Jens/ForgeFlow
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 24 Wiki Activity

test: prove Authenticode release chain

Browse Source
This commit is contained in:
NuklearRabbit
2026-07-29 19:58:35 +02:00
parent e5599f7a5d
commit 347f7132b9
5 changed files with 109 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/RELEASING.md
+14 -2
View File
@@ -17,7 +17,7 @@ certificate through its supported CSC environment variables, then set:
```powershell
$env:FORGEFLOW_SIGNED_RELEASE = '1'
$env:FORGEFLOW_EXPECTED_PUBLISHER = 'exact certificate subject fragment'
$env:FORGEFLOW_EXPECTED_PUBLISHER = 'CN=Exact Legal Publisher, O=Exact Legal Organization, C=BE'
npm run dist:win
```
@@ -35,5 +35,17 @@ the installer, portable executable, two checksums, provenance and SBOM. It only
publishes after all six assets are present. A failed upload leaves a draft rather
than exposing an incomplete updater target.
The production Authenticode certificate and legal publisher identity are
The publisher check is an exact subject match, not a substring match. Before a
production certificate is available, validate the complete local chain with:
```powershell
npm run test:signing
```
This disposable fixture signs installer, portable, update-helper and uninstaller
stand-ins, requires an RFC 3161 timestamp, and proves rejection of a missing
timestamp, wrong publisher and a modified binary. Its certificate is removed
from the current-user certificate store after the test.
The production Authenticode certificate and exact legal publisher identity are
`PENDING_HUMAN_INPUT`; all surrounding build and verification code is complete.