Add ImageWriter SignPath test and release signing in its own repository

.github/workflows/build.yml

@@ -137,239 +137,13 @@ jobs:
           republish: "true"
           file: "*.deb"
   windows:
-    runs-on: windows-latest
-
-    defaults:
-      run:
-        working-directory: src
-
-    steps:
-    - uses: actions/checkout@v5
-
-    - name: Install Qt
-      id: qt-install
-      uses: jurplel/install-qt-action@v4
-      with:
-        version: '5.15.2'
-        aqtversion: '==3.1.*'
-        host: windows
-        target: desktop
-        arch: win32_mingw81
-        setup-python: false
-        tools: tools_cmake tools_mingw81,qt.tools.win32_mingw810
-
-    - name: Download and Extract OpenSSL
-      shell: pwsh
-      working-directory: ${{ github.workspace }}
-      run: |
-        Invoke-WebRequest `
-          -Uri "https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-1.1.1w.zip" `
-          -OutFile openssl-1.1.1w.zip
-        Expand-Archive openssl-1.1.1w.zip -DestinationPath openssl111
-
-    - name: Copy OpenSSL to Qt MinGW path
-      shell: pwsh
-      working-directory: ${{ github.workspace }}
-      run: |
-          dir ${{ github.workspace }}\..\Qt\
-          dir ${{ github.workspace }}\..\Qt\Tools\
-          dir ${{ github.workspace }}\..\Qt\Tools\mingw810_32\
-
-          $openssl = (Get-ChildItem -Directory -Path "${{ github.workspace }}\openssl111" | Where-Object { $_.Name -like "openssl-*" } | Select-Object -First 1).FullName + "\x86"
-          $mingwRoot = "${{ github.workspace }}\..\Qt\Tools\mingw810_32"
-
-          Write-Host "Resolved OpenSSL path: $openssl"
-          if (Test-Path $openssl) {
-            Get-ChildItem -Recurse "$openssl" | ForEach-Object { Write-Host $_.FullName }
-          } else {
-            Write-Error "OpenSSL path not found: $openssl"
-          }
-
-          Copy-Item "$openssl\bin\libcrypto-1_1.dll" "$mingwRoot\bin\" -Force
-          Copy-Item "$openssl\bin\libssl-1_1.dll"    "$mingwRoot\bin\" -Force
-          Copy-Item "$openssl\lib\libcrypto.lib"     "$mingwRoot\lib\" -Force
-          Copy-Item "$openssl\lib\libssl.lib"        "$mingwRoot\lib\" -Force
-          New-Item -ItemType Directory -Force -Path "$mingwRoot\include\openssl"
-          Write-Host "Copying OpenSSL headers from: $openssl\include\openssl\."
-          Copy-Item "$openssl\include\openssl\." "$mingwRoot\include\" -Recurse -Force -Verbose
-          dir "$mingwRoot\include\openssl\"
-
-    - name: Install NSIS
-      run: choco install nsis --x86 --force -y
-
-    - name: Show Qt & CMake Info
-      run: |
-        where gcc
-        where g++
-        cmake --version
-
-    - name: Debug OpenSSL include headers
-      shell: pwsh
-      working-directory: ${{ github.workspace }}
-      run: |
-        $opensslInclude = "$Env:GITHUB_WORKSPACE\..\Qt\Tools\mingw810_32\include\openssl"
-        $openssl = (Get-ChildItem -Directory -Path "${{ github.workspace }}\openssl111" | Where-Object { $_.Name -like "openssl-*" } | Select-Object -First 1).FullName + "\x86"
-
-        Write-Host "Looking in: $opensslInclude"
-        if (Test-Path $opensslInclude) {
-          Get-ChildItem $opensslInclude | Select-Object -First 20
-        } else {
-          Write-Error "OpenSSL include directory not found!"
-        }
-
-        dir "$openssl\include\openssl\"
-
-
-    - name: Configure CMake
-      shell: cmd
-      working-directory: src
-      run: |
-        dir "%GITHUB_WORKSPACE%\openssl111\openssl-1.1\x86\include"
-        mkdir build
-        cd build
-        cmake .. -G "MinGW Makefiles" ^
-        -DCMAKE_BUILD_TYPE=Release ^
-        -DCMAKE_C_COMPILER="%GITHUB_WORKSPACE%\..\Qt\Tools\mingw810_32\bin\gcc.exe" ^
-        -DCMAKE_CXX_COMPILER="%GITHUB_WORKSPACE%\..\Qt\Tools\mingw810_32\bin\g++.exe" ^
-        -DOPENSSL_INCLUDE_DIR="%GITHUB_WORKSPACE%\openssl111\openssl-1.1\x86\include" ^
-        -DOPENSSL_LIBRARIES="%GITHUB_WORKSPACE%\openssl111\openssl-1.1\x86\lib"
-
-
-    - name: Check CMake Cache
-      run: |
-        dir build
-        type build\CMakeCache.txt || echo "Cache missing"
-
-    - name: Build
-      shell: pwsh
-      run: |
-        $env:PATH = "$Env:GITHUB_WORKSPACE\..\Qt\5.15.2\mingw81_32\bin;$Env:GITHUB_WORKSPACE\..\Qt\Tools\mingw810_32\bin;$env:PATH"
-        cd build
-        cmake --build . --verbose
-
-    - name: Copy OpenSSL DLLs to build folder
-      shell: pwsh
-      run: |
-        Copy-Item "$Env:GITHUB_WORKSPACE\..\Qt\Tools\mingw810_32\bin\libssl-1_1.dll" -Destination "$Env:GITHUB_WORKSPACE\src\build\"
-        Copy-Item "$Env:GITHUB_WORKSPACE\..\Qt\Tools\mingw810_32\bin\libcrypto-1_1.dll" -Destination "$Env:GITHUB_WORKSPACE\src\build\"
-
-    - name: Validate Windows signing configuration
-      shell: pwsh
-      working-directory: ${{ github.workspace }}
-      env:
-        WINDOWS_SIGNING_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
-        WINDOWS_SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
-      run: |
-        $hasCertificate = -not [string]::IsNullOrWhiteSpace($Env:WINDOWS_SIGNING_CERTIFICATE_BASE64)
-        $hasPassword = -not [string]::IsNullOrWhiteSpace($Env:WINDOWS_SIGNING_CERTIFICATE_PASSWORD)
-        if ($hasCertificate -xor $hasPassword) {
-          throw "Configure both Windows signing secrets or neither of them"
-        }
-        if (-not $hasCertificate) {
-          Write-Warning "Windows signing secrets are not configured; this CI artifact will be unsigned"
-        }
-
-    # Sign the executable before NSIS packages it. The two repository secrets
-    # are intentionally optional so pull requests and forks can still build.
-    - name: Sign Windows application
-      shell: pwsh
-      working-directory: ${{ github.workspace }}
-      env:
-        WINDOWS_SIGNING_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
-        WINDOWS_SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
-      run: |
-        if ([string]::IsNullOrWhiteSpace($Env:WINDOWS_SIGNING_CERTIFICATE_BASE64)) {
-          Write-Host "Windows signing is not configured; skipping application signing"
-          exit 0
-        }
-
-        $certificatePath = Join-Path $Env:RUNNER_TEMP "openhd-imagewriter-signing.pfx"
-        [IO.File]::WriteAllBytes(
-          $certificatePath,
-          [Convert]::FromBase64String($Env:WINDOWS_SIGNING_CERTIFICATE_BASE64)
-        )
-
-        $signTool = Get-ChildItem "${Env:ProgramFiles(x86)}\Windows Kits\10\bin" `
-          -Filter signtool.exe -Recurse |
-          Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } |
-          Sort-Object FullName -Descending |
-          Select-Object -First 1 -ExpandProperty FullName
-        if (-not $signTool) {
-          throw "signtool.exe was not found"
-        }
-
-        & $signTool sign /fd SHA256 /td SHA256 /tr http://timestamp.digicert.com `
-          /f $certificatePath /p $Env:WINDOWS_SIGNING_CERTIFICATE_PASSWORD `
-          /d "OpenHD ImageWriter" /du "https://openhd.tech" `
-          "src\build\deploy\OpenHDImageWriter.exe"
-        if ($LASTEXITCODE -ne 0) {
-          throw "Signing OpenHDImageWriter.exe failed with exit code $LASTEXITCODE"
-        }
-        & $signTool verify /pa /v "src\build\deploy\OpenHDImageWriter.exe"
-        if ($LASTEXITCODE -ne 0) {
-          throw "Signature verification for OpenHDImageWriter.exe failed with exit code $LASTEXITCODE"
-        }
-
-    - name: Build NSIS Installer
-      shell: pwsh
-      working-directory: src\build
-      run: |
-        & "${Env:ProgramFiles(x86)}\NSIS\makensis.exe" "openhdimagewriter.nsi"
-
-    - name: Sign Windows installer
-      shell: pwsh
-      working-directory: ${{ github.workspace }}
-      env:
-        WINDOWS_SIGNING_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }}
-        WINDOWS_SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }}
-      run: |
-        if ([string]::IsNullOrWhiteSpace($Env:WINDOWS_SIGNING_CERTIFICATE_BASE64)) {
-          Write-Host "Windows signing is not configured; skipping installer signing"
-          exit 0
-        }
-
-        $certificatePath = Join-Path $Env:RUNNER_TEMP "openhd-imagewriter-signing.pfx"
-        $signTool = Get-ChildItem "${Env:ProgramFiles(x86)}\Windows Kits\10\bin" `
-          -Filter signtool.exe -Recurse |
-          Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } |
-          Sort-Object FullName -Descending |
-          Select-Object -First 1 -ExpandProperty FullName
-        if (-not $signTool) {
-          throw "signtool.exe was not found"
-        }
-
-        $installer = Get-ChildItem "src\build\OpenHD-ImageWriter-*.exe" |
-          Select-Object -First 1
-        if (-not $installer) {
-          throw "NSIS installer was not found"
-        }
-
-        & $signTool sign /fd SHA256 /td SHA256 /tr http://timestamp.digicert.com `
-          /f $certificatePath /p $Env:WINDOWS_SIGNING_CERTIFICATE_PASSWORD `
-          /d "OpenHD ImageWriter" /du "https://openhd.tech" `
-          $installer.FullName
-        if ($LASTEXITCODE -ne 0) {
-          throw "Signing the NSIS installer failed with exit code $LASTEXITCODE"
-        }
-        & $signTool verify /pa /v $installer.FullName
-        if ($LASTEXITCODE -ne 0) {
-          throw "Signature verification for the NSIS installer failed with exit code $LASTEXITCODE"
-        }
-
-    - name: Remove temporary signing certificate
-      if: always()
-      shell: pwsh
-      working-directory: ${{ github.workspace }}
-      run: |
-        Remove-Item -LiteralPath (Join-Path $Env:RUNNER_TEMP "openhd-imagewriter-signing.pfx") `
-          -Force -ErrorAction SilentlyContinue
-
-    - name: Upload Installer
-      uses: actions/upload-artifact@v7
-      with:
-        name: OpenHDImageWriter-Build-Full
-        path: src/build/OpenHD-ImageWriter-*
-        if-no-files-found: error
+    permissions:
+      contents: read
+      actions: read
+    uses: ./.github/workflows/windows.yml
+    with:
+      source-repository: ${{ github.repository }}
+      source-ref: ${{ github.sha }}
   macos:
     name: Build (${{ matrix.arch }})
     runs-on: ${{ matrix.runner }}

.github/workflows/sign-windows.yml

@@ -0,0 +1,30 @@
+name: Sign Windows ImageWriter
+
+on:
+  workflow_dispatch:
+    inputs:
+      signing_mode:
+        description: Test for SignPath onboarding, release for public distribution
+        type: choice
+        options: [test, release]
+        default: test
+        required: true
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  imagewriter:
+    if: github.repository == 'OpenHD/OpenHD-ImageWriter'
+    uses: ./.github/workflows/windows.yml
+    with:
+      source-ref: ${{ github.sha }}
+      sign: true
+      signing-mode: ${{ inputs.signing_mode }}
+      organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
+      project-slug: ${{ vars.SIGNPATH_PROJECT_SLUG }}
+      signing-policy-slug: ${{ inputs.signing_mode == 'test' && vars.SIGNPATH_TEST_SIGNING_POLICY_SLUG || vars.SIGNPATH_RELEASE_SIGNING_POLICY_SLUG }}
+      test-certificate-base64: ${{ vars.SIGNPATH_TEST_CERTIFICATE_BASE64 }}
+    secrets:
+      SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}