Skip to content

Commit 466db9b

Browse files
bobby-smedleybobby-smedley
authored
ci: Windows binary signing (#36)
ci: sign Windows binary
1 parent b613dcc commit 466db9b

4 files changed

Lines changed: 165 additions & 32 deletions

File tree

‎.github/runs-on.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
_extends: .github-private
2+

‎.github/workflows/release.yaml‎

Lines changed: 95 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -11,22 +11,21 @@ jobs:
1111
uses: ./.github/workflows/build.yaml
1212
release:
1313
needs: build
14-
runs-on: ubuntu-latest
15-
env:
16-
BUILD_DIR: 'build'
14+
runs-on:
15+
- runs-on
16+
- run-id=${{ github.run_id }}
17+
- runner=md
18+
- env=production-eu
19+
- tag=build-${{ github.event.repository.name }}
20+
environment: Release
1721
permissions:
1822
contents: write
1923
steps:
20-
- uses: actions/checkout@v5
24+
- name: Checkout
25+
uses: actions/checkout@v5
2126
with:
2227
fetch-depth: 0
2328

24-
- name: Set version
25-
run: |
26-
VERSION=${{ github.ref_name }}
27-
VERSION=${VERSION#v}
28-
echo "VERSION=$VERSION" >> $GITHUB_ENV
29-
3029
- name: Setup Go
3130
uses: actions/setup-go@v6
3231
with:
@@ -35,29 +34,94 @@ jobs:
3534
- name: Install dependencies
3635
run: go mod download
3736

37+
- name: Set version
38+
run: |
39+
VERSION=${{ github.ref_name }}
40+
VERSION=${VERSION#v}
41+
echo "VERSION=$VERSION" >> $GITHUB_ENV
42+
3843
- name: Test
44+
if: ${{ !contains(env.VERSION, '-') }} # Skip tests for pre-release versions (e.g., 1.0.0-beta) to avoid issues with version parsing in tests
3945
run: go test --tags release -run TestReleaseVersionCheck -v ./...
4046

41-
- name: Build
47+
- name: Setup Java 17
48+
run: |
49+
mkdir -p /tmp/chip-signing
50+
pushd /tmp/chip-signing
51+
wget -q https://corretto.aws/downloads/latest/amazon-corretto-17-x64-linux-jdk.tar.gz
52+
tar -xzf amazon-corretto-17-x64-linux-jdk.tar.gz
53+
JAVA_DIR=$(find . -maxdepth 1 -type d -name "amazon-corretto-*" -print -quit | sed 's|^\./||')
54+
echo "$PWD/$JAVA_DIR/bin" >> $GITHUB_PATH
55+
echo "Java 17 installed: $JAVA_DIR"
56+
popd
57+
58+
- name: Download JSign
4259
run: |
43-
GOFIPS140=v1.0.0 GOOS=linux GOARCH=amd64 go build -ldflags="-X 'github.com/collibra/chip/pkg/chip.Version=${{ env.VERSION }}'" -o ${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-linux-amd64 ./cmd/chip
44-
GOFIPS140=v1.0.0 GOOS=linux GOARCH=arm64 go build -ldflags="-X 'github.com/collibra/chip/pkg/chip.Version=${{ env.VERSION }}'" -o ${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-linux-arm64 ./cmd/chip
45-
GOFIPS140=v1.0.0 GOOS=darwin GOARCH=amd64 go build -ldflags="-X 'github.com/collibra/chip/pkg/chip.Version=${{ env.VERSION }}'" -o ${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-mac-amd64 ./cmd/chip
46-
GOFIPS140=v1.0.0 GOOS=darwin GOARCH=arm64 go build -ldflags="-X 'github.com/collibra/chip/pkg/chip.Version=${{ env.VERSION }}'" -o ${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-mac-arm64 ./cmd/chip
47-
GOFIPS140=v1.0.0 GOOS=windows GOARCH=amd64 go build -ldflags="-X 'github.com/collibra/chip/pkg/chip.Version=${{ env.VERSION }}'" -o ${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-windows-amd64.exe ./cmd/chip
48-
GOFIPS140=v1.0.0 GOOS=windows GOARCH=arm64 go build -ldflags="-X 'github.com/collibra/chip/pkg/chip.Version=${{ env.VERSION }}'" -o ${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-windows-arm64.exe ./cmd/chip
49-
50-
- name: Release
51-
uses: softprops/action-gh-release@v2
60+
mkdir -p /tmp/chip-signing
61+
wget -q https://github.com/ebourg/jsign/releases/download/7.4/jsign-7.4.jar -O /tmp/chip-signing/jsign.jar
62+
echo "JSIGN_JAR_PATH=/tmp/chip-signing/jsign.jar" >> $GITHUB_ENV
63+
echo "JSign downloaded successfully"
64+
65+
- name: Create certificate chain file
66+
run: |
67+
mkdir -p /tmp/chip-signing
68+
echo "${{ secrets.CODE_SIGNING_CERTIFICATE_CHAIN }}" > /tmp/chip-signing/signing_chain.pem
69+
if [ ! -s /tmp/chip-signing/signing_chain.pem ]; then
70+
echo "ERROR: CODE_SIGNING_CERTIFICATE_CHAIN secret is empty or not set"
71+
exit 1
72+
fi
73+
echo "CODE_SIGNING_CERT_CHAIN_FILE=/tmp/chip-signing/signing_chain.pem" >> $GITHUB_ENV
74+
echo "Certificate chain file created"
75+
76+
# RunsOn workers have the CodeSigningPolicy attached, which grants
77+
# access to the KMS signing key via EC2 instance metadata (IMDSv2).
78+
- name: Configure AWS credentials
79+
run: |
80+
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
81+
ROLE_NAME=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
82+
CREDENTIALS=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE_NAME)
83+
84+
ACCESS_KEY=$(echo $CREDENTIALS | jq -r .AccessKeyId)
85+
SECRET_KEY=$(echo $CREDENTIALS | jq -r .SecretAccessKey)
86+
SESSION_TOKEN=$(echo $CREDENTIALS | jq -r .Token)
87+
88+
mkdir -p ~/.aws
89+
echo "[default]" > ~/.aws/credentials
90+
echo "aws_access_key_id = ${ACCESS_KEY}" >> ~/.aws/credentials
91+
echo "aws_secret_access_key = ${SECRET_KEY}" >> ~/.aws/credentials
92+
echo "aws_session_token = ${SESSION_TOKEN}" >> ~/.aws/credentials
93+
94+
echo "[default]" > ~/.aws/config
95+
echo "region = ${{ vars.CODE_SIGNING_AWS_REGION || 'eu-west-1' }}" >> ~/.aws/config
96+
97+
echo "AWS credentials configured successfully"
98+
99+
- name: Set signing environment variables
100+
run: |
101+
echo "CODE_SIGNING_AWS_REGION=${{ vars.CODE_SIGNING_AWS_REGION || 'eu-west-1' }}" >> $GITHUB_ENV
102+
if [ -z "${{ secrets.KMS_SIGNING_KEY_ARN }}" ]; then
103+
echo "ERROR: KMS_SIGNING_KEY_ARN secret is not set"
104+
exit 1
105+
fi
106+
echo "KMS_SIGNING_KEY_ARN=${{ secrets.KMS_SIGNING_KEY_ARN }}" >> $GITHUB_ENV
107+
108+
- name: Run GoReleaser
109+
uses: goreleaser/goreleaser-action@v6
52110
with:
53-
files: |
54-
${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-linux-amd64
55-
${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-linux-arm64
56-
${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-mac-amd64
57-
${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-mac-arm64
58-
${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-windows-amd64.exe
59-
${{ env.BUILD_DIR }}/chip-${{ env.VERSION }}-windows-arm64.exe
60-
generate_release_notes: true
61-
make_latest: true
62-
draft: false
63-
prerelease: false
111+
distribution: goreleaser
112+
version: latest
113+
args: release --clean --verbose
114+
env:
115+
GORELEASER_CURRENT_TAG: ${{ github.ref_name }}
116+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
117+
JSIGN_JAR_PATH: ${{ env.JSIGN_JAR_PATH }}
118+
CODE_SIGNING_CERT_CHAIN_FILE: ${{ env.CODE_SIGNING_CERT_CHAIN_FILE }}
119+
CODE_SIGNING_AWS_REGION: ${{ env.CODE_SIGNING_AWS_REGION }}
120+
KMS_SIGNING_KEY_ARN: ${{ env.KMS_SIGNING_KEY_ARN }}
121+
122+
- name: Cleanup
123+
if: always()
124+
run: |
125+
rm -rf /tmp/chip-signing ~/.aws
126+
echo "Cleanup completed"
127+

‎.goreleaser.yaml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
2+
version: 2
3+
4+
project_name: chip
5+
dist: ./build/dist
6+
7+
builds:
8+
- id: default
9+
main: ./cmd/chip
10+
env:
11+
- CGO_ENABLED=0
12+
- GOFIPS140=v1.0.0
13+
goos:
14+
- linux
15+
- darwin
16+
- windows
17+
goarch:
18+
- amd64
19+
- arm64
20+
binary: chip
21+
ldflags:
22+
- -X github.com/collibra/chip/pkg/chip.Version={{.Version}}
23+
# Sign Windows binaries using AWS KMS and JSign (the signature is embedded in the binary)
24+
hooks:
25+
post:
26+
- >
27+
bash -c '
28+
if [ -n "${SKIP_SIGNING}" ]; then
29+
echo "Skipping signing Windows binaries (SKIP_SIGNING is set)";
30+
exit 0;
31+
fi;
32+
if [ "{{ .Os }}" = "windows" ]; then
33+
echo "Signing Windows binary {{ .Path }}";
34+
if [ ! -f "{{ .Path }}" ]; then
35+
echo "ERROR Binary file does not exist: {{ .Path }}";
36+
exit 1;
37+
fi;
38+
java -jar "${JSIGN_JAR_PATH}" --storetype AWS --keystore "${CODE_SIGNING_AWS_REGION}" --alias "${KMS_SIGNING_KEY_ARN}" --certfile "${CODE_SIGNING_CERT_CHAIN_FILE}" --tsaurl http://timestamp.digicert.com "{{ .Path }}" || {
39+
echo "ERROR Failed to sign {{ .Path }}";
40+
exit 1;
41+
};
42+
if [ ! -f "{{ .Path }}" ]; then
43+
echo "ERROR Binary file disappeared after signing {{ .Path }}";
44+
exit 1;
45+
fi;
46+
echo "✓ Signed {{ .Path }}";
47+
else
48+
echo "Skipping non-Windows binary ({{ .Os }}) {{ .Path }}";
49+
fi
50+
'
51+
52+
archives:
53+
- id: default
54+
formats: ["binary"]
55+
name_template: '{{ .ProjectName }}-{{ .Version }}-{{ if eq .Os "darwin" }}mac{{ else }}{{ .Os }}{{ end }}-{{ .Arch }}'
56+
57+
checksum:
58+
name_template: 'checksums.txt'
59+
60+
release:
61+
draft: false
62+
prerelease: auto
63+
make_latest: legacy
64+
65+
changelog:
66+
use: github-native
67+

‎pkg/chip/version.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
package chip
22

3-
var Version = "0.0.26-SNAPSHOT"
3+
var Version = "0.0.27-SNAPSHOT"

0 commit comments

Comments
 (0)