new way of signing

Author: rozyczko

.github/workflows/build.yml

@@ -38,29 +38,38 @@ jobs:
 
       - name: Set up certificate
         run: |
-          echo "${{ secrets.WINDOWS_CERT_DATA }}" | base64 --decode > /d/Certificate_pkcs12.p12
+          echo "${{ secrets.CODESIGN_WIN_CERT_P12_BASE64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
         shell: bash
 
-      - name: Set variables
-        id: variables
-        run: |
-          #  echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
-          echo "SM_HOST=${{ secrets.KEYLOCKER_HOST }}" >> "$GITHUB_ENV"
-          echo "SM_API_KEY=${{ secrets.KEYLOCKER_API_KEY }}" >> "$GITHUB_ENV"
-          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.WINDOWS_CERT_PASSWORD }}" >> "$GITHUB_ENV"
-        shell: bash
+      - name: Setup Software Trust Manager
+          uses: digicert/code-signing-software-trust-action@v1
+          with:
+            simple-signing-mode: true
+            # If the below 2 parameters are supplied, then smctl executable is invoked to attempt the signing.
+            input: binary.exe
+            keypair-alias: key_1369544803
+          env:
+            SM_HOST: ${{ vars.CODESIGN_WIN_KEYLOCKER_HOST }}
+            SM_API_KEY: ${{ secrets.CODESIGN_WIN_KEYLOCKER_API_KEY }}
+            SM_CLIENT_CERT_FILE: D:\\Certificate_pkcs12.p12
+            SM_CLIENT_CERT_PASSWORD: ${{ secrets.CODESIGN_WIN_CERT_P12_PASSWORD }}
+          shell: bash
 
-      # - name: Signing using certificate fingerprint
-      #   run: |
-      #      smctl sign --fingerprint ${{ secrets.KEYLOCKER_CERT_SHA1_HASH }} --input binary.exe --config-file "C:\\Users\\RUNNER~1\\AppData\\Local\\Temp\\smtools-windows-x64\\pkcs11properties.cfg"
-      #   shell: cmd
 
+      # - name: Set variables
+      #   id: variables
+      #   run: |
+      #     echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+      #     echo "SM_HOST=${{ secrets.CODESIGN_WIN_KEYLOCKER_HOST }}" >> "$GITHUB_ENV"
+      #     echo "SM_API_KEY=${{ secrets.CODESIGN_WIN_KEYLOCKER_API_KEY }}" >> "$GITHUB_ENV"
+      #     echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
+      #     echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.CODESIGN_WIN_CERT_P12_PASSWORD }}" >> "$GITHUB_ENV"
+      #   shell: bash
+      # - name: Signing using keypair alias
+      #   run: |
+      #      # smctl sign --keypair-alias ${{ secrets.KEYLOCKER_KEYPAIR_ALIAS }} --input binary.exe
 
-      - name: Signing using keypair alias
-        run: |
-           smctl sign --keypair-alias ${{ secrets.KEYLOCKER_KEYPAIR_ALIAS }} --input binary.exe
-        shell: cmd
+      #   shell: cmd
 
       - name: upload signed installer
         uses: actions/upload-artifact@v4