4 ms·

I'm in exactly the same boat; doing the same thing to store my OV .pfx certificate in a GitHub Actions secret. My certificate expires in November 2024 and I'm u

I'm in exactly the same boat; doing the same thing to store my OV .pfx certificate in a GitHub Actions secret. My certificate expires in November 2024 and I'm undecided what I'll do. It was hard enough to get a certificate as a solo developer and not a corporation. Still, though, it should just be a matter of money. The $629/year cloud-hosted HSM mentioned in the OP will do it. If you pay that, you can use this procedure to make it work with GitHub Actions with the same sort of signtool or Set-AuthenticodeSignature command that you use now: https://docs.digicert.com/en/software-trust-manager/ci-cd-integrations/plugins/github-custom-action-for-keypair-signing.html https://docs.digicert.com/en/software-trust-manager/ci-cd-in...

jborean93 3y ago
I’ve found the easiest option available here is through using Azure KeyVault to store the keys. I use a custom module to sign my PowerShell scripts and dlls [1] for this because I can integrate it with OIDC to sign the code using the keys stored in the Azure HSM. While the builtin pwsh Set-Authenticode cmdlet can’t do this currently there are other options that rely on Window’s authenticode APIs like AzureSignTool [2] that I highly recommend. While I’m unsure if Azure is suitable for actual companies I think the risk is ok for what I need it for and the API quality as well as OIDC support make it quite nice to use with GHA. [1] https://github.com/jborean93/PowerShell-OpenAuthenticode https://github.com/jborean93/PowerShell-OpenAuthenticode [2] https://github.com/vcsjones/AzureSignTool https://github.com/vcsjones/AzureSignTool
- electroly 3y ago
  I was looking into Azure Key Vault Managed HSM and it appears to be vastly more expensive than the $629/year from Digicert. A Managed HSM Pool is $3.20/hour. Am I missing something?
  - veeti 3y ago
    You don't need a HSM, just a HSM backed key. It costs like $5 a month.
    - electroly 3y ago
      Can you point me at some more information about the difference? This would seem to be a much better deal than paying Digicert, but I'm confused about how it can be so cheap? Isn't the required for an HSM at all the reason it's so much more expensive now at other CAs?
      - veeti 3y ago
        I don't know what happens under the hood, but presumably a HSM key is on a shared HSM with other people whereas what you're talking about will get you a dedicated HSM. We have set up Key Vault for code signing using this and it does work.
        electroly 3y ago
        Thanks so much for this. I will dig into this option, and it seems the ImageMagick people have been clued into the same solution.
      - gloosx 3y ago
        This whole thing is set-up to earn your money under the cover of protecting somebody from something, so all the prices you see are random manager thoughts on how much they want to get. There is no reasoning behind this price really and it is just arbitrary price made from rules "as high as possible" and "low enough they still buy from us". Microsoft certificate prices are essentially like drug prices, and the "authorized resellers" is basically a drug cartel
hermitcrab 3y ago
$629 per year for doing some basic ID checks and basically multiplying 2 prime numbers together. What a scam.

jborean93 3y ago

I’ve found the easiest option available here is through using Azure KeyVault to store the keys. I use a custom module to sign my PowerShell scripts and dlls [1] for this because I can integrate it with OIDC to sign the code using the keys stored in the Azure HSM. While the builtin pwsh Set-Authenticode cmdlet can’t do this currently there are other options that rely on Window’s authenticode APIs like AzureSignTool [2] that I highly recommend. While I’m unsure if Azure is suitable for actual companies I think the risk is ok for what I need it for and the API quality as well as OIDC support make it quite nice to use with GHA. [1] https://github.com/jborean93/PowerShell-OpenAuthenticode https://github.com/jborean93/PowerShell-OpenAuthenticode [2] https://github.com/vcsjones/AzureSignTool https://github.com/vcsjones/AzureSignTool

electroly 3y ago
I was looking into Azure Key Vault Managed HSM and it appears to be vastly more expensive than the $629/year from Digicert. A Managed HSM Pool is $3.20/hour. Am I missing something?
- veeti 3y ago
  You don't need a HSM, just a HSM backed key. It costs like $5 a month.
  - electroly 3y ago
    Can you point me at some more information about the difference? This would seem to be a much better deal than paying Digicert, but I'm confused about how it can be so cheap? Isn't the required for an HSM at all the reason it's so much more expensive now at other CAs?
    - veeti 3y ago
      I don't know what happens under the hood, but presumably a HSM key is on a shared HSM with other people whereas what you're talking about will get you a dedicated HSM. We have set up Key Vault for code signing using this and it does work.
      - electroly 3y ago
        Thanks so much for this. I will dig into this option, and it seems the ImageMagick people have been clued into the same solution.
    - gloosx 3y ago
      This whole thing is set-up to earn your money under the cover of protecting somebody from something, so all the prices you see are random manager thoughts on how much they want to get. There is no reasoning behind this price really and it is just arbitrary price made from rules "as high as possible" and "low enough they still buy from us". Microsoft certificate prices are essentially like drug prices, and the "authorized resellers" is basically a drug cartel

hermitcrab 3y ago

$629 per year for doing some basic ID checks and basically multiplying 2 prime numbers together. What a scam.