Skip to content

Don't create dev certificate when using Azure trusted signing#27

Open
daniel-weisse wants to merge 1 commit into
electron-userland:mainfrom
daniel-weisse:azure-trusted-signing
Open

Don't create dev certificate when using Azure trusted signing#27
daniel-weisse wants to merge 1 commit into
electron-userland:mainfrom
daniel-weisse:azure-trusted-signing

Conversation

@daniel-weisse
Copy link
Copy Markdown

Azure artifact signing uses a dll and json config file to retrieve the certificates required to sign artifacts with signtool.exe.
The configuration is passed to signtool.exe using the /dlib and /dmdf flags.
No certificate is explicitly passed using the /f flag.
The MSIX packager however automatically generates a dev certificate if none is provided and adds it to the arguments for signtool.exe, effectively blocking artifact signing.

This PR changes the dev cert creation behavior by simply not creating one if the parameters for signtool.exe contains the /dlib flag

Fixes #24

Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Copy link
Copy Markdown

@WesUnwin WesUnwin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome fix, have experienced the same issue locally I had to make the same modification to this lib in my node_modules/electron-windows-msix to work around this, I have tested this exact fix and confirmed it works + makes sense.

If createDevCert remains true when using Azure not only does it undesirably create a dev cert (real cert is sourced from the certificate profile in azure) but it results in params being passed in to signtool.exe that conflict with dlib/dmdf (such as the /p pfx password option).

This PR fixes a bug that is an absolute blocker to using this lib with MS azure signing.

@WesUnwin
Copy link
Copy Markdown

Just saw the other PR: #28

That PR might be the more general fix

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support Azure Trusted Signing

2 participants