CM-23216 - Sign Windows CLI executable

.github/workflows/black.yml

@@ -36,6 +36,8 @@ jobs:
       - name: Setup Poetry
         if: steps.cached-poetry.outputs.cache-hit != 'true'
         uses: snok/install-poetry@v1
+        with:
+          version: 1.5.1
 
       - name: Add Poetry to PATH
         run: echo "$HOME/.local/bin" >> $GITHUB_PATH

.github/workflows/build_executable.yml

@@ -51,6 +51,8 @@ jobs:
       - name: Setup Poetry
         if: steps.cached-poetry.outputs.cache-hit != 'true'
         uses: snok/install-poetry@v1
+        with:
+          version: 1.5.1
 
       - name: Add Poetry to PATH
         run: echo "$HOME/.local/bin" >> $GITHUB_PATH
@@ -108,10 +110,51 @@ jobs:
           # we can't staple the app because it's executable. we should only staple app bundles like .dmg
           # xcrun stapler staple dist/cycode
 
-      - name: Test signed executable
+      - name: Test macOS signed executable
         if: ${{ startsWith(matrix.os, 'macos') }}
         run: ./dist/cycode version
 
+      - name: Import cert for Windows and setup envs
+        if: ${{ startsWith(matrix.os, 'windows') }}
+        env:
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+        run: |
+          # import certificate
+          echo "$SM_CLIENT_CERT_FILE_B64" | base64 --decode > /d/Certificate_pkcs12.p12 
+          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
+
+          # add required soft to the path
+          echo "C:\Program Files (x86)\Windows Kits\10\App Certification Kit" >> $GITHUB_PATH  
+          echo "C:\Program Files\DigiCert\DigiCert One Signing Manager Tools" >> $GITHUB_PATH 
+
+      - name: Sign Windows executable
+        if: ${{ startsWith(matrix.os, 'windows') }}
+        shell: cmd
+        env:
+          SM_HOST: ${{ secrets.SM_HOST }}
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
+        run: |
+          :: setup SSM KSP
+          curl -X GET  https://one.digicert.com/signingmanager/api-ui/v1/releases/smtools-windows-x64.msi/download -H "x-api-key:%SM_API_KEY%" -o smtools-windows-x64.msi 
+          msiexec /i smtools-windows-x64.msi /quiet /qn
+          C:\Windows\System32\certutil.exe -csp "DigiCert Signing Manager KSP" -key -user
+          smksp_cert_sync.exe
+
+          :: sign executable
+          signtool.exe sign /sha1 %SM_CODE_SIGNING_CERT_SHA1_HASH% /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 ".\dist\cycode.exe" 
+
+      - name: Test Windows signed executable
+        if: ${{ startsWith(matrix.os, 'windows') }}
+        shell: cmd
+        run: |
+          :: call executable and expect correct output
+          .\dist\cycode.exe version
+
+          :: verify signature
+          signtool.exe verify /v /pa ".\dist\cycode.exe"
+
       - uses: actions/upload-artifact@v3
         with:
           name: cycode-cli-${{ matrix.os }}

.github/workflows/pre_release.yml

@@ -46,6 +46,8 @@ jobs:
       - name: Setup Poetry
         if: steps.cached-poetry.outputs.cache-hit != 'true'
         uses: snok/install-poetry@v1
+        with:
+          version: 1.5.1
 
       - name: Add Poetry to PATH
         run: echo "$HOME/.local/bin" >> $GITHUB_PATH

.github/workflows/release.yml

@@ -45,6 +45,8 @@ jobs:
       - name: Setup Poetry
         if: steps.cached-poetry.outputs.cache-hit != 'true'
         uses: snok/install-poetry@v1
+        with:
+          version: 1.5.1
 
       - name: Add Poetry to PATH
         run: echo "$HOME/.local/bin" >> $GITHUB_PATH

.github/workflows/ruff.yml

@@ -36,6 +36,8 @@ jobs:
       - name: Setup Poetry
         if: steps.cached-poetry.outputs.cache-hit != 'true'
         uses: snok/install-poetry@v1
+        with:
+          version: 1.5.1
 
       - name: Add Poetry to PATH
         run: echo "$HOME/.local/bin" >> $GITHUB_PATH

.github/workflows/tests.yml

@@ -39,6 +39,8 @@ jobs:
       - name: Setup Poetry
         if: steps.cached-poetry.outputs.cache-hit != 'true'
         uses: snok/install-poetry@v1
+        with:
+          version: 1.5.1
 
       - name: Add Poetry to PATH
         run: echo "$HOME/.local/bin" >> $GITHUB_PATH

.github/workflows/tests_full.yml

@@ -52,6 +52,8 @@ jobs:
       - name: Setup Poetry
         if: steps.cached-poetry.outputs.cache-hit != 'true'
         uses: snok/install-poetry@v1
+        with:
+          version: 1.5.1
 
       - name: Add Poetry to PATH
         run: echo "$HOME/.local/bin" >> $GITHUB_PATH