alexjhawk
commented
5 months ago These are primarily changes that align this repository with the workflows/automation in the starter project. A few modifications are made to use the necessary JDK version (11) and the proper module build process and file paths.
Of note, there is also a correction in the release-build-outputs.yml file to once and for all fix the regex evaluation to detect pre-release versus standard release. Following the merge of this PR, I will upstream the change to the starter project.
An example of a resulting release can be seen at https://github.com/hms-networks/IgnitionEwonConnector/releases/tag/v2.0.0-pre1.
In addition, following the merge of this PR, the release of v2.0.0 will be code-signed and published.
- Because code signing is not possible in the automation, when a full release (non-pre-release) is published, the developer will have to download the unsigned
modlfile, sign it, and then replace the unsignedmodlfile with the signed one in the release.
Notes on Code Signing in Automation (Investigation)
I did spend some time looking into this, and the automation code was developed to support automated code signing here. For security reasons though, our code signing token does not permit exporting the private key.
- While the public code signing certificate chain can be exported as desired, there is no option to export the private key in SafeNet Authentication Client.
- I am unsure as to whether logging in as the token administrator allows export, but Sectigo does not provide token administration access. They only allow standard access to public components, and the private key is securely made available to the OS (and signtool) through a SafeNet cryptographic provider hosted by the SafeNet client.
- The SafeNet cryptographic provider which hosts the private key in the operating system certificate store/system is protected and inaccessible through the operating system certificate management tools.
Windows Message when Attempting to Export Entire Certificate
SafeNet Authentication Client with no Management Buttons for Private Key
I updated the automation to use the latest available versions from https://github.com/hms-networks/sc-java-maven-starter-project. It was modified to build the Ignition module using the correct JDK.