GitHub Actions script integration with PKCS11

DigiCert​​®​​ Software Trust Manager clients can be downloaded in a package.

set PATH=%path%;<path to DigiCert One Signing Manager Tools>

set PATH=%path%;C:\Program Files\DigiCert\DigiCert One Signing Manager Tools

Software Trust Manager enforces multifactor authentication for security. To access keypairs, certificates, and sign code, you need to set up two types of credentials: an API token and an authentication certificate.

Set the following environment variables:

Set certificate file in environment variables

The client tools need these environment variables to connect with DigiCert​​®​​ Software Trust Manager. To integrate environment variables as GitHub secrets:

The values for these environment variables:

Command to set environment variables:

- name: Set variables
  id: variables
  run: |
    echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
    echo "::set-output name=KEYPAIR_NAME::github-action-keypair"
    echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
    echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
    echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
    echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
    echo "C:\Program Files\DigiCert\DigiCert One Signing Manager Tools" >> $GITHUB_PATH
  shell: bash

Create test keypair and certificate

To generate a RSA test keypair with certificate using GitHub actions:

- name: Generate Test Keypair
  run: |
      smctl keypair generate rsa <Keypair Name> --cert-alias=<Certificate Name> --cert-profile-id=<Certificate Profile ID> --generate-cert=true --key-type=TEST
  shell: cmd

The keypair name and certificate name must be unique, meaning these names cannot already exist on the portal.

To retrieve the certificate profile ID:

Create production keypair with certificate

To generate an RSA production keypair with a given certificate using the GitHub actions pipeline:

- name: Generate Production Keypair
  run: |
    smctl keypair generate rsa <Keypair Name> --cert-alias=<Certificate Name> --cert-profile-id=<Certificate Profile ID> --generate-cert=true --key-type=PRODUCTION
  shell: cmd

The parameters are the same as the previous case, but be sure to select a certificate profile that has the profile category "Production".

Sign with Jarsigner:

- name: Signing using jarsigner
  run: |
    jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg pkcs11properties.cfg -signedjar <Path to Output Signed Jar> <Path to the Jar to be Signed> <Keypair Certificate Name/Alias > -tsa http://timestamp.digicert.com
 shell: cmd

The input parameters for this example are the output path for the signed .jar file, the path to the .jar file to be signed, and the name or alias of the certificate to be used for signing.

Verify with Jarsigner:

- name: Jarsigner verify
  run: |
    jarsigner -verify <Path to Signed .jar>
  shell: cmd

The only input for this command is the path to the signed .jar file that needs to be verified.

name: 'build and release electron installer'
on:
  push:
    tags:
      - 'v*'
      
jobs:
  release:
    runs-on: ${{ matrix.os }}
    
    strategy:
      matrix:
        os: [windows-latest]
        
    steps:
      - name: Check out Git repository
        uses: actions/checkout@v2

      - name: Install Node.js, NPM and Yarn
        uses: actions/setup-node@v2
        with: 
          node-version: 14
  
      - name: Setup Certificate
        run: |
          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
          cat /d/Certificate_pkcs12.p12
        shell: bash

          
      - name: Set variables
        id: variables
        run: |
          echo "::set-output name=version::${GITHUB_REF#refs/tags/v}"
          echo "::set-output name=KEYPAIR_NAME::github-action-keypair-test3"
          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV"
          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV"
          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH
          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH
          echo "C:\Program Files\DigiCert\DigiCert One Signing Manager Tools" >> $GITHUB_PATH
        shell: bash

      - name: Setting up the client tools
        run: |
          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o smtools-windows-x64.msi
          msiexec /i smtools-windows-x64.msi /quiet /qn
        shell: cmd

      - name: Generate Production Keypair
        run: |
          smctl keypair generate rsa ${{ steps.variables.outputs.KEYPAIR_NAME }} --cert-alias=${{ steps.variables.outputs.KEYPAIR_NAME }} --cert-profile-id=93a61900-e33f-4d24-a91e-f1e405db4452 --generate-cert=true --key-type=PRODUCTION

      - name: create folder
        run: |
          mkdir D:\a\github-action-electron\github-action-electron\dist
          copy D:\a\github-action-electron\github-action-electron\UNSIGNED.jar D:\a\github-action-electron\github-action-electron\dist\UNSIGNED.jar

      - name: Signing using Jarsigner
        run: |
          jarsigner -keystore NONE -storepass NONE -storetype PKCS11 -sigalg SHA256withRSA -providerClass sun.security.pkcs11.SunPKCS11 -providerArg D:\a\github-action-electron\github-action-electron\pkcs11properties.cfg -signedjar D:\a\github-action-electron\github-action-electron\dist\SIGNED.jar D:\a\github-action-electron\github-action-electron\dist\UNSIGNED.jar ${{ steps.variables.outputs.KEYPAIR_NAME }} -tsa http://timestamp.digicert.com

      - name: Jarsigner verify
        run: |
          jarsigner -verify D:\a\github-action-electron\github-action-electron\dist\SIGNED.jar

      - name: Upload artifacts
        uses: actions/upload-artifact@v2
        with:
          name: ${{ matrix.os }}
          path: |
            dist 

name=signingmanager
library=D:\a\github-action-electron\github-action-electron\smpkcs11.dll
slotListIndex=0

Troubleshooting