Azure DevOpsクライアントツール拡張

Software Trust Manager enforces multifactor authentication for security. To access keypairs, certificates, and sign code, you need to set up two types of credentials: an API token and an authentication certificate.

Azure DevOps PipelineのユーザーがDigiCert​​®​​ Software Trust Managerを使用してコードに署名する際には、セキュリティと説明責任を確保するために、シークレットとセキュアファイルを使用してください。この後にあるコード例では、シークレットとセキュアファイルを使用することを前提としています。

シークレット

シークレットは　Azure DevOps Pipelineの変数を暗号化したもので、ユーザーはその情報の値を知ることなく情報を入力することができます。たとえば、APIキーの場合、Azureのすべての協力者があなたに固有の　APIキーが何であるかを知って欲しくはありませんが、彼らはDigiCert​​®​​ Software Trust Managerを通じて署名ツールを採用する際にそれを使用する必要が出てくるかもしれません。"(api_key)"が名前で値がAPIキーそのものである変数をセットアップすることができます。次に、 この値を秘密にするを選択して、値を暗号化します。また、 Azure Key Vault Secrets を使用することもできます。

pipeline {
    agent any
    environment { 
            SM_API_KEY = credentials('SM_API_KEY')
            SM_HOST = credentials('SM_HOST')
            SM_CLIENT_CERT_PASSWORD = credentials('SM_CLIENT_CERT_PASSWORD')
            SM_CLIENT_CERT_FILE = credentials('SM_CLIENT_CERT_FILE')
    }

    stages {

        stage('Set Up Software Trust Manager') {

            steps {

                    SoftwareTrustManagerSetup()

            }

        }
}

The following command may require the following inputs:

To create a keypair and default certificate, use:

stage('keypair setup') {
  steps {
    bat 'smctl keypair generate rsa <keypair alias> --cert-alias=<certificate alias> --cert-profile-id=<certificate profile ID> --generate-cert=true --key-type=<TEST or PRODUCTION>'
}

To create a certificate from an existing keypair, use:

stage('keypair setup') {
   steps {
     bat 'smctl keypair generate-cert <keypair ID> --cert-alias=<certificate alias> --cert-profile-id=<certificate profile ID> --set-as-default-cert=true --key-type=<TEST or PRODUCTION>'
}

To sign with the default signing tool, use:

stage('sign') {
steps{
bat 'smctl sign --keypair-alias <keypair alias> --config-file <Software Trust Manager PKCS11 config file> --input <unsigned file> -v'
}
}

To sign using signtool.exe, use:

stage('sign') {
  steps {
    bat 'signtool.exe sign /csp "DigiCert Signing Manager KSP" /kc "<keypair alias>" /f <certificate> /tr http://timestamp.digicert.com <unsigned file>'
}

The input parameters are the alias of the keypair used for signing, the name/alias of the certificate that needs to be used for signing, and the path to the file that needs to be signed.

The input parameters are the path to the file that needs to be signed, the name/alias of the certificate that needs to be used for signing, and the alias of the keypair used for signing.

To sign using nuget.exe, use:

stage('sign') {
  steps {
    bat 'nuget sign <unsigned file> -Timestamper http://timestamp.digicert.com -outputdirectory <output path for signed file> -CertificateFingerprint ‎<certificate fingerprint> -Verbosity detailed -Overwrite'
}

The input parameters are the the path to the file that needs to be signed, the path of the output signed file, and the fingerprint of the certificate that needs to be used for signing.

To sign using a jarsigner, use:

stage('sign') {
  steps {
    bat 'jarsigner -keystore NONE -storetype Windows-My -signedjar <output path for signed file> -sigalg SHA256withRSA -digestalg SHA256 <unsigned file> <keypair alias>'
}

The input parameters are the path where the signed jar needs to be output, the path to the jar that needs to be signed, and the name/alias of the certificate that needs to be used for signing.

To sign using jsign, use:

stage('sign') {
steps{
bat 'jsign --keystore pkcs11properties.cfg --storepass NONE --storetype PKCS11 --alias <keypair alias> <unsigned file> jsign –keystore <path to Software Trust Manager PKCS11 config file> –storepass NONE –storetype PKCS11 -alias <keypair alias>'
}
}

To verify using signtool, use:

stage('verify') {
 steps {
   bat 'signtool.exe sign verify /v /pa <signed file>'
}

To verify using nuget, use:

stage('verify') {
  steps {
    bat 'nuget verify -all <signed file>'
}

To verify using jarsigner, use:

stage('verify') {
  steps {
    bat 'jarsigner -verify <signed file>'
}

The only input for this stage is the path to the signed file that needs to be verified.

Troubleshooting