The Signing Projects section
provides the configuration interface to create and manage the
necessary data for a
reproducible build with
pre/post hash validation. It
allows to define the metadata, source control, and build server
settings required to securely manage the signing process with
build verification within an automated Jenkins pipeline.
Prerequisites
For a Signing Project to be operational, two main external
components must be pre-configured and ready for integration:
Git Repository and Branch:
The project must specify the source code repository (e.g.,
GitHub) and the
specific branch from
which the build artifacts will be pulled for signing.
Jenkins Build Server:
A Jenkins server must be set up to manage the automated
build process.
To setup this, check the steps in the Reproducible Build section
of Signing Capabilities.
You can create a new signing project in the portal using the
Add Signing Projects button.
It also provides options for a signing project in the context
menu by right clicking on the respective entry.
Options are:
View Details:
You can view the configured settings for a signing project
which will be useful when performing the signing operation.
Edit:
Modify the existing signing project for updated settings.
Delete:
Delete a signing project when not needed anymore.
Note:
For signing project to use
pre/post hash validation
during the signing operation, you will have to update the Key Usage for the signing certificate from the Keys and Certificate
section.
