[OBJECT-16744] Add helpers for signing Nuget packages #57

Merged

PavelGrossSpb merged 2 commits from potyarkin/frostfs-sdk-csharp:feature/code-signing into master

2025-04-11 10:19:26 +00:00

potyarkin commented

2025-04-10 15:38:57 +00:00

Member

This PR introduces code signing for Nuget packages:

Root of trust is self-signed TrueCloudLab CA
Maintainer certificate is issued by CA administrator for one year
Maintainer private key MUST not leave the machine it was generated on
Users need to add TrueCloudLab Code Signing CA to the list of trusted roots
We use timestamp.digicert.com as a third-party RFC3161 timestamp authority
We do not use CRLs

The rest of documentation in the README.

Existing workflow for automated publishing of unsigned release nugets will be switched off. It will still be available for manual trigger as an escape hatch.

This PR introduces code signing for Nuget packages: - Root of trust is self-signed TrueCloudLab CA - Maintainer certificate is issued by CA administrator for one year - Maintainer private key MUST not leave the machine it was generated on - Users need to add [TrueCloudLab Code Signing CA](https://git.frostfs.info/potyarkin/frostfs-sdk-csharp/src/commit/9248874a9ec1bbfa1385bfc2d1b14fb148993db0/release/ca.cert) to the list of trusted roots - We use timestamp.digicert.com as a third-party RFC3161 timestamp authority - We do not use CRLs The rest of documentation in the [README](https://git.frostfs.info/potyarkin/frostfs-sdk-csharp/src/commit/9248874a9ec1bbfa1385bfc2d1b14fb148993db0/release/README.md). Existing workflow for automated publishing of unsigned release nugets will be switched off. It will still be available for manual trigger as an escape hatch.

potyarkin added 1 commit 2025-04-10 15:38:57 +00:00

[OBJECT-16744] Add helpers for signing Nuget packages

DCO / DCO (pull_request) Failing after 22s

Details

lint-build / dotnet8.0 (pull_request) Successful in 38s

Details

9248874a9e

Signed-off-by: Vitaliy Potyarkin <v.potyarkin@yadro.com>

requested review from PavelGrossSpb

2025-04-10 15:38:57 +00:00

potyarkin force-pushed feature/code-signing from 9248874a9e to 30af614558

2025-04-10 15:41:14 +00:00

Compare

potyarkin commented

2025-04-10 15:45:37 +00:00

Author

Member

@PavelGrossSpb, after merging this:

Run make maintainer.csr in repo top-level directory
- Use a strong unique passphrase for maintainer.key
Send maintainer.csr to me via corporate IM
Do not ever share maintainer.key with anyone!
I will generate maintainer.cert and will send it back to you

@PavelGrossSpb, after merging this: - Run `make maintainer.csr` in repo top-level directory - Use a strong unique passphrase for `maintainer.key` - Send `maintainer.csr` to me via corporate IM - Do not ever share `maintainer.key` with anyone! - I will generate `maintainer.cert` and will send it back to you

potyarkin added 1 commit 2025-04-11 07:34:52 +00:00

[#57 ] ci: Disable automatic publishing of unsigned nugets

DCO / DCO (pull_request) Successful in 23s

Details

lint-build / dotnet8.0 (pull_request) Successful in 41s

Details

lint-build / dotnet8.0 (push) Successful in 1m22s

Details

b390778201

We're switching to non-automatic process for publishing signed nugets,
unsigned workflow will still be available as an escape hatch but it won't
ever be triggered automatically.

Signed-off-by: Vitaliy Potyarkin <v.potyarkin@yadro.com>