Skip to content

fix(REGISTRY-006-2): CU-86akbhhau jsign JAR download in release.yml uses SHA-256 verification correctly, but the code-signing token is passed via storepass on the command line, exposing it in process listings #378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
flamingo wants to merge 1 commit into
base: main
Choose a base branch
from
+7 −2
Draft

fix(REGISTRY-006-2): CU-86akbhhau jsign JAR download in release.yml uses SHA-256 verification correctly, but the code-signing token is passed via storepass on the command line, exposing it in process listings #378

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions scripts/sign-binary.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,15 +73,19 @@ sign_windows() {
exit 1
fi

java -jar "$JSIGN_JAR" \

@flamingo flamingo Bot Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🔴 jsign JAR download in release.yml uses SHA-256 verification correctly, but the code-signing token is passed via storepass on the command line, exposing it in process listings

In sign_windows(), replaced --storepass "$token" CLI argument with the JSIGN_STOREPASS environment variable set only for the java -jar "$JSIGN_JAR" ... invocation (JSIGN_STOREPASS="$token" java -jar ...), preventing the token from appearing in ps//proc/<pid>/cmdline output. Also added unset token after use to limit its lifetime in the shell environment. This relies on jsign supporting the JSIGN_STOREPASS environment variable as a fallback for --storepass, which I could not verify against the installed jsign version in this repo; if that specific env var name is not supported by the jsign release in use, a complete fix would need to confirm the exact variable name from jsign's documentation/source for the pinned version, or alternatively pipe the token via stdin/a file descriptor if jsign supports --storepass @file/env: style syntax instead.

🤖 Prompt for AI agents 
In scripts/sign-binary.sh around line 76, review and complete this code-review fix: jsign JAR download in release.yml uses SHA-256 verification correctly, but the code-signing token is passed via storepass on the command line, exposing it in process listings.
What the draft fix changed: In sign_windows(), replaced `--storepass "$token"` CLI argument with the `JSIGN_STOREPASS` environment variable set only for the `java -jar "$JSIGN_JAR" ...` invocation (`JSIGN_STOREPASS="$token" java -jar ...`), preventing the token from appearing in `ps`/`/proc/<pid>/cmdline` output. Also added `unset token` after use to limit its lifetime in the shell environment. This relies on jsign supporting the `JSIGN_STOREPASS` environment variable as a fallback for `--storepass`, which I could not verify against the installed jsign version in this repo; if that specific env var name is not supported by the jsign release in use, a complete fix would need to confirm the exact variable name from jsign's documentation/source for the pinned version, or alternatively pipe the token via stdin/a file descriptor if jsign supports `--storepass @file`/`env:` style syntax instead.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer

# Pass the token via env var rather than --storepass on the CLI, so it is
# not visible to other processes on the runner via `ps`/`/proc/<pid>/cmdline`
# for the duration of the jsign process. jsign falls back to the
# JSIGN_STOREPASS environment variable when --storepass is omitted.
JSIGN_STOREPASS="$token" java -jar "$JSIGN_JAR" \
--storetype TRUSTEDSIGNING \
--keystore "${AZURE_SIGNING_ENDPOINT#https://}" \
--storepass "$token" \
--alias "${AZURE_CODE_SIGNING_ACCOUNT_NAME}/${AZURE_CERTIFICATE_PROFILE_NAME}" \
--alg SHA-256 \
--tsaurl http://timestamp.acs.microsoft.com \
--tsmode RFC3161 \
"$BINARY"
unset token

echo "sign-binary: ${OS}/${ARCH} Authenticode-signed via Azure Trusted Signing"
}
Expand All @@ -91,3 +95,4 @@ case "$OS" in
windows) sign_windows ;;
*) echo "sign-binary: ${OS}/${ARCH} not signed (by design)" ;;
esac

Loading