Skip to content

Validate launcher in CI#18384

Closed
SaschaCowley wants to merge 5 commits into
masterfrom
validateLauncher
Closed

Validate launcher in CI#18384
SaschaCowley wants to merge 5 commits into
masterfrom
validateLauncher

Conversation

@SaschaCowley

Copy link
Copy Markdown
Member

Link to issue number:

None

Summary of the issue:

If launcher signing fails, the release may still be deployed.

Description of user facing changes:

None

Description of developer facing changes:

Extra step in CI

Description of development approach:

Check the certificate authenticode signature is valid in CI.

Testing strategy:

Ran locally. Ran on CI.

Known issues with pull request:

Currently probably messes up CI due to exiting with an error status.

Code Review Checklist:

  • Documentation:
    • Change log entry
    • User Documentation
    • Developer / Technical Documentation
    • Context sensitive help for GUI changes
  • Testing:
    • Unit tests
    • System (end to end) tests
    • Manual testing
  • UX of all users considered:
    • Speech
    • Braille
    • Low Vision
    • Different web browsers
    • Localization in other languages / culture than English
  • API is compatible with existing add-ons.
  • Security precautions taken.

@coderabbitai summary

@SaschaCowley SaschaCowley added the conceptApproved Similar 'triaged' for issues, PR accepted in theory, implementation needs review. label Jul 15, 2025
SaschaCowley added a commit that referenced this pull request Oct 24, 2025
Fixes #19099
Supersedes #18384

### Summary of the issue:

Some files are not signed some of the time

### Description of user facing changes:

None

### Description of developer facing changes:

In the case of alpha, beta, rc, stable and try builds, failure to sign
the launcher or most of our executables will fail the build.
All CI builds now run serially to avoid race conditions.

### Description of development approach:

Set the `ErrorAction` common parameter on `Send-SigningRequest` to
`Stop` to cause the signing script to fail if the cmd-let fails.
Use `Get-AuthenticodeSignature` to verify the signature of files after
`Submit-SigningRequest` returns.

### Testing strategy:

CI

* [x] Successful signing:
https://github.com/nvaccess/nvda/actions/runs/18733609673
  * Note that this run's failure was due to a system test failure
* Checked that the launcher and all `dll` and `exe` files are signed.
Found unsigned `exe`s and `dll` s by unzipping the controller client and
launcher into the same directory, and running:
    
    ```ps1
(Get-ChildItem -Recurse -Include *.exe, *.dll -Name |
Get-AuthenticodeSignature | where-object {$_.Status -ne 'Valid'}).Path
    ```

    The following files do not have valid signatures:

    * `app\brailleDisplayDrivers\lilli.dll`
    * `app\miscDeps\tools\msgfmt.exe`
    * `app\synthDrivers\espeak.dll`
    * `app\synthDrivers\sonic.dll`
    * `app\brlapi-0.8.dll`
    * `app\libgcc_s_dw2-1.dll`
    * `app\wxbase32u_net_vc140.dll`
    * `app\wxbase32u_vc140.dll`
    * `app\wxmsw32u_aui_vc140.dll`
    * `app\wxmsw32u_core_vc140.dll`
    * `app\wxmsw32u_html_vc140.dll`
    * `app\wxmsw32u_stc_vc140.dll`
    * `Banner.dll`
    * `System.dll`

However, as best as I can tell, we never attempt to sign these files.

* [x] Intentionally don't sign a DLL:
https://github.com/nvaccess/nvda/actions/runs/18703904287
* [x] Intentionally don't sign the launcher:
https://github.com/nvaccess/nvda/actions/runs/18707118372

### Known issues with pull request:

None
bramd pushed a commit to bramd/nvda that referenced this pull request Nov 11, 2025
Fixes nvaccess#19099
Supersedes nvaccess#18384

### Summary of the issue:

Some files are not signed some of the time

### Description of user facing changes:

None

### Description of developer facing changes:

In the case of alpha, beta, rc, stable and try builds, failure to sign
the launcher or most of our executables will fail the build.
All CI builds now run serially to avoid race conditions.

### Description of development approach:

Set the `ErrorAction` common parameter on `Send-SigningRequest` to
`Stop` to cause the signing script to fail if the cmd-let fails.
Use `Get-AuthenticodeSignature` to verify the signature of files after
`Submit-SigningRequest` returns.

### Testing strategy:

CI

* [x] Successful signing:
https://github.com/nvaccess/nvda/actions/runs/18733609673
  * Note that this run's failure was due to a system test failure
* Checked that the launcher and all `dll` and `exe` files are signed.
Found unsigned `exe`s and `dll` s by unzipping the controller client and
launcher into the same directory, and running:
    
    ```ps1
(Get-ChildItem -Recurse -Include *.exe, *.dll -Name |
Get-AuthenticodeSignature | where-object {$_.Status -ne 'Valid'}).Path
    ```

    The following files do not have valid signatures:

    * `app\brailleDisplayDrivers\lilli.dll`
    * `app\miscDeps\tools\msgfmt.exe`
    * `app\synthDrivers\espeak.dll`
    * `app\synthDrivers\sonic.dll`
    * `app\brlapi-0.8.dll`
    * `app\libgcc_s_dw2-1.dll`
    * `app\wxbase32u_net_vc140.dll`
    * `app\wxbase32u_vc140.dll`
    * `app\wxmsw32u_aui_vc140.dll`
    * `app\wxmsw32u_core_vc140.dll`
    * `app\wxmsw32u_html_vc140.dll`
    * `app\wxmsw32u_stc_vc140.dll`
    * `Banner.dll`
    * `System.dll`

However, as best as I can tell, we never attempt to sign these files.

* [x] Intentionally don't sign a DLL:
https://github.com/nvaccess/nvda/actions/runs/18703904287
* [x] Intentionally don't sign the launcher:
https://github.com/nvaccess/nvda/actions/runs/18707118372

### Known issues with pull request:

None
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

conceptApproved Similar 'triaged' for issues, PR accepted in theory, implementation needs review.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant