargogh
Correcting how we do text searching. RE:natcap#1580
f2eef42
phargogh added a commit to phargogh/invest that referenced this issue Feb 4, 2025
@phargogh
Correcting how we check for signatures. RE:natcap#1580
9784a26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@phargogh phargogh

Labels
enhancement New feature or request
Projects
None yet
Milestone
3.15.0
Development

Successfully merging a pull request may close this issue.

Automate Code Signing of Windows Binary phargogh/invest
2 participants
@davemfish @phargogh