CodeSignTool is a secure, privacy-oriented multi-platform Java command line utility for remotely signing Microsoft Authenticode and Java code objects with eSigner EV code signing certificates. Hashes of the files are sent to SSL.com for signing so that the code itself is not sent. This is ideal where sensitive files need to be signed, but should not be sent over the wire for signing. CodeSignTool is also ideal for automated batch processes for high volume signings or integration into existing CI/CD pipeline workflows.
This action provides the sign artifacts with CodeSignTool.
ES_USERNAME, ES_PASSWORD, CRENDENTIAL_ID and ES_TOTP_SECRET values to be used in CodeSignTool can be stored in the Actons Secrets area of Github.
Detailed Information: https://docs.github.com/en/actions/security-guides/encrypted-secrets
- name: Sign Artifact with CodeSignTooluses: sslcom/actions-codesigner@developwith:
# CodeSignTool Commands:# - get_credential_ids: Output the list of eSigner credential IDs associated with a particular user.# - credential_info: Output key and certificate information related to a credential ID.# - sign: Sign and timestamp code object.# - batch_sign: Sign and timestamp multiple code objects with one OTP.# - hash: Pre-compute hash(es) for later use with batch_hash_sign command.# - batch_sign_hash: Sign hash(es) pre-computed with hash command.command: sign# SSL.com account username..username: ${{secrets.ES_USERNAME}}# SSL.com account password.password: ${{secrets.ES_PASSWORD}}# Credential ID for signing certificate.credential_id: ${{secrets.CREDENTIAL_ID}}# OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)totp_secret: ${{secrets.ES_TOTP_SECRET}}# Path of code object to be signed.# Supported File Types: acm, ax, bin, cab, cpl, dll, drv, efi, exe, mui, ocx, scr, sys, tsp, msi, ps1, ps1xml, js, vbs, wsf, jarfile_path: ${GITHUB_WORKSPACE}/test/src/build/HelloWorld.jar# Directory where signed code object(s) will be written.output_path: ${GITHUB_WORKSPACE}/artifactsusername: SSL.com account username. (Required)password: SSL.com account password (Required)credential_id: Credential ID for signing certificate. If credential_id is omitted and the user has only one eSigner code signing certificate, CodeSignTool will default to that. If the user has more than one code signing certificate, this parameter is mandatory. (Required)totp_secret: OAuth TOTP Secret. You can access detailed information on https://www.ssl.com/how-to/automate-esigner-ev-code-signing (Required)file_path: Path of code object to be signed. (Required)output_path: Directory where signed code object(s) will be written. If output_path is omitted, the file specified in -file_path will be overwritten with the signed file.
# The name of the workflow.name: (DLL) Dotnet Core Build and Sign# Trigger this workflow on a pushon: push# Create an environment variableenv:
PROJECT_NAME: HelloWorldPROJECT_VERSION: 0.0.1DOTNET_VERSION: 3.1# Defines a single job named "codesigner-dotnet-dll"jobs:
codesigner-dotnet-dll:
# Run job on Ubuntu Runnerruns-on: ubuntu-latest# When the workflow runs, this is the name that is loggedname: CodeSigner on Dotnetsteps:
# 1) Check out the source code so that the workflow can access it.
- name: Checkout Repositoryuses: actions/checkout@v2# 2) Set up the .NET CLI environment for the workflow to use.
- name: Setup Dotnet Coreuses: actions/setup-dotnet@v2with:
dotnet-version: '3.1.x'# 3) Create Artifact Directory to store signed and unsigned artifact files
- name: Create Artifacts Directoryshell: bashrun: | mkdir ${GITHUB_WORKSPACE}/artifacts mkdir ${GITHUB_WORKSPACE}/packages# 4) Build a dotnet project or solution and all of its dependencies.# After it has been created dll or exe file, copy to 'packages' folder for siging
- name: Compile Dotnet Libraryshell: bashrun: | dotnet build dotnet/${{env.PROJECT_NAME}}.csproj -c Release cp dotnet/bin/Release/netcoreapp${{env.DOTNET_VERSION}}/${{env.PROJECT_NAME}}-${{env.PROJECT_VERSION}}.dll ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.dll# 5) This is the step where the created DLL or EXE (artifact) files will be signed with CodeSignTool.
- name: Sign Artifact with CodeSignTooluses: sslcom/actions-codesigner@developwith:
# Sign and timestamp code object.command: sign# SSL.com account username.username: ${{secrets.ES_USERNAME}}# SSL.com account password.password: ${{secrets.ES_PASSWORD}}# Credential ID for signing certificate.credential_id: ${{secrets.CREDENTIAL_ID}}# OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)totp_secret: ${{secrets.ES_TOTP_SECRET}}# Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )file_path: ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.dll# Directory where signed code object(s) will be written.output_path: ${GITHUB_WORKSPACE}/artifacts# 6) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
- name: Upload Signed Filesuses: actions/upload-artifact@v2with:
name: ${{env.PROJECT_NAME}}.dllpath: ./artifacts/${{env.PROJECT_NAME}}.dll# The name of the workflow.name: (JAR) Maven Build and Sign# Trigger this workflow on a pushon: push# Create an environment variableenv:
PROJECT_NAME: HelloWorldPROJECT_VERSION: 0.0.1MAVEN_VERSION: 3.8.5JAVA_VERSION: 17# Defines a single job named "codesigner-maven-jar"jobs:
codesigner-maven-jar:
# Run job on Ubuntu Runnerruns-on: ubuntu-latest# When the workflow runs, this is the name that is loggedname: CodeSigner on Java with Mavensteps:
# 1) Check out the source code so that the workflow can access it.
- name: Checkout Repositoryuses: actions/checkout@v2# 2) Set up the Java and Maven environment for the workflow to use.
- name: Setup Java and Mavenuses: s4u/setup-maven-action@v1.3.1with:
java-version: '${{env.JAVA_VERSION}}'maven-version: '${{env.MAVEN_VERSION}}'# 3) Create Artifact Directory to store signed and unsigned artifact files
- name: Create Artifacts Directoryshell: bashrun: | mkdir ${GITHUB_WORKSPACE}/artifacts mkdir ${GITHUB_WORKSPACE}/packages# 4) Build a maven project or solution and all of its dependencies.# After it has been created jar file, copy to 'packages' folder for siging
- name: Compile Java Library with Mavenshell: bashrun: | mvn clean install -f java/pom.xml cp java/target/${{env.PROJECT_NAME}}-${{env.PROJECT_VERSION}}.jar ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.jar# 5) This is the step where the created JAR (artifact) files will be signed with CodeSignTool.
- name: Sign Artifact with CodeSignTooluses: sslcom/actions-codesigner@developwith:
# Sign and timestamp code object.command: sign# SSL.com account username.username: ${{secrets.ES_USERNAME}}# SSL.com account password.password: ${{secrets.ES_PASSWORD}}# Credential ID for signing certificate.credential_id: ${{secrets.CREDENTIAL_ID}}# OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)totp_secret: ${{secrets.ES_TOTP_SECRET}}# Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )file_path: ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.jar# Directory where signed code object(s) will be written.output_path: ${GITHUB_WORKSPACE}/artifacts# 6) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
- name: Upload Signed Filesuses: actions/upload-artifact@v2with:
name: ${{env.PROJECT_NAME}}.jarpath: ./artifacts/${{env.PROJECT_NAME}}.jar# The name of the workflow.name: (JAR) Gradle Build and Sign# Trigger this workflow on a pushon: push# Create an environment variableenv:
PROJECT_NAME: HelloWorldPROJECT_VERSION: 0.0.1GRADLE_VERSION: 7.3JAVA_VERSION: 17# Defines a single job named "codesigner-gradle-jar"jobs:
codesigner-gradle-jar:
# Run job on Ubuntu Runnerruns-on: ubuntu-latest# When the workflow runs, this is the name that is loggedname: CodeSigner on Java with Gradlesteps:
# 1) Check out the source code so that the workflow can access it.
- name: Checkout Repositoryuses: actions/checkout@v2# 2) Set up the Java environment for the workflow to use.
- uses: actions/setup-java@v2with:
distribution: zulujava-version: ${{env.JAVA_VERSION}}# 3) Set up the Gradle environment for the workflow to use.
- name: Setup Gradleuses: gradle/gradle-build-action@v2with:
gradle-version: ${{env.GRADLE_VERSION}}# 4) Create Artifact Directory to store signed and unsigned artifact files
- name: Create Artifacts Directoryshell: bashrun: | mkdir ${GITHUB_WORKSPACE}/artifacts mkdir ${GITHUB_WORKSPACE}/packages# 5) Build a gradle project or solution and all of its dependencies.# After it has been created jar file, copy to 'packages' folder for siging
- name: Compile Java Library with Gradleshell: bashrun: | gradle clean build -p java -PsetupType=jar cp java/build/libs/${{env.PROJECT_NAME}}-${{env.PROJECT_VERSION}}.jar ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.jar# 6) This is the step where the created JAR (artifact) files will be signed with CodeSignTool.
- name: Sign Artifact with CodeSignTooluses: sslcom/actions-codesigner@developwith:
# Sign and timestamp code object.command: sign# SSL.com account username.username: ${{secrets.ES_USERNAME}}# SSL.com account password.password: ${{secrets.ES_PASSWORD}}# Credential ID for signing certificate.credential_id: ${{secrets.CREDENTIAL_ID}}# OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)totp_secret: ${{secrets.ES_TOTP_SECRET}}# Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )file_path: ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.jar# Directory where signed code object(s) will be written.output_path: ${GITHUB_WORKSPACE}/artifacts# 7) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
- name: Upload Signed Filesuses: actions/upload-artifact@v2with:
name: ${{env.PROJECT_NAME}}.jarpath: ./artifacts/${{env.PROJECT_NAME}}.jar# The name of the workflow.name: (MSI) Gradle Build and Sign# Trigger this workflow on a pushon: push# Create an environment variableenv:
PROJECT_NAME: HelloWorldPROJECT_VERSION: 0.0.1GRADLE_VERSION: 7.3JAVA_VERSION: 17jobs:
# Defines job named "build-gradle-msi"build-gradle-msi:
# Run job on Windows Runnerruns-on: windows-latest# When the workflow runs, this is the name that is loggedname: Build MSI File with Gradlesteps:
# 1) Check out the source code so that the workflow can access it.
- name: Checkout Repositoryuses: actions/checkout@v2# 2) Set up the Java environment for the workflow to use.
- uses: actions/setup-java@v2with:
distribution: zulujava-version: ${{env.JAVA_VERSION}}# 3) Set up the Gradle environment for the workflow to use.
- name: Setup Gradleuses: gradle/gradle-build-action@v2with:
gradle-version: ${{env.GRADLE_VERSION}}# 4) Install WIX for MSI Setup File
- name: Windows Specific Setuprun: | curl -OLS https://github.com/wixtoolset/wix3/releases/download/wix3111rtm/wix311.exe .\wix311.exe /install /quiet /norestart# 5) Add WIX to environment variable
- name: Add path to PATH environment variableuses: myci-actions/export-env-var-powershell@1with:
name: PATHvalue: $env:PATH;C:\Program Files (x86)\WiX Toolset v3.11\bin# 6) Create Artifact Directory to store signed and unsigned artifact files
- name: Create Artifacts Directoryshell: bashrun: | mkdir ${GITHUB_WORKSPACE}/artifacts mkdir ${GITHUB_WORKSPACE}/packages# 7) Build a gradle project or solution and all of its dependencies.# After it has been created jar file, copy to 'packages' folder for siging
- name: Compile Java Library with Gradleshell: bashrun: | gradle build jpackage -x test --warning-mode all -p java -PsetupType=msi cp java/build/release/windows/*.msi ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.msi# 8) Save the MSI file to the artifacts directory for codesigning tool
- name: Upload Setup Fileid: upload-installer-windowsuses: actions/upload-artifact@v2with:
name: ${{env.PROJECT_NAME}}.msipath: ./packages/${{env.PROJECT_NAME}}.msi# Defines job named "codesigner-msi"codesigner-msi:
# Codesigner job only work with linux runnerruns-on: ubuntu-latest# Run this job after build-gradle-msi job is finishedneeds: [build-gradle-msi]# When the workflow runs, this is the name that is loggedname: CodeSigner on MSI Filesteps:
# 1) Download created msi file from Github Artifacts
- name: Download Windows Installer Fileuses: actions/download-artifact@v2with:
name: ${{env.PROJECT_NAME}}.msi# 2) Create Artifact Directory to store signed and unsigned artifact files
- name: Create Artifacts Directoryshell: bashrun: | mkdir ${GITHUB_WORKSPACE}/artifacts# 3) This is the step where the created JAR (artifact) files will be signed with CodeSignTool.
- name: Sign Artifact with CodeSignTooluses: sslcom/actions-codesigner@developwith:
# Sign and timestamp code object.command: sign# SSL.com account username.username: ${{secrets.ES_USERNAME}}# SSL.com account password.password: ${{secrets.ES_PASSWORD}}# Credential ID for signing certificate.credential_id: ${{secrets.CREDENTIAL_ID}}# OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)totp_secret: ${{secrets.ES_TOTP_SECRET}}# Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )file_path: ${GITHUB_WORKSPACE}/${{env.PROJECT_NAME}}.msi# Directory where signed code object(s) will be written.output_path: ${GITHUB_WORKSPACE}/artifacts# 4) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
- name: Upload Signed Filesuses: actions/upload-artifact@v2with:
name: ${{env.PROJECT_NAME}}.msipath: ./artifacts/${{env.PROJECT_NAME}}.msi# The name of the workflow.name: (EXE) Gradle Build and Sign# Trigger this workflow on a pushon: push# Create an environment variableenv:
PROJECT_NAME: HelloWorldPROJECT_VERSION: 0.0.1GRADLE_VERSION: 7.3JAVA_VERSION: 17jobs:
# Defines job named "build-gradle-exe"build-gradle-exe:
# Run job on Windows Runnerruns-on: windows-latest# When the workflow runs, this is the name that is loggedname: Build exe File with Gradlesteps:
# 1) Check out the source code so that the workflow can access it.
- name: Checkout Repositoryuses: actions/checkout@v2# 2) Set up the Java environment for the workflow to use.
- uses: actions/setup-java@v2with:
distribution: zulujava-version: ${{env.JAVA_VERSION}}# 3) Set up the Gradle environment for the workflow to use.
- name: Setup Gradleuses: gradle/gradle-build-action@v2with:
gradle-version: ${{env.GRADLE_VERSION}}# 4) Install WIX for exe Setup File
- name: Windows Specific Setuprun: | curl -OLS https://github.com/wixtoolset/wix3/releases/download/wix3111rtm/wix311.exe .\wix311.exe /install /quiet /norestart# 5) Add WIX to environment variable
- name: Add path to PATH environment variableuses: myci-actions/export-env-var-powershell@1with:
name: PATHvalue: $env:PATH;C:\Program Files (x86)\WiX Toolset v3.11\bin# 6) Create Artifact Directory to store signed and unsigned artifact files
- name: Create Artifacts Directoryshell: bashrun: | mkdir ${GITHUB_WORKSPACE}/artifacts mkdir ${GITHUB_WORKSPACE}/packages# 7) Build a gradle project or solution and all of its dependencies.# After it has been created jar file, copy to 'packages' folder for siging
- name: Compile Java Library with Gradleshell: bashrun: | gradle build jpackage -x test --warning-mode all -p java -PsetupType=exe cp java/build/release/windows/*.exe ${GITHUB_WORKSPACE}/packages/${{env.PROJECT_NAME}}.exe# 8) Save the exe file to the artifacts directory for codesigning tool
- name: Upload Setup Fileid: upload-installer-windowsuses: actions/upload-artifact@v2with:
name: ${{env.PROJECT_NAME}}.exepath: ./packages/${{env.PROJECT_NAME}}.exe# Defines job named "codesigner-exe"codesigner-exe:
# Codesigner job only work with linux runnerruns-on: ubuntu-latest# Run this job after build-gradle-exe job is finishedneeds: [build-gradle-exe]# When the workflow runs, this is the name that is loggedname: CodeSigner on exe Filesteps:
# 1) Download created exe file from Github Artifacts
- name: Download Windows Installer Fileuses: actions/download-artifact@v2with:
name: ${{env.PROJECT_NAME}}.exe# 2) Create Artifact Directory to store signed and unsigned artifact files
- name: Create Artifacts Directoryshell: bashrun: | mkdir ${GITHUB_WORKSPACE}/artifacts# 3) This is the step where the created JAR (artifact) files will be signed with CodeSignTool.
- name: Sign Artifact with CodeSignTooluses: sslcom/actions-codesigner@developwith:
# Sign and timestamp code object.command: sign# SSL.com account username.username: ${{secrets.ES_USERNAME}}# SSL.com account password.password: ${{secrets.ES_PASSWORD}}# Credential ID for signing certificate.credential_id: ${{secrets.CREDENTIAL_ID}}# OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)totp_secret: ${{secrets.ES_TOTP_SECRET}}# Path of code object to be signed. (DLL, JAR, EXE, exe files vb... )file_path: ${GITHUB_WORKSPACE}/${{env.PROJECT_NAME}}.exe# Directory where signed code object(s) will be written.output_path: ${GITHUB_WORKSPACE}/artifacts# 4) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
- name: Upload Signed Filesuses: actions/upload-artifact@v2with:
name: ${{env.PROJECT_NAME}}.exepath: ./artifacts/${{env.PROJECT_NAME}}.exe# The name of the workflow.name: (PS1) Poweshell Script Signing# Trigger this workflow on a pushon: push# Create an environment variableenv:
PROJECT_NAME: HelloWorld# Defines a single job named "codesigner-powershell-ps1"jobs:
codesigner-powershell-ps1:
# Run job on Ubuntu Runnerruns-on: ubuntu-latest# When the workflow runs, this is the name that is loggedname: CodeSigner on Powershellsteps:
# 1) Check out the source code so that the workflow can access it.
- name: Checkout Repositoryuses: actions/checkout@v2# 2) Create Artifact Directory to store signed and unsigned artifact files
- name: Create Artifacts Directoryshell: bashrun: | mkdir ${GITHUB_WORKSPACE}/artifacts# 3) This is the step PS1 file will be signed with CodeSignTool.
- name: Sign Artifact with CodeSignTooluses: sslcom/actions-codesigner@developwith:
# Sign and timestamp code object.command: sign# SSL.com account username.username: ${{secrets.ES_USERNAME}}# SSL.com account password.password: ${{secrets.ES_PASSWORD}}# Credential ID for signing certificate.credential_id: ${{secrets.CREDENTIAL_ID}}# OAuth TOTP Secret (https://www.ssl.com/how-to/automate-esigner-ev-code-signing)totp_secret: ${{secrets.ES_TOTP_SECRET}}# Path of code object to be signed. (DLL, JAR, EXE, MSI files vb... )file_path: ${GITHUB_WORKSPACE}/powershell/${{env.PROJECT_NAME}}.ps1# Directory where signed code object(s) will be written.output_path: ${GITHUB_WORKSPACE}/artifacts# 4) This uploads artifacts from your workflow allowing you to share data between jobs and store data once a workflow is complete
- name: Upload Signed Filesuses: actions/upload-artifact@v2with:
name: ${{env.PROJECT_NAME}}.ps1path: ./artifacts/${{env.PROJECT_NAME}}.ps1