axodotdev / axodotdev/cargo-dist

signing: signpath

Open
#1,693 1 comment 0 reactions 0 assignees View on GitHub
feature request - new integration
Dominant language
Rust
Stars
2.1k
Forks
149
Avg merge
1d 11h
Merged PRs (30d)
32

Description

Support signing on WIndows via signpath alongside the other options.

Signpath offers free code signing for [some open-source projects](https://about.signpath.io/product/open-source), as of recently GHA is supported. [Sample workflow using signpath for signing on GHA](https://github.com/starship/starship/blob/master/.github/workflows/release.yml#L127-L149). Successful signing also requires setting up an appropriate artifact configuration because uploads via GHA are zipped.

* Documentation for use with Appveyor: https://about.signpath.io/documentation/trusted-build-systems/appveyor
* Documentation for use with GHA: https://about.signpath.io/documentation/trusted-build-systems/github

Contributor guide

Open the contributing guide

Research direction

Start with the sample GitHub Actions workflow in .github/workflows/release.yml at lines 127-149, then read SignPath's GitHub Actions and AppVeyor documentation. Determine how cargo-dist's existing Windows signing options and zipped GHA artifacts are configured. Done means SignPath signing is supported alongside the other options with the required artifact configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, rust
Domain
ci-cd, operating-systems, release, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.