Sign with CodeSignTool

CodeSignTool is a secure, privacy-oriented multi-platform Java command line utility for remotely signing Microsoft Authenticode and Java code objects with eSigner EV code signing certificates. Hashes of the files are sent to SSL.com for signing so that the code itself is not sent. This is ideal where sensitive files need to be signed, but should not be sent over the wire for signing. CodeSignTool is also ideal for automated batch processes for high volume signings or integration into existing CI/CD pipeline workflows.

This action provides the sign artifacts with CodeSignTool.

ES_USERNAME, ES_PASSWORD, CRENDENTIAL_ID and ES_TOTP_SECRET values to be used in CodeSignTool can be stored in the Actons Secrets area of Github. Detailed Information: https://docs.github.com/en/actions/security-guides/encrypted-secrets

Usage

- name: Sign Artifact with CodeSignTool
  uses: sslcom/actions-codesigner@develop
  with:
    # CodeSignTool Commands:
    # - get_credential_ids: Output the list of eSigner credential IDs associated with a particular user.
    # - credential_info: Output key and certificate information related to a credential ID.
    # - sign: Sign and timestamp code object.
    # - batch_sign: Sign and timestamp multiple code objects with one OTP.
    # - hash: Pre-compute hash(es) for later use with batch_hash_sign command.
    # - batch_sign_hash: Sign hash(es) pre-computed with hash command.
    command: sign

    # SSL.com account username..
    username: ${{secrets.ES_USERNAME}}

    # SSL.com account password.
    password: ${{secrets.ES_PASSWORD}}

    # Credential ID for signing certificate.
    credential_id: ${{secrets.CREDENTIAL_ID}}

    # OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)
    totp_secret: ${{secrets.ES_TOTP_SECRET}}

    # Path of code object to be signed.
    # Supported File Types: acm, ax, bin, cab, cpl, dll, drv, efi, exe, mui, ocx, scr, sys, tsp, msi, ps1, ps1xml, js, vbs, wsf, jar
    file_path: ${GITHUB_WORKSPACE}/test/src/build/HelloWorld.jar

    # Directory where signed code object(s) will be written.
    output_path: ${GITHUB_WORKSPACE}/artifacts

Inputs

username: SSL.com account username. (Required)
password: SSL.com account password (Required)
credential_id: Credential ID for signing certificate. If credential_id is omitted and the user has only one eSigner code signing certificate, CodeSignTool will default to that. If the user has more than one code signing certificate, this parameter is mandatory. (Required)
totp_secret: OAuth TOTP Secret. You can access detailed information on https://www.ssl.com/how-to/automate-esigner-ev-code-signing (Required)
file_path: Path of code object to be signed. (Required)
output_path: Directory where signed code object(s) will be written. If output_path is omitted, the file specified in -file_path will be overwritten with the signed file.

Examples

Dotnet Code DLL Signing Example Workflow

# The name of the workflow.
name: (DLL) Dotnet Core Build and Sign

# Trigger this workflow on a push
on: push

# Create an environment variable
env:
  PROJECT_NAME: HelloWorld
  PROJECT_VERSION: 0.0.1
  DOTNET_VERSION: 3.1

# Defines a single job named "codesigner-dotnet-dll"
jobs:
  codesigner-dotnet-dll:
    # Run job on Ubuntu Runner
    runs-on: ubuntu-latest
    # When the workflow runs, this is the name that is logged
    name: CodeSigner on Dotnet
    steps:
      # 1) Check out the source code so that the workflow can access it.
      - name: Checkout Repository
        uses: actions/checkout@v2

      # 2) Set up the .NET CLI environment for the workflow to use.
      - name: Setup Dotnet Core
        uses: actions/setup-dotnet@v2
        with:
          dotnet-version: '3.1.x'

      # 3) Create Artifact Directory to store signed and unsigned artifact files
      - name: Create Artifacts Directory
        shell: bash
        run: |
          mkdir ${GITHUB_WORKSPACE}/artifacts
          mkdir ${GITHUB_WORKSPACE}/packages

      # 4) Build a dotnet project or solution and all of its dependencies.
      #    After it has been created dll or exe file, copy to 'packages' folder for siging
      - name: Compile Dotnet Library
        shell: bash
        run: |
          dotnet build dotnet/${{env.PROJECT_NAME}}.csproj -c Release
          cp dotnet/bin/Release/netcoreapp${{env.DOTNET_VERSION}}/${{env.PROJECT_NAME}}-${{env.PROJECT_VERSION}}.dll ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.dll

      # 5) This is the step where the created DLL or EXE (artifact) files will be signed with CodeSignTool.
      - name: Sign Artifact with CodeSignTool
        uses: sslcom/actions-codesigner@develop
        with:
          # Sign and timestamp code object.
          command: sign
          # SSL.com account username.
          username: ${{secrets.ES_USERNAME}}
          # SSL.com account password.
          password: ${{secrets.ES_PASSWORD}}
          # Credential ID for signing certificate.
          credential_id: ${{secrets.CREDENTIAL_ID}}
          # OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)
          totp_secret: ${{secrets.ES_TOTP_SECRET}}
          # Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )
          file_path: ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.dll
          # Directory where signed code object(s) will be written.
          output_path: ${GITHUB_WORKSPACE}/artifacts

        # 6) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
      - name: Upload Signed Files
        uses: actions/upload-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.dll
          path: ./artifacts/${{env.PROJECT_NAME}}.dll

Java Code (Maven) JAR Signing Example Workflow

# The name of the workflow.
name: (JAR) Maven Build and Sign

# Trigger this workflow on a push
on: push

# Create an environment variable
env:
  PROJECT_NAME: HelloWorld
  PROJECT_VERSION: 0.0.1
  MAVEN_VERSION: 3.8.5
  JAVA_VERSION: 17

# Defines a single job named "codesigner-maven-jar"
jobs:
  codesigner-maven-jar:
    # Run job on Ubuntu Runner
    runs-on: ubuntu-latest
    # When the workflow runs, this is the name that is logged
    name: CodeSigner on Java with Maven
    steps:
      # 1) Check out the source code so that the workflow can access it.
      - name: Checkout Repository
        uses: actions/checkout@v2

      # 2) Set up the Java and Maven environment for the workflow to use.
      - name: Setup Java and Maven
        uses: s4u/[email protected]
        with:
          java-version: '${{env.JAVA_VERSION}}'
          maven-version: '${{env.MAVEN_VERSION}}'

      # 3) Create Artifact Directory to store signed and unsigned artifact files
      - name: Create Artifacts Directory
        shell: bash
        run: |
          mkdir ${GITHUB_WORKSPACE}/artifacts
          mkdir ${GITHUB_WORKSPACE}/packages

      # 4) Build a maven project or solution and all of its dependencies.
      #    After it has been created jar file, copy to 'packages' folder for siging
      - name: Compile Java Library with Maven
        shell: bash
        run: |
          mvn clean install -f java/pom.xml
          cp java/target/${{env.PROJECT_NAME}}-${{env.PROJECT_VERSION}}.jar ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.jar

      # 5) This is the step where the created JAR (artifact) files will be signed with CodeSignTool.
      - name: Sign Artifact with CodeSignTool
        uses: sslcom/actions-codesigner@develop
        with:
          # Sign and timestamp code object.
          command: sign
          # SSL.com account username.
          username: ${{secrets.ES_USERNAME}}
          # SSL.com account password.
          password: ${{secrets.ES_PASSWORD}}
          # Credential ID for signing certificate.
          credential_id: ${{secrets.CREDENTIAL_ID}}
          # OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)
          totp_secret: ${{secrets.ES_TOTP_SECRET}}
          # Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )
          file_path: ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.jar
          # Directory where signed code object(s) will be written.
          output_path: ${GITHUB_WORKSPACE}/artifacts

        # 6) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
      - name: Upload Signed Files
        uses: actions/upload-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.jar
          path: ./artifacts/${{env.PROJECT_NAME}}.jar

Java Code (Gradle) JAR Signing Example Workflow

# The name of the workflow.
name: (JAR) Gradle Build and Sign

# Trigger this workflow on a push
on: push

# Create an environment variable
env:
  PROJECT_NAME: HelloWorld
  PROJECT_VERSION: 0.0.1
  GRADLE_VERSION: 7.3
  JAVA_VERSION: 17

# Defines a single job named "codesigner-gradle-jar"
jobs:
  codesigner-gradle-jar:
    # Run job on Ubuntu Runner
    runs-on: ubuntu-latest
    # When the workflow runs, this is the name that is logged
    name: CodeSigner on Java with Gradle
    steps:
      # 1) Check out the source code so that the workflow can access it.
      - name: Checkout Repository
        uses: actions/checkout@v2

      # 2) Set up the Java environment for the workflow to use.
      - uses: actions/setup-java@v2
        with:
          distribution: zulu
          java-version: ${{env.JAVA_VERSION}}

      # 3) Set up the Gradle environment for the workflow to use.
      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2
        with:
          gradle-version: ${{env.GRADLE_VERSION}}

      # 4) Create Artifact Directory to store signed and unsigned artifact files
      - name: Create Artifacts Directory
        shell: bash
        run: |
          mkdir ${GITHUB_WORKSPACE}/artifacts
          mkdir ${GITHUB_WORKSPACE}/packages

      # 5) Build a gradle project or solution and all of its dependencies.
      #    After it has been created jar file, copy to 'packages' folder for siging
      - name: Compile Java Library with Gradle
        shell: bash
        run: |
          gradle clean build -p java -PsetupType=jar
          cp java/build/libs/${{env.PROJECT_NAME}}-${{env.PROJECT_VERSION}}.jar ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.jar

      # 6) This is the step where the created JAR (artifact) files will be signed with CodeSignTool.
      - name: Sign Artifact with CodeSignTool
        uses: sslcom/actions-codesigner@develop
        with:
          # Sign and timestamp code object.
          command: sign
          # SSL.com account username.
          username: ${{secrets.ES_USERNAME}}
          # SSL.com account password.
          password: ${{secrets.ES_PASSWORD}}
          # Credential ID for signing certificate.
          credential_id: ${{secrets.CREDENTIAL_ID}}
          # OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)
          totp_secret: ${{secrets.ES_TOTP_SECRET}}
          # Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )
          file_path: ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.jar
          # Directory where signed code object(s) will be written.
          output_path: ${GITHUB_WORKSPACE}/artifacts

        # 7) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
      - name: Upload Signed Files
        uses: actions/upload-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.jar
          path: ./artifacts/${{env.PROJECT_NAME}}.jar

Java Code (Gradle) MSI Signing Example Workflow

# The name of the workflow.
name: (MSI) Gradle Build and Sign

# Trigger this workflow on a push
on: push

# Create an environment variable
env:
  PROJECT_NAME: HelloWorld
  PROJECT_VERSION: 0.0.1
  GRADLE_VERSION: 7.3
  JAVA_VERSION: 17

jobs:
  # Defines job named "build-gradle-msi"
  build-gradle-msi:
    # Run job on Windows Runner
    runs-on: windows-latest
    # When the workflow runs, this is the name that is logged
    name: Build MSI File with Gradle
    steps:
      # 1) Check out the source code so that the workflow can access it.
      - name: Checkout Repository
        uses: actions/checkout@v2

      # 2) Set up the Java environment for the workflow to use.
      - uses: actions/setup-java@v2
        with:
          distribution: zulu
          java-version: ${{env.JAVA_VERSION}}

      # 3) Set up the Gradle environment for the workflow to use.
      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2
        with:
          gradle-version: ${{env.GRADLE_VERSION}}

      # 4) Install WIX for MSI Setup File
      - name: Windows Specific Setup
        run: |
          curl -OLS https://github.com/wixtoolset/wix3/releases/download/wix3111rtm/wix311.exe
          .\wix311.exe /install /quiet /norestart

      # 5) Add WIX to environment variable
      - name: Add path to PATH environment variable
        uses: myci-actions/export-env-var-powershell@1
        with:
          name: PATH
          value: $env:PATH;C:\Program Files (x86)\WiX Toolset v3.11\bin

      # 6) Create Artifact Directory to store signed and unsigned artifact files
      - name: Create Artifacts Directory
        shell: bash
        run: |
          mkdir ${GITHUB_WORKSPACE}/artifacts
          mkdir ${GITHUB_WORKSPACE}/packages

      # 7) Build a gradle project or solution and all of its dependencies.
      #    After it has been created jar file, copy to 'packages' folder for siging
      - name: Compile Java Library with Gradle
        shell: bash
        run: |
          gradle build jpackage -x test --warning-mode all -p java -PsetupType=msi
          cp java/build/release/windows/*.msi ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.msi

      # 8) Save the MSI file to the artifacts directory for codesigning tool
      - name: Upload Setup File
        id: upload-installer-windows
        uses: actions/upload-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.msi
          path: ./packages/${{env.PROJECT_NAME}}.msi

  # Defines job named "codesigner-msi"
  codesigner-msi:
    # Codesigner job only work with linux runner
    runs-on: ubuntu-latest
    # Run this job after build-gradle-msi job is finished
    needs: [build-gradle-msi]
    # When the workflow runs, this is the name that is logged
    name: CodeSigner on MSI File
    steps:
      # 1) Download created msi file from Github Artifacts
      - name: Download Windows Installer File
        uses: actions/download-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.msi

      # 2) Create Artifact Directory to store signed and unsigned artifact files
      - name: Create Artifacts Directory
        shell: bash
        run: |
          mkdir ${GITHUB_WORKSPACE}/artifacts

      # 3) This is the step where the created JAR (artifact) files will be signed with CodeSignTool.
      - name: Sign Artifact with CodeSignTool
        uses: sslcom/actions-codesigner@develop
        with:
          # Sign and timestamp code object.
          command: sign
          # SSL.com account username.
          username: ${{secrets.ES_USERNAME}}
          # SSL.com account password.
          password: ${{secrets.ES_PASSWORD}}
          # Credential ID for signing certificate.
          credential_id: ${{secrets.CREDENTIAL_ID}}
          # OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)
          totp_secret: ${{secrets.ES_TOTP_SECRET}}
          # Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )
          file_path: ${GITHUB_WORKSPACE}/${{env.PROJECT_NAME}}.msi
          # Directory where signed code object(s) will be written.
          output_path: ${GITHUB_WORKSPACE}/artifacts

      # 4) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
      - name: Upload Signed Files
        uses: actions/upload-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.msi
          path: ./artifacts/${{env.PROJECT_NAME}}.msi

Java Code (Gradle) EXE Signing Example Workflow

# The name of the workflow.
name: (EXE) Gradle Build and Sign

# Trigger this workflow on a push
on: push

# Create an environment variable
env:
  PROJECT_NAME: HelloWorld
  PROJECT_VERSION: 0.0.1
  GRADLE_VERSION: 7.3
  JAVA_VERSION: 17

jobs:
  # Defines job named "build-gradle-exe"
  build-gradle-exe:
    # Run job on Windows Runner
    runs-on: windows-latest
    # When the workflow runs, this is the name that is logged
    name: Build exe File with Gradle
    steps:
      # 1) Check out the source code so that the workflow can access it.
      - name: Checkout Repository
        uses: actions/checkout@v2

      # 2) Set up the Java environment for the workflow to use.
      - uses: actions/setup-java@v2
        with:
          distribution: zulu
          java-version: ${{env.JAVA_VERSION}}

      # 3) Set up the Gradle environment for the workflow to use.
      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2
        with:
          gradle-version: ${{env.GRADLE_VERSION}}

      # 4) Install WIX for exe Setup File
      - name: Windows Specific Setup
        run: |
          curl -OLS https://github.com/wixtoolset/wix3/releases/download/wix3111rtm/wix311.exe
          .\wix311.exe /install /quiet /norestart

      # 5) Add WIX to environment variable
      - name: Add path to PATH environment variable
        uses: myci-actions/export-env-var-powershell@1
        with:
          name: PATH
          value: $env:PATH;C:\Program Files (x86)\WiX Toolset v3.11\bin

      # 6) Create Artifact Directory to store signed and unsigned artifact files
      - name: Create Artifacts Directory
        shell: bash
        run: |
          mkdir ${GITHUB_WORKSPACE}/artifacts
          mkdir ${GITHUB_WORKSPACE}/packages

      # 7) Build a gradle project or solution and all of its dependencies.
      #    After it has been created jar file, copy to 'packages' folder for siging
      - name: Compile Java Library with Gradle
        shell: bash
        run: |
          gradle build jpackage -x test --warning-mode all -p java -PsetupType=exe
          cp java/build/release/windows/*.exe ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.exe

      # 8) Save the exe file to the artifacts directory for codesigning tool
      - name: Upload Setup File
        id: upload-installer-windows
        uses: actions/upload-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.exe
          path: ./packages/${{env.PROJECT_NAME}}.exe

  # Defines job named "codesigner-exe"
  codesigner-exe:
    # Codesigner job only work with linux runner
    runs-on: ubuntu-latest
    # Run this job after build-gradle-exe job is finished
    needs: [build-gradle-exe]
    # When the workflow runs, this is the name that is logged
    name: CodeSigner on exe File
    steps:
      # 1) Download created exe file from Github Artifacts
      - name: Download Windows Installer File
        uses: actions/download-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.exe

      # 2) Create Artifact Directory to store signed and unsigned artifact files
      - name: Create Artifacts Directory
        shell: bash
        run: |
          mkdir ${GITHUB_WORKSPACE}/artifacts

      # 3) This is the step where the created JAR (artifact) files will be signed with CodeSignTool.
      - name: Sign Artifact with CodeSignTool
        uses: sslcom/actions-codesigner@develop
        with:
          # Sign and timestamp code object.
          command: sign
          # SSL.com account username.
          username: ${{secrets.ES_USERNAME}}
          # SSL.com account password.
          password: ${{secrets.ES_PASSWORD}}
          # Credential ID for signing certificate.
          credential_id: ${{secrets.CREDENTIAL_ID}}
          # OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)
          totp_secret: ${{secrets.ES_TOTP_SECRET}}
          # Path of code object to be signed. (DLL, JAR, EXE, exe files vb... )
          file_path: ${GITHUB_WORKSPACE}/${{env.PROJECT_NAME}}.exe
          # Directory where signed code object(s) will be written.
          output_path: ${GITHUB_WORKSPACE}/artifacts

      # 4) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
      - name: Upload Signed Files
        uses: actions/upload-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.exe
          path: ./artifacts/${{env.PROJECT_NAME}}.exe

Powershell PS1 Signing Example Workflow

# The name of the workflow.
name: (PS1) Poweshell Script Signing

# Trigger this workflow on a push
on: push

# Create an environment variable
env:
  PROJECT_NAME: HelloWorld

# Defines a single job named "codesigner-powershell-ps1"
jobs:
  codesigner-powershell-ps1:
    # Run job on Ubuntu Runner
    runs-on: ubuntu-latest
    # When the workflow runs, this is the name that is logged
    name: CodeSigner on Powershell
    steps:
      # 1) Check out the source code so that the workflow can access it.
      - name: Checkout Repository
        uses: actions/checkout@v2

      # 2) Create Artifact Directory to store signed and unsigned artifact files
      - name: Create Artifacts Directory
        shell: bash
        run: |
          mkdir ${GITHUB_WORKSPACE}/artifacts

      # 3) This is the step PS1 file will be signed with CodeSignTool.
      - name: Sign Artifact with CodeSignTool
        uses: sslcom/actions-codesigner@develop
        with:
          # Sign and timestamp code object.
          command: sign
          # SSL.com account username.
          username: ${{secrets.ES_USERNAME}}
          # SSL.com account password.
          password: ${{secrets.ES_PASSWORD}}
          # Credential ID for signing certificate.
          credential_id: ${{secrets.CREDENTIAL_ID}}
          # OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)
          totp_secret: ${{secrets.ES_TOTP_SECRET}}
          # Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )
          file_path: ${GITHUB_WORKSPACE}/powershell/${{env.PROJECT_NAME}}.ps1
          # Directory where signed code object(s) will be written.
          output_path: ${GITHUB_WORKSPACE}/artifacts

        # 4) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
      - name: Upload Signed Files
        uses: actions/upload-artifact@v2
        with:
          name: ${{env.PROJECT_NAME}}.ps1
          path: ./artifacts/${{env.PROJECT_NAME}}.ps1

sslcom / codesigner-samples Goto Github PK

codesigner-samples's Introduction

Sign with CodeSignTool

Usage

Inputs

Examples

Dotnet Code DLL Signing Example Workflow

Java Code (Maven) JAR Signing Example Workflow

Java Code (Gradle) JAR Signing Example Workflow

Java Code (Gradle) MSI Signing Example Workflow

Java Code (Gradle) EXE Signing Example Workflow

Powershell PS1 Signing Example Workflow

CodeSignTool Guide

codesigner-samples's People

Contributors

Watchers

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

Jobs