GPG signing with Jenkins plugin

DigiCert​​®​​ Software Trust Manager requires multifactor authentication. You will need to set up two credential types, namely an API token and an authentication certificate before you can access keypairs, certificates, and to sign code.

Create an API token

The API token is an authentication method used to verify the user and their permissions as set in DigiCert ONE®. The client authentication provides the first factor authentication.

To generate an API token:

Create an authentication certificate

The client authentication certificate is an authentication method used to verify the user and their permissions as set in DigiCert ONE. The client authentication certificate provides the second factor authentication.

To create a client authentication certificate:

Use secret text and files to ensure security and accountability among your Jenkins users when they use DigiCert​​®​​ Software Trust Manager to sign code. The code examples later assume that you are using secret text and files.

Jenkins secrets

Secrets are variables in Jenkins encrypted so users can input information without knowing what the value of that information is. For example, you do not want all of your Jenkins collaborators knowing what your unique API key is, but they may need to use it to access signing tools through DigiCert​​®​​ Software Trust Manager. You can set up a variable where "(api_key)" is the name and the value is the API key itself.

The client tools need these environment variables to connect with DigiCert​​®​​ Software Trust Manager.

To add new global credentials:

Environment variables setup for Jenkins plugin in pipeline script

The client tools need these environment variables to connect with DigiCert​​®​​ Software Trust Manager to provide its service.

To integrate as environment variables that are part of the pipeline:

pipeline {
    agent any
    environment { 
            SM_API_KEY = credentials('SM_API_KEY')
            SM_HOST = credentials('SM_HOST')
            SM_CLIENT_CERT_PASSWORD = credentials('SM_CLIENT_CERT_PASSWORD')
            SM_CLIENT_CERT_FILE = credentials('SM_CLIENT_CERT_FILE')
    }

To add a stage to the pipeline script and call the plugin to perform Software Trust Manager setup for standard keypairs:

    stages {

        stage('GPG set up using Software Trust Manager') {

            steps {

                    SoftwareTrustManagerGPGSetup()

            }

        }
}

To generate a GPG master key, use:

   stage ('generate gpg master key using smctl '){
steps {

        bat 'gpg keypair generate <master key alias> --key-alg "<algorithm>" --key-size <RSA key size>|--curve "<ECDSA curve name>" --can-sign "<YES or NO>" --gpg-key-type "MASTER" --uids "name=<name>,email=<email>", "name=<name>,email=<email>" '

}
}

To download GPG keyring, use:

stage ('Download GPG keyring'){
steps {

        bat 'smctl gpg keyring download <GPG master key keypair ID> <GPG master key keypair ID>'

}
}

To list GPG public and private keys:

stage ('List gpg public and private keys'){
steps {

        bat 'gpg –list-keys <file path to keyring> '

	bat 'gpg --list-secret-keys <file path to keyring> '

}
}

To sign using SMCTL, use:

stage ('GPG signing '){
steps {

        bat 'gpg --sign <unsigned file name>'

}
}

Troubleshooting