You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@daffodil.apache.org by sl...@apache.org on 2026/08/17 17:32:09 UTC
(daffodil-infrastructure) branch main updated: Rename ssl.com signing variables/inputs
This is an automated email from the ASF dual-hosted git repository.
stevedlawrence pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/daffodil-infrastructure.git
The following commit(s) were added to refs/heads/main by this push:
new d9e9378 Rename ssl.com signing variables/inputs
d9e9378 is described below
commit d9e937883c64459d336e2618bb1fbd2b2163390b
Author: Steve Lawrence <sl...@apache.org>
AuthorDate: Mon Aug 17 07:24:34 2026 -0400
Rename ssl.com signing variables/inputs
This more closely matches the ASF provided secrets and jsign option names
DAFFODIL-3090
---
actions/release-candidate/README.md | 31 ++++++++++++++--------------
actions/release-candidate/action.yml | 11 ++++------
actions/release-candidate/dist/post/index.js | 11 +++++-----
actions/release-candidate/src/post.js | 11 +++++-----
4 files changed, 29 insertions(+), 35 deletions(-)
diff --git a/actions/release-candidate/README.md b/actions/release-candidate/README.md
index 93c89c3..2af7f14 100644
--- a/actions/release-candidate/README.md
+++ b/actions/release-candidate/README.md
@@ -55,7 +55,7 @@ at the end of the workflow:
* Sign all rpm artifacts with the GPG key with rpmsign
* Sign all exe artifacts with the ssl.com certificates, if publishing is
- enabled and `ssl_com_username` is defined
+ enabled and `esigner_storepass` is defined
* Create sha512 checksum files for all artifacts
* Create detached ASCII armored GPG signatures for all artifacts
* Commit all files added to `dist/dev/` to SVN
@@ -72,21 +72,20 @@ This is useful for testing the workflow using workflow dispatch.
## Inputs
-| Input | Required | Default | Description |
-|-----------------|---------------|---------|-------------|
-| tlp_dir | yes | | Directory of the top level project in dist/dev/ |
-| project_name | yes | | Human readable name of the project |
-| project_id | yes | | ID of the project, used in source artifact file name |
-| project_dir | no | "" | Directory for the project in dev/dist/<tlp_dir>/. Omit if at the root |
-| gpg_signing_key | if publishing | | Key used to sign artifacts |
-| ssl_com_username| no | | Username for signing .exe artifacts using SSL.com |
-| ssl_com_password| no | | Password for signing .exe artifacts using SSL.com |
-| ssl_com_secret | no | | Secret for signing .exe artifacts using SSL.com |
-| svn_username | if publishing | | Username for publishing release artifacts to SVN dev/dist |
-| svn_password | if publishing | | Password for publishing release artifacts to SVN dev/dist |
-| nexus_username | if publishing | | Username for publishing release artifacts to Nexus |
-| nexus_password | if publishing | | Password for publishing release artifacts to Nexus |
-| publish | no | false | Enable/disabling publish artifacts. Must be explicitly set to true to enable publishing. May be ignored depending on other factors. |
+| Input | Required | Default | Description |
+|----------------- |---------------|---------|-------------|
+| tlp_dir | yes | | Directory of the top level project in dist/dev/ |
+| project_name | yes | | Human readable name of the project |
+| project_id | yes | | ID of the project, used in source artifact file name |
+| project_dir | no | "" | Directory for the project in dev/dist/<tlp_dir>/. Omit if at the root |
+| gpg_signing_key | if publishing | | Key used to sign artifacts |
+| esigner_storepass| no | | Storepass for signing .exe artifacts using SSL.com |
+| esigner_keypass | no | | Keypass for signing .exe artifacts using SSL.com |
+| svn_username | if publishing | | Username for publishing release artifacts to SVN dev/dist |
+| svn_password | if publishing | | Password for publishing release artifacts to SVN dev/dist |
+| nexus_username | if publishing | | Username for publishing release artifacts to Nexus |
+| nexus_password | if publishing | | Password for publishing release artifacts to Nexus |
+| publish | no | false | Enable/disabling publish artifacts. Must be explicitly set to true to enable publishing. May be ignored depending on other factors. |
## Outputs
diff --git a/actions/release-candidate/action.yml b/actions/release-candidate/action.yml
index 5e4132a..290b423 100644
--- a/actions/release-candidate/action.yml
+++ b/actions/release-candidate/action.yml
@@ -34,14 +34,11 @@ inputs:
gpg_signing_key:
description: Key used to sign artifacts
required: false
- ssl_com_usename:
- description: Username for signing .exe artifacts using SSL.com
+ esigner_storepass:
+ description: Storepass for signing .exe artifacts using SSL.com
required: false
- ssl_com_password:
- description: Password for signing .exe artifacts using SSL.com
- required: false
- ssl_com_secret:
- description: Secret for signing .exe artifacts using SSL.com
+ esigner_keypass:
+ description: Keypass for signing .exe artifacts using SSL.com
required: false
svn_username:
description: Username for publishing release artifacts to SVN dev/dist
diff --git a/actions/release-candidate/dist/post/index.js b/actions/release-candidate/dist/post/index.js
index 63bec32..53d580a 100644
--- a/actions/release-candidate/dist/post/index.js
+++ b/actions/release-candidate/dist/post/index.js
@@ -125629,10 +125629,9 @@ async function run() {
// exe artifacts. Also, each ssl.com signature costs ASF money, so we
// only sign exe artifacts if we are actually going to publish things
// (e.g. this isn't a test run)
- const ssl_com_username = core.getInput("ssl_com_username");
- const ssl_com_password = core.getInput("ssl_com_password");
- const ssl_com_secret = core.getInput("ssl_com_secret");
- const do_ssl_com_sign = ssl_com_username;
+ const esigner_storepass = core.getInput("esigner_storepass");
+ const esigner_keypass = core.getInput("esigner_keypass");
+ const do_esigner = esigner_storepass;
// sign/checksum all artifacts
const artifacts = fs.readdirSync(artifact_dir, { recursive: true, withFileTypes: true });
@@ -125642,10 +125641,10 @@ async function run() {
if (artifact.name.endsWith(".rpm")) {
await exec("rpmsign", ["--define", `_gpg_name ${ gpg_signing_key_id }`, "--define", "_binary_filedigest_algorithm 10", "--addsign", `${ artifact.parentPath }/${ artifact.name }`]);
}
- if (artifact.name.endsWith(".exe") && do_ssl_com_sign) {
+ if (artifact.name.endsWith(".exe") && do_esigner) {
// see https://infra.apache.org/code-signing-use.html for more information
const cert_uuid = "d97c5110-c66a-4c0c-ac0c-1cd6af812ee6";
- await exec("jsign", ["--storetype", "ESIGNER", "--alias", cert_uuid, "--storepass", `${ssl_com_username}|${ssl_com_password}`, "--keypass", ssl_com_secret, "--tsaurl=http://ts.ssl.com", "--tsmode", "RFC3161", "--alg", "SHA512", `${ artifact.parentPath }/${ artifact.name }`]);
+ await exec("jsign", ["--storetype", "ESIGNER", "--alias", cert_uuid, "--storepass", esigner_storepass, "--keypass", esigner_keypass, "--tsaurl=http://ts.ssl.com", "--tsmode", "RFC3161", "--alg", "SHA512", `${ artifact.parentPath }/${ artifact.name }`]);
}
const shasum_output = await getExecOutput("sha512sum", ["--binary", artifact.name], {
cwd: artifact.parentPath
diff --git a/actions/release-candidate/src/post.js b/actions/release-candidate/src/post.js
index a4ffb08..a1648a1 100644
--- a/actions/release-candidate/src/post.js
+++ b/actions/release-candidate/src/post.js
@@ -38,10 +38,9 @@ async function run() {
// exe artifacts. Also, each ssl.com signature costs ASF money, so we
// only sign exe artifacts if we are actually going to publish things
// (e.g. this isn't a test run)
- const ssl_com_username = core.getInput("ssl_com_username");
- const ssl_com_password = core.getInput("ssl_com_password");
- const ssl_com_secret = core.getInput("ssl_com_secret");
- const do_ssl_com_sign = ssl_com_username;
+ const esigner_storepass = core.getInput("esigner_storepass");
+ const esigner_keypass = core.getInput("esigner_keypass");
+ const do_esigner = esigner_storepass;
// sign/checksum all artifacts
const artifacts = fs.readdirSync(artifact_dir, { recursive: true, withFileTypes: true });
@@ -51,10 +50,10 @@ async function run() {
if (artifact.name.endsWith(".rpm")) {
await exec("rpmsign", ["--define", `_gpg_name ${ gpg_signing_key_id }`, "--define", "_binary_filedigest_algorithm 10", "--addsign", `${ artifact.parentPath }/${ artifact.name }`]);
}
- if (artifact.name.endsWith(".exe") && do_ssl_com_sign) {
+ if (artifact.name.endsWith(".exe") && do_esigner) {
// see https://infra.apache.org/code-signing-use.html for more information
const cert_uuid = "d97c5110-c66a-4c0c-ac0c-1cd6af812ee6";
- await exec("jsign", ["--storetype", "ESIGNER", "--alias", cert_uuid, "--storepass", `${ssl_com_username}|${ssl_com_password}`, "--keypass", ssl_com_secret, "--tsaurl=http://ts.ssl.com", "--tsmode", "RFC3161", "--alg", "SHA512", `${ artifact.parentPath }/${ artifact.name }`]);
+ await exec("jsign", ["--storetype", "ESIGNER", "--alias", cert_uuid, "--storepass", esigner_storepass, "--keypass", esigner_keypass, "--tsaurl=http://ts.ssl.com", "--tsmode", "RFC3161", "--alg", "SHA512", `${ artifact.parentPath }/${ artifact.name }`]);
}
const shasum_output = await getExecOutput("sha512sum", ["--binary", artifact.name], {
cwd: artifact.parentPath