axodotdev / axodotdev/cargo-dist
signing: signpath
- Dominant language
- Rust
- Stars
- 2.1k
- Forks
- 149
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 32
Description
Support signing on WIndows via signpath alongside the other options.
Signpath offers free code signing for [some open-source projects](https://about.signpath.io/product/open-source), as of recently GHA is supported. [Sample workflow using signpath for signing on GHA](https://github.com/starship/starship/blob/master/.github/workflows/release.yml#L127-L149). Successful signing also requires setting up an appropriate artifact configuration because uploads via GHA are zipped.
* Documentation for use with Appveyor: https://about.signpath.io/documentation/trusted-build-systems/appveyor
* Documentation for use with GHA: https://about.signpath.io/documentation/trusted-build-systems/github
Contributor guide
Research direction
Start with the sample GitHub Actions workflow in .github/workflows/release.yml at lines 127-149, then read SignPath's GitHub Actions and AppVeyor documentation. Determine how cargo-dist's existing Windows signing options and zipped GHA artifacts are configured. Done means SignPath signing is supported alongside the other options with the required artifact configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, rust
- Domain
- ci-cd, operating-systems, release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100