Azure DevOpsクライアントツール拡張

Azure Pipelineの [設定] で、以下を使用して、タスクを構成します。

Create an API token

The API token is an authentication method used to verify the user and their permissions as set in DigiCert ONE®. The client authentication provides the first factor authentication.

To generate an API token:

Create an authentication certificate

The client authentication certificate is an authentication method used to verify the user and their permissions as set in DigiCert ONE. The client authentication certificate provides the second factor authentication.

To create a client authentication certificate:

Azure DevOps PipelineのユーザーがDigiCert​​®​​ Software Trust Managerを使用してコードに署名する際には、セキュリティと説明責任を確保するために、シークレットとセキュアファイルを使用してください。この後にあるコード例では、シークレットとセキュアファイルを使用することを前提としています。

シークレット

シークレットは　Azure DevOps Pipelineの変数を暗号化したもので、ユーザーはその情報の値を知ることなく情報を入力することができます。たとえば、APIキーの場合、Azureのすべての協力者があなたに固有の　APIキーが何であるかを知って欲しくはありませんが、彼らはDigiCert​​®​​ Software Trust Managerを通じて署名ツールを採用する際にそれを使用する必要が出てくるかもしれません。"(api_key)"が名前で値がAPIキーそのものである変数をセットアップすることができます。次に、 この値を秘密にするを選択して、値を暗号化します。また、 Azure Key Vault Secrets を使用することもできます。

To add a certificate to GitHub secrets, you need to encode the certificate to a base64 string.

On Linux, run this command in Terminal:

base64 -i <file_name>

On Windows, run this command in PowerShell:

 $fileContentBytes = get-content 'YOURFILEPATH.pfx' -Encoding Byte 

 [System.Convert]::ToBase64String($fileContentBytes) 

The client tools need these environment variables to connect with DigiCert​​®​​ Software Trust Manager.

To integrate environment variables as GitHub secrets:

Commands to set environment variables

Once you save the variable, it is fully encrypted. Not even the creator of the value (you) can see the value. Make sure you save it elsewhere if it is something you will need in the future.

To set the API token as a new repository secret:

To set the client authentication certificate as a new repository secret:

To set the client authentication certificate password as a new repository secret:

To set up the certificate file for signing, run:

- name: Setup Certificate 

  run: | 

    echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12 

  shell: bash 

To set environment variables:

- name: Set variables 

  id: variables 

  run: | 

    echo "::set-output name=version::${GITHUB_REF#refs/tags/v}" 

    echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV" 

    echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV" 

    echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV" 

    echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV" 

    shell: bash 

Usage example

Copy and paste the following snippet into your .yml file.

- name: GPG signing with Software Trust Manager 

 
 

on: push 

 
 

jobs: 

  build: 

 
 

    strategy: 

 
 

      matrix: 

 
 

        os: [ubuntu-latest, windows-latest] 

 
 
 

    runs-on: ${{ matrix.os }} 

 
 

    steps: 

     - name: GPG signing with Secure Software Manager 

       uses: digicert/ssm-gpg-signing@latest-version 

 
 

    env: 

      SM_API_KEY: ${{secrets.SM_API_KEY}} 

      SM_CLIENT_CERT_PASSWORD: ${{secrets.SM_CLIENT_CERT_PASSWORD}} 

      SM_CLIENT_CERT_FILE: ${{secrets.SM_CLIENT_CERT_FILE}} 

The DigiCert​​®​​ Software Trust Manager client tools set up task installs and configures all the DigiCert​​®​​ Software Trust Manager client tools, including the CTL client and the SCD client.

To find the client tools installation path, run:

- run: echo “installation Path ${{ steps.SSMClientToolSetup.outputs.extractPath }}” 

During the task configuration step, there will be a prompt to input an API key, but you can skip this if you want to use the environment variables to add the API key.

To set the API key to GitHub secrets:

- name: GPG signing with Secure Software Manager    

  run: | 

     echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV"   

  env:  

    SM_API_KEY: ${{secrets.SM_API_KEY}}

Generate GPG master key using SMCTL

    - name: generate gpg master key using smctl 

        run: | 

           gpg keypair generate <master key alias> --key-alg “<algorithm>” --key-size        <RSA key size>|--curve “<ECDSA curve name>” --can-sign “<YES or NO>” --gpg-key-type “MASTER” --uids “name=<name>,email=<email>", “name=<name>,email=<email>" 

Download GPG keyring

     - name: Download GPG keyring 

       run: | 

           smctl gpg keyring download <gpg master key keypair id> <gpg master key          keypair id> 

To get a list GPG public and private keys, run:

   - name: List gpg public and private keys 

       run: | 

           gpg –list-keys <file path to keyring> 

          gpg --list-secret-keys <file path to keyring> 

To sign using the command line interface, run:

     - name: GPG signing 

       run: | 

           gpg --sign <unsigned file name> 

- name: 'build and release electron installer' 

on: 

  push: 

    tags: 

      - 'v*' 

       

jobs: 

  release: 

    runs-on: ${{ matrix.os }} 

     

    strategy: 

      matrix: 

        os: [windows-latest,ubuntu-latest] 

         

    steps: 

      - name: Check out Git repository 

        uses: actions/checkout@v2 

 

      - name: Install Node.js, NPM and Yarn 

        uses: actions/setup-node@v2 

        with:  

          node-version: 14 

         

      - name: Build/release Electron app 

        uses: samuelmeuli/action-electron-builder@v1 

        with:  

          github_token: ${{ secrets.github_token }} 

          release: ${{ startsWith(github.ref, 'refs/tags/v') }} 

          build_script_name: dist 

 

      - name: NuGet Install 

        uses: NuGet/setup-nuget@v1.0.5 

        with: 

          nuget-version: latest 

 

      - name: Setup Certificate 

        run: | 

          echo "${{secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12 

          cat /d/Certificate_pkcs12.p12 

        shell: bash 

 

           

      - name: Set variables 

        id: variables 

        run: | 

          echo "::set-output name=version::${GITHUB_REF#refs/tags/v}" 

          echo "SM_HOST=${{ secrets.SM_HOST }}" >> "$GITHUB_ENV" 

          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> "$GITHUB_ENV" 

          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV" 

          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> "$GITHUB_ENV" 

          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH 

          echo "C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools" >> $GITHUB_PATH 

          echo "C:\Program Files\DigiCert\DigiCert One Signing Manager Tools" >> $GITHUB_PATH 

        shell: bash 

       

      - name: generate gpg master key using smctl 

        run: | 

           gpg keypair generate <master key alias> --key-alg “<algorithm>” --key-size        <RSA key size>|--curve “<ECDSA curve name>” --can-sign “<YES or NO>” --gpg-key-type “MASTER” --uids “name=<name>,email=<email>", “name=<name>,email=<email>" 

      

 

     - name: Download GPG keyring 

       run: | 

           smctl gpg keyring download <gpg master key keypair id> <gpg master key          keypair id> 

 

 

      

     - name: List gpg public and private keys 

       run: | 

           gpg –list-keys <file path to keyring> 

          gpg --list-secret-keys <file path to keyring> 

 

     - name: GPG signing 

       run: | 

           gpg --sign <unsigned file name 

Troubleshooting