how to do Code Signing via esigner from ssl.com without USB Token?

[timebuzzerfelix]

A few months ago ssl.com launched "esigner" and a CLI tool called CodeSignTool. This allows to sign apps for windows without a USB Token, even with EV Code Signing what normally needs the USB Token. This is really cool, allows for instance to build an app on a hosted build server and allows to fully automate the build process, no Token PIN has to be entered manually during the building process.

I haven't find any information how to setup this with electron-bulder. Is there someone who already did it?

Of course it would be super cool if electron-bulder would support the CodeSignTool, no need for local certificate and usb token anymore.

[HyperSprite]

I've done it, was going to do a writeup and submit a PR to the docs but since you have a pressing need, I'll just throw out what I have now.

I read through all the windows sign/singing on Unix etc. and you don't need much of it with this CodeSignTool. This was the most useful part and the basis for what I ended up doing.

After you have your certs paid for (and I assume you are using the team feature, were each user can have their own login)...

• Enroll using this guide for Team Sharing for eSigner Document and EV Code Signing Certificates and get the Authenticator setup. You can stop when you get to You’re now ready to start signing code or documents with the shared eSigner certificate. Don't worry about signing the docs at the end unless you want to, it won't make any difference.
• Download the CodeSignTool from ssl.com and unpack in a directory adjacent to your projects code (you only need one CodeSignTool per computer, not one per project you are signing, nothing changes in that dir). The ssl.com esigner codesigntool command guide has a download link and is a handy reference.
• For our purposes you will need the following values from ssl.com:
  • WINDOWS_SIGN_USER_NAME: the email address you use for ssl.com auth
  • WINDOWS_SIGN_USER_PASSWORD: your ssl.com password
  • WINDOWS_SIGN_CREDENTIAL_ID: the certificate's credential id, located on the certificate order page.
  • WINDOWS_SIGN_USER_TOTP: the totp code - on the certificate order page, use your PIN to Show QR Code and copy the secret code under the QR.

THESE ARE YOUR ssl.com CREDENTIALS, BE CAREFUL WITH THEM!

This example uses these values running under process.env, you can devise your own way to set these values, but for example sake, we'll just prepend them to our yarn release like:

WINDOWS_SIGN_USER_NAME=my@example.com WINDOWS_SIGN_USER_PASSWORD=myPasswordWithoutBashEscapeCharsIntIt WINDOWS_SIGN_CREDENTIAL_ID=someCredentialId WINDOWS_SIGN_USER_TOTP=totpThing yarn release 

You will need to update your electron builder section, it no longer needs the certificateSubjectName but will need a path to our code sign script:

"win": {
  "signingHashAlgorithms": ["sha256"],
  "sign": "./sign.js",
  "target": ["nsis"]
}

"signingHashAlgorithms": ["sha256"], is optional, see this to decide

And here's the ./sign.js script that should be located in the root of your project.

const path = require('path');
const fs = require('fs');
const childProcess = require('child_process');

const TEMP_DIR = path.join(__dirname, 'release', 'temp');

if (!fs.statSync(TEMP_DIR).isDirectory()) {
  fs.mkdirSync(TEMP_DIR);
}

function sign(configuration) {
  // credentials from ssl.com
  const USER_NAME = process.env.WINDOWS_SIGN_USER_NAME;
  const USER_PASSWORD = process.env.WINDOWS_SIGN_USER_PASSWORD;
  const CREDENTIAL_ID = process.env.WINDOWS_SIGN_CREDENTIAL_ID;
  const USER_TOTP = process.env.WINDOWS_SIGN_USER_TOTP;
  if (USER_NAME && USER_PASSWORD && USER_TOTP && CREDENTIAL_ID) {
    console.log(`Signing ${configuration.path}`);
    const { name, dir } = path.parse(configuration.path);
    // CodeSignTool can't sign in place without verifying the overwrite with a
    // y/m interaction so we are creating a new file in a temp directory and
    // then replacing the original file with the signed file.
    const tempFile = path.join(TEMP_DIR, name);
    const setDir = `cd ../CodeSignTool-v1.2.0-windows`;
    const signFile = `CodeSignTool sign -input_file_path="${configuration.path}" -output_dir_path="${TEMP_DIR}" -credential_id="${CREDENTIAL_ID}" -username="${USER_NAME}" -password="${USER_PASSWORD}" -totp_secret="${USER_TOTP}"`;
    const moveFile = `mv "${tempFile}" "${dir}"`;
    childProcess.execSync(`${setDir} && ${signFile} && ${moveFile}`, { stdio: 'inherit' });
  } else {
    console.warn(`sign.js - Can't sign file ${configuration.path}, missing value for:
${USER_NAME ? '' : 'WINDOWS_SIGN_USER_NAME'}
${USER_PASSWORD ? '' : 'WINDOWS_SIGN_USER_PASSWORD'}
${CREDENTIAL_ID ? '' : 'WINDOWS_SIGN_CREDENTIAL_ID'}
${USER_TOTP ? '' : 'WINDOWS_SIGN_USER_TOTP'}
`);
    process.exit(1);
  }
}

exports.default = sign;

Let me know if you have any questions etc.

[timebuzzerfelix]

Christopher you're a hero, thank you very much!

INFO
In my case the email address does not work in WINDOWS_SIGN_USER_NAME, only the username

ISSUE 1
My target folder is called dist, so the temp files should go into dist/temp
but if there's no temp folder, the fs.mkdirSync(TEMP_DIR); does not create one. It only works if I add the temp folder manually.
Do you have any idea?

ISSUE 2
Regarding const moveFile = `mv "${tempFile}" "${dir}"`;

1. I had to change the "mv" into "move"
2. I had to extend it with .exe So now the line looks like this:

const moveFile = `move "${tempFile}.exe" "${dir}"`;

Seems ok in case we're signing .exe files only

ISSUE 3
It worked if I put all the SSL.com credentials into the sign.js file. I tried your approach with
WINDOWS_SIGN_USER_NAME=my@example.com WINDOWS_SIGN_USER_PASSWORD=myPasswordWithoutBashEscapeCharsIntIt WINDOWS_SIGN_CREDENTIAL_ID=someCredentialId WINDOWS_SIGN_USER_TOTP=totpThing yarn release
but didn't work. Do I understand right that this is the command you start the build process with?

IDEA
If someone wants to use an external build server service like travis-ci, I could be a good idea to extend the script that downloads and unpacks the CodeSignTool?

[HyperSprite]

This is some good feedback, like I said, I wasn't quite ready to write this stuff up so I knew there would be issues.

You might be in a better place to test some of these things than I am, I primarily use a Mac to dev, going so far as to use VS Code though ssh to my Windows VM so I am on it as little as possible. So some things might work for me differently than a typical Windows dev env.

• ISSUE 1: Node has docs about caveats with fs on windows and you may be falling into one of those when it tries to create the folder. I have all my code in c:\code\... because I don't trust Windows paths since back to the Win98 days. Try logging out TEMP_DIR to see if it is where you expect it to be. It could also be a permissions issue. Hard to say there.

• ISSUE 2:

  • 2.a - mv vs move, oh yeah, I use bash on Windows, so this difference makes sense.
  • 2.b - I think these two lines need to be changed so you don't need to add the exe:

    const { name, dir } = path.parse(configuration.path);
    const tempFile = path.join(TEMP_DIR, name);
  

  to

    const { base, dir } = path.parse(configuration.path);
    const tempFile = path.join(TEMP_DIR, base);
  

• ISSUE 3: tl;dr, this might need cross-env for powershell/cmd. Go read Kent's description at the link.

  • More context: Did you try logging them out? I don't put the real credentials on process.env on the command line. I have another script that I run once to collect my env vars and save them into an encrypted file, then pass only a PASSWORD=<some made up password i only use for this build process> yarn release but the results should be the same because the script still reads process.env for the PASSWORD. This too might be a difference with bash and powershell or cmd. I see a lot of stackoverflow questions about the issue of not passing process.env but it's always worked fine for me so I've been scratching my head. cross-env package might be what is needed for non-bash.

• IDEA: yeah, wouldn't that be great. I only got any signing working last week so getting the CI stuff to work would be nice but I haven't got the time or need quite yet to prioritize that right now. Be happy to test or help out if I can.

[timebuzzerfelix]

It's a few months ago, now SSL.com changed it and the service is now not free anymore.. Seems they want a subscription fee. Not very cool if you need signing your app only few times a year.. Is there any other solution on the market for signing apps on Github actions with an EV code signing certificate without a usb dongle?

[stale]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[mhellsten-ml]

Thanks for this! One more small tweak:

The temp dir creation didn't work for me, but this does:

if (!fs.existsSync(TEMP_DIR)) {
  fs.mkdirSync(TEMP_DIR, { recursive: true });
}

[arjun-formicsio]

Hey does the ssl.com code signing certificate still work to sign electron apps? I'm trying to build an electron app that has code signing and I'm considering this code signing certificate:
https://www.ssl.com/certificates/code-signing/
Is this still working?

Thanks

[t3chguy]

@arjun-formicsio I managed to do SSL.com eSigner signing in a much simpler manner using the codesign support in electron-builder along with SSL.com's Cloud Key Adapter. You can see it at https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_windows.yaml#L118-L163

[mhellsten-ml]

Is this still working?

Yes

[c960657]

@arjun-formicsio I managed to do SSL.com eSigner signing in a much simpler manner using the codesign support in electron-builder along with SSL.com's Cloud Key Adapter. You can see it at https://github.com/vector-im/element-desktop/blob/develop/.github/workflows/build_windows.yaml#L118-L163

Thanks, this was very useful 🤷‍♂️.

For those using this approach, make sure that you specify signingHashAlgorithms and override SIGNTOOL_PATH (apparently the version of SignTool.exe included in electron-builder isn't sufficient).