sign

Action for code-signing Bonsai Foundation applications and installers via SSL.com eSigner cloud signing.

The action downloads a pinned release of CodeSignTool, then signs each requested file in place using the eSigner credentials supplied to it. Signing happens in the SSL.com cloud, so no certificate or private key is ever present on the runner.

Usage

Provide the files to sign and the eSigner credentials. Store the credentials as organization secrets scoped to the repositories that are allowed to sign:

- name: Sign
  uses: bonsai-rx/sign@v1
  with:
    files: path/to/App.exe
    username: ${{secrets.ES_USERNAME}}
    password: ${{secrets.ES_PASSWORD}}
    credential-id: ${{secrets.ES_CREDENTIAL_ID}}
    totp-secret: ${{secrets.ES_TOTP_SECRET}}

Multiple files can be signed in one call, separated by spaces or newlines:

  with:
    files: |
      path/to/App.exe
      path/to/Installer.msi

Testing against the sandbox

Set use-sandbox: true to sign against the SSL.com eSigner sandbox. The sandbox accepts the public demo credentials from SSL.com, so it can be exercised without any real secrets:

- name: Sign against sandbox
  uses: bonsai-rx/sign@v1
  with:
    files: sample.exe
    use-sandbox: true
    username: esigner_demo
    password: esignerDemo#1
    totp-secret: RDXYgV9qju+6/7GnMf1vCbKexXVJmUVr+86Wq/8aIGg=

Signatures produced against the sandbox are not publicly trusted, so they validate as signed but untrusted. This is expected and only confirms the signing pipeline works.

Documentation

See action.yml for the full list of input parameters supported by this action.