release: sign .net tool with sign cli

Migrate .NET tool from using ESRP to using the Sign CLI tool for signing. This tool is a fork of [1] that was set up to support Trusted Signing (previously known as Azure Code Signing). 1: https://github.com/dotnet/sign
git-ecosystem · Apr 8, 2024 · 9cd12fa · 9cd12fa
1 parent 5f9bede
commit 9cd12fa
Showing 1 changed file with 41 additions and 56 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -331,7 +331,6 @@ jobs:
 
   dotnet-tool-payload-sign:
     name: Sign .NET tool payload
-    # ESRP service requires signing to run on Windows
     runs-on: windows-latest
     environment: release
     needs: dotnet-tool-build
@@ -343,49 +342,44 @@ jobs:
       with:
         name: tmp.dotnet-tool-build
 
-    - name: Zip unsigned payload
-      shell: pwsh
-      run: |
-        Compress-Archive -Path payload payload/payload.zip
-        cd payload
-        Get-ChildItem -Exclude payload.zip | Remove-Item -Recurse -Force
-
     - name: Log into Azure
       uses: azure/login@v1
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID }}
         subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
-    - name: Set up ESRP client
-      shell: pwsh
+    - name: Download/extract Sign CLI tool
       env:
-        AZURE_VAULT: ${{ secrets.AZURE_VAULT }}
-        AZURE_STORAGE_ACCOUNT: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
-        AZURE_STORAGE_CONTAINER: ${{ secrets.AZURE_STORAGE_CONTAINER }}
-        ESRP_TOOL: ${{ secrets.ESRP_TOOL }}
-        AUTH_CERT: ${{ secrets.AZURE_VAULT_AUTH_CERT_NAME }}
-        REQUEST_SIGNING_CERT: ${{ secrets.AZURE_VAULT_REQUEST_SIGNING_CERT_NAME }}
+        AST: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
+        ASC: ${{ secrets.AZURE_STORAGE_CONTAINER }}
+        SCT: ${{ secrets.SIGN_CLI_TOOL }}
       run: |
-        .github\set_up_esrp.ps1
+        az storage blob download --file sign-cli.zip --auth-mode login `
+          --account-name $env:AST --container-name $env:ASC --name $env:SCT
+        Expand-Archive -Path sign-cli.zip -DestinationPath .\sign-cli
 
-    - name: Run ESRP client
-      shell: pwsh
+    - name: Sign payload
       env:
-        AZURE_AAD_ID: ${{ secrets.AZURE_AAD_ID }}
-        NUGET_KEY_CODE: ${{ secrets.NUGET_KEY_CODE }}
-        NUGET_OPERATION_CODE: ${{ secrets.NUGET_OPERATION_CODE }}
+        ACST: ${{ secrets.AZURE_TENANT_ID }}
+        ACSI: ${{ secrets.AZURE_CLIENT_ID }}
+        ACSS: ${{ secrets.AZURE_CLIENT_SECRET }}
       run: |
-        python .github\run_esrp_signing.py payload `
-         $env:NUGET_KEY_CODE $env:NUGET_OPERATION_CODE
+        ./sign-cli/sign.exe code azcodesign payload/* `
+          -acsu https://wus2.codesigning.azure.net/ `
+          -acsa git-fundamentals-signing `
+          -acscp git-fundamentals-windows-signing `
+          -d "Git Fundamentals Windows Signing Certificate" `
+          -u "https://github.com/git-ecosystem/git-credential-manager" `
+          -acst $env:ACST `
+          -acsi $env:ACSI `
+          -acss $env:ACSS
 
     - name: Lay out signed payload, images, and symbols
       shell: bash
       run: |
         mkdir dotnet-tool-payload-sign
-        rm -rf payload
-        mv images payload.sym -t dotnet-tool-payload-sign
-        unzip signed/payload.zip -d dotnet-tool-payload-sign
+        mv images payload.sym payload -t dotnet-tool-payload-sign
 
     - name: Upload signed payload
       uses: actions/upload-artifact@v4
@@ -427,7 +421,6 @@ jobs:
 
   dotnet-tool-sign:
     name: Sign .NET tool package
-    # ESRP service requires signing to run on Windows
     runs-on: windows-latest
     environment: release
     needs: dotnet-tool-pack
@@ -440,52 +433,44 @@ jobs:
         name: tmp.dotnet-tool-package-unsigned
         path: nupkg
 
-    - name: Zip unsigned package
-      shell: pwsh
-      run: |
-        Compress-Archive -Path nupkg/*.nupkg nupkg/gcm-nupkg.zip
-        cd nupkg
-        Get-ChildItem -Exclude gcm-nupkg.zip | Remove-Item -Recurse -Force
-
     - name: Log into Azure
       uses: azure/login@v1
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID }}
         tenant-id: ${{ secrets.AZURE_TENANT_ID }}
         subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
-    - name: Set up ESRP client
-      shell: pwsh
+    - name: Download/extract Sign CLI tool
       env:
-        AZURE_VAULT: ${{ secrets.AZURE_VAULT }}
-        AZURE_STORAGE_ACCOUNT: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
-        AZURE_STORAGE_CONTAINER: ${{ secrets.AZURE_STORAGE_CONTAINER }}
-        ESRP_TOOL: ${{ secrets.ESRP_TOOL }}
-        AUTH_CERT: ${{ secrets.AZURE_VAULT_AUTH_CERT_NAME }}
-        REQUEST_SIGNING_CERT: ${{ secrets.AZURE_VAULT_REQUEST_SIGNING_CERT_NAME }}
+        AST: ${{ secrets.AZURE_STORAGE_ACCOUNT }}
+        ASC: ${{ secrets.AZURE_STORAGE_CONTAINER }}
+        SCT: ${{ secrets.SIGN_CLI_TOOL }}
       run: |
-        .github\set_up_esrp.ps1
+        az storage blob download --file sign-cli.zip --auth-mode login `
+          --account-name $env:AST --container-name $env:ASC --name $env:SCT
+        Expand-Archive -Path sign-cli.zip -DestinationPath .\sign-cli
 
     - name: Sign package
-      shell: pwsh
       env:
-        AZURE_AAD_ID: ${{ secrets.AZURE_AAD_ID }}
-        NUGET_KEY_CODE: ${{ secrets.NUGET_KEY_CODE }}
-        NUGET_OPERATION_CODE: ${{ secrets.NUGET_OPERATION_CODE }}
-      run: |
-        python .github\run_esrp_signing.py nupkg $env:NUGET_KEY_CODE $env:NUGET_OPERATION_CODE
-
-    - name: Unzip signed package
-      shell: pwsh
+        ACST: ${{ secrets.AZURE_TENANT_ID }}
+        ACSI: ${{ secrets.AZURE_CLIENT_ID }}
+        ACSS: ${{ secrets.AZURE_CLIENT_SECRET }}
       run: |
-        Expand-Archive -LiteralPath signed\gcm-nupkg.zip -DestinationPath .\signed -Force
-        Remove-Item signed\gcm-nupkg.zip -Force
+        ./sign-cli/sign.exe code azcodesign nupkg/* `
+          -acsu https://wus2.codesigning.azure.net/ `
+          -acsa git-fundamentals-signing `
+          -acscp git-fundamentals-windows-signing `
+          -d "Git Fundamentals Windows Signing Certificate" `
+          -u "https://github.com/git-ecosystem/git-credential-manager" `
+          -acst $env:ACST `
+          -acsi $env:ACSI `
+          -acss $env:ACSS
 
     - name: Publish signed package
       uses: actions/upload-artifact@v4
       with:
         name: dotnet-tool-sign
-        path: signed/*.nupkg
+        path: nupkg/*.nupkg
 
 # ================================
 #           Validate