Every exe and dll in the Windows app packages (virtualjaguar.exe, librashader.dll,
the software-opengl/ copy and the bundled Mesa DLLs, x64 and arm64) and both Inno
Setup installers are Authenticode-signed with Azure Artifact Signing: SHA-256,
RFC 3161 timestamp from timestamp.acs.microsoft.com, OpenID Connect login
(azure/login), no certificate material or client secret anywhere.
- .github/actions/windows-sign: composite action (azure/login v3.1.0 and
azure/artifact-signing-action v2.0.0, both pinned by commit) that decides from
its inputs whether it can sign, prints a ::notice:: and does nothing otherwise,
signs, then re-reads every file with Get-AuthenticodeSignature and fails when
one is not Valid and timestamped.
- app-package.yml: the Windows leg becomes build (native runner per arch, install
tree -> intermediate windows-stage-<arch>) -> windows-package (ONE x64 job for
both architectures: the signing action does not run on Windows ARM runners,
its dlib is x64/x86 only) -> windows-smoke (native runner per arch, Authenticode
re-checked on the DOWNLOADED artifact, portable zip, silent install/uninstall).
SignPath stub (inputs, secrets, env, steps) removed; secrets are now
AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_SUBSCRIPTION_ID plus the variables
AZURE_SIGNING_ENDPOINT / AZURE_SIGNING_ACCOUNT / AZURE_SIGNING_PROFILE.
- app.yml and release.yml grant id-token: write to the package job; app.yml
passes the three secrets so same-repo PR packages are signed like a release.
- Release gate: a second expectation, WINDOWS_APP_EXPECT, for the app zips and
installers; release.yml passes `signed` when all six Azure values exist. The
core DLLs, cue2cdi and the jagcd tools keep EXPECT_WINDOWS (unsigned) until
their jobs sign too. The zip check now covers every PE file inside, summarised
in one cell. stage.sh skips the windows-stage-* intermediates.
- app/packaging/windows/verify-signatures.ps1: the shared check (files, folders,
zips; -Expect signed|unsigned|report; table in the job summary).
- package.sh: the local sign hook signed the x64 installer name for both arches.
- Docs: app/packaging/README.md (secrets/variables, layout, Mesa decision, quota,
the one-time Azure setup incl. roles and federated-credential subjects),
docs/release-process.md.
- release-packages.cjs: the three new jobs join the completeness list (15).
Refs #1150
Co-Authored-By: Claude Fable 5.1 <[email protected]>
release.yml flattens once in the stage job (scripts/release/stage.sh keeps
the ci-core-*, librashader-* and signing-status-* intermediates out) and the
gate, release and nightly jobs download the staged artifact, so the test
asserts that instead of two per-publisher ci-core exclusions.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
