Repository navigation
ci(release): Authenticode-sign the Windows wheel via Azure Artifact Signing - #807
Merged
Merged
Conversation
…igning
Signs bosn.exe and _native.pyd inside the win_amd64 release wheel with jsign
7.6 (pinned SHA-256) against Azure Artifact Signing (OIDC azure/login, no
client secret), rewrites RECORD to the signed bytes, fails closed on any
unsigned PE, and requires Get-AuthenticodeSignature Valid on the native
Windows runner before the wheel is smoke-tested, uploaded or published.
Local-Gate: v1 tree=52cdd7626a1cbcf1e19c2a89ad616e720139ded4 secs=229 lanes=rust:run,tests:run
Ci-Attestation: {"at":1793623289,"gate":"rust/all/fmt","host":"linux-x86_64","key":"234bf58375c6d5cf8bb3a02c3a58fe162fc92c6d628e999ff2d1dad4a69d6a9c","lane":"rust","parents":["1bde60f1e18ef79aa5d91e11022b67028f678dc4"],"secs":196,"stamp":"53f9f64b20b6ceea9e2b3418fc225140","tree":"52cdd7626a1cbcf1e19c2a89ad616e720139ded4","v":1,"via":"run"}
Ci-Attestation: {"at":1793623289,"gate":"rust/all/boundary","host":"linux-x86_64","key":"234bf58375c6d5cf8bb3a02c3a58fe162fc92c6d628e999ff2d1dad4a69d6a9c","lane":"rust","parents":["1bde60f1e18ef79aa5d91e11022b67028f678dc4"],"secs":196,"stamp":"d881f3ad0e40a082df0447230606b459","tree":"52cdd7626a1cbcf1e19c2a89ad616e720139ded4","v":1,"via":"run"}
Ci-Attestation: {"at":1793623289,"gate":"rust/x86_64-unknown-linux-gnu/clippy","host":"linux-x86_64","key":"234bf58375c6d5cf8bb3a02c3a58fe162fc92c6d628e999ff2d1dad4a69d6a9c","lane":"rust","parents":["1bde60f1e18ef79aa5d91e11022b67028f678dc4"],"secs":196,"stamp":"fb283c87f4dd40b6e9c28e5fada4540f","tree":"52cdd7626a1cbcf1e19c2a89ad616e720139ded4","v":1,"via":"run"}
Ci-Attestation: {"at":1793623289,"gate":"rust/x86_64-unknown-linux-gnu/test","host":"linux-x86_64","key":"234bf58375c6d5cf8bb3a02c3a58fe162fc92c6d628e999ff2d1dad4a69d6a9c","lane":"rust","parents":["1bde60f1e18ef79aa5d91e11022b67028f678dc4"],"secs":196,"stamp":"3a8d7b51c54e246fb8097f095c90a841","tree":"52cdd7626a1cbcf1e19c2a89ad616e720139ded4","v":1,"via":"run"}
Ci-Attestation: {"at":1793623289,"gate":"python/all/static","host":"linux-x86_64","key":"c96a30cdc6ce43ad5242e74834a0f911e0c38a62c33500acfc35735d90a97eec","lane":"tests","parents":["1bde60f1e18ef79aa5d91e11022b67028f678dc4"],"secs":229,"stamp":"62139e3630d90a3ed404cd0641c02c86","tree":"52cdd7626a1cbcf1e19c2a89ad616e720139ded4","v":1,"via":"run"}
Ci-Attestation: {"at":1793623289,"gate":"general/all/ci-policy","host":"linux-x86_64","key":"c96a30cdc6ce43ad5242e74834a0f911e0c38a62c33500acfc35735d90a97eec","lane":"tests","parents":["1bde60f1e18ef79aa5d91e11022b67028f678dc4"],"secs":229,"stamp":"8a15e3eb248ea41998a6b4e531f05916","tree":"52cdd7626a1cbcf1e19c2a89ad616e720139ded4","v":1,"via":"run"}
Ci-Attestation: {"at":1793623289,"gate":"python/x86_64-unknown-linux-gnu/test","host":"linux-x86_64","key":"c96a30cdc6ce43ad5242e74834a0f911e0c38a62c33500acfc35735d90a97eec","lane":"tests","parents":["1bde60f1e18ef79aa5d91e11022b67028f678dc4"],"secs":229,"stamp":"4fbce9619ed358ebcd82d1038c5e554f","tree":"52cdd7626a1cbcf1e19c2a89ad616e720139ded4","v":1,"via":"run"}
zackees
force-pushed
the
ci/authenticode-sign
branch
from
November 2, 2026 12:41
3a73c40 to
405f680
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signs the Windows PEs shipped in the release (
bosn.exein.data/scripts/andbosn/_native.pydin thewin_amd64wheel) inauto-release.yml'snative-wheeljob, Windows cell only, right afteruv buildand before smoke test, upload, collect/sha256 record, PyPI and GitHub release.azure/loginv2.3.0 pinned by SHA (client-id/tenant-id org secrets,allow-no-subscriptions: true); job getsid-token: writepluscontents: read.ci/sign_windows_release.py: token fromaz account get-access-token --resource https://codesigning.azure.net, masked, passed via--storepass env:; jsign 7.6 jar pinned by SHA-256; TRUSTEDSIGNING / RFC3161 timestamp; rewrites the wheel RECORD; fail-closed structural check (publisher + timestamp + RECORD consistency).check-wheel: native Windows requiresGet-AuthenticodeSignature=Validfor every PE.tests/test_sign_windows_release.py(command line, signature check, RECORD rewrite, workflow ordering).Unverified until a real release dispatch from
main(OIDC subjectrefs/heads/main): the Azure exchange, jsign signing, and the Authenticode Valid verdict. A dispatch from a non-main ref will now fail at signing.