From e0cdf163c3eaee440a413d2f1654b55035c2b54c Mon Sep 17 00:00:00 2001 From: pauline ramon Date: Thu, 24 Sep 2026 15:52:31 +0200 Subject: [PATCH 1/3] ci: sign EKM DLL with Azure Trusted Signing --- .github/workflows/build.yml | 63 ++++++++++++++++++++++++++++++++++--- 1 file changed, 58 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9425c95..1300948 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -104,18 +104,71 @@ jobs: Build-EkmDll # ----------------------------------------------------------------------- - # Upload: DLL + PowerShell scripts (for operator signing + deployment) + # Upload: unsigned DLL + PowerShell scripts # ----------------------------------------------------------------------- - - name: Upload artefacts + - name: Upload unsigned artefacts uses: actions/upload-artifact@v7 with: - name: cosmian-ekm-sql-server + name: cosmian-ekm-sql-server-unsigned path: | target/release/cosmian_ekm_sql_server.dll scripts/ retention-days: 1 if-no-files-found: error + sign: + name: Sign DLL with Azure Trusted Signing + needs: build + uses: Cosmian/reusable_scripts/.github/workflows/sign-windows-artifacts.yml@develop + with: + artifact-to-download: cosmian-ekm-sql-server-unsigned + files-folder: to-sign + files-folder-filter: dll + artifact-name: cosmian-ekm-sql-server-signed + signing-account-name: cosmian-codesigning-test + certificate-profile-name: cosmian-public-profile + secrets: + AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID_POC }} + AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID_POC }} + AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET_POC }} + + verify: + name: Verify signed DLL + needs: sign + runs-on: windows-2022 + + steps: + - name: Download signed artefacts + uses: actions/download-artifact@v8 + with: + name: cosmian-ekm-sql-server-signed + path: . + + - name: Verify Authenticode signature + shell: pwsh + run: | + $dlls = @(Get-ChildItem -Recurse -Filter "cosmian_ekm_sql_server.dll") + if ($dlls.Count -ne 1) { + Write-Error "Expected one signed DLL, found $($dlls.Count)" + exit 1 + } + + $signature = Get-AuthenticodeSignature -FilePath $dlls[0].FullName + $signer = $signature.SignerCertificate + $status = "$($signature.Status)" + $subject = if ($null -ne $signer) { $signer.Subject } else { "" } + Write-Host "$($dlls[0].Name): status=$status signer=$subject" + + # Azure Trusted Signing test profiles can return UnknownError when + # the runner cannot build the public trust chain. The signer + # certificate is still present; reject missing certificates and + # cryptographic/hash failures, but allow this trust-only status. + $trustOnlyStatus = $signature.Status -eq "UnknownError" -and $null -ne $signer + if ($signature.Status -ne "Valid" -and -not $trustOnlyStatus) { + Write-Error "Invalid Authenticode signature: $($signature.Status)" + exit 1 + } + # --------------------------------------------------------------------------- # Publish to package.cosmian.com — skipped on pull requests # Uses the same self-hosted runner + Docker container pattern as the kms repo. @@ -123,7 +176,7 @@ jobs: # --------------------------------------------------------------------------- publish: name: Publish to package.cosmian.com - needs: build + needs: verify if: github.event_name != 'pull_request' runs-on: [self-hosted, not-sgx] container: @@ -135,7 +188,7 @@ jobs: - name: Download artefacts uses: actions/download-artifact@v8 with: - name: cosmian-ekm-sql-server + name: cosmian-ekm-sql-server-signed path: . - name: List downloaded files From b398b2830771c066523b558d12a665ac94c32b90 Mon Sep 17 00:00:00 2001 From: pauline ramon Date: Thu, 24 Sep 2026 16:08:16 +0200 Subject: [PATCH 2/3] ci: clarify build artifact upload step --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1300948..e5ec9ff 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -106,7 +106,7 @@ jobs: # ----------------------------------------------------------------------- # Upload: unsigned DLL + PowerShell scripts # ----------------------------------------------------------------------- - - name: Upload unsigned artefacts + - name: Upload build artefacts uses: actions/upload-artifact@v7 with: name: cosmian-ekm-sql-server-unsigned From c7860eb04212563a0b46b36674c278232cfa28dd Mon Sep 17 00:00:00 2001 From: pauline ramon Date: Thu, 24 Sep 2026 16:44:12 +0200 Subject: [PATCH 3/3] fix(ci): flatten DLL signing artifact --- .github/workflows/build.yml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e5ec9ff..d2b7bbd 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -106,13 +106,23 @@ jobs: # ----------------------------------------------------------------------- # Upload: unsigned DLL + PowerShell scripts # ----------------------------------------------------------------------- + - name: Prepare build artefact + shell: pwsh + run: | + $ErrorActionPreference = "Stop" + if (Test-Path artifact) { + Remove-Item -Recurse -Force artifact + } + New-Item -ItemType Directory -Path artifact\scripts -Force | Out-Null + Copy-Item target\release\cosmian_ekm_sql_server.dll artifact\ + Copy-Item scripts\* artifact\scripts\ -Recurse + - name: Upload build artefacts uses: actions/upload-artifact@v7 with: name: cosmian-ekm-sql-server-unsigned path: | - target/release/cosmian_ekm_sql_server.dll - scripts/ + artifact/ retention-days: 1 if-no-files-found: error