smallsolar
/
node
mirror of https://github.com/nodejs/node.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

win,tools: upgrade Windows signing to smctl 

As a part of the new signing requrements for Windows change approach to
use the DigiCert cloud HSM service KeyLocker.

PR-URL: https://github.com/nodejs/node/pull/50956
Fixes: https://github.com/nodejs/build/issues/3491
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
This commit is contained in:
Stefan Stojanovic 2023-12-08 22:58:17 +01:00 committed by GitHub
parent 3f942e2c49
commit 1ba508d51b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
tools/sign.bat
View File

@ -1,15 +1,12 @@
@echo off
set timeservers=(http://timestamp.globalsign.com/scripts/timestamp.dll http://timestamp.comodoca.com/authenticode http://timestamp.verisign.com/scripts/timestamp.dll http://tsa.starfieldtech.com)
for %%s in %timeservers% do (
signtool sign /a /d "Node.js" /du "https://nodejs.org" /fd SHA256 /t %%s %1
if not ERRORLEVEL 1 (
echo Successfully signed %1 using timeserver %%s
exit /b 0
)
echo Signing %1 failed using %%s
@REM From December 2023, new certificates use DigiCert cloud HSM service for EV signing.
@REM They provide a client side app smctl.exe for managing certificates and signing process.
@REM Release CI machines are configured to have it in the PATH so this can be used safely.
smctl sign -k key_nodejs -i %1
if not ERRORLEVEL 1 (
echo Successfully signed %1 using smctl
exit /b 0
)
echo Could not sign %1 using any available timeserver
exit /b 1
echo Could not sign %1 using smctl
exit /b 1