From 1f44ce6022ce8071334a93af069539968df93268 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 05:07:45 +0000
Subject: [PATCH] fix(REGISTRY-006-2): jsign JAR download in release.yml uses
 SHA-256 verification correctly, but the code-signing token is passed via
 storepass on the command line, exposing it in process listings

---
 scripts/sign-binary.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/sign-binary.sh b/scripts/sign-binary.sh
index 3a25d5f2..2b264ce3 100755
--- a/scripts/sign-binary.sh
+++ b/scripts/sign-binary.sh
@@ -73,15 +73,19 @@ sign_windows() {
     exit 1
   fi
 
-  java -jar "$JSIGN_JAR" \
+  # Pass the token via env var rather than --storepass on the CLI, so it is
+  # not visible to other processes on the runner via `ps`/`/proc/<pid>/cmdline`
+  # for the duration of the jsign process. jsign falls back to the
+  # JSIGN_STOREPASS environment variable when --storepass is omitted.
+  JSIGN_STOREPASS="$token" java -jar "$JSIGN_JAR" \
     --storetype TRUSTEDSIGNING \
     --keystore "${AZURE_SIGNING_ENDPOINT#https://}" \
-    --storepass "$token" \
     --alias "${AZURE_CODE_SIGNING_ACCOUNT_NAME}/${AZURE_CERTIFICATE_PROFILE_NAME}" \
     --alg SHA-256 \
     --tsaurl http://timestamp.acs.microsoft.com \
     --tsmode RFC3161 \
     "$BINARY"
+  unset token
 
   echo "sign-binary: ${OS}/${ARCH} Authenticode-signed via Azure Trusted Signing"
 }
@@ -91,3 +95,4 @@ case "$OS" in
   windows) sign_windows ;;
   *)       echo "sign-binary: ${OS}/${ARCH} not signed (by design)" ;;
 esac
+