GitHub custom action for keypair signing

To use this plugin, follow these steps:

DigiCert​​®​​ KeyLocker enforces multifactor authentication for security. To access keypairs, certificates, and sign code, you need to set up two types of credentials: an API token and an authentication certificate.

To add a client authentication certificate to GitHub secrets, it needs to be encoded as a base64 string. The following commands demonstrate how to achieve this based on your operating system.

 $fileContentBytes = get-content 'YOURFILEPATH.p12' -Encoding Byte 

 [System.Convert]::ToBase64String($fileContentBytes) 

base64 <certificate_file_name>

For secure GitHub usage with DigiCert​​®​​ KeyLocker, we recommend using secrets and secure files. This ensures security and accountability for your GitHub users, particularly when they are using DigiCert​​®​​ KeyLocker for code signing. Follow these instructions to set up GitHub secrets.

Once you have stored your credentials in GitHub secrets, use the code snippets below to set up your environment variables.

- name: Set up certificate 

  run: | 
    echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12 
  shell: bash 

- name: Set variables 
  id: variables 
  run: | 
    echo "::set-output name=version::${GITHUB_REF#refs/tags/v}" 
    echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV" 
    echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV" 
    echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV" 
    echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV" 
  shell: bash

Follow these steps to set up DigiCert​​®​​ KeyLocker client tools securely.

- run: echo “The config file path ${{ steps.SSMClientToolSetup.outputs.PKCS11_CONFIG }}” 

 - name: Get API key from GitHub secrets and save to environment variables
   id: variables
   run: |
     echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"

Copy and paste the following workflow snippet into your .yml file to implement code signing with DigiCert​​®​​ KeyLocker.

name: Sign with DigiCert KeyLocker KSP

on: push
 
jobs:
  release:
    runs-on: ${{ matrix.os }}
     
    strategy:
      matrix:
        os: [windows-latest]

    steps:
      - name: Check out the Git repository 
        uses: actions/checkout@v2 

      - name: Install Node.js, NPM and Yarn 
        uses: actions/setup-node@v2 
        with:  
          node-version: 14 

      - name: NuGet Install 
        uses: NuGet/setup-nuget@v1.0.5 
        with: 
          nuget-version: latest 
   
      - name: Setup Certificate
        run: |
           echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
           cat  /d/Certificate_pkcs12.p12
        shell: bash  
        
      - name: Set variables
        id: variables
        run: |
          dir
          echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
          echo "::set-output name=KEYPAIR_NAME::gt-standard-keypair"
          echo "::set-output name=CERTIFICATE_NAME::gt-certificate"
          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
          echo "C:\Program Files\DigiCert\DigiCert Keylocker Tools" >> $GITHUB_PATH
        shell: bash

      - name: Setup Keylocker KSP on windows 
        run: | 
          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/Keylockertools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o Keylockertools-windows-x64.msi 
          msiexec /i Keylockertools-windows-x64.msi /quiet /qn
          smksp_registrar.exe list 
          smctl.exe keypair ls 
          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
        shell: cmd 
              
      - name: Certificates Sync       
        run: |
           smctl windows certsync
        shell: cmd
        
      - name: Create Signed Directory       
        run: |
           mkdir D:\a\stm-github-action-demo\stm-github-action-demo\dist\
        shell: cmd

      - name: Signing using Signtool
        run: |
          copy D:\a\stm-github-action-demo\stm-github-action-demo\unsigned.exe D:\a\stm-github-action-demo\stm-github-action-demo\dist\unsigned.exe
          signtool.exe sign /sha1 ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 "D:\a\stm-github-action-demo\stm-github-action-demo\dist\unsigned.exe"
          signtool.exe verify /v /pa "D:\a\stm-github-action-demo\stm-github-action-demo\dist\unsigned.exe"

      - name: Signing using Nuget
        run: |
          copy D:\a\stm-github-action-demo\stm-github-action-demo\UNSIGNED.nupkg D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg
          nuget sign "D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED.nupkg" -Timestamper http://timestamp.digicert.com -outputdirectory "D:\a\stm-github-action-demo\stm-github-action-demo\dist\NugetSigned" -CertificateFingerprint ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} -HashAlgorithm SHA256 -Verbosity detailed -Overwrite
          nuget verify -All "D:\a\stm-github-action-demo\stm-github-action-demo\dist\NugetSigned\*"

      - name: Signing using Mage
        run: |
          copy D:\a\stm-github-action-demo\stm-github-action-demo\UNSIGNED1.manifest D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED1.manifest
          mage.exe -sign "D:\a\stm-github-action-demo\stm-github-action-demo\dist\UNSIGNED1.manifest" -CertHash ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }} -a sha256RSA
          mage -Verify "D:\a\stm-github-action-demo\stm-github-action-demo\UNSIGNED1.manifest"
        
      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: ${{ matrix.os }}
          path: |
            dist

Troubleshooting