From a5a29871f8776eaf393c7a889488a3cb5fc2a910 Mon Sep 17 00:00:00 2001 From: Chris Hennes Date: Sun, 22 Feb 2026 20:33:00 -0600 Subject: [PATCH] Packaging: Add Azure-based artifact signing on Win Sign all *.exe, *.dll, and *.pyd files in the bin directory of the build, as well as the two Chocolatey stubs and the installer. Requires the use of several environment variables and secrets, documented at https://github.com/FreeCAD/DevelopersHandbook/blob/main/technical/codesigning.md#windows (cherry picked from commit 6206ed2c5107b859e373e69bc86f74da1eb5f100) --- .github/workflows/build_release.yml | 95 ++++++++++++++++--- package/rattler-build/osx/create_bundle.sh | 4 +- .../rattler-build/windows/create_bundle.sh | 85 +++++++++++++++++ 3 files changed, 168 insertions(+), 16 deletions(-) diff --git a/.github/workflows/build_release.yml b/.github/workflows/build_release.yml index 86add33ba2..f6de5e921c 100644 --- a/.github/workflows/build_release.yml +++ b/.github/workflows/build_release.yml @@ -9,6 +9,10 @@ on: permissions: contents: write +concurrency: + group: build-release-${{ github.event_name }} + cancel-in-progress: true + jobs: upload_src: runs-on: ubuntu-latest @@ -20,15 +24,15 @@ jobs: with: egress-policy: audit - - name: Checkout Source - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - name: Checkout source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.sha }} fetch-depth: 2 fetch-tags: true submodules: 'recursive' - - name: get tag and create release if weekly + - name: Get tag and create release if weekly id: get_tag shell: bash -l {0} env: @@ -38,7 +42,10 @@ jobs: export BUILD_TAG="${{ github.event.release.tag_name }}" else export BUILD_TAG=weekly-$(date "+%Y.%m.%d") - gh release create ${BUILD_TAG} --title "Development Build ${BUILD_TAG}" -F .github/workflows/weekly-build-notes.md --prerelease || true + gh release create ${BUILD_TAG} --title "Development Build ${BUILD_TAG}" \ + -F .github/workflows/weekly-build-notes.md \ + --prerelease || \ + gh release view ${BUILD_TAG} > /dev/null # fail if it doesn't exist fi echo "BUILD_TAG=${BUILD_TAG}" >> "$GITHUB_ENV" echo "build_tag=${BUILD_TAG}" >> "$GITHUB_OUTPUT" @@ -92,7 +99,7 @@ jobs: remove-android: 'true' # (frees ~9 GB) remove-cached-tools: 'true' # (frees ~8.3 GB) - - name: Set Platform Environment Variables + - name: Set platform environment variables shell: bash -l {0} env: OPERATING_SYSTEM: ${{ runner.os }} @@ -102,8 +109,8 @@ jobs: echo 'RATTLER_CACHE_DIR=D:\rattler' >> "$GITHUB_ENV" fi - - name: Checkout Source - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - name: Checkout source + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.sha }} fetch-depth: 2 @@ -116,7 +123,7 @@ jobs: cache: false - name: Install the Apple certificate and provisioning profile - id: get_cert + id: macos_get_cert if: runner.os == 'macOS' env: APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }} @@ -124,7 +131,6 @@ jobs: BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }} DEVELOPER_TEAM_ID: ${{ secrets.DEVELOPER_TEAM_ID }} - KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} P12_PASSWORD: ${{ secrets.P12_PASSWORD }} run: | if [ -z "$BUILD_CERTIFICATE_BASE64" ]; then @@ -160,20 +166,81 @@ jobs: xcrun notarytool store-credentials "FreeCAD" --keychain "$KEYCHAIN_PATH" --apple-id "${APPLE_ID}" --password "${APP_SPECIFIC_PASSWORD}" --team-id "${DEVELOPER_TEAM_ID}" - - name: Build and Release Packages + - name: Setup .NET 10 SDK + if: runner.os == 'Windows' + uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0 + with: + dotnet-version: '10.0.103' + + - name: Install sign tool + if: runner.os == 'Windows' + run: | + # NOTE: The sign tool is ONLY available as a prerelease package, they never issue real releases. + dotnet tool install --global --prerelease sign --version 0.9.1-beta.26127.1 + echo "$env:USERPROFILE\.dotnet\tools" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append + dotnet --info + sign --version + + - name: Build packages + shell: bash + env: + GH_TOKEN: ${{ github.token }} + TARGET_PLATFORM: ${{ matrix.target }} + BUILD_TAG: ${{ needs.upload_src.outputs.build_tag }} + run: | + set -euo pipefail + if [[ "${{ runner.os }}" == "macOS" ]]; then + export MACOS_DEPLOYMENT_TARGET="${{ matrix.deploy_target }}" + fi + python3 package/scripts/write_version_info.py ../freecad_version.txt + cd package/rattler-build + pixi install + + - name: Azure login for Windows build code signing + id: azure_login + if: runner.os == 'Windows' + continue-on-error: true + uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0 + with: + creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ secrets.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}' + + - name: Release packages with optional code-signing on Windows and macOS shell: bash env: GH_TOKEN: ${{ github.token }} - SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }} - SIGN_RELEASE: ${{ steps.get_cert.outputs.has_cert }} TARGET_PLATFORM: ${{ matrix.target }} MAKE_INSTALLER: "true" UPLOAD_RELEASE: "true" BUILD_TAG: ${{ needs.upload_src.outputs.build_tag }} run: | - python3 package/scripts/write_version_info.py ../freecad_version.txt + set -euo pipefail + + export MACOS_SIGN_RELEASE=0 + export WINDOWS_SIGN_RELEASE=0 + + case "${RUNNER_OS}" in + Windows) + export WINDOWS_SIGN_RELEASE="${{ steps.azure_login.outcome }}" + export WINDOWS_AZURE_ENDPOINT="${{ vars.AZURE_TRUSTED_SIGNING_ENDPOINT }}" + export WINDOWS_AZURE_CERTIFICATE_PROFILE="${{ vars.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE }}" + export WINDOWS_AZURE_SIGNING_ACCOUNT="${{ vars.AZURE_TRUSTED_SIGNING_ACCOUNT }}" + + # For good measure, normalize the azure_login result to 1 or 0 + if [[ "${WINDOWS_SIGN_RELEASE:-}" == "success" ]]; then + export WINDOWS_SIGN_RELEASE=1 + else + export WINDOWS_SIGN_RELEASE=0 + fi + ;; + + macOS) + export MACOS_SIGN_RELEASE="${{ steps.macos_get_cert.outputs.has_cert }}" + export MACOS_SIGNING_KEY_ID="${{ secrets.SIGNING_KEY_ID }}" + export MACOS_DEPLOYMENT_TARGET="${{ matrix.deploy_target }}" + ;; + esac + cd package/rattler-build - pixi install pixi run -e package create_bundle ## Needed if running on a self-hosted runner: diff --git a/package/rattler-build/osx/create_bundle.sh b/package/rattler-build/osx/create_bundle.sh index 7872126c24..f184339df0 100644 --- a/package/rattler-build/osx/create_bundle.sh +++ b/package/rattler-build/osx/create_bundle.sh @@ -66,9 +66,9 @@ sed -i '1s/.*/\nLIST OF PACKAGES:/' FreeCAD.app/Contents/packages.txt cp -a ${conda_env}/Library ${conda_env}/.. rm -rf ${conda_env}/Library -if [[ "${SIGN_RELEASE}" == "true" ]]; then +if [[ "${MACOS_SIGN_RELEASE}" == "true" ]]; then # create the signed dmg - ../../scripts/macos_sign_and_notarize.zsh -p "FreeCAD" -k ${SIGNING_KEY_ID} -o "${version_name}.dmg" + ../../scripts/macos_sign_and_notarize.zsh -p "FreeCAD" -k ${MACOS_SIGNING_KEY_ID} -o "${version_name}.dmg" else # create the dmg dmgbuild -s dmg_settings.py "FreeCAD" "${version_name}.dmg" diff --git a/package/rattler-build/windows/create_bundle.sh b/package/rattler-build/windows/create_bundle.sh index ddb69e87bd..7a5508a6a8 100644 --- a/package/rattler-build/windows/create_bundle.sh +++ b/package/rattler-build/windows/create_bundle.sh @@ -44,6 +44,9 @@ find ${copy_dir} -name \*arm\*.exe -delete # arm binaries that fail to extract u mv ${copy_dir}/bin/Lib/ssl.py .ssl-orig.py cp ssl-patch.py ${copy_dir}/bin/Lib/ssl.py +# Turn off the echo before we start actually calling "echo" +set +x + echo '[Paths]' >> ${copy_dir}/bin/qt6.conf echo 'Prefix = ../lib/qt6' >> ${copy_dir}/bin/qt6.conf @@ -67,6 +70,64 @@ sed -i '1s/.*/\nLIST OF PACKAGES:/' ${copy_dir}/packages.txt mv ${copy_dir} ${version_name} + +# Sign the EXE, DLL, and PYD files (if we can access the Azure account for signing): +set -euo pipefail +SIGN_DIR="${version_name}" + + +if [[ "${WINDOWS_SIGN_RELEASE:-0}" == "1" ]]; then + TENANT="$(az account show --query tenantId -o tsv)" + export AZURE_IDENTITY_DISABLE_WORKLOAD_IDENTITY=true + export AZURE_IDENTITY_DISABLE_MANAGED_IDENTITY=true + unset AZURE_IDENTITY_LOGGING_ENABLED + + if az account get-access-token \ + --tenant "$TENANT" \ + --scope "https://codesigning.azure.net/.default" \ + >/dev/null 2>&1; + then + echo "Azure Artifact Signing access confirmed. Beginning signing process..." + + shopt -s nullglob + + FILES=( + "$SIGN_DIR"/*.exe + "$SIGN_DIR"/bin/*.exe + "$SIGN_DIR"/bin/*.dll + "$SIGN_DIR"/bin/*.pyd + ) + + count=0 + total=${#FILES[@]} + echo "Signing $total files" + for f in "${FILES[@]}"; do + ((count+=1)) + echo "Signing [$count/$total]: $f" + sign code artifact-signing \ + --artifact-signing-endpoint "${WINDOWS_AZURE_ENDPOINT}" \ + --artifact-signing-certificate-profile "${WINDOWS_AZURE_CERTIFICATE_PROFILE}" \ + --artifact-signing-account "${WINDOWS_AZURE_SIGNING_ACCOUNT}" \ + --timestamp-url https://timestamp.acs.microsoft.com \ + --timestamp-digest sha256 \ + "$f" >/dev/null 2>&1 + + # Output was redirected to /dev/null because Azure authentication is absurdly noisy, with constant misleading + # "failure" messages about Managed Identity authentication failing. We don't use, or want to use, that + # authentication, and the fact that it fails is not a problem as long as the real authentication succeeds. + done + + # Manually check the important one! + signtool verify -pa "$SIGN_DIR/bin/FreeCAD.exe" + + echo "Signing completed." + else + echo "Signing requested, but no Azure Artifact Signing available -- skipping signing." + fi +else + echo "Not logged into Azure -- skipping signing." +fi + 7z a -t7z -mx9 -mmt=${NUMBER_OF_PROCESSORS} ${version_name}.7z ${version_name} -bb # create hash sha256sum ${version_name}.7z > ${version_name}.7z-SHA256.txt @@ -88,6 +149,28 @@ if [ "${MAKE_INSTALLER}" == "true" ]; then -X'SetCompressor /FINAL lzma' \ ../../WindowsInstaller/FreeCAD-installer.nsi mv ../../WindowsInstaller/${version_name}-installer.exe . + echo "Created installer ${version_name}-installer.exe" + + # See if we can sign the installer exe as well: + if [[ "${WINDOWS_SIGN_RELEASE:-0}" == "1" ]] && \ + az account get-access-token \ + --tenant "$TENANT" \ + --scope "https://codesigning.azure.net/.default" \ + >/dev/null 2>&1; + then + echo "Signing the installer..." + sign code artifact-signing \ + --artifact-signing-endpoint "${WINDOWS_AZURE_ENDPOINT}" \ + --artifact-signing-certificate-profile "${WINDOWS_AZURE_CERTIFICATE_PROFILE}" \ + --artifact-signing-account "${WINDOWS_AZURE_SIGNING_ACCOUNT}" \ + --timestamp-url https://timestamp.acs.microsoft.com \ + --timestamp-digest sha256 \ + ${version_name}-installer.exe >/dev/null 2>&1 \ + || { echo "Signing the installer failed!"; exit 1; } + else + echo "No code signing available, leaving the installer unsigned" + fi + sha256sum ${version_name}-installer.exe > ${version_name}-installer.exe-SHA256.txt else echo "Error: Failed to get NsProcess plugin. Aborting installer creation..." @@ -96,8 +179,10 @@ if [ "${MAKE_INSTALLER}" == "true" ]; then fi if [ "${UPLOAD_RELEASE}" == "true" ]; then + echo "Uploading the release..." gh release upload --clobber ${BUILD_TAG} "${version_name}.7z" "${version_name}.7z-SHA256.txt" if [ "${MAKE_INSTALLER}" == "true" ]; then gh release upload --clobber ${BUILD_TAG} "${version_name}-installer.exe" "${version_name}-installer.exe-SHA256.txt" fi + echo "Done uploading" fi