From 191c12b0c993bbc66cfc165161ba32c2fc89f947 Mon Sep 17 00:00:00 2001 From: Chaim Date: Mon, 11 May 2026 16:49:37 +0000 Subject: [PATCH] fix(ci): mage -Sign via -CertFile/.pfx (avoid cert store lookup quirks) Co-Authored-By: Claude Opus 4.7 (1M context) --- .gitea/workflows/build.yml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 3c2c45e..295856a 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -291,11 +291,18 @@ jobs: New-Item -ItemType Directory -Force -Path $appFilesDir | Out-Null Copy-Item -Recurse -Force "$appBin/*" $appFilesDir + # Write the PFX to disk so mage can sign via -CertFile (more reliable + # than -CertHash under LocalSystem). + $signPfx = Join-Path $env:TEMP "sign-$([Guid]::NewGuid()).pfx" + [IO.File]::WriteAllBytes($signPfx, [Convert]::FromBase64String($env:PFX_B64)) + & "$env:MAGE" -New Application -ToFile "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" ` -Name "Marcus-Law OutlookAddin" -Version $version -FromDirectory $appFilesDir -TrustLevel FullTrust - if ($LASTEXITCODE -ne 0) { throw "mage -New failed" } + if ($LASTEXITCODE -ne 0) { throw "mage -New Application failed" } - & "$env:MAGE" -Sign "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" -CertHash $thumb -TimeStampUri http://timestamp.digicert.com + & "$env:MAGE" -Sign "$appFilesDir/MarcusLaw.OutlookAddin.dll.manifest" ` + -CertFile $signPfx -Password $env:PFX_PWD ` + -TimeStampUri http://timestamp.digicert.com if ($LASTEXITCODE -ne 0) { throw "mage -Sign app manifest failed" } # Create the deployment manifest (.vsto) directly via -New Deployment. @@ -311,8 +318,11 @@ jobs: -Install true if ($LASTEXITCODE -ne 0) { throw "mage -New Deployment failed" } - & "$env:MAGE" -Sign "$publishDir/OutlookAddin.vsto" -CertHash $thumb -TimeStampUri http://timestamp.digicert.com + & "$env:MAGE" -Sign "$publishDir/OutlookAddin.vsto" ` + -CertFile $signPfx -Password $env:PFX_PWD ` + -TimeStampUri http://timestamp.digicert.com if ($LASTEXITCODE -ne 0) { throw "mage -Sign deployment manifest failed" } + Remove-Item -Force $signPfx Get-ChildItem -Recurse -File "$appFilesDir" | ? { $_.Extension -notin '.manifest','.deploy' } |