From ac9b1c8be1c97584a3aa7c2a00c48b4a367fc8db Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Sun, 2 Jul 2023 18:22:45 -0400 Subject: [PATCH] Self sign installer .exe You know it's secure because this commit is signed! *taps head* --- .github/workflows/ci-pipeline.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index 43a7355027..1cc32d0b2b 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -1027,6 +1027,16 @@ jobs: cd build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle dotnet build -c Release + - name: Sign Installer .exe + shell: powershell + run: | + $pfxBytes = [convert]::FromBase64String("${{ secrets.CODE_SIGNING_BASE64 }}") + [IO.File]::WriteAllBytes("tg_codesigning.pfx", $pfxBytes) + $certPassword = ConvertTo-SecureString -String "${{ secrets.CODE_SIGNING_PASSWORD }}" -Force -AsPlainText + $cert=Import-PfxCertificate -FilePath tg_codesigning.pfx -Cert Cert:\CurrentUser\My -Password $certPassword + rm tg_codesigning.pfx + Set-AuthenticodeSignature build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/tgstation-server-installer.exe -Certificate $cert -TimestampServer "http://timestamp.digicert.com" + - name: Test Install # Sanity checks the .deps.json exists, which the installation is broken without shell: powershell # If it's missing, I found that in elements were the problem run: |