juli/OrcaSlicer
1
1
Fork 0
mirror of https://github.com/OrcaSlicer/OrcaSlicer.git synced 2026-06-22 19:50:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci(windows): tolerate untrusted root in signature verification for test cert

Browse Source 
signtool verify /pa exits non-zero when the certificate chain terminates in
an untrusted root, which is always the case for the SignPath self-signed test
certificate. Add an -AllowUntrustedRoot switch to verify-authenticode.ps1 that
accepts a signed-but-untrusted-root result (while still failing on unsigned or
otherwise invalid files), and pass it from the workflow during test-signing.

Remove the switch once signing-policy-slug moves to release-signing with a
production CA-issued certificate, so release builds enforce a fully trusted chain.
This commit is contained in:
SoftFever
2026-05-30 01:52:51 +08:00
parent ebdfa74ce8
commit 48acf4f13b
2 changed files with 39 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.github/workflows/build_orca.yml vendored
View File

@@ -323,7 +323,10 @@ jobs:
- name: Verify SignPath Windows portable signatures
if: github.repository == 'OrcaSlicer/OrcaSlicer' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && runner.os == 'Windows' && !vars.SELF_HOSTED
shell: pwsh
run: ./scripts/verify-authenticode.ps1 -ArtifactDirectory '${{ github.workspace }}/build/signpath/windows-portable'
# -AllowUntrustedRoot is required while signing with the SignPath test
# certificate (self-signed). Remove it once signing-policy-slug switches
# to release-signing with a production CA-issued certificate.
run: ./scripts/verify-authenticode.ps1 -ArtifactDirectory '${{ github.workspace }}/build/signpath/windows-portable' -AllowUntrustedRoot
- name: Replace Windows portable bundle with signed output
if: github.repository == 'OrcaSlicer/OrcaSlicer' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && runner.os == 'Windows' && !vars.SELF_HOSTED