juli/OrcaSlicer
1
1
Fork 0
mirror of https://github.com/OrcaSlicer/OrcaSlicer.git synced 2026-07-26 04:12:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci(windows): wire SignPath test-signing for portable bundle

Browse Source 
Add SignPath artifact configuration (windows-portable-v1) signing only the
first-party binaries orca-slicer.exe and OrcaSlicer.dll, plus verification
and inventory scripts. The Windows build job uploads the unsigned portable
bundle, submits it to SignPath (test-signing), verifies the returned
signatures, and rebuilds the installer/zip from the signed binaries.

project-slug matches the SignPath project (OrcaSlicer).
This commit is contained in:
SoftFever
2026-05-29 23:41:39 +08:00
parent 6b55e324c9
commit ebdfa74ce8
6 changed files with 206 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
signpath/README.md Normal file
View File

@@ -0,0 +1,16 @@
# SignPath configurations
This directory contains SignPath artifact configurations used by GitHub Actions.
## `windows-portable-v1`
`windows-portable-v1.xml` is the initial conservative Windows portable-bundle signing configuration. It signs only the two first-party binaries:
- `orca-slicer.exe`
- `OrcaSlicer.dll`
Do not broaden this to all DLLs without first confirming ownership, provenance, and whether upstream vendor signatures should be verified instead.
The Windows workflow uploads `${{ github.workspace }}/build/OrcaSlicer` with `actions/upload-artifact`. GitHub stores that artifact as a ZIP, and the uploaded directory contents are rooted at the ZIP root. Because of that, the SignPath configuration uses `<zip-file>` with `orca-slicer.exe` and `OrcaSlicer.dll` directly beneath it.
The release portable ZIP is a separate archive created with 7-Zip from `${{ github.workspace }}/build/OrcaSlicer`; that archive keeps the top-level `OrcaSlicer/` folder. After SignPath returns the signed artifact, the workflow copies the signed files back into `build/OrcaSlicer` and recreates the portable release ZIP so the public ZIP layout stays unchanged.

12
signpath/windows-portable-v1.xml Normal file
View File

@@ -0,0 +1,12 @@
<?xml version="1.0" encoding="utf-8"?>
<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
<zip-file>
<pe-file path="orca-slicer.exe">
<authenticode-sign />
</pe-file>
<pe-file path="OrcaSlicer.dll">
<authenticode-sign />
</pe-file>
</zip-file>
</artifact-configuration>