Our product has 4 apps (Windows, macOS, iOS & Android) with a partially combined build pipeline. 90% is run in the cloud (Android, iOS & macOS are built entirely on cloud infrastructure) but for Windows, in spite of it being the most straightforward of the 4 build processes, at one stage we have to grab the .exe and pull it onto a local PC sat in our office (which is my home office as we're fully remote), sign the thing with signtool using a Digicert physical key, and then upload it back to the cloud pipeline to complete processing.
This obviously introduces a point of failure/bottleneck in our process, which is that if that machine goes down and i'm on vacation, or my internet goes down for an afternoon, or the machine needs maintenance and i'm not about, then we can't build our Windows app.
One solution here would clearly be to buy a second Digicert key & NUC and have it in another employee's office as a failover (i'm the only DevOps so they wouldn't be solving the maintenance part so much), but i'd rather pull the entire step into the cloud and use cloudHSM (we're an AWS shop) to do this process.
Doing some research, I initially assumed this would be cost prohibitive ($1.45p/h for 1x HSM = $1450p/m, vs $699p/y for the Digicert key), however I found this article which suggests that if we don't need HA (we don't - builds only happen 2/3x per week on avg) it would obviously lower the cost dramatically.
The only security issue I can see is around the movement of the .exe in order to sign, however I believe I could mitigate this dramatically by keeping everything within the private VPC of the CI.
Does anyone have any experience with doing this, and what gotchas am I missing?
