Repository navigation
Add ImageWriter SignPath test and release signing in its own repository - #27
Merged
Merged
Conversation
raphaelscholle
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows signing currently depends on optional local certificate secrets. This adds a reusable GitHub-hosted build and a manual signing workflow in OpenHD/OpenHD-ImageWriter, matching SignPath Foundation's confirmed arrangement: a separate ImageWriter project in the OpenHD OSS organization, sharing its production certificate.
The manual workflow defaults to test mode and builds its own exact commit for origin verification. Test mode trusts only the configured public self-signed onboarding certificate on the ephemeral runner, requires signatures from that exact certificate, and labels outputs Test-Signed. Release mode retains normal Windows trust and timestamp checks. Ordinary pushes, PRs and forks remain unsigned.
The application, FAT32 formatter and generated NSIS uninstaller are signed before packaging; the outer installer is signed afterward. Both installer and portable application artifacts are uploaded. Rejected requests or invalid signatures fail the build without unsigned fallback.
Activation requires SignPath to add the ImageWriter project, configure its artifact configurations and policies, and provide the test certificate and permitted CI API token. The ImageWriter organization variable is configured; project-specific values are deliberately left unset until confirmed. The prior OpenHD caller is superseded.
Validation: all checks passed on the prior revision, including Windows installer build. On this revision, actionlint and PowerShell parsing passed. Signature fixtures passed for expected/wrong signer, missing test pin, missing timestamp and invalid signature, and the trust helper rejects local execution. Existing NSIS uninstaller generation and packaging checks passed. Actual certificate-backed signing awaits project configuration.