6 ms·

Does anyone have a windows code signing system they like? Something on GitHub actions ideally. I’m distributing unsigned binaries not because I care about the

Does anyone have a windows code signing system they like? Something on GitHub actions ideally. I’m distributing unsigned binaries not because I care about the $200 for a cert, but I don’t want to spend hours figuring out a signing flow.

tonyedgecombe 2y ago
> but I don’t want to spend hours figuring out a signing flow. That part is trivial, the real pain comes from dealing with the certificate providers.
landr0id 2y ago
I haven't tried it but have been looking into the same problem. This is probably the best bet (does require an Azure account though): https://github.com/Azure/trusted-signing-action https://github.com/Azure/trusted-signing-action
- scosman 2y ago
  Azure looked promising, but their trusted signing service won't issue a cert unless your corp is 3 years old. Doesn't look like you can bring your own keys here.
  - paulddraper 2y ago
    > unless your corp is 3 years old ...and you need to have a corporation? I thought corporations were pseudo-humans. Turns out it may be the other way around.
  - knallfrosch 2y ago
    Microsoft Learn: Import HSM-protected keys to Key Vault (BYOK) https://learn.microsoft.com/en-us/azure/key-vault/keys/hsm-protected-keys-byok https://learn.microsoft.com/en-us/azure/key-vault/keys/hsm-p... I guess that allows you to get your own cert (example: from DigiKey) for your own HSM (example: YubiKey) and then upload it. That's what we researched before we abandonded the approach and kept code-signing by manually downloading the build, signing on a specific machine where only one architect had access. What could ever go wrong?
donmcronald 2y ago
I thought that if you want a code signing certificate that isn't useless it has to be an EV certificate and those require an HSM. How would that ever get worked into GitHub Actions?
- scosman 2y ago
  I thought OV still bypassed smart screen and virus false positives from Windows defender? Although I think even OV require HSM now for local, with some options for hosted services like Azure Trusted Signing. But I really don't know. I read details only to end up not certain.
  - mappu 2y ago
    Originally OV allowed file-based certificates (pkcs12) and EV required an HSM. But since June 2023, now file-based certificates are no longer allowed[1], you need to certify that your CSR comes from an HSM (just paperwork, nothing technical) as part of the issuance request. Smartscreen, AV warnings, etc use a reputation-based system. No amount of money makes you truly immune from warnings, but paying for EV does give you a higher default reputation. Since there is no longer any file-vs-HSM distinction between EV and OV, it is simply a cost for more default reputation. Any business will pay it easily. (My prediction is that OV/EV will consolidate to a single offering, in the same way that EV for web SSL has been phased-out.) Azure Trusted Signing is an all-in-one service that creates keys, purchases the certificate, and hosts the HSM for you. It's still OK to do all these things separately e.g. purchase the cert from Globalsign and use Azure Key Vault as the HSM (you have to pay for the 5 USD/mo service for the larger key size, instead of the cheap one). ATS is still somewhat new and has not fed into toolchains like https://github.com/sassoftware/relic https://github.com/sassoftware/relic yet. Although https://github.com/ebourg/jsign https://github.com/ebourg/jsign does support it. 1. https://knowledge.digicert.com/alerts/code-signing-changes-in-2023 https://knowledge.digicert.com/alerts/code-signing-changes-i...
    - nickf 2y ago
      EV codesigning has been gone for almost a year now. MS said it no longer makes a difference.
weinzierl 2y ago
Isn't Microsoft switching to Trusted Signing[1] and you can get or you'll have to get the cert from them directly in the future? Seems not to make the process easier, because apparently your organization has to be more than 3 years old[2] to be eligible. For the traditional way with a third-party cert provider someone on Reddit made a comparison table[3]. The whole thread is interesting. [1] https://learn.microsoft.com/en-us/azure/trusted-signing/overview https://learn.microsoft.com/en-us/azure/trusted-signing/over... [2] https://learn.microsoft.com/en-us/answers/questions/2082252/identity-validation-keeps-failing-for-no-reason https://learn.microsoft.com/en-us/answers/questions/2082252/... [3] https://www.reddit.com/r/electronjs/comments/17sizjf/a_guide_to_code_signing_certificates_for_the/?rdt=43938 https://www.reddit.com/r/electronjs/comments/17sizjf/a_guide...
- jagged-chisel 2y ago
  As of November 27, 2024: > We are working on making the functionality available for organizations that were incorporated less than 3 years ago. We don't have an ETA yet to share. From your link at [2]
  - sitic 2y ago
    Trusted Signing for individual developers is in Public Preview, prices start at $9.99/month [1]. Here is the GitHub action for file signing using Trusted Signing: https://github.com/Azure/trusted-signing-action https://github.com/Azure/trusted-signing-action. [1] https://techcommunity.microsoft.com/blog/microsoft-security-blog/trusted-signing-is-now-open-for-individual-developers-to-sign-up-in-public-previ/4273554 https://techcommunity.microsoft.com/blog/microsoft-security-...
    - mananaysiempre 2y ago
      So now you can pay $120/yr for the privilege of being a Windows developer (and no other actual service), just like on (or actually somewhat more than for) iOS?
likeabatterycar 2y ago
What is wrong with Microsoft's free signtool.exe?
- bagels 2y ago
  Okay, you need an EV certificate (required to be on a hardware token), and next you need to integrate it in to a CICD pipeline.
  - likeabatterycar 2y ago
    Signtool interfaces with any kind of certificate including on smartcard. https://www.mgtek.com/smartcard https://www.mgtek.com/smartcard For automating pin entry
    - bagels 2y ago
      I was able to bypass the 2fa using the right signtool incantations
paulddraper 2y ago
You have two options: 1. Get an EV certificate from a trusted CA [1]. That will run $400-800. 2. Use managed Trusted Signing from Azure. [2] Identity validation takes ~a week. Signing can be done via web or CLI. This does require a tax history of 3+ years. [3] [1] https://learn.microsoft.com/en-us/windows-hardware/drivers/dashboard/code-signing-cert-manage https://learn.microsoft.com/en-us/windows-hardware/drivers/d... [2] https://learn.microsoft.com/en-us/azure/trusted-signing/quickstart https://learn.microsoft.com/en-us/azure/trusted-signing/quic... [3] https://learn.microsoft.com/en-us/azure/trusted-signing/quickstart?tabs=registerrp-portal%2Caccount-portal%2Corgvalidation%2Ccertificateprofile-portal%2Cdeleteresources-portal#important-information-for-public-identity-validation https://learn.microsoft.com/en-us/azure/trusted-signing/quic...
CaliforniaKarl 2y ago
It's not using GitHub Actions, but it is possible to use a YubiKey 5 FIPS model as an HSM for the purpose of getting a code-signing certificate. https://support.sectigo.com/IS_KnowledgeDetailPage?Id=kA03l000000roEV https://support.sectigo.com/IS_KnowledgeDetailPage?Id=kA03l0... is an example explaining how to get both a CSR and an attestation certificate from a YubiKey 5 FIPS, on Windows. https://support.yubico.com/hc/en-us/articles/360016614840-Code-Signing-with-the-YubiKey-on-Windows https://support.yubico.com/hc/en-us/articles/360016614840-Co... explains how to use Windows' signtool with a Yubikey. Using a YubiKey does require that you provide your PIN every time you want to do a signature, which limits how much you can automate things. A YubiHSM would remove that requirement, and might be able to work with a self-hosted GitHub Actions Runner, but it's more expensive, and you'd want confirmation from your CA (Sectigo, for example) that a YubiHSM is OK.
- Stratoscope 2y ago
  > Using a YubiKey does require that you provide your PIN every time you want to do a signature, which limits how much you can automate things. AutoHotkey is your friend! When I set up our code signing machine at AltspaceVR ten years ago, I wrote a simple little AutoHotkey script that watched for the signtool PIN popup and typed in the PIN. It was maybe 15-20 lines of code. Problem solved.
eXpl0it3r 2y ago
Haven't used them, but for open source, SignPath might be interesting, they do require transparent builds, but do support GitHub Actions: https://about.signpath.io/product/open-source https://about.signpath.io/product/open-source Some other signing that works in the cloud and has support for GitHub Actions would be DigiCert's KeyLocker (note: every signed binary is counted and by default the subscription only contains 1000 signings): https://www.digicert.com/signing/code-signing-certificates#code_signing_key_locker https://www.digicert.com/signing/code-signing-certificates#c...
bagels 2y ago
I just went through this process. It's a racket. It's really poorly documented. I rolled my own. It's a lot of work. It almost inspired me to make a product, but it's not a business I want to be in, especially if Microsoft does eventually relax their 3 year old business requirement for their Trusted Signing product. My formula was: Github actions, Sectigo usb key, physical windows machine in the office that runs a self-hosted action runner that does the signing step.
MrAlex94 2y ago
I use a Azure Key Vault[1], and jsign[2] to do this. You can execute it on any platform that supports Java, so I have Linux builds cross compiling to windows with clang and then sign with jsign: https://github.com/BrowserWorks/Waterfox/blob/7eda3b998a56ad9cad19a388ff759a8d7d6f4b7d/.github/workflows/build.yml#L315 https://github.com/BrowserWorks/Waterfox/blob/7eda3b998a56ad... [1] https://trustzone.com/knowledge-base/purchasing-an-ev-code-signing-certificate-for-azure/ https://trustzone.com/knowledge-base/purchasing-an-ev-code-s... [2] https://trustzone.com/knowledge-base/purchasing-an-ev-code-signing-certificate-for-azure/ https://trustzone.com/knowledge-base/purchasing-an-ev-code-s...
mscrivo 2y ago
I've actually got an action for this (based on fork, so can't take full credit): https://github.com/mscrivo/signtool-code-sign https://github.com/mscrivo/signtool-code-sign you can see a usage example here: https://github.com/mscrivo/OotD/blob/main/.github/workflows/build.yml#L55 https://github.com/mscrivo/OotD/blob/main/.github/workflows/...
tfolbrecht 2y ago
I use jsign and AWS KMS. It's a lot less expensive than a full on HSM or "cloud HSM" service. There's a lot to it, and expect a ton of a back and forth emails with a CA to get an EV Cert. Here's some example code for generating the CSR (Certificate signing request) to submit to a CA. https://github.com/aws-samples/csr-builder-for-kms https://github.com/aws-samples/csr-builder-for-kms
electroly 2y ago
I ultimately concluded the automation was too much work and I didn't want to figure it out. I bought the Sectigo cert (they will sell code signing certs to individuals) with the USB dongle and installed their crappy software (SafeNet Authentication Client), and I manually sign builds from GitHub Actions on my workstation with "signtool."
scosman 2y ago
Based on comments here, Azure Trusted Signing with a personal certificate and their GitHub action worked. This blog post below is great. It works through the process, including the truly weird/awful UX choices Azure makes. I archived it on wayback in case it ever disappears. https://www.hendrik-erz.de/post/code-signing-with-azure-trusted-signing-on-github-actions https://www.hendrik-erz.de/post/code-signing-with-azure-trus...
piker 2y ago
https://melatonin.dev/blog/code-signing-on-windows-with-azure-trusted-signing/ https://melatonin.dev/blog/code-signing-on-windows-with-azur... is the way forward if you haven't found a solution already.

tonyedgecombe 2y ago

> but I don’t want to spend hours figuring out a signing flow. That part is trivial, the real pain comes from dealing with the certificate providers.

landr0id 2y ago

I haven't tried it but have been looking into the same problem. This is probably the best bet (does require an Azure account though): https://github.com/Azure/trusted-signing-action https://github.com/Azure/trusted-signing-action

scosman 2y ago
Azure looked promising, but their trusted signing service won't issue a cert unless your corp is 3 years old. Doesn't look like you can bring your own keys here.
- paulddraper 2y ago
  > unless your corp is 3 years old ...and you need to have a corporation? I thought corporations were pseudo-humans. Turns out it may be the other way around.
- knallfrosch 2y ago
  Microsoft Learn: Import HSM-protected keys to Key Vault (BYOK) https://learn.microsoft.com/en-us/azure/key-vault/keys/hsm-protected-keys-byok https://learn.microsoft.com/en-us/azure/key-vault/keys/hsm-p... I guess that allows you to get your own cert (example: from DigiKey) for your own HSM (example: YubiKey) and then upload it. That's what we researched before we abandonded the approach and kept code-signing by manually downloading the build, signing on a specific machine where only one architect had access. What could ever go wrong?

donmcronald 2y ago

I thought that if you want a code signing certificate that isn't useless it has to be an EV certificate and those require an HSM. How would that ever get worked into GitHub Actions?

scosman 2y ago
I thought OV still bypassed smart screen and virus false positives from Windows defender? Although I think even OV require HSM now for local, with some options for hosted services like Azure Trusted Signing. But I really don't know. I read details only to end up not certain.
- mappu 2y ago
  Originally OV allowed file-based certificates (pkcs12) and EV required an HSM. But since June 2023, now file-based certificates are no longer allowed[1], you need to certify that your CSR comes from an HSM (just paperwork, nothing technical) as part of the issuance request. Smartscreen, AV warnings, etc use a reputation-based system. No amount of money makes you truly immune from warnings, but paying for EV does give you a higher default reputation. Since there is no longer any file-vs-HSM distinction between EV and OV, it is simply a cost for more default reputation. Any business will pay it easily. (My prediction is that OV/EV will consolidate to a single offering, in the same way that EV for web SSL has been phased-out.) Azure Trusted Signing is an all-in-one service that creates keys, purchases the certificate, and hosts the HSM for you. It's still OK to do all these things separately e.g. purchase the cert from Globalsign and use Azure Key Vault as the HSM (you have to pay for the 5 USD/mo service for the larger key size, instead of the cheap one). ATS is still somewhat new and has not fed into toolchains like https://github.com/sassoftware/relic https://github.com/sassoftware/relic yet. Although https://github.com/ebourg/jsign https://github.com/ebourg/jsign does support it. 1. https://knowledge.digicert.com/alerts/code-signing-changes-in-2023 https://knowledge.digicert.com/alerts/code-signing-changes-i...
  - nickf 2y ago
    EV codesigning has been gone for almost a year now. MS said it no longer makes a difference.

weinzierl 2y ago

Isn't Microsoft switching to Trusted Signing[1] and you can get or you'll have to get the cert from them directly in the future? Seems not to make the process easier, because apparently your organization has to be more than 3 years old[2] to be eligible. For the traditional way with a third-party cert provider someone on Reddit made a comparison table[3]. The whole thread is interesting. [1] https://learn.microsoft.com/en-us/azure/trusted-signing/overview https://learn.microsoft.com/en-us/azure/trusted-signing/over... [2] https://learn.microsoft.com/en-us/answers/questions/2082252/identity-validation-keeps-failing-for-no-reason https://learn.microsoft.com/en-us/answers/questions/2082252/... [3] https://www.reddit.com/r/electronjs/comments/17sizjf/a_guide_to_code_signing_certificates_for_the/?rdt=43938 https://www.reddit.com/r/electronjs/comments/17sizjf/a_guide...

jagged-chisel 2y ago
As of November 27, 2024: > We are working on making the functionality available for organizations that were incorporated less than 3 years ago. We don't have an ETA yet to share. From your link at [2]
- sitic 2y ago
  Trusted Signing for individual developers is in Public Preview, prices start at $9.99/month [1]. Here is the GitHub action for file signing using Trusted Signing: https://github.com/Azure/trusted-signing-action https://github.com/Azure/trusted-signing-action. [1] https://techcommunity.microsoft.com/blog/microsoft-security-blog/trusted-signing-is-now-open-for-individual-developers-to-sign-up-in-public-previ/4273554 https://techcommunity.microsoft.com/blog/microsoft-security-...
  - mananaysiempre 2y ago
    So now you can pay $120/yr for the privilege of being a Windows developer (and no other actual service), just like on (or actually somewhat more than for) iOS?

likeabatterycar 2y ago

What is wrong with Microsoft's free signtool.exe?

bagels 2y ago
Okay, you need an EV certificate (required to be on a hardware token), and next you need to integrate it in to a CICD pipeline.
- likeabatterycar 2y ago
  Signtool interfaces with any kind of certificate including on smartcard. https://www.mgtek.com/smartcard https://www.mgtek.com/smartcard For automating pin entry
  - bagels 2y ago
    I was able to bypass the 2fa using the right signtool incantations

paulddraper 2y ago

You have two options: 1. Get an EV certificate from a trusted CA [1]. That will run $400-800. 2. Use managed Trusted Signing from Azure. [2] Identity validation takes ~a week. Signing can be done via web or CLI. This does require a tax history of 3+ years. [3] [1] https://learn.microsoft.com/en-us/windows-hardware/drivers/dashboard/code-signing-cert-manage https://learn.microsoft.com/en-us/windows-hardware/drivers/d... [2] https://learn.microsoft.com/en-us/azure/trusted-signing/quickstart https://learn.microsoft.com/en-us/azure/trusted-signing/quic... [3] https://learn.microsoft.com/en-us/azure/trusted-signing/quickstart?tabs=registerrp-portal%2Caccount-portal%2Corgvalidation%2Ccertificateprofile-portal%2Cdeleteresources-portal#important-information-for-public-identity-validation https://learn.microsoft.com/en-us/azure/trusted-signing/quic...

CaliforniaKarl 2y ago

It's not using GitHub Actions, but it is possible to use a YubiKey 5 FIPS model as an HSM for the purpose of getting a code-signing certificate. https://support.sectigo.com/IS_KnowledgeDetailPage?Id=kA03l000000roEV https://support.sectigo.com/IS_KnowledgeDetailPage?Id=kA03l0... is an example explaining how to get both a CSR and an attestation certificate from a YubiKey 5 FIPS, on Windows. https://support.yubico.com/hc/en-us/articles/360016614840-Code-Signing-with-the-YubiKey-on-Windows https://support.yubico.com/hc/en-us/articles/360016614840-Co... explains how to use Windows' signtool with a Yubikey. Using a YubiKey does require that you provide your PIN every time you want to do a signature, which limits how much you can automate things. A YubiHSM would remove that requirement, and might be able to work with a self-hosted GitHub Actions Runner, but it's more expensive, and you'd want confirmation from your CA (Sectigo, for example) that a YubiHSM is OK.

Stratoscope 2y ago
> Using a YubiKey does require that you provide your PIN every time you want to do a signature, which limits how much you can automate things. AutoHotkey is your friend! When I set up our code signing machine at AltspaceVR ten years ago, I wrote a simple little AutoHotkey script that watched for the signtool PIN popup and typed in the PIN. It was maybe 15-20 lines of code. Problem solved.

eXpl0it3r 2y ago

Haven't used them, but for open source, SignPath might be interesting, they do require transparent builds, but do support GitHub Actions: https://about.signpath.io/product/open-source https://about.signpath.io/product/open-source Some other signing that works in the cloud and has support for GitHub Actions would be DigiCert's KeyLocker (note: every signed binary is counted and by default the subscription only contains 1000 signings): https://www.digicert.com/signing/code-signing-certificates#code_signing_key_locker https://www.digicert.com/signing/code-signing-certificates#c...

bagels 2y ago

I just went through this process. It's a racket. It's really poorly documented. I rolled my own. It's a lot of work. It almost inspired me to make a product, but it's not a business I want to be in, especially if Microsoft does eventually relax their 3 year old business requirement for their Trusted Signing product. My formula was: Github actions, Sectigo usb key, physical windows machine in the office that runs a self-hosted action runner that does the signing step.

MrAlex94 2y ago

I use a Azure Key Vault[1], and jsign[2] to do this. You can execute it on any platform that supports Java, so I have Linux builds cross compiling to windows with clang and then sign with jsign: https://github.com/BrowserWorks/Waterfox/blob/7eda3b998a56ad9cad19a388ff759a8d7d6f4b7d/.github/workflows/build.yml#L315 https://github.com/BrowserWorks/Waterfox/blob/7eda3b998a56ad... [1] https://trustzone.com/knowledge-base/purchasing-an-ev-code-signing-certificate-for-azure/ https://trustzone.com/knowledge-base/purchasing-an-ev-code-s... [2] https://trustzone.com/knowledge-base/purchasing-an-ev-code-signing-certificate-for-azure/ https://trustzone.com/knowledge-base/purchasing-an-ev-code-s...

mscrivo 2y ago

I've actually got an action for this (based on fork, so can't take full credit): https://github.com/mscrivo/signtool-code-sign https://github.com/mscrivo/signtool-code-sign you can see a usage example here: https://github.com/mscrivo/OotD/blob/main/.github/workflows/build.yml#L55 https://github.com/mscrivo/OotD/blob/main/.github/workflows/...

tfolbrecht 2y ago

I use jsign and AWS KMS. It's a lot less expensive than a full on HSM or "cloud HSM" service. There's a lot to it, and expect a ton of a back and forth emails with a CA to get an EV Cert. Here's some example code for generating the CSR (Certificate signing request) to submit to a CA. https://github.com/aws-samples/csr-builder-for-kms https://github.com/aws-samples/csr-builder-for-kms

electroly 2y ago

I ultimately concluded the automation was too much work and I didn't want to figure it out. I bought the Sectigo cert (they will sell code signing certs to individuals) with the USB dongle and installed their crappy software (SafeNet Authentication Client), and I manually sign builds from GitHub Actions on my workstation with "signtool."

scosman 2y ago

Based on comments here, Azure Trusted Signing with a personal certificate and their GitHub action worked. This blog post below is great. It works through the process, including the truly weird/awful UX choices Azure makes. I archived it on wayback in case it ever disappears. https://www.hendrik-erz.de/post/code-signing-with-azure-trusted-signing-on-github-actions https://www.hendrik-erz.de/post/code-signing-with-azure-trus...

piker 2y ago

https://melatonin.dev/blog/code-signing-on-windows-with-azure-trusted-signing/ https://melatonin.dev/blog/code-signing-on-windows-with-azur... is the way forward if you haven't found a solution already.