mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
esengine
d84bc0c625
SignPath has no quota left, so Studio Windows builds could only ship unsigned. Port the 1.x Certum SimplySign signer, pointed at Studio's own account and certificate. - Signing runs only when STUDIO_SIGNING_ENABLED=true, as three jobs, so the SimplySign session is never up while third-party code runs: windows-sign-payload signs the window, kernel and computer-use helper; windows-package builds the installer and zip on a separate runner with no environment or secrets; windows-sign-installer signs the installer. The two signing jobs check out only workflow_sha, install no toolchain, leave Defender on, and stop SimplySign after signing. - Verification checks trust, the pinned thumbprint, the STUDIO_SIGNING_SUBJECT subject, an issuer and a timestamp on every signed executable, on the installer, and on the zip's copies. - The SimplySign MSI is pinned by SHA-256 as well as by its signature. - With the switch on, a missing secret or subject, or any signing failure, blocks publish. The release body's Windows sentence follows windows-sign-installer's result. - Credentials are STUDIO_CERTUM_USERNAME, STUDIO_CERTUM_OTP_URI and STUDIO_CERTUM_KEY_ID only. The concurrency group is studio-certum-signing, shared with a new non-publishing smoke workflow. - publish downloads every package artifact by its exact name, taking Windows from windows-sign-installer when it ran, and fails when two artifacts carry the same file name. - signing-contract validates and fingerprints both the tag's tree and the workflow_sha tree. - The SignPath request steps, artifact configurations and request helper are removed. The contract now covers the Certum files, and its call graph detects Certum credentials. - The runbook lists the repository settings to decide on before enabling and says which PE files stay unsigned (Electron DLLs, elevate.exe, the NSIS uninstaller).