Sign with the materialized PFX before trying the cert store - #10
Merged
Conversation
Try-SignFile preferred thumbprint/store signing whenever THEMETOGGLE_SIGN_CERT_THUMBPRINT was set. Passing that secret to the CI build step (required by the tagged-release guard) therefore switched CI to store lookup, where the release cert does not exist, and signtool failed with "No certificates were found". The materialized PFX is the signing credential; the thumbprint is the verify-step identity pin. Store signing remains the local path when no PFX is configured. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the release signing logic in tools/release/build-and-publish.ps1 so CI prefers signing with the materialized PFX on disk before attempting certificate-store (thumbprint) signing, aligning the script’s behavior with how the GitHub Actions release workflow provides the signing credential.
Changes:
- Switch signing credential precedence to PFX-first, with thumbprint/store signing as fallback when no PFX is configured.
- Improve inline documentation explaining the CI vs local signing paths and the role of the pinned thumbprint.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+162
to
+165
| if (-not $password) { | ||
| $secure = Read-Host "Enter PFX password" -AsSecureString | ||
| $password = Get-PlainTextFromSecureString $secure | ||
| } |
| if (-not $pfxPath) { $pfxPath = $env:PFX_PATH } | ||
|
|
||
| if ($pfxPath) { | ||
| if (-not (Test-Path $pfxPath)) { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second v1.6.0 release attempt failed at signing: with
THEMETOGGLE_SIGN_CERT_THUMBPRINTnow visible to the build step (required by the tagged-release guard),Try-SignFilechose thumbprint/store signing — but CI's release cert exists only as the materialized PFX on disk, so signtool found no store certificate. This flips the precedence to PFX-first; thumbprint/store signing stays as the local path when no PFX is configured. The verify step continues to pin the signer thumbprint.Validated with
tools\validate-release-workflow.ps1. Tag will be re-pushed after merge (no release was published by the failed runs).🤖 Generated with Claude Code