Feature/cosign (#53)

* ci: add signatures to RCM executables in Ubuntu, macOS and Windows
RemoteConnectionManager · Feb 15, 2024 · f57f6bb · f57f6bb
1 parent c572644
commit f57f6bb
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 5 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -127,21 +127,36 @@ jobs:
           find . -name "RCM" -type f -exec mv '{}' RCM \;
           find . -name "RCM.zip" -type f -exec unzip '{}' -d ./RCM-dir \;
 
+      - uses: sigstore/[email protected]
+
+      - name: Sign image with a key
+        run: |
+          cosign sign-blob --yes --key env://COSIGN_PRIVATE_KEY --output-signature "${{ env.FILE2SIGN }}.sig" "${{ env.FILE2SIGN }}"
+          cosign verify-blob --key env://COSIGN_PUBLIC_KEY --signature "${{ env.FILE2SIGN }}.sig" "${{ env.FILE2SIGN }}"
+          echo "${{ env.COSIGN_PUBLIC_KEY }}" > RCM.pub
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+          FILE2SIGN: "RCM"
+
       - name: (GHO) Upload exe
         uses: actions/[email protected]
         with:
           name: RCM-client-${{ matrix.os }}-turbovnc-${{ matrix.turbovnc-version }}
           path: |
             RCM
-
-      - name: (GHO) Restore git
-        run: |
-          mv RCM RCM.exe
-          mv RCM.bck RCM
+            RCM.sig
+            RCM.pub
 
       - name: (GHO) Upload dir
         uses: actions/[email protected]
         with:
           name: RCM-client-${{ matrix.os }}-turbovnc-${{ matrix.turbovnc-version }}-dir
           path: |
             RCM-dir
+
+      - name: (GHO) Restore git
+        run: |
+          mv RCM RCM.exe
+          mv RCM.bck RCM
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
@@ -95,12 +95,27 @@ jobs:
           mv dist/*/*/RCM.exe .
           Expand-Archive -Path dist/*/*/RCM.zip -DestinationPath ./RCM-dir
 
+      - uses: sigstore/[email protected]
+
+      - name: Sign image with a key
+        run: |
+          cosign sign-blob --yes --key env://COSIGN_PRIVATE_KEY --output-signature "${{ env.FILE2SIGN }}.sig" "${{ env.FILE2SIGN }}.exe"
+          cosign verify-blob --key env://COSIGN_PUBLIC_KEY --signature "${{ env.FILE2SIGN }}.sig" "${{ env.FILE2SIGN }}.exe"
+          echo "${{ env.COSIGN_PUBLIC_KEY }}" > RCM.pub
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+          FILE2SIGN: "RCM"
+
       - name: (GHO) Upload exe
         uses: actions/[email protected]
         with:
           name: RCM-client-${{ runner.os }}-turbovnc-${{ matrix.turbovnc-version }}
           path: |
             RCM.exe
+            RCM.sig
+            RCM.pub
 
       - name: (GHO) Upload dir
         uses: actions/[email protected]