The SignPath Plugin for Jenkins allows you to integrate code signing with SignPath in your Jenkins pipeline.
The following plugins must be installed:
- Credentials Binding [com.cloudbees.plugins.credentials]
- Git [hudson.plugins.git.util.Build]
- Pipeline
Make sure that the correct Jenkins URL is set unter Manage Jenkins / Configure system.
On SignPath.io:
- Add a Trusted Build System on SignPath and copy the generated Trusted Build System Token
- Link the Trusted Build System to all projects that are build with it
- Add one or more CI users (e.g. one per team) and copy the generated API Token
On Jenkins:
- Store the Trusted Build System Token in a System Credential (Under Manage Jenkins / Manage Credentials) with the id
SignPath.TrustedBuildSystemToken - Store the API Token(s) in a Credential so that it is available to the build pipelines of the respective projects (default id
SignPath.ApiToken)
Note: Currently, the SignPath plugin requires you to use git as your source control system. The git repository origin information is extracted and included in the signing request.
In your Jenkinsfile, make sure the artifacts to be signed are pushed to the master node by adding a stage e.g.
stage('Archive') {
steps {
archiveArtifacts artifacts: "build-output/**", fingerprint: true
}
}
Include the submitSigningRequest and optionally, the getSignedArtifact steps in your build pipeline. The artifacts to be signed need to be uploaded to the Jenkins master by calling the archiveArtifacts step.
stage('Sign with SignPath') {
steps {
submitSigningRequest(
organizationId: "${ORGANIZATION_ID}",
projectSlug: "${PROJECT_SLUG}",
signingPolicySlug: "${SIGNING_POLICY_SLUG}",
artifactConfigurationSlug: "${ARTIFACT_CONFIGURATION_SLUG}",
inputArtifactPath: "build-output/my-artifact.exe",
outputArtifactPath: "build-output/my-artifact.signed.exe",
waitForCompletion: true
)
}
}
stage('Sign with SignPath') {
steps {
script {
signingRequestId = submitSigningRequest(
organizationId: "${ORGANIZATION_ID}",
projectSlug: "${PROJECT_SLUG}",
signingPolicySlug: "${SIGNING_POLICY_SLUG}",
artifactConfigurationSlug: "${ARTIFACT_CONFIGURATION_SLUG}",
inputArtifactPath: "build-output/my-artifact.exe",
outputArtifactPath: "build-output/my-artifact.signed.exe",
waitForCompletion: false
)
}
}
}
stage('Download Signed Artifact') {
input {
id "WaitForSigningRequestCompleted"
message "Has the signing request completed?"
}
steps{
getSignedArtifact(
organizationId: "${ORGANIZATION_ID}",
signingRequestId: "${signingRequestId}",
outputArtifactPath: "build-output/my-artifact.exe"
)
}
}
| Parameter | |
|---|---|
apiUrl |
(optional) The API endpoint of SignPath. Defaults to https://app.signpath.io/api |
apiTokenCredentialId |
The ID of the credential containing the API Token. Defaults to SignPath.ApiToken. Recommended in scope "Global". |
trustedBuildSytemTokenCredentialId |
The ID of the credential containing the Trusted Build System Token. Needs to be in scope "System". |
organizationId, projectSlug, signingPolicySlug |
Specify which organization, project and signing policy to use for signing. See the official documentation |
artifactConfigurationSlug |
(optional). Specify which artifact configuration to use. See the official documentation |
inputArtifactPath |
The relative path of the artifact to be signed |
outputArtifactPath |
The relative path where the signed artifact is stored after signing |
artifactConfigurationSlug |
(optional) The artifact configuration slug to use for signing |
waitForCompletion |
Set to true for synchronous and false for asynchronous signing requests |
serviceUnavailableTimeoutInSeconds |
(optional, defaults to 600) Total time in seconds that the cmdlet will wait for a single service call to succeed (across several retries). |
uploadAndDownloadRequestTimeoutInSeconds |
(optional, defaults to 300) HTTP timeout used for upload and download HTTP requests. |
waitForCompletionTimeoutInSeconds |
(optional, defaults to 600) Maximum time in seconds that the step will wait for the signing request to complete. |
https://ci.jenkins.io/job/Plugins/job/signpath-plugin/
https://about.signpath.io/documentation/changelog/?component=jenkins_plugin
The plugin is compatible with Jenkins 2.359 or higher.
Please refer to the support available in your respective SignPath edition.
Copyright by SignPath GmbH
The SignPath Jenkins Plugin is being developed by SignPath and licensed under the GNU General Public License v3 (GPL-3)