Add code signing for Windows executables. (#18222)
* Add code signing for Windows executables. * Fix typos and add failure notification. * Use full version for trusted signing action. Because MS isn’t publishing it with proper semver tags. * Avoid reinstalling dependencies that are already installed. * Fix CMake 3.30 compatibility. * Don’t let BUILD_DIR propagate to cmake. * Fix JSON-C build warning. * Fix handling of externally specified build directories. While regular Windows paths do actually work under MSYS2, they seem to confuse CMake, so we need to convert to a standard MSYS2 path if `BUILD_DIR` is set to a Windows path. * Fix typo. * Fix build directory handling.
Austin S. Hemmelgarn committed
Aug 8, 2024 at 07:24 UTC
a3ea51ed156df8903b9ebfb11ee8f80edbd03a6b
7 files changed
+105
-36
.github/workflows/build.yml
+62
@@ -1082,11 +1082,47 @@ jobs:
1082
- name: Build Netdata
1083
id: build
1084
if: needs.file-check.outputs.run == 'true'
1085
+ env:
1086
+ BUILD_DIR: ${{ github.workspace }}\build
1087
run: ./packaging/windows/build.ps1
1088
+ - name: Sign Agent Code
1089
+ id: sign-agent
1090
+ if: needs.file-check.outputs.run == 'true' && github.event_name != 'pull_request'
1091
+ uses: azure/trusted-signing-action@v0.4.0
1092
+ with:
1093
+ azure-tennant-id: ${{ secrets.CODE_SIGNING_TENNANT_ID }}
1094
+ azure-client-id: ${{ secrets.CODE_SIGNING_CLIENT_ID }}
1095
+ azure-client-secret: ${{ secrets.CODE_SIGNING_CLIENT_SECRET }}
1096
+ endpoint: "https://eus.codesigning.azure.net/"
1097
+ trusted-signing-account-name: Netdata
1098
+ certificate-profile-name: Netdata
1099
+ files-folder: ${{ github.workspace }}\build
1100
+ files-folder-filter: exe,dll
1101
+ files-recurse: true
1102
+ file-digest: SHA256
1103
+ timestamp-rfc3161: "http://timestamp.acs.microsoft.com"
1104
+ timestamp-digest: SHA256
1105
- name: Package Netdata
1106
id: package
1107
if: needs.file-check.outputs.run == 'true'
1108
+ env:
1109
+ BUILD_DIR: ${{ github.workspace }}\build
1110
run: ./packaging/windows/package.ps1
1111
+ - name: Sign Installer
1112
+ id: sign-installer
1113
+ if: needs.file-check.outputs.run == 'true' && github.event_name != 'pull_request'
1114
+ uses: azure/trusted-signing-action@v0.4.0
1115
+ with:
1116
+ azure-tennant-id: ${{ secrets.CODE_SIGNING_TENNANT_ID }}
1117
+ azure-client-id: ${{ secrets.CODE_SIGNING_CLIENT_ID }}
1118
+ azure-client-secret: ${{ secrets.CODE_SIGNING_CLIENT_SECRET }}
1119
+ endpoint: "https://eus.codesigning.azure.net/"
1120
+ trusted-signing-account-name: Netdata
1121
+ certificate-profile-name: Netdata
1122
+ files: ${{ github.workspace }}\packaging\windows\netdata-installer.exe
1123
+ file-digest: SHA256
1124
+ timestamp-rfc3161: "http://timestamp.acs.microsoft.com"
1125
+ timestamp-digest: SHA256
1126
- name: Upload Installer
1127
id: upload
1128
uses: actions/upload-artifact@v4
@@ -1094,6 +1130,32 @@ jobs:
1130
name: windows-x86_64-installer
1131
path: packaging\windows\netdata-installer.exe
1132
retention-days: 30
1133
+ - name: Failure Notification
1134
+ uses: rtCamp/action-slack-notify@v2
1135
+ env:
1136
+ SLACK_COLOR: 'danger'
1137
+ SLACK_FOOTER: ''
1138
+ SLACK_ICON_EMOJI: ':github-actions:'
1139
+ SLACK_TITLE: 'Windows build failed:'
1140
+ SLACK_USERNAME: 'GitHub Actions'
1141
+ SLACK_MESSAGE: |-
1142
+ ${{ github.repository }}: Updater checks for ${{ matrix.distro }} failed.
1143
+ Checkout: ${{ steps.checkout.outcome }}
1144
+ Set Up Dependencies: ${{ steps.deps.outcome }}
1145
+ Build Netdata: ${{ steps.build.outcome }}
1146
+ Sign Agent Code: ${{ steps.sign-agent.outcome }}
1147
+ Package Netdata: ${{ steps.package.outcome }}
1148
+ Sign Installer: ${{ steps.sign-installer.outcome }}
1149
+ Upload Installer: ${{ steps.upload.outcome }}
1150
+ SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
1151
+ if: >-
1152
+ ${{
1153
+ failure()
1154
+ && startsWith(github.ref, 'refs/heads/master')
1155
+ && github.event_name != 'pull_request'
1156
+ && github.repository == 'netdata/netdata'
1157
+ && needs.file-check.outputs.run == 'true'
1158
+ }}
1159
1160
updater-check: # Test the generated dist archive using the updater code.
1161
name: Test Generated Distfile and Updater Code
packaging/cmake/Modules/NetdataFetchContentExtra.cmake
+12
-3
@@ -38,8 +38,17 @@ endmacro()
38
#
39
# This needs to be explicitly included for any sub-project that needs
40
# to be built for the target system.
41
+#
42
+# This also needs to _NOT_ have any generator expressions, as they are not
43
+# supported for the required usage of this variable in CMake 3.30 or newer.
44
set(NETDATA_PROPAGATE_TOOLCHAIN_ARGS
45
"-DCMAKE_C_COMPILER=${CMAKE_C_COMPILER}
43
- -DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}
44
- $<$<BOOL:${CMAKE_C_COMPILER_TARGET}>:-DCMAKE_C_COMPILER_TARGET=${CMAKE_C_COMPILER_TARGET}
45
- $<$<BOOL:${CMAKE_CXX_COMPILER_TARGET}>:-DCMAKE_CXX_COMPILER_TARGET=${CMAKE_CXX_COMPILER_TARGET}")
46
+ -DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}")
47
+
48
+if(DEFINED CMAKE_C_COMPILER_TARGET)
49
+ set(NETDATA_PROPAGATE_TOOLCHAIN_ARGS "${NETDATA_PROPAGATE_TOOLCHAIN_ARGS} -DCMAKE_C_COMPILER_TARGET=${CMAKE_C_COMPILER_TARGET}")
50
+endif()
51
+
52
+if(DEFINED CMAKE_CXX_COMPILER_TARGET)
53
+ set(NETDATA_PROPAGATE_TOOLCHAIN_ARGS "${NETDATA_PROPAGATE_TOOLCHAIN_ARGS} -DCMAKE_CXX_COMPILER_TARGET=${CMAKE_CXX_COMPILER_TARGET}")
54
+endif()
packaging/cmake/Modules/NetdataJSONC.cmake
+1
-1
@@ -75,7 +75,7 @@ macro(netdata_detect_jsonc)
75
endif()
76
77
if(NOT JSONC_FOUND)
78
- set(ENABLE_BUNDLED_JSONC True PARENT_SCOPE)
78
+ set(ENABLE_BUNDLED_JSONC True)
79
netdata_bundle_jsonc()
80
set(NETDATA_JSONC_LDFLAGS json-c)
81
set(NETDATA_JSONC_INCLUDE_DIRS ${PROJECT_BINARY_DIR}/include)
packaging/windows/compile-on-windows.sh
+4
-15
@@ -1,21 +1,10 @@
1
#!/bin/bash
2
3
-repo_root="$(dirname "$(dirname "$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null && pwd -P)")")"
3
+REPO_ROOT="$(dirname "$(dirname "$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null && pwd -P)")")"
4
CMAKE_BUILD_TYPE="${CMAKE_BUILD_TYPE:-RelWithDebInfo}"
5
6
-if [ -n "${BUILD_DIR}" ]; then
7
- build="${BUILD_DIR}"
8
-elif [ -n "${OSTYPE}" ]; then
9
- if [ -n "${MSYSTEM}" ]; then
10
- build="${repo_root}/build-${OSTYPE}-${MSYSTEM}"
11
- else
12
- build="${repo_root}/build-${OSTYPE}"
13
- fi
14
-elif [ "$USER" = "vk" ]; then
15
- build="${repo_root}/build"
16
-else
17
- build="${repo_root}/build"
18
-fi
6
+# shellcheck source=./win-build-dir.sh
7
+. "${REPO_ROOT}/packaging/windows/win-build-dir.sh"
8
9
set -exu -o pipefail
10
@@ -42,7 +31,7 @@ fi
31
${GITHUB_ACTIONS+echo "::group::Configuring"}
32
# shellcheck disable=SC2086
33
CFLAGS="${BUILD_CFLAGS}" /usr/bin/cmake \
45
- -S "${repo_root}" \
34
+ -S "${REPO_ROOT}" \
35
-B "${build}" \
36
-G "${generator}" \
37
-DCMAKE_INSTALL_PREFIX="/opt/netdata" \
packaging/windows/msys2-dependencies.sh
+1
-1
@@ -11,7 +11,7 @@ pacman -Syuu --noconfirm
11
${GITHUB_ACTIONS+echo "::endgroup::"}
12
13
${GITHUB_ACTIONS+echo "::group::Installing dependencies"}
14
-pacman -S --noconfirm \
14
+pacman -S --noconfirm --needed \
15
base-devel \
16
cmake \
17
git \
packaging/windows/package-windows.sh
+5
-16
@@ -1,20 +1,9 @@
1
#!/bin/bash
2
3
-repo_root="$(dirname "$(dirname "$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null && pwd -P)")")"
3
+REPO_ROOT="$(dirname "$(dirname "$(cd "$(dirname "${BASH_SOURCE[0]}")" > /dev/null && pwd -P)")")"
4
5
-if [ -n "${BUILD_DIR}" ]; then
6
- build="${BUILD_DIR}"
7
-elif [ -n "${OSTYPE}" ]; then
8
- if [ -n "${MSYSTEM}" ]; then
9
- build="${repo_root}/build-${OSTYPE}-${MSYSTEM}"
10
- else
11
- build="${repo_root}/build-${OSTYPE}"
12
- fi
13
-elif [ "$USER" = "vk" ]; then
14
- build="${repo_root}/build"
15
-else
16
- build="${repo_root}/build"
17
-fi
5
+# shellcheck source=./win-build-dir.sh
6
+. "${REPO_ROOT}/packaging/windows/win-build-dir.sh"
7
8
set -exu -o pipefail
9
@@ -24,7 +13,7 @@ ${GITHUB_ACTIONS+echo "::endgroup::"}
13
14
if [ ! -f "/msys2-installer.exe" ]; then
15
${GITHUB_ACTIONS+echo "::group::Fetching MSYS2 installer"}
27
- "${repo_root}/packaging/windows/fetch-msys2-installer.py" /msys2-installer.exe
16
+ "${REPO_ROOT}/packaging/windows/fetch-msys2-installer.py" /msys2-installer.exe
17
${GITHUB_ACTIONS+echo "::endgroup::"}
18
fi
19
@@ -33,5 +22,5 @@ NDVERSION=$"$(grep 'CMAKE_PROJECT_VERSION:STATIC' "${build}/CMakeCache.txt"| cut
22
NDMAJORVERSION=$"$(grep 'CMAKE_PROJECT_VERSION_MAJOR:STATIC' "${build}/CMakeCache.txt"| cut -d= -f2)"
23
NDMINORVERSION=$"$(grep 'CMAKE_PROJECT_VERSION_MINOR:STATIC' "${build}/CMakeCache.txt"| cut -d= -f2)"
24
36
-/mingw64/bin/makensis.exe -DCURRVERSION="${NDVERSION}" -DMAJORVERSION="${NDMAJORVERSION}" -DMINORVERSION="${NDMINORVERSION}" "${repo_root}/packaging/windows/installer.nsi"
25
+/mingw64/bin/makensis.exe -DCURRVERSION="${NDVERSION}" -DMAJORVERSION="${NDMAJORVERSION}" -DMINORVERSION="${NDMINORVERSION}" "${REPO_ROOT}/packaging/windows/installer.nsi"
26
${GITHUB_ACTIONS+echo "::endgroup::"}
packaging/windows/win-build-dir.sh
new
+20
@@ -0,0 +1,20 @@
1
+#!/bin/bash
2
+
3
+if [ -n "${BUILD_DIR}" ]; then
4
+ if (echo "${BUILD_DIR}" | grep -q -E "^[A-Z]:\\\\"); then
5
+ build="$(echo "${BUILD_DIR}" | sed -e 's/\\/\//g' -e 's/^\([A-Z]\):\//\/\1\//' -)"
6
+ else
7
+ build="${BUILD_DIR}"
8
+ fi
9
+elif [ -n "${OSTYPE}" ]; then
10
+ if [ -n "${MSYSTEM}" ]; then
11
+ build="${REPO_ROOT}/build-${OSTYPE}-${MSYSTEM}"
12
+ else
13
+ build="${REPO_ROOT}/build-${OSTYPE}"
14
+ fi
15
+elif [ "$USER" = "vk" ]; then
16
+ build="${REPO_ROOT}/build"
17
+else
18
+ # shellcheck disable=SC2034
19
+ build="${REPO_ROOT}/build"
20
+fi