chore(build): sign all artifacts COMPASS-7549 #5349
Conversation
…n-all-artifacts
…mpass into sign-all-artifacts
mabaasit
changed the title
mabaasit
changed the title
| * @returns {Promise<void>} | ||
| */ | ||
| async function sign(src, garasign = _garasign) { | ||
| const variant = process.env.EVERGREEN_BUILD_VARIANT; |
There was a problem hiding this comment.
We have similar branching based on build variants in mongosh, and personally i find it hard to digest and maintain, it creates obscure dependencies between the CI and the code that may not be immediately clear, and relies on assumptions about the variants that may not stand true over time.
Could we do something different / more intentional to detect where to use ssh and where to use docker? For example, we could directly set this as a variable / expansion in CI: https://docs.devprod.prod.corp.mongodb.com/evergreen/Project-Configuration/Project-Configuration-Files#build-variants
name: ubuntu
expansions:
garasign_client_type: "remote"
Also, as a more radical thought, since it seems that we have docker only on ubuntu, is there a downside to always sign with SSH?
There was a problem hiding this comment.
ended up using remote signing client across. this makes our CI cleaner and similar across all build variants
In this PR, we are signing all the remaining compass artifacts - for windows, macos (zip only) and rhel. Steps to verify a files are similar to the one in #5334.
For windows
.exeand.msi, the files should have a digital signature, chrome (when downloading) and os (when installing) should not complain.Description
Checklist
Motivation and Context
Open Questions
Dependents
Types of changes