To perform codesigning using Jenkins the following steps are necessary:
To install and configure Signtool and the ECSigning KSP, please follow the steps mentioned here.
To Setup and Configure Jenkins go through the link
Once Jenkins is setup, we will require administrative privilege to run the command for signtool. To set up administrative privilege for Jenkins using these steps:
Double Click on Jenkins or Right Click > Properties to open Properties. Go to Log On. Select “This Account”
Set it as “.\Administrator”. Give a password, preferably admininstrator password. Click on Apply once done.
Once we have set this we’ll now head to Jenkins. Whichever URL/hostname you specified earlier while setting up, navigating to that from your browser will lead you to Jenkins. In my system I have set it up as http://localhost:8080/ (It is also default).
In you Dashboard follow the steps below:
Click on Manage Jenkins (NOTE: Manage Jenkins doesn’t come up unless you have a job created)
Scroll down to Plugins, Under System Configuration
In Manage Plugins, in “Available Plugins” section, search for powershell plugin. It won’t show in search result in this section if it has already been installed. You can see under “Installed Plugins” to see the plugins you have installed.
Click the Checkbox of the plugin (if not already installed), and click on Install without restart. You can refresh the page once installed.
Scroll down to Powershell. Click on Add Powershell. You’ll see configuration window like the picture below. Name you powershell. Provide the path (where it is located in your machine) to your powershell. The default path is
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Click on Apply and Save.
After we’ve configured PowerShell, we’ll move on to creating the pipeline job.
Enter any item name and click on pipeline and click ok.
In configuration page, under General put up a description as your wish
Scroll down to the bottom to find Pipeline.
Write the script in the script box and click on save. You’ll need to edit your environment variable as per your setup
Note: The EC_ variables below are defined in the pipeline itself and passed to SignTool. They are separate from the KSP settings EC_Client_Auth and EC_Client_Pass, which are set on the agent. Keep certificate files and passwords in Jenkins Credentials; see Securing CI/CD Credentials.
pipeline {
agent any
environment {
EC_KEY_NAME='evcodesigning'
EC_CLIENT_CERT_FILE='C:\\Users\\Administrator\\Desktop\\ForTesting\\evcodesigning.pem'
EC_HASHING_ALGORITHM='SHA256'
EC_TIME_STAMP_SERVER="http://timestamp.digicert.com"
EC_FILEPATH="C:\\Users\\Administrator\\Desktop\\ForTesting\\AgentService.exe"
}
stages {
stage('Code Signing') {
steps {
dir('C:\\Users\\Administrator\\Desktop\\ForTesting'){
bat 'signtool sign /csp "Encryption Consulting Key Storage Provider" /kc %EC_KEY_NAME% /fd %EC_HASHING_ALGORITHM% /f %EC_CLIENT_CERT_FILE% /tr %EC_TIME_STAMP_SERVER% /td SHA256 %EC_FILEPATH%'
}
}
}
}
}
Click on build now and you’ll see a build number running on the screen
If you click on the build number and go for console output you’ll see that your file has been signed.
