search

JuliaCI / julia-buildkite

Buildkite configuration files for Base Julia CI
8 stars 15 forks source link

Codesign all executable objects in windows build #374

Closed staticfloat closed 3 months ago

staticfloat commented 3 months ago

Inno setup does its own codesigning which is great and all, but we want code signatures on our .exe and .dll files in our .zip and .tar.gz distributions as well.

davidanthoff commented 3 months ago

We got the trusted signing account working now, the GitHub trusted signing action is successfully signing the Juliaup stuff.

So I think the best strategy here is to use https://www.powershellgallery.com/packages/TrustedSigning/0.4.1 for signing and just completely ditch signtool. My sense is that is the easiest path forward.

One can also use signtool with trusted signing, but the instructions https://learn.microsoft.com/en-us/azure/trusted-signing/how-to-signing-integrations seem very involved and much more complicated than the PowerShell module.

IanButterworth commented 3 months ago

I think this has caused re-precompilation because the .ji file checksums aren't updated after the codesigning like we do on MacOS

┌ Debug: Rejecting cache file C:\hostedtoolcache\windows\julia\nightly\x64\share\julia\compiled\v1.12\REPL\u0gqU_Miz3B.ji because C:\hostedtoolcache\windows\julia\nightly\x64\share\julia\compiled\v1.12\REPL\u0gqU_Miz3B.dll has an invalid checksum
└ @ Base loading.jl:3868
IanButterworth commented 3 months ago

i.e. we need to do this (may need generalization for Windows?) https://github.com/JuliaCI/julia-buildkite/blob/31d8bae76776d22e66e20b279ce6a4ff68808a7d/utilities/macos/update_stdlib_pkgimage_checksums.jl#L5