From a8af5e374907ca4759063f11df307d37e8cfdea8 Mon Sep 17 00:00:00 2001 From: Chaim Date: Mon, 11 May 2026 16:17:05 +0000 Subject: [PATCH] fix(ci): import cert to CurrentUser\My + patch csproj thumbprint VSTO's ResolveKeySource target reads ManifestCertificateThumbprint directly from csproj XML (not from /p: overrides) and looks for it under Cert:\CurrentUser\My (not LocalMachine\My). Import the cert to CurrentUser\My before build and patch the csproj XML to use the real Marcus-Law thumbprint instead of VS's temporary-key thumbprint. Co-Authored-By: Claude Opus 4.7 (1M context) --- .gitea/workflows/build.yml | 82 ++++++++++++++++++++++++++++++-------- 1 file changed, 66 insertions(+), 16 deletions(-) diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml index 0f52b10..617c4c0 100644 --- a/.gitea/workflows/build.yml +++ b/.gitea/workflows/build.yml @@ -40,17 +40,47 @@ jobs: Write-Host "Using MSBuild from $msbuildDir" Add-Content -Path $env:GITHUB_PATH -Value $msbuildDir + - name: Import code-signing cert into CurrentUser\My + # The VSTO ResolveKeySource target reads ManifestCertificateThumbprint + # straight from the csproj XML and looks for it under Cert:\CurrentUser\My + # (not LocalMachine\My). Import the real Marcus-Law cert there. + shell: powershell + env: + PFX_B64: ${{ secrets.CODESIGN_CERT_PFX_BASE64 }} + PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }} + THUMB: ${{ secrets.CODESIGN_THUMBPRINT }} + run: | + $existing = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue | + Where-Object { $_.Thumbprint -eq $env:THUMB } + if ($existing) { Write-Host "Cert already in CurrentUser\My."; return } + $pfxBytes = [Convert]::FromBase64String($env:PFX_B64) + $tmp = Join-Path $env:TEMP "codesign-$([Guid]::NewGuid()).pfx" + [IO.File]::WriteAllBytes($tmp, $pfxBytes) + $pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText + Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null + Remove-Item -Force $tmp + Write-Host "Cert imported into CurrentUser\My." + + - name: Patch csproj to use real cert thumbprint + # VS's compile-time manifest signing reads the thumbprint from the + # csproj XML (not from /p: overrides), so we rewrite it in place to + # point at our Marcus-Law cert. + shell: powershell + env: + THUMB: ${{ secrets.CODESIGN_THUMBPRINT }} + run: | + $csproj = 'src/OutlookAddin/OutlookAddin.csproj' + $orig = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256' + $content = Get-Content $csproj -Raw + $patched = $content -replace [regex]::Escape($orig), $env:THUMB + if ($patched -eq $content) { Write-Warning "Thumbprint $orig not present in csproj." } + else { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched: $orig -> $env:THUMB" } + - name: Build (restore + compile) # `msbuild /restore` runs restore and build in the same MSBuild process, - # which keeps the NuGet package cache + project.assets.json + assembly - # resolution consistent (avoids NETSDK1064 from a mismatch between a - # standalone `nuget restore` and the later build). - # VSTO mandates SignManifests=true (the build aborts otherwise). The - # project's hardcoded ManifestCertificateThumbprint points to VS's - # auto-generated temporary key which doesn't exist on the runner, so - # override it with the real Marcus-Law cert that lives in - # LocalMachine\My (migrated there by 2-install-windows-runner.ps1). - run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m + # so the package cache + project.assets.json + assembly resolution stay + # consistent (avoids NETSDK1064). + run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m - name: Test run: dotnet test src/OutlookAddin.Tests/OutlookAddin.Tests.csproj --configuration Release --no-build --logger "trx;LogFileName=test-results.trx" @@ -113,7 +143,7 @@ jobs: "versionUscore=$($version -replace '\.','_')" | Out-File -Append $env:GITHUB_OUTPUT Write-Host "Version: $version" - - name: Ensure code-signing cert in LocalMachine\My + - name: Ensure code-signing cert in CurrentUser\My AND LocalMachine\My shell: powershell env: THUMB: ${{ secrets.CODESIGN_THUMBPRINT }} @@ -121,6 +151,19 @@ jobs: PFX_PWD: ${{ secrets.CODESIGN_CERT_PASSWORD }} run: | $thumb = $env:THUMB + # Import to CurrentUser\My (where VSTO ResolveKeySource looks). + $inUser = Get-ChildItem Cert:\CurrentUser\My -ErrorAction SilentlyContinue | + Where-Object { $_.Thumbprint -eq $thumb } + if (-not $inUser) { + $pfxBytes = [Convert]::FromBase64String($env:PFX_B64) + $tmp = Join-Path $env:TEMP "cs-$([Guid]::NewGuid()).pfx" + [IO.File]::WriteAllBytes($tmp, $pfxBytes) + $pwd = ConvertTo-SecureString -String $env:PFX_PWD -Force -AsPlainText + Import-PfxCertificate -FilePath $tmp -CertStoreLocation Cert:\CurrentUser\My -Password $pwd | Out-Null + Remove-Item -Force $tmp + Write-Host "Imported into CurrentUser\My." + } else { Write-Host "Already in CurrentUser\My." } + $found = Get-ChildItem Cert:\LocalMachine\My -ErrorAction SilentlyContinue | Where-Object { $_.Thumbprint -eq $thumb } if ($found) { @@ -138,13 +181,20 @@ jobs: Remove-Item -Force $tmpPfx Write-Host "Cert imported." + - name: Patch csproj to use real cert thumbprint + shell: powershell + env: + THUMB: ${{ secrets.CODESIGN_THUMBPRINT }} + run: | + $csproj = 'src/OutlookAddin/OutlookAddin.csproj' + $orig = '2399E9BF73820F3B1FC744BCBFA7F82D536E3256' + $content = Get-Content $csproj -Raw + $patched = $content -replace [regex]::Escape($orig), $env:THUMB + if ($patched -ne $content) { Set-Content -Path $csproj -Value $patched -NoNewline; Write-Host "Patched csproj." } + else { Write-Warning "Original thumbprint not present in csproj." } + - name: Build Release (restore + compile) - # VSTO mandates SignManifests=true (the build aborts otherwise). The - # project's hardcoded ManifestCertificateThumbprint points to VS's - # auto-generated temporary key which doesn't exist on the runner, so - # override it with the real Marcus-Law cert that lives in - # LocalMachine\My (migrated there by 2-install-windows-runner.ps1). - run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /p:ManifestCertificateThumbprint=${{ secrets.CODESIGN_THUMBPRINT }} /p:ManifestKeyFile= /m + run: msbuild OutlookAddin.sln /restore /t:Build /p:Configuration=Release /p:Platform="Any CPU" /m # Code signing -- cert in LocalMachine\My (or CurrentUser\My); signtool # picks it by thumbprint, the service runs as LocalSystem so the runtime