stevedlawrence commented on code in PR #48:
URL:
https://github.com/apache/daffodil-infrastructure/pull/48#discussion_r3760464790
##########
actions/release-candidate/dist/post/index.js:
##########
@@ -125633,6 +125642,9 @@ async function run() {
if (artifact.name.endsWith(".rpm")) {
await exec("rpmsign", ["--define",
`_gpg_name ${ gpg_signing_key_id }`, "--define", "_binary_filedigest_algorithm
10", "--addsign", `${ artifact.parentPath }/${ artifact.name }`]);
}
+ if (artifact.name.endsWith(".exe") &&
do_ssl_com_sign) {
+ await exec("jsign", ["--storetype",
"ESIGNER", "--alias", "d97c5110-c66a-4c0c-ac0c-1cd6af812ee6", "--storepass",
`${ssl_com_username}|${ssl_com_password}`, "--keypass", ssl_com_secret,
"--tsaurl=http://ts.ssl.com";, "--tsmode", "RFC3161", "--alg", "SHA256", `${
artifact.parentPath }/${ artifact.name }`]);
Review Comment:
This command comes from ASF infra:
https://infra.apache.org/code-signing-use.html
I'll add this as a comment.
I don't actually know what the alias, I think maybe an identifier to the key
that should be used to sign? I'll do some research and give it an appropriate
name.
Regarding the sha256 algorithm, again this comes from the infra
documentation. I'll do some research and see if sha512 would work or if it's a
limitation with jsign or exe signing or something. If I can I'll bump it to 512.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
