2

I own a public and open-source Windows Forms/C# application in a Github repo that I want to start code signing with my certificate through Azure Pipelines CI. I have set up my pipeline and it is building fine, the next step is to integrate automatic code signing, which until this point I have been doing manually. I have taken the following steps:

After adding a task, the YML generating is:

- task: codesigning@2
  inputs:
    secureFileId: '$(certName)'
    signCertPassword: '$(certPass)'
    files: '**/*.exe'
    timeServer: 'http://timestamp.digicert.com'
    hashingAlgorithm: 'SHA256'

So, saving this, it is obviously going to update my azure-pipelines.yml in my repository. Is it possible to perform code signing in Azure Pipelines without exposing any information in the repository? Is this considered best practice for code-signing in Azure Pipelines?

Improve this question
2
  • Hey - incidentally, it would be worth posting how many users download your application as this materially affects the risk assessment; i.e. if you get 100,000 downloads a month then your application is a might greater target of attacks. If You get much less than that it's probably not enough of a target for an attacker to try and compromise your pipeline. I really like this question because you are demonstrating two good practices merged together, those being code signing and CI/CD - well done.
    – Richard Slater
    Commented Jul 31, 2019 at 19:50
  • @RichardSlater My application has typically less than 100 downloads per month, it is not that popular of a repository, but I wish to put the security of my project and userbase first and foremost.
    – Jason Bayldon
    Commented Jul 31, 2019 at 22:10

1 Answer 1

Reset to default
2

From what I can see you have done everything correctly, you have stored both the certificate material (i.e. the PFX) and the password for the PFX in a secure location that presumably no one else can access. Assuming you don't give anyone else permissions on your Azure tenant and you don't blindly accept pull requests that change azure-pipelines.yml then you are in a good place.

If you are feeling paranoid, then you could create a second pipeline using a private repository that is triggered when the previous pipeline completes successfully. However, IMHO, I would carefully consider the risk you are exposing yourself to against the complexity and fragility of trying to tie two pipelines together.

Improve this answer
1
  • Thank you, I have determined I will add the code signing process to azure-pipelines.yml for now. I couldn't see how this would pose any risk given I alone manage the project but my paranoia probably comes from my day job in secure software development.
    – Jason Bayldon
    Commented Jul 31, 2019 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.