Skip to content

fix(ci): replace broken eSigner action with direct CodeSignTool #2143

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tofikwest merged 1 commit into from
Feb 17, 2026
Merged

fix(ci): replace broken eSigner action with direct CodeSignTool #2143

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 41 additions & 22 deletions .github/workflows/device-agent-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,24 +179,43 @@ jobs:
AUTO_UPDATE_URL: ${{ needs.detect-version.outputs.auto_update_url }}
run: bun run package:win

- name: Setup SSL.com eSigner CodeSignTool
uses: sslcom/esigner-codesign@v1.3.2
- name: Setup Java for CodeSignTool
uses: actions/setup-java@v4
with:
command: get_credential_ids
username: ${{ secrets.ESIGNER_USERNAME }}
password: ${{ secrets.ESIGNER_PASSWORD }}
totp_secret: ${{ secrets.ESIGNER_TOTP_SECRET }}
distribution: 'corretto'
java-version: '11'

- name: Sign Windows EXE with SSL.com eSigner
uses: sslcom/esigner-codesign@v1.3.2
with:
command: sign
username: ${{ secrets.ESIGNER_USERNAME }}
password: ${{ secrets.ESIGNER_PASSWORD }}
credential_id: ${{ secrets.ESIGNER_CREDENTIAL_ID }}
totp_secret: ${{ secrets.ESIGNER_TOTP_SECRET }}
file_path: ${{ github.workspace }}/packages/device-agent/release
override: true
- name: Sign Windows EXE with SSL.com CodeSignTool
shell: powershell
working-directory: packages/device-agent/release
env:
ESIGNER_USERNAME: ${{ secrets.ESIGNER_USERNAME }}
ESIGNER_PASSWORD: ${{ secrets.ESIGNER_PASSWORD }}
ESIGNER_CREDENTIAL_ID: ${{ secrets.ESIGNER_CREDENTIAL_ID }}
ESIGNER_TOTP_SECRET: ${{ secrets.ESIGNER_TOTP_SECRET }}
run: |
# Download and extract CodeSignTool
Invoke-WebRequest -Uri "https://github.com/SSLcom/CodeSignTool/releases/download/v1.3.0/CodeSignTool-v1.3.0-windows.zip" -OutFile "codesigntool.zip"
Expand-Archive -Path "codesigntool.zip" -DestinationPath "codesigntool"

# Find the jar file
$jar = Get-ChildItem -Path "codesigntool" -Recurse -Filter "code_sign_tool-*.jar" | Select-Object -First 1
if (-not $jar) { throw "CodeSignTool jar not found" }
Write-Host "Found CodeSignTool jar at: $($jar.FullName)"

# Sign each .exe file using Java directly (skips .bat which needs bundled JDK)
Get-ChildItem -Filter "*.exe" | ForEach-Object {
Write-Host "Signing $($_.Name)..."
& java -Xmx1024M -jar "$($jar.FullName)" sign `
-username="$env:ESIGNER_USERNAME" `
-password="$env:ESIGNER_PASSWORD" `
-credential_id="$env:ESIGNER_CREDENTIAL_ID" `
-totp_secret="$env:ESIGNER_TOTP_SECRET" `
-input_file_path="$($_.FullName)" `
-override="true"
if ($LASTEXITCODE -ne 0) { throw "Code signing failed for $($_.Name)" }
Write-Host "Signed $($_.Name) successfully"
}
Comment thread
cursor[bot] marked this conversation as resolved.
Copy link
Copy Markdown

@cursor cursor Bot Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Signing step silently succeeds when no exe files found

Medium Severity

Get-ChildItem -Filter "*.exe" | ForEach-Object { ... } silently succeeds when no .exe files are found, since PowerShell's ForEach-Object simply doesn't iterate on an empty pipeline. The signing step would pass without signing anything. While the subsequent hash recalculation step would catch a missing .exe, it would produce a confusing error rather than clearly indicating that signing was skipped. Adding a count check before the loop (similar to the jar-not-found check on line 203) would fail fast with a clear message if no files are present to sign.

Fix in Cursor Fix in Web


- name: Recalculate latest.yml hash after signing
shell: bash
Expand Down Expand Up @@ -377,10 +396,10 @@ jobs:

- name: Upload installers to S3
env:
AWS_ACCESS_KEY_ID: ${{ secrets.APP_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.APP_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ needs.detect-version.outputs.s3_env == 'production' && secrets.APP_AWS_ACCESS_KEY_ID || secrets.APP_AWS_ACCESS_KEY_ID_STAGING }}
AWS_SECRET_ACCESS_KEY: ${{ needs.detect-version.outputs.s3_env == 'production' && secrets.APP_AWS_SECRET_ACCESS_KEY || secrets.APP_AWS_SECRET_ACCESS_KEY_STAGING }}
AWS_REGION: ${{ secrets.APP_AWS_REGION }}
S3_BUCKET: ${{ secrets.FLEET_AGENT_BUCKET_NAME }}
S3_BUCKET: ${{ needs.detect-version.outputs.s3_env == 'production' && secrets.FLEET_AGENT_BUCKET_NAME || secrets.FLEET_AGENT_BUCKET_NAME_STAGING }}
Copy link
Copy Markdown

@cursor cursor Bot Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ternary &&/|| pattern silently falls through on empty secrets

Medium Severity

The condition && A || B pattern in GitHub Actions expressions is not a true ternary — if A is falsy (e.g., the production secret is empty or unconfigured), the expression silently falls through to B (the staging secret) even when the condition is true. This means a production release could silently upload artifacts using staging credentials to the staging S3 bucket without any error, if a production secret happens to be missing.

Additional Locations (1)

Fix in Cursor Fix in Web

VERSION: ${{ needs.detect-version.outputs.version }}
S3_ENV: ${{ needs.detect-version.outputs.s3_env }}
run: |
Expand Down Expand Up @@ -416,10 +435,10 @@ jobs:

- name: Upload auto-update files to S3
env:
AWS_ACCESS_KEY_ID: ${{ secrets.APP_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.APP_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ needs.detect-version.outputs.s3_env == 'production' && secrets.APP_AWS_ACCESS_KEY_ID || secrets.APP_AWS_ACCESS_KEY_ID_STAGING }}
AWS_SECRET_ACCESS_KEY: ${{ needs.detect-version.outputs.s3_env == 'production' && secrets.APP_AWS_SECRET_ACCESS_KEY || secrets.APP_AWS_SECRET_ACCESS_KEY_STAGING }}
AWS_REGION: ${{ secrets.APP_AWS_REGION }}
S3_BUCKET: ${{ secrets.FLEET_AGENT_BUCKET_NAME }}
S3_BUCKET: ${{ needs.detect-version.outputs.s3_env == 'production' && secrets.FLEET_AGENT_BUCKET_NAME || secrets.FLEET_AGENT_BUCKET_NAME_STAGING }}
S3_ENV: ${{ needs.detect-version.outputs.s3_env }}
run: |
UPDATE_DIR="device-agent/${S3_ENV}/updates"
Expand Down
2 changes: 1 addition & 1 deletion packages/device-agent/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "@comp/device-agent",
"version": "1.0.0",
"description": "Comp AI Device Agent - Device Compliance Checks",
"description": "Comp AI Device Agent - Endpoint Compliance",
"author": "Comp AI <hello@trycomp.ai>",
"homepage": "https://trycomp.ai",
"private": true,
Expand Down
Loading