Cert signing for Github Action

[ReynoldsL05]

Hi, I am following this tutorial for using certificated in the advanced installer git action, https://www.advancedinstaller.com/code- ... tions.html

however this code does not seem to store anything in the env.PFX_PATH variable

Code: Select all

        $pfxPath = Join-Path -Path $env:RUNNER_TEMP -ChildPath "cert.pfx";
        $encodedBytes = [System.Convert]::FromBase64String($env:PFX_CONTENT);
        Set-Content $pfxPath -Value $encodedBytes -AsByteStream;
        Write-Output "::set-output name=PFX_PATH::$pfxPath";

What am I doing wrong?

[Catalin]

Hello,

Is your certificate name "cert.pfx"?

From what I can see, that's offered as a sample, but in your case that should be different.

Best regards,
Catalin

[ReynoldsL05]

Have updated cert name but behaviour does not change

[Catalin]

Hello,

Hmm, this is quite strange.

That piece of code is used to basically build your certificate, as per the article.

If possible, could you please show me the YML file structure to see whether I can see something there?

Best regards,
Catalin

[ReynoldsL05]

Code: Select all

name: Firefly Build Advanced Installer

on:
  workflow_dispatch:
      inputs:
        logLevel:
          description: 'Log level'
          required: true
          default: 'warning'
        environment:
          description: 'Environment to deploy'
          required: false
          default: 'staging'
  push:
    branches: ['FFYUI11212_AI_git_action_clean'] 

env:
  PostSharpLicense: ${{ secrets.POSTSHARP_LICENSE }}
  CIScript:  "${{ github.workspace }}\\firefly\\Software\\CI\\RenameAiInstallersAndUpload.ps1"
  App_Installer_Path: "${{ github.workspace }}\\firefly\\Software\\Installation\\Firefly Application Advanced Installer"
  Instrument_Installer_Path: "${{ github.workspace }}\\firefly\\Software\\Installation\\Firefly Instrument Advanced Installer"
  Firefly_Solution_Path: "${{ github.workspace }}\\firefly\\Software\\firefly.sln"
  App_Installer_Name: "Firefly Application Installer"
  Instrument_Installer_Name: "Firefly Instrument Installer"
  Ver: "V2.0.0_Debug"

jobs:
  build_installer:
    name: Delete old installers and build new ones
    runs-on: windows-latest  # For a list of available runner types, refer to
                         # https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idruns-on
    timeout-minutes: 20
    environment: Installer
    permissions:
      contents: write
#
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

      # Install the .NET Core workload
    - name: Install .NET Core
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: 8.0.x

      # Add  MSBuild to the PATH: https://github.com/microsoft/setup-msbuild
    - name: Setup MSBuild.exe
      uses: microsoft/setup-msbuild@v2

    - name: Restore
      run: dotnet restore ${{ env.Firefly_Solution_Path }}

    - name: Build Firefly
      run: dotnet build ${{ env.Firefly_Solution_Path }} -c Release 

    - name: Create PFX certificate
      id: create-pfx
      shell: pwsh
      env:
        PFX_CONTENT: ${{ secrets.CERT_DATA }}
      run: |
        $pfxPath = Join-Path -Path $env:RUNNER_TEMP -ChildPath "GitActionCert.pfx";
        $encodedBytes = [System.Convert]::FromBase64String($env:PFX_CONTENT);
        Set-Content $pfxPath -Value $encodedBytes -AsByteStream;
        Write-Output "::set-output name=PFX_PATH::$pfxPath";
    - name: List files
      run: ls -R

    - name: Build App Installer
      uses: caphyon/advinst-github-action@main
      with:
        advinst-version: '22.3'
        advinst-license: ${{ secrets.ADVINST_LICENSE_KEY }}
        advinst-enable-automation: 'true'
        aip-path: "${{ env.App_Installer_Path }}\\Firefly Application.aip"
        aip-build-name: DefaultBuild
        aip-package-name: "installer.exe"
        aip-output-dir:  "${{ env.App_Installer_Path }}\\Installer"
        aip-commands: |
           SetSig 
            SetDigitalCertificateFile -file "${{ env.PFX_PATH }}"
        
    - name: Build Instrument Installer
      uses: caphyon/advinst-github-action@main
      with:
        advinst-version: '22.3'
        advinst-license: ${{ secrets.ADVINST_LICENSE_KEY }}
        advinst-enable-automation: 'true'
        aip-path: "${{ env.Instrument_Installer_Path }}\\Firefly Instrument.aip"
        aip-build-name: DefaultBuild
        aip-package-name: "installer.exe"
        aip-output-dir:  "${{ env.Instrument_Installer_Path }}\\Installer"
        aip-commands: |
           SetSig 
            SetDigitalCertificateFile -file "${{ env.PFX_PATH }}"
    - name: Delete installers
      run: gh release delete "Advanced_Installers"
      continue-on-error: true
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Delete PFX certificate
      shell: pwsh
      env:
        PFX_PATH: ${{ steps.create-pfx.outputs.PFX_PATH }}
      run: |
        Remove-Item -Path $env:PFX_PATH;
    - name: Create Release
      run: gh release create "Advanced_Installers" 
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    - name: Upload and rename Application
      run: ${{env.CIScript}} "${{ env.App_Installer_Path }}" "${{env.App_Installer_Name}}" "${{env.Ver}}" 
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  

    - name: Upload and rename Instrument
      run: ${{env.CIScript}} "${{ env.Instrument_Installer_Path }}" "${{env.Instrument_Installer_Name}}" "${{env.Ver}}" 
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

[Catalin]

Hello,

Thank you for providing the YAML file.

I've had a look over it and it looks just fine to me.

To be quite honest with you, I am not sure why this is happening - I'm thinking that perhaps some permissions or something else on your side that is causing this. I'm saying this because I've tried reproducing this by following the article and it worked just fine on my end - the setup was digitally signed just fine.

I will try to discuss with the article writer to see whether he has some more ideeas on this.

Best regards,
Catalin

[ReynoldsL05]

Is it possible that we set up the certificate in different ways? What steps did you take when creating the cert / converting it to a string?

[Catalin]

Hello,

I followed exactly the steps from the article.

In the article, it is said that storing the certificate directly can not be done, so I first encoded it using the PowerShell code and then stored the string into a secret.

After doing so, I simply used the provided code to "rebuild" the certificate from base64 form to the pfx form.

Best regards,
Catalin

[ReynoldsL05]

How did you generate the initial certificate before converting it to base 64?

[Catalin]

Hello,

I had a test certificate that I used.

The test certificate was created using PowerShell - it's a simple test certificate, not a commercial one.

Do you think that might have to do with this?

Best regards,
Catalin