mirror of
https://github.com/libretro/virtualjaguar-libretro.git
synced 2026-11-08 08:10:33 -10:00
Joseph MattielloandClaude Fable 5.1
d7482ba3ec
Every exe and dll in the Windows app packages (virtualjaguar.exe, librashader.dll, the software-opengl/ copy and the bundled Mesa DLLs, x64 and arm64) and both Inno Setup installers are Authenticode-signed with Azure Artifact Signing: SHA-256, RFC 3161 timestamp from timestamp.acs.microsoft.com, OpenID Connect login (azure/login), no certificate material or client secret anywhere. - .github/actions/windows-sign: composite action (azure/login v3.1.0 and azure/artifact-signing-action v2.0.0, both pinned by commit) that decides from its inputs whether it can sign, prints a ::notice:: and does nothing otherwise, signs, then re-reads every file with Get-AuthenticodeSignature and fails when one is not Valid and timestamped. - app-package.yml: the Windows leg becomes build (native runner per arch, install tree -> intermediate windows-stage-<arch>) -> windows-package (ONE x64 job for both architectures: the signing action does not run on Windows ARM runners, its dlib is x64/x86 only) -> windows-smoke (native runner per arch, Authenticode re-checked on the DOWNLOADED artifact, portable zip, silent install/uninstall). SignPath stub (inputs, secrets, env, steps) removed; secrets are now AZURE_CLIENT_ID / AZURE_TENANT_ID / AZURE_SUBSCRIPTION_ID plus the variables AZURE_SIGNING_ENDPOINT / AZURE_SIGNING_ACCOUNT / AZURE_SIGNING_PROFILE. - app.yml and release.yml grant id-token: write to the package job; app.yml passes the three secrets so same-repo PR packages are signed like a release. - Release gate: a second expectation, WINDOWS_APP_EXPECT, for the app zips and installers; release.yml passes `signed` when all six Azure values exist. The core DLLs, cue2cdi and the jagcd tools keep EXPECT_WINDOWS (unsigned) until their jobs sign too. The zip check now covers every PE file inside, summarised in one cell. stage.sh skips the windows-stage-* intermediates. - app/packaging/windows/verify-signatures.ps1: the shared check (files, folders, zips; -Expect signed|unsigned|report; table in the job summary). - package.sh: the local sign hook signed the x64 installer name for both arches. - Docs: app/packaging/README.md (secrets/variables, layout, Mesa decision, quota, the one-time Azure setup incl. roles and federated-credential subjects), docs/release-process.md. - release-packages.cjs: the three new jobs join the completeness list (15). Refs #1150 Co-Authored-By: Claude Fable 5.1 <[email protected]>