This is an automated email from the ASF dual-hosted git repository.
stevedlawrence pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/daffodil-infrastructure.git
The following commit(s) were added to refs/heads/main by this push:
new d9e9378 Rename ssl.com signing variables/inputs
d9e9378 is described below
commit d9e937883c64459d336e2618bb1fbd2b2163390b
Author: Steve Lawrence <[email protected]>
AuthorDate: Mon Aug 17 07:24:34 2026 -0400
Rename ssl.com signing variables/inputs
This more closely matches the ASF provided secrets and jsign option names
DAFFODIL-3090
---
actions/release-candidate/README.md | 31 ++++++++++++++--------------
actions/release-candidate/action.yml | 11 ++++------
actions/release-candidate/dist/post/index.js | 11 +++++-----
actions/release-candidate/src/post.js | 11 +++++-----
4 files changed, 29 insertions(+), 35 deletions(-)
diff --git a/actions/release-candidate/README.md
b/actions/release-candidate/README.md
index 93c89c3..2af7f14 100644
--- a/actions/release-candidate/README.md
+++ b/actions/release-candidate/README.md
@@ -55,7 +55,7 @@ at the end of the workflow:
* Sign all rpm artifacts with the GPG key with rpmsign
* Sign all exe artifacts with the ssl.com certificates, if publishing is
- enabled and `ssl_com_username` is defined
+ enabled and `esigner_storepass` is defined
* Create sha512 checksum files for all artifacts
* Create detached ASCII armored GPG signatures for all artifacts
* Commit all files added to `dist/dev/` to SVN
@@ -72,21 +72,20 @@ This is useful for testing the workflow using workflow
dispatch.
## Inputs
-| Input | Required | Default | Description |
-|-----------------|---------------|---------|-------------|
-| tlp_dir | yes | | Directory of the top level
project in dist/dev/ |
-| project_name | yes | | Human readable name of the
project |
-| project_id | yes | | ID of the project, used in
source artifact file name |
-| project_dir | no | "" | Directory for the project in
dev/dist/<tlp_dir>/. Omit if at the root |
-| gpg_signing_key | if publishing | | Key used to sign artifacts |
-| ssl_com_username| no | | Username for signing .exe
artifacts using SSL.com |
-| ssl_com_password| no | | Password for signing .exe
artifacts using SSL.com |
-| ssl_com_secret | no | | Secret for signing .exe
artifacts using SSL.com |
-| svn_username | if publishing | | Username for publishing release
artifacts to SVN dev/dist |
-| svn_password | if publishing | | Password for publishing release
artifacts to SVN dev/dist |
-| nexus_username | if publishing | | Username for publishing release
artifacts to Nexus |
-| nexus_password | if publishing | | Password for publishing release
artifacts to Nexus |
-| publish | no | false | Enable/disabling publish
artifacts. Must be explicitly set to true to enable publishing. May be ignored
depending on other factors. |
+| Input | Required | Default | Description |
+|----------------- |---------------|---------|-------------|
+| tlp_dir | yes | | Directory of the top level
project in dist/dev/ |
+| project_name | yes | | Human readable name of the
project |
+| project_id | yes | | ID of the project, used in
source artifact file name |
+| project_dir | no | "" | Directory for the project in
dev/dist/<tlp_dir>/. Omit if at the root |
+| gpg_signing_key | if publishing | | Key used to sign artifacts |
+| esigner_storepass| no | | Storepass for signing .exe
artifacts using SSL.com |
+| esigner_keypass | no | | Keypass for signing .exe
artifacts using SSL.com |
+| svn_username | if publishing | | Username for publishing release
artifacts to SVN dev/dist |
+| svn_password | if publishing | | Password for publishing release
artifacts to SVN dev/dist |
+| nexus_username | if publishing | | Username for publishing release
artifacts to Nexus |
+| nexus_password | if publishing | | Password for publishing release
artifacts to Nexus |
+| publish | no | false | Enable/disabling publish
artifacts. Must be explicitly set to true to enable publishing. May be ignored
depending on other factors. |
## Outputs
diff --git a/actions/release-candidate/action.yml
b/actions/release-candidate/action.yml
index 5e4132a..290b423 100644
--- a/actions/release-candidate/action.yml
+++ b/actions/release-candidate/action.yml
@@ -34,14 +34,11 @@ inputs:
gpg_signing_key:
description: Key used to sign artifacts
required: false
- ssl_com_usename:
- description: Username for signing .exe artifacts using SSL.com
+ esigner_storepass:
+ description: Storepass for signing .exe artifacts using SSL.com
required: false
- ssl_com_password:
- description: Password for signing .exe artifacts using SSL.com
- required: false
- ssl_com_secret:
- description: Secret for signing .exe artifacts using SSL.com
+ esigner_keypass:
+ description: Keypass for signing .exe artifacts using SSL.com
required: false
svn_username:
description: Username for publishing release artifacts to SVN dev/dist
diff --git a/actions/release-candidate/dist/post/index.js
b/actions/release-candidate/dist/post/index.js
index 63bec32..53d580a 100644
--- a/actions/release-candidate/dist/post/index.js
+++ b/actions/release-candidate/dist/post/index.js
@@ -125629,10 +125629,9 @@ async function run() {
// exe artifacts. Also, each ssl.com signature costs ASF money,
so we
// only sign exe artifacts if we are actually going to publish
things
// (e.g. this isn't a test run)
- const ssl_com_username = core.getInput("ssl_com_username");
- const ssl_com_password = core.getInput("ssl_com_password");
- const ssl_com_secret = core.getInput("ssl_com_secret");
- const do_ssl_com_sign = ssl_com_username;
+ const esigner_storepass = core.getInput("esigner_storepass");
+ const esigner_keypass = core.getInput("esigner_keypass");
+ const do_esigner = esigner_storepass;
// sign/checksum all artifacts
const artifacts = fs.readdirSync(artifact_dir, { recursive:
true, withFileTypes: true });
@@ -125642,10 +125641,10 @@ async function run() {
if (artifact.name.endsWith(".rpm")) {
await exec("rpmsign", ["--define",
`_gpg_name ${ gpg_signing_key_id }`, "--define", "_binary_filedigest_algorithm
10", "--addsign", `${ artifact.parentPath }/${ artifact.name }`]);
}
- if (artifact.name.endsWith(".exe") &&
do_ssl_com_sign) {
+ if (artifact.name.endsWith(".exe") &&
do_esigner) {
// see
https://infra.apache.org/code-signing-use.html for more information
const cert_uuid =
"d97c5110-c66a-4c0c-ac0c-1cd6af812ee6";
- await exec("jsign", ["--storetype",
"ESIGNER", "--alias", cert_uuid, "--storepass",
`${ssl_com_username}|${ssl_com_password}`, "--keypass", ssl_com_secret,
"--tsaurl=http://ts.ssl.com";, "--tsmode", "RFC3161", "--alg", "SHA512", `${
artifact.parentPath }/${ artifact.name }`]);
+ await exec("jsign", ["--storetype",
"ESIGNER", "--alias", cert_uuid, "--storepass", esigner_storepass, "--keypass",
esigner_keypass, "--tsaurl=http://ts.ssl.com";, "--tsmode", "RFC3161", "--alg",
"SHA512", `${ artifact.parentPath }/${ artifact.name }`]);
}
const shasum_output = await
getExecOutput("sha512sum", ["--binary", artifact.name], {
cwd: artifact.parentPath
diff --git a/actions/release-candidate/src/post.js
b/actions/release-candidate/src/post.js
index a4ffb08..a1648a1 100644
--- a/actions/release-candidate/src/post.js
+++ b/actions/release-candidate/src/post.js
@@ -38,10 +38,9 @@ async function run() {
// exe artifacts. Also, each ssl.com signature costs ASF money,
so we
// only sign exe artifacts if we are actually going to publish
things
// (e.g. this isn't a test run)
- const ssl_com_username = core.getInput("ssl_com_username");
- const ssl_com_password = core.getInput("ssl_com_password");
- const ssl_com_secret = core.getInput("ssl_com_secret");
- const do_ssl_com_sign = ssl_com_username;
+ const esigner_storepass = core.getInput("esigner_storepass");
+ const esigner_keypass = core.getInput("esigner_keypass");
+ const do_esigner = esigner_storepass;
// sign/checksum all artifacts
const artifacts = fs.readdirSync(artifact_dir, { recursive:
true, withFileTypes: true });
@@ -51,10 +50,10 @@ async function run() {
if (artifact.name.endsWith(".rpm")) {
await exec("rpmsign", ["--define",
`_gpg_name ${ gpg_signing_key_id }`, "--define", "_binary_filedigest_algorithm
10", "--addsign", `${ artifact.parentPath }/${ artifact.name }`]);
}
- if (artifact.name.endsWith(".exe") &&
do_ssl_com_sign) {
+ if (artifact.name.endsWith(".exe") &&
do_esigner) {
// see
https://infra.apache.org/code-signing-use.html for more information
const cert_uuid =
"d97c5110-c66a-4c0c-ac0c-1cd6af812ee6";
- await exec("jsign", ["--storetype",
"ESIGNER", "--alias", cert_uuid, "--storepass",
`${ssl_com_username}|${ssl_com_password}`, "--keypass", ssl_com_secret,
"--tsaurl=http://ts.ssl.com";, "--tsmode", "RFC3161", "--alg", "SHA512", `${
artifact.parentPath }/${ artifact.name }`]);
+ await exec("jsign", ["--storetype",
"ESIGNER", "--alias", cert_uuid, "--storepass", esigner_storepass, "--keypass",
esigner_keypass, "--tsaurl=http://ts.ssl.com";, "--tsmode", "RFC3161", "--alg",
"SHA512", `${ artifact.parentPath }/${ artifact.name }`]);
}
const shasum_output = await
getExecOutput("sha512sum", ["--binary", artifact.name], {
cwd: artifact.parentPath
