Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sign Windows binaries #3764

Merged
merged 5 commits into from
Dec 11, 2024
Merged

Sign Windows binaries #3764

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dc90c6e
Sign Windows binaries
blampe Dec 9, 2024
c694cd9
feedback
blampe Dec 10, 2024
1017e0c
Merge branch 'master' of github.com:pulumi/pulumi-azure-native into b…
blampe Dec 10, 2024
4fcfd5e
use bash shell
blampe Dec 10, 2024
6bc1dea
Merge branch 'master' into blampe/windows
blampe Dec 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .github/workflows/build-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,6 +366,28 @@ jobs:
make --touch codegen schema
make provider_prebuild

- name: Build and sign windows provider
shell: bash # Runs with -eo pipefail
run: |
blampe marked this conversation as resolved.
Show resolved Hide resolved
make bin/windows-amd64/pulumi-resource-azure-native.exe;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, this is building just the windows binary first, then relying on the make dist from skipping the rebuild as it should be up-to-date?

Slightly more tempted to move this into the makefile given the implicit assumptions on the target associations here. Might be able to spike on this myself now you've done the legwork of the actual signing code.

Copy link
Member

@danielrbradley danielrbradley Dec 10, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Quick hack of what the extra code in the platform-specific provider binary target might look like:

ifeq ($(TARGET),windows-amd64)
ifeq (findstring ||,|${AZURE_SIGNING_CLIENT_ID}|${AZURE_SIGNING_CLIENT_SECRET}|${AZURE_SIGNING_TENANT_ID}|)
  echo "Skipping signing as Azure credentials are not set (AZURE_SIGNING_CLIENT_ID, AZURE_SIGNING_CLIENT_SECRET, AZURE_SIGNING_TENANT_ID)"
else
  az login --service-principal \
            --username ${{ secrets.AZURE_SIGNING_CLIENT_ID }} \
            --password ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }} \
            --tenant ${{ secrets.AZURE_SIGNING_TENANT_ID }} \
            --output none && \
    wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar && \
    java -jar jsign-6.0.jar \
             --storetype AZUREKEYVAULT \
             --keystore "PulumiCodeSigning" \
             --url ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }} \
             --storepass "$(az account get-access-token --resource "https://vault.azure.net" | jq -r .accessToken)" \
             bin/windows-amd64/pulumi-resource-azure-native.exe && \
    az logout
endif
endif

Copy link
Member

@danielrbradley danielrbradley Dec 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, new bash version seems like it's half way there ... can't test fully due to no cred though:

bin/%/$(PROVIDER) bin/%/$(PROVIDER).exe: bin/pulumictl .make/provider_mod_download .make/prebuild provider/cmd/$(PROVIDER)/*.go .make/provider_prebuild $(PROVIDER_PKG)
	@# check the TARGET is set
	test $(TARGET)
	cd provider && \
		export GOOS=$$(echo "$(TARGET)" | cut -d "-" -f 1) && \
		export GOARCH=$$(echo "$(TARGET)" | cut -d "-" -f 2) && \
		CGO_ENABLED=0 go build -o ${WORKING_DIR}/$@ $(VERSION_FLAGS) $(PROJECT)/v2/provider/cmd/$(PROVIDER)
	@# Only sign if configured. Test variables set by joining with | between and looking for || showing at least one variable is empty
	if [[ "${TARGET}" = "windows-amd64" && "|${AZURE_SIGNING_CLIENT_ID}|${AZURE_SIGNING_CLIENT_SECRET}|${AZURE_SIGNING_TENANT_ID}|${AZURE_SIGNING_KEY_VAULT_URI}|" == *"||"* ]]; then \
		echo "Skipping signing as required configuration not set: AZURE_SIGNING_CLIENT_ID, AZURE_SIGNING_CLIENT_SECRET, AZURE_SIGNING_TENANT_ID, AZURE_SIGNING_KEY_VAULT_URI"; \
	else \
		az login --service-principal \
			--username ${AZURE_SIGNING_CLIENT_ID} \
			--password ${AZURE_SIGNING_CLIENT_SECRET} \
			--tenant ${AZURE_SIGNING_TENANT_ID} \
			--output none; \
		wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar --output-document=bin/jsign-6.0.jar; \
		java -jar bin/jsign-6.0.jar \
			--storetype AZUREKEYVAULT \
			--keystore "PulumiCodeSigning" \
			--url ${AZURE_SIGNING_KEY_VAULT_URI} \
			--storepass "$$(az account get-access-token --resource "https://vault.azure.net" | jq -r .accessToken)" \
			bin/windows-amd64/pulumi-resource-azure-native.exe; \
		az logout; \
	fi

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pushed as alternative PR here: #3774


az login --service-principal \
--username ${{ secrets.AZURE_SIGNING_CLIENT_ID }} \
--password ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }} \
--tenant ${{ secrets.AZURE_SIGNING_TENANT_ID }} \
--output none;

wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar;

java -jar jsign-6.0.jar \
--storetype AZUREKEYVAULT \
--keystore "PulumiCodeSigning" \
--url ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }} \
--storepass "$(az account get-access-token --resource "https://vault.azure.net" | jq -r .accessToken)" \
bin/windows-amd64/pulumi-resource-azure-native.exe;

az logout;

- name: Build dist packages
run: make dist --jobs=2

Expand Down
Loading