ci: Fix code signing on Windows #2346
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We were using the wrong env variable to get the keypair alias of the certificate to use to sign binaries on Windows. It's a mystery how we could sign binaries before but since we were using the main DigiCert Keylocker account user rather than a dedicated service user to fetch the certificates, the process might have been a bit different and might have not required a keypair alias at all.
We'll start signing Windows binaries only when doing a release to save on signatures as they are costly. To this end, we'll start building when tags are pushed and let `electron-builder` automatically create the release and publish artifacts during that build as it will simplify the condition that will trigger binaries signatures (i.e. only on tag builds). This enables building on tags on Github Actions for macOS and linux (AppVeyor already triggers builds on tags by default). Since `electron-builder` already publishes when detecting it's being run on a CI server for a tag build, there's nothing else to do.
Our Windows installer includes a number of other binaries such as DLLs that need to be signed as well as our own executable. In total, we need to sign 24 files. Since our code signing certificate comes with a limited number of signatures and additional ones are costly, we'll sign binaries only when doing a release thus when building a tag.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please make sure the following boxes are checked: