Jenkins plugin for keypair signing

When running this plugin on a remote agent, the path environment variable for the installed tools isn't automatically set. The path as an environment variable must be manually configured in your pipeline script.

For example, on a Linux environment, add the following script to your pipeline script:

pipeline {
    agent any
    environment {
        PATH = "/root/smtools-linux-x64:${env.PATH}"
    }
    // other pipeline steps...
}

For Linux, review the paths that the plugin sets up:

/<Jenkins user directory>/smtools-linux-x64

For Windows, review the paths that the plugin sets up:

C:\Program Files\DigiCert\DigiCert One Signing Manager Tools
C:\Users\<Jenkins user directory>
<Path to signtool.exe on the machine>

Software Trust enforces multi-factor authentication for security. To access keypairs, certificates, and sign code, you need to set up two types of credentials: An API key and an authentication certificate.

To sign code using Software Trust, use secret text and files to ensure security and accountability among your Jenkins users.

Secrets are encrypted variables in Jenkins where users can input information without knowing the specific value. For example, you may not want your Jenkins collaborators to know your unique API key, but they may need it to access signing tools. As a result, you can set up a variable where "(api_key)" is the name and the value is the API key itself.

To connect with Software Trust, client tools needs environment variables to be configured, which this document explains.

pipeline {
    agent any
    environment { 
            SM_API_KEY = credentials('SM_API_KEY')
            SM_HOST = credentials('SM_HOST')
            SM_CLIENT_CERT_PASSWORD = credentials('SM_CLIENT_CERT_PASSWORD')
            SM_CLIENT_CERT_FILE = credentials('SM_CLIENT_CERT_FILE')
    }

    stages {

        stage('Set Up Software Trust Manager') {

            steps {

                    SoftwareTrustManagerSetup()

            }

        }
}

pipeline {
  agent any
  environment {
        PATH = "C:\\Program Files\\DigiCert\\DigiCert One Signing Manager Tools;${env.PATH}"
        SM_API_KEY=credentials('SM_API_KEY')
        SM_HOST=credentials('SM_HOST')
        SM_CLIENT_CERT_PASSWORD=credentials('SM_CLIENT_CERT_PASSWORD')
        SM_CLIENT_CERT_FILE=credentials('SM_CLIENT_CERT_FILE')
    }
  stages {
    stage('Set up Software Trust Manager') {
      steps {
        SoftwareTrustManagerSetup()
        sh'''
        smctl sign --keypair-alias <keypair alias> --config-file <Software Trust Manager PKCS11 config file> --input path\to\your\unsignedfile
        '''
      }
    }
  }    
}

pipeline {
  agent any
  environment {
        PATH = "/root/smtools-linux-x64:${env.PATH}" //path to the tools directory
        SM_API_KEY=credentials('SM_API_KEY')
        SM_HOST=credentials('SM_HOST')
        SM_CLIENT_CERT_PASSWORD=credentials('SM_CLIENT_CERT_PASSWORD')
        SM_CLIENT_CERT_FILE=credentials('SM_CLIENT_CERT_FILE')
   }
  
  stages {
    stage('Set up Software Trust Manager') {
      steps {
        SoftwareTrustManagerSetup()
        sh'''
        smctl healthcheck
        smctl sign --keypair-alias <keypair alias> --config-file /root/smtools-linux-x64/pkcs11properties.cfg --input path/to/your/unsignedfile
        '''
      }
    }
  }    
}

The following commands may require the following inputs:

To create a keypair and default certificate, run the following script:

stage('keypair setup') {
  steps {
    bat 'smctl keypair generate rsa <keypair alias> --cert-alias=<certificate alias> --cert-profile-id=<certificate profile ID> --generate-cert=true --key-type=<TEST or PRODUCTION>'
}

To create a certificate from an existing keypair, run the following script:

stage('keypair setup') {
   steps {
     bat 'smctl keypair generate-cert <keypair ID> --cert-alias=<certificate alias> --cert-profile-id=<certificate profile ID> --set-as-default-cert=true --key-type=<TEST or PRODUCTION>'
}

To sign with the default signing tool, run the following script:

stage('sign') {
steps{
bat 'smctl sign --keypair-alias <keypair alias> --config-file <Software Trust Manager PKCS11 config file> --input <unsigned file> -v'
}
}

To sign using signtool.exe, run the following script:

stage('sign') {
  steps {
    bat 'signtool.exe sign /csp "DigiCert Signing Manager KSP" /kc "<keypair alias>" /f <certificate> /tr http://timestamp.digicert.com <unsigned file>'
}

To sign using nuget.exe, run the following script:

stage('sign') {
  steps {
    bat 'nuget sign <unsigned file> -Timestamper http://timestamp.digicert.com -outputdirectory <output path for signed file> -CertificateFingerprint ‎<certificate fingerprint> -Verbosity detailed -Overwrite'
}

To sign using Jarsigner, run the following script:

stage('sign') {
  steps {
    bat 'jarsigner -keystore NONE -storetype Windows-My -signedjar <output path for signed file> -sigalg SHA256withRSA -digestalg SHA256 <unsigned file> <keypair alias>'
}

To sign using Jsign, run the following script:

stage('sign') {
steps{
bat 'jsign --keystore pkcs11properties.cfg --storepass NONE --storetype PKCS11 --alias <keypair alias> <unsigned file> jsign –keystore <path to Software Trust Manager PKCS11 config file> –storepass NONE –storetype PKCS11 -alias <keypair alias>'
}
}

To verify using SignTool, run the following script:

stage('verify') {
 steps {
   bat 'signtool.exe sign verify /v /pa <signed file>'
}

To verify using NuGet, run the following script:

stage('verify') {
  steps {
    bat 'nuget verify -all <signed file>'
}

To verify using Jarsigner, run the following script:

stage('verify') {
  steps {
    bat 'jarsigner -verify <signed file>'
}