feat(ci): sign Windows installers with Azure Trusted Signing - #1101
Draft
p0wline wants to merge 1 commit into
Draft
feat(ci): sign Windows installers with Azure Trusted Signing#1101p0wline wants to merge 1 commit into
p0wline wants to merge 1 commit into
Conversation
Contributor
Author
|
Changement de plan : le workflow de signature sera un reusable workflow dans Cosmian/reusable_scripts. |
p0wline
force-pushed
the
feat/azure-code-signing
branch
2 times, most recently
from
August 6, 2026 12:36
a0e1b03 to
22782fc
Compare
Replace inline azure/artifact-signing-action step with a dedicated sign job that calls Cosmian/reusable_workflows sign-windows-artifacts.yml. Flow: cargo-build → upload unsigned artifact (-release) sign → download, sign, upload signed artifact (-release-signed) test → download -release-signed publish → download -release-signed Secrets required: AZURE_TENANT_ID_POC, AZURE_CLIENT_ID_POC, AZURE_CLIENT_SECRET_POC
p0wline
force-pushed
the
feat/azure-code-signing
branch
from
August 6, 2026 13:56
22782fc to
c1e69aa
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integrates Azure Trusted Signing into the Windows CI build pipeline, based on the signing POC (https://github.com/p0wline/cosmian-signing-poc).
Changes
Adds a
Sign installers with Azure Trusted Signingstep inbuild_windows.ymlbetweenRename installers to new conventionandUpload build artifacts. Signs bothcosmian-kms-serverandckms.exeinstallers usingazure/artifact-signing-action@v2.Configuration:
https://weu.codesigning.azure.net/cosmian-codesigning-testcosmian-test-profileRequired secrets
The following secrets must be set in the repository:
AZURE_TENANT_ID_POCAZURE_CLIENT_ID_POCAZURE_CLIENT_SECRET_POCPOC findings
Azure Trusted Signing uses an OV certificate (not EV). The cryptographic signature is valid, but SmartScreen will block binaries on first download until the certificate builds reputation (weeks/months). If immediate SmartScreen bypass is required, an EV code signing certificate (DigiCert, Sectigo, GlobalSign) would be needed instead.