Commit fd028e1
win,tools: upgrade Windows signing to smctl
As a part of the new signing requrements for Windows change approach to
use the DigiCert cloud HSM service KeyLocker.
PR-URL: #50956
Fixes: nodejs/build#3491
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>1 parent 838179b commit fd028e1
1 file changed
Lines changed: 9 additions & 12 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,15 +1,12 @@ | |||
| 1 | 1 | @echo off | |
| 2 | 2 | ||
| 3 | - set timeservers=(http://timestamp.globalsign.com/scripts/timestamp.dll http://timestamp.comodoca.com/authenticode http://timestamp.verisign.com/scripts/timestamp.dll http://tsa.starfieldtech.com) | ||
| 4 | - | ||
| 5 | - for %%s in %timeservers% do ( | ||
| 6 | - signtool sign /a /d "Node.js" /du "https://nodejs.org" /fd SHA256 /t %%s %1 | ||
| 7 | - if not ERRORLEVEL 1 ( | ||
| 8 | - echo Successfully signed %1 using timeserver %%s | ||
| 9 | - exit /b 0 | ||
| 10 | - ) | ||
| 11 | - echo Signing %1 failed using %%s | ||
| 3 | + @REM From December 2023, new certificates use DigiCert cloud HSM service for EV signing. | ||
| 4 | + @REM They provide a client side app smctl.exe for managing certificates and signing process. | ||
| 5 | + @REM Release CI machines are configured to have it in the PATH so this can be used safely. | ||
| 6 | + smctl sign -k key_nodejs -i %1 | ||
| 7 | + if not ERRORLEVEL 1 ( | ||
| 8 | + echo Successfully signed %1 using smctl | ||
| 9 | + exit /b 0 | ||
| 12 | 10 | ) | |
| 13 | - | ||
| 14 | - echo Could not sign %1 using any available timeserver | ||
| 15 | - exit /b 1 | ||
| 11 | + echo Could not sign %1 using smctl | ||
| 12 | + exit /b 1 | ||
0 commit comments