Repository navigation
Enable verified SignPath Windows test signing - #1605
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
luokerenx4
marked this pull request as draft
September 23, 2026 14:53
…gning # Conflicts: # PLANS.md # docs/README.md
luokerenx4
changed the title
luokerenx4
marked this pull request as ready for review
October 11, 2026 07:55
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OpenAlice's Windows release currently produces an unsigned NSIS installer. This adds a separate SignPath test-signing workflow on reviewed
devsource: build and smoke-test the installer on GitHub-hosted Windows, submit its GitHub artifact, verify the returned Authenticode signature against the pinned self-signed test certificate, and preserve the test installer for seven days. It does not publish releases or update feeds.The SignPath organization invitation is now accepted, the rotated CI token is stored in the repository Actions secret, and the
windows-installerartifact configuration passes SignPath's server validation. Repository variables and the test-only enable switch are configured. The workflow rejects any policy other thantest-signing; signature verification temporarily trusts only the pinned test certificate on the disposable runner and removes that trust afterwards. The SignPath action is pinned to its v3 commit.Validation: actionlint 1.7.12, XML well-formedness plus SignPath server validation, root and registered-suite TypeScript checks, and hosted Dev PR Clean Build pass. Hosted run 38122997125 built the installer, passed packaged Workspace and PE metadata checks, and uploaded the artifact. Signing is blocked by
Failed to retrieve GitHub App token: the organization has no SignPath App installation, so owner login and App permission review are required before rerunning.The final local short-temp full run reported 7,738 passed, 9 skipped, and one intermittent adjacent-port collision (#1778); that file's five tests passed immediately in isolation. Earlier full runs exposed the existing temp-path issue #1774 and long Guardian endpoint paths #1777. All 29 assertions in the affected path-related files pass using
TMPDIR=/private/tmp. No application or test-framework source changed.Production signing remains separate: the release certificate is
CSR PENDING, and the installer-only test does not sign the embedded application executable. The owner guide and active plan retain public-policy review, production-certificate coordination, and exact-byte release/update integration as remaining work.