Skip to content

Avoid interactive test certificate prompts on Windows CI #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
raphaelscholle merged 3 commits into from
Nov 3, 2026
Merged

Avoid interactive test certificate prompts on Windows CI #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5b88e66
Use current SignPath GitHub pipeline connector endpoint
raphaelscholle Nov 3, 2026
120b5e1
Avoid interactive test certificate trust on GitHub runners
raphaelscholle Nov 3, 2026
a45c59b
Document machine trust restricted to disposable signing test runners
raphaelscholle Nov 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions doc/signpath.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,8 @@ commit (`github.sha`), so the source matches the build's origin metadata.
## Test signing and production review

Run with `test` first. Only this ephemeral GitHub-hosted runner imports the
configured public self-signed test certificate into its current-user trust
stores. Each signed file must have a valid timestamped signature from exactly
configured public self-signed test certificate into its machine trust stores
to avoid interactive user-store prompts. Each signed file must have a valid timestamped signature from exactly
that certificate. Test outputs are labelled `-Test-Signed`; they are for
onboarding verification and are not publicly trusted distribution packages.
Do not install this certificate on end-user computers.
Expand Down
5 changes: 4 additions & 1 deletion scripts/trust_signpath_test_certificate.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,12 @@ try {
}
# Only the ephemeral GitHub-hosted test job trusts this public certificate.
# Release jobs never execute this script and retain normal Windows trust.
# The user Root store can show an interactive security prompt.
# GitHub-hosted Windows runners are disposable and run as administrator.
foreach ($storeName in @('Root', 'TrustedPublisher')) {
$store = [System.Security.Cryptography.X509Certificates.X509Store]::new($storeName, 'CurrentUser')
$store = [System.Security.Cryptography.X509Certificates.X509Store]::new($storeName, 'LocalMachine')
try {
Write-Host "Importing the public test certificate into LocalMachine/$storeName"
$store.Open('ReadWrite')
$store.Add($certificate)
} finally {
Expand Down
Loading