Skip to content

Merge rc to beta#19136

Merged
SaschaCowley merged 1 commit into
betafrom
rc
Oct 24, 2025
Merged

Merge rc to beta#19136
SaschaCowley merged 1 commit into
betafrom
rc

Conversation

@SaschaCowley

Copy link
Copy Markdown
Member

No description provided.

Fixes #19099
Supersedes #18384

### Summary of the issue:

Some files are not signed some of the time

### Description of user facing changes:

None

### Description of developer facing changes:

In the case of alpha, beta, rc, stable and try builds, failure to sign
the launcher or most of our executables will fail the build.
All CI builds now run serially to avoid race conditions.

### Description of development approach:

Set the `ErrorAction` common parameter on `Send-SigningRequest` to
`Stop` to cause the signing script to fail if the cmd-let fails.
Use `Get-AuthenticodeSignature` to verify the signature of files after
`Submit-SigningRequest` returns.

### Testing strategy:

CI

* [x] Successful signing:
https://github.com/nvaccess/nvda/actions/runs/18733609673
  * Note that this run's failure was due to a system test failure
* Checked that the launcher and all `dll` and `exe` files are signed.
Found unsigned `exe`s and `dll` s by unzipping the controller client and
launcher into the same directory, and running:
    
    ```ps1
(Get-ChildItem -Recurse -Include *.exe, *.dll -Name |
Get-AuthenticodeSignature | where-object {$_.Status -ne 'Valid'}).Path
    ```

    The following files do not have valid signatures:

    * `app\brailleDisplayDrivers\lilli.dll`
    * `app\miscDeps\tools\msgfmt.exe`
    * `app\synthDrivers\espeak.dll`
    * `app\synthDrivers\sonic.dll`
    * `app\brlapi-0.8.dll`
    * `app\libgcc_s_dw2-1.dll`
    * `app\wxbase32u_net_vc140.dll`
    * `app\wxbase32u_vc140.dll`
    * `app\wxmsw32u_aui_vc140.dll`
    * `app\wxmsw32u_core_vc140.dll`
    * `app\wxmsw32u_html_vc140.dll`
    * `app\wxmsw32u_stc_vc140.dll`
    * `Banner.dll`
    * `System.dll`

However, as best as I can tell, we never attempt to sign these files.

* [x] Intentionally don't sign a DLL:
https://github.com/nvaccess/nvda/actions/runs/18703904287
* [x] Intentionally don't sign the launcher:
https://github.com/nvaccess/nvda/actions/runs/18707118372

### Known issues with pull request:

None
Copilot AI review requested due to automatic review settings October 24, 2025 02:59
@SaschaCowley SaschaCowley requested a review from a team as a code owner October 24, 2025 02:59

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR merges changes from the rc branch to beta, enhancing the signing verification process and simplifying the SCons build configuration.

  • Adds comprehensive signature validation with detailed error reporting for signed files
  • Removes conditional core allocation logic in favor of a consistent single-core build approach

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
ci/scripts/sign.ps1 Adds signature verification after signing with detailed HTML reporting and proper error handling
ci/scripts/setSconsArgs.ps1 Simplifies build configuration by removing conditional core allocation logic

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment thread ci/scripts/sign.ps1
if ($null -eq $authenticodeSignature.SignerCertificate) {
"None"
} else {
$authenticodeSignature.SignerCertificate | ConvertTo-Html -fragment -Property Subject, Issuer, SerialNumber, Thumbprint, `

Copilot AI Oct 24, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extra spaces between 'Issuer,' and 'SerialNumber,' - should be single space for consistency with other properties.

Copilot uses AI. Check for mistakes.
Comment thread ci/scripts/sign.ps1
if ($null -eq $authenticodeSignature.TimestamperCertificate) {
"None"
} else {
$authenticodeSignature.TimestamperCertificate | ConvertTo-Html -fragment -Property Subject, Issuer, SerialNumber, Thumbprint,`

Copilot AI Oct 24, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extra spaces between 'Issuer,' and 'SerialNumber,' - should be single space for consistency with other properties.

Copilot uses AI. Check for mistakes.
@SaschaCowley SaschaCowley merged commit 9e4f46e into beta Oct 24, 2025
9 of 10 checks passed
@github-actions github-actions Bot added this to the 2026.1 milestone Oct 24, 2025
@SaschaCowley SaschaCowley removed this from the 2026.1 milestone Oct 24, 2025
@github-actions github-actions Bot requested a deployment to snapshot October 24, 2025 04:23 Abandoned
@github-actions github-actions Bot requested a deployment to production October 27, 2025 05:52 Abandoned
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants