Skip to content

Add possibility to sign many Windows binaries at once

Ingo Klöcker requested to merge work/kloecker/optional-bulk-signing into master

If an expensive custom command is used for signing then performing tens or even hundreds of signing operations isn't an option. In this case, as many binaries as easily possible should be signed with a single signing operation.

For example, when packaging NeoChat then 101 signing operations are performed. 99 when copying the image directories (in CollectionPackagerBase.internalCreatePackage), 1 when signing the 7za.exe and 1 when signing the installer. If bulk signing is used then only 3 signing operations are performed with the first operation signing all binaries that are found in the archive directory.

I'm unsure whether signing all binaries in archiveDir works or if there are some binaries in archiveDir that shouldn't be signed. But, as far as I can see, also without bulk signing all binaries in archiveDir are signed (just not all in one go).

In summary a possible approach for bringing Windows signing with our signing service to GitLab is:

  • Cache is unsigned.
  • Signing is disabled for the --install-deps step.
  • Bulk signing is used for the --package step.

I have tested this approach with NeoChat: https://invent.kde.org/network/neochat/-/jobs/1521470 In this test the custom signing command is called, but the actual signing isn't performed because the work branch used for testing isn't cleared for signing.

An alternative approach would use cache signing, but I haven't investigated how this would work with the signing service (where each signing operation takes a long time).

By the way, using the signing service requires adding 3 more Python modules to dev-utils/python3 in Craft because Craft uses its own Python when running the signing service. I'll open another MR to discuss this.

Merge request reports