Skip to content

IEP-1475: Signing Windows Executable #1228

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 33 commits into from
Jun 4, 2025
Merged

IEP-1475: Signing Windows Executable #1228

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
826dfc7
testing signing with jks
alirana01 May 19, 2025
200eee5
updated pfx pass
alirana01 May 19, 2025
914f938
upload added to test
alirana01 May 19, 2025
543756a
testing workflow with single file
alirana01 May 20, 2025
5c69473
fixing macos build steps
alirana01 May 20, 2025
8116925
fixing macos signing issues
alirana01 May 20, 2025
f10e08f
fixing the signing part
alirana01 May 20, 2025
47bcd01
fixing the build artifact name for windows signing
alirana01 May 20, 2025
70b422f
fixing naming issues
alirana01 May 20, 2025
cdfaf07
validation for certificate
alirana01 May 21, 2025
baeea69
fixing env level
alirana01 May 21, 2025
ff20f32
fixing errors
alirana01 May 22, 2025
09a227b
fixing path issues on windows signing
alirana01 May 22, 2025
e1ae050
retrigger workflow
alirana01 May 22, 2025
94b1f30
debugging information
alirana01 May 22, 2025
c27f9ba
fixing directory resolution
alirana01 May 22, 2025
e8d43f4
signature verification added
alirana01 May 22, 2025
9a8b624
fixing double zip
alirana01 May 26, 2025
f1aead4
updated the directory to include wildcards for upload
alirana01 May 27, 2025
c7a227e
fixed path for upload
alirana01 May 28, 2025
eb83701
trying without wildcard
alirana01 Jun 2, 2025
6b008a8
update for debugging
alirana01 Jun 2, 2025
38f2739
fixing paths
alirana01 Jun 2, 2025
6a0e72f
removing unsigned zip
alirana01 Jun 2, 2025
7024921
added the upload functionality
alirana01 Jun 3, 2025
28fd1f0
added the test keys to verify workflow
alirana01 Jun 3, 2025
b018315
some debugging information
alirana01 Jun 3, 2025
40e11f5
fixing and zipping again courtesy of microsoft :/
alirana01 Jun 3, 2025
c7097fe
correct path for the update zip
alirana01 Jun 3, 2025
a292776
fix for update path
alirana01 Jun 3, 2025
8a7b021
fixing version param for variable
alirana01 Jun 4, 2025
4327e23
fixed zip command
alirana01 Jun 4, 2025
b17abfe
fixed and finalized
alirana01 Jun 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions .github/workflows/win_exe_sign_test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
name: Signing Windows Executable test workflow

on:
push:
branches: [ master ]
pull_request:
branches: [ master ]

jobs:
signing:
runs-on: windows-latest
env:
JKS_B64: ${{ secrets.JARSIGNER_REL_KEYSTORE_B64 }}
JKS_PASS: ${{ secrets.JARSIGNER_REL_STOREPASS }}
ALIAS: ${{ secrets.JARSIGNER_REL_ALIAS }}
PFX_PASS: ${{ secrets.JARSIGNER_REL_STOREPASS }}

steps:
- uses: actions/checkout@v3
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Update checkout action version
Actionlint flags actions/checkout@v3 as outdated. Bump to the latest major version:

- uses: actions/checkout@v3
+ uses: actions/checkout@v4

This ensures you get the newest bug fixes and performance improvements.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/checkout@v3
- uses: actions/checkout@v4
🧰 Tools
🪛 actionlint (1.7.7)

19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🤖 Prompt for AI Agents 
In .github/workflows/win_exe_sign_test.yml at line 19, the checkout action
version is outdated. Update the version from actions/checkout@v3 to the latest
major version, such as actions/checkout@v4, to incorporate the newest bug fixes
and performance improvements.



- name: Decode base64-encoded JKS
run: |
echo "$env:JKS_B64" | Out-File -FilePath encoded.b64 -Encoding ASCII
certutil -decode encoded.b64 mykeystore.jks
Remove-Item encoded.b64

- name: Convert JKS to PFX
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Add Java setup action
The workflow invokes keytool.exe but doesn't ensure a JDK is installed or JAVA_HOME is set. Insert the official setup action before converting the keystore:

     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4
+    - name: Set up Java
+      uses: actions/setup-java@v3
+      with:
+        distribution: 'temurin'
+        java-version: '11'

Committable suggestion skipped: line range outside the PR's diff.

🧰 Tools
🪛 actionlint (1.7.7)

19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🪛 YAMLlint (1.37.1)

[error] 21-21: trailing spaces

(trailing-spaces)

🤖 Prompt for AI Agents 
In .github/workflows/win_exe_sign_test.yml around lines 18 to 28, the workflow
uses keytool.exe without ensuring a JDK is installed or JAVA_HOME is set. Fix
this by adding the official Java setup action (actions/setup-java) before the
step that converts the keystore. Configure it to install the required JDK
version and set JAVA_HOME properly to enable keytool.exe usage.

shell: pwsh
run: |
& "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore `
-srckeystore mykeystore.jks `
-srcstorepass $env:JKS_PASS `
-srcalias $env:ALIAS `
-destkeystore cert.pfx `
-deststoretype PKCS12 `
-deststorepass $env:PFX_PASS
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Secure handling of keystore & error checking

  • After conversion, mykeystore.jks remains on the runner. Remove it to avoid leaking secrets: 
       & "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore `
        -srckeystore mykeystore.jks `
        … `
        -deststorepass $env:PFX_PASS
  • Remove-Item mykeystore.jks
- If the key entry has a separate password, add `-srckeypass $env:KEY_PASS`.  
- Consider breaking out each step or enabling `fail-fast` / `set -e` style behavior so the job fails immediately on errors.  



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

```suggestion
  - name: Convert JKS to PFX
    shell: pwsh
    run: |
     & "${env:JAVA_HOME}\bin\keytool.exe" -importkeystore `
          -srckeystore mykeystore.jks `
          -srcstorepass $env:JKS_PASS `
          -srcalias $env:ALIAS `
          -destkeystore cert.pfx `
          -deststoretype PKCS12 `
          -deststorepass $env:PFX_PASS
     Remove-Item mykeystore.jks
🤖 Prompt for AI Agents 
In .github/workflows/win_exe_sign_test.yml around lines 28 to 37, improve
security and robustness by deleting the mykeystore.jks file after conversion to
prevent secret leakage, add the -srckeypass $env:KEY_PASS option if the key
entry uses a separate password, and modify the script to enable fail-fast
behavior so the job stops immediately on errors, either by breaking the command
into steps or using error handling features like set -e or equivalent in
PowerShell.


- name: Sign Windows Executable
run: |
& "C:\Program Files (x86)\Windows Kits\10\bin\10.0.17763.0\x86\signtool.exe" sign `
/f cert.pfx `
/p $env:PFX_PASS `
/tr http://timestamp.digicert.com `
/td sha256 `
/fd sha256 `
releng/espressif-ide.exe
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Specify shell & avoid hardcoded SDK path

  • The signing commands use PowerShell syntax (& and backticks) but don’t declare shell: pwsh; add it for clarity.
  • Hardcoding 10.0.17763.0 may not match the runner’s installed Windows SDK. Instead, rely on signtool.exe in PATH or dynamically locate the correct SDK version: 
    

    • 

  • 

      

    • name: Sign Windows Executable
      • 

    

    • 

  • 

     run: |

    

    • 



    

  • 

      

    • name: Sign Windows Executable
      • 

    

    • 

  • 

     shell: pwsh

    

    • 

  • 

     run: |
   signtool sign `
        /f cert.pfx `
        /p $env:PFX_PASS `
        /tr https://timestamp.digicert.com `
        /td sha256 `
        /fd sha256 `
        releng/espressif-ide.exe

    

    



    

    • 





Committable suggestion skipped: line range outside the PR's diff.





🤖 Prompt for AI Agents

In .github/workflows/win_exe_sign_test.yml around lines 39 to 47, the signing
step uses PowerShell syntax but does not specify 'shell: pwsh', so add 'shell:
pwsh' to ensure the commands run in PowerShell. Also, remove the hardcoded
Windows SDK path '10.0.17763.0' and instead call 'signtool.exe' directly
assuming it is in the system PATH or implement a method to dynamically locate
the correct SDK version to avoid path mismatches.





    

  
  



    


        

      
  
  

    
  
    
    

  

  

  



          

      
    








    


  









  


    


  		





                
              


          


    

  



    
  

    

      

        



          



          Binary file added
          

        

  releng/espressif-ide.exe

  
  
      
      
  





        
      


      

        











            


          

          

            
              

                
    

              

            
            
                            

                            


                              
   View file



                                    


                                  


                            


                            

                            

    Open in desktop



                
            
          

        

      

    



    

          

            Binary file not shown.
          


    

  



  



    

  
  
    
      Loading