Skip to content

[SINT-5203] Use New Windows Code Signer #52030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
cedricvanrompay-datadog wants to merge 3 commits into
base: main
Choose a base branch
from
+24 −11
Draft

[SINT-5203] Use New Windows Code Signer #52030

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2e6d63a
use windows-code-signer.exe in project_extension.rb
cedricvanrompay-datadog Jun 9, 2026
0195a11
replace all occurrences of dd-wcs
cedricvanrompay-datadog Jun 10, 2026
d861f79
fix call to signer
cedricvanrompay-datadog Jun 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion .gitlab/windows/build/powershell_script_signing/windows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,5 +17,17 @@ powershell_script_signing:
- $WINDOWS_POWERSHELL_DIR
script:
- mkdir $WINDOWS_POWERSHELL_DIR
- docker run --rm -v "$(Get-Location):c:\mnt" -e AWS_NETWORKING=true -e CI -e IS_AWS_CONTAINER=true -e WINDOWS_SIGNING_CERT -e WINDOWS_SIGNING_CONFIG ${WINBUILDIMAGE} powershell -C "if (`$Env:WINDOWS_SIGNING_CERT -and `$Env:WINDOWS_SIGNING_CONFIG) { dd-wcs sign --cert `$Env:WINDOWS_SIGNING_CERT --config `$Env:WINDOWS_SIGNING_CONFIG '\mnt\tools\windows\DatadogAgentInstallScript\Install-Datadog.ps1' } else { dd-wcs sign '\mnt\tools\windows\DatadogAgentInstallScript\Install-Datadog.ps1' }"
# documentation: https://github.com/DataDog/windows-code-signer
- docker run --rm
-v "$(Get-Location):c:\mnt"
-v "${CI_PROJECT_DIR}\.aws\credentials-by-job-id:C:\aws-creds"
-e "AWS_SHARED_CREDENTIALS_FILE=C:\aws-creds\${CI_JOB_ID}"
-e AWS_NETWORKING=true
-e CI
-e IS_AWS_CONTAINER=true
-e CI_IDENTITIES_GITLAB_ID_TOKEN
-e CI_JOB_NAME_SLUG
${WINBUILDIMAGE}
powershell -C "C:\devtools\windows-code-signer.exe
sign \mnt\tools\windows\DatadogAgentInstallScript\Install-Datadog.ps1"
Comment on lines +31 to +32

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Pass the selected key info to the signer

In the powershell_script_signing job, scheduled pipelines set WINDOWS_SIGNING_CERT and WINDOWS_SIGNING_CONFIG in .gitlab-ci.yml, and the other updated signing call sites translate those into --cert ... --key-info ...; this direct invocation drops them entirely. When those variables are present, the install script will be signed with the signer's default key/config instead of the configured beta/release key, or fail if no default key info is available, so this command needs the same conditional arguments as the Omnibus/MSI paths.

Useful? React with 👍 / 👎.

Comment on lines +31 to +32

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve signing overrides for the PowerShell script

In jobs that set WINDOWS_SIGNING_CERT and WINDOWS_SIGNING_CONFIG, this standalone install-script signing step now ignores those overrides: the old command passed them conditionally, and the updated Omnibus/MSI helpers still map the same variables to --cert/--key-info, but this command only invokes the signer with the file path. That makes Install-Datadog.ps1 get signed with the default key while the rest of the Windows artifacts can be signed with the requested certificate/config, which breaks override/FIPS-style signing runs.

Useful? React with 👍 / 👎.

- copy .\tools\windows\DatadogAgentInstallScript\Install-Datadog.ps1 $WINDOWS_POWERSHELL_DIR\Install-Datadog.ps1
12 changes: 6 additions & 6 deletions omnibus/lib/project_extension.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,11 +132,11 @@ def ddwcssign(file)
begin
attempts += 1
cmd = Array.new.tap do |arr|
arr << "dd-wcs"
arr << "C:/devtools/windows-code-signer.exe"
arr << "sign"
if ENV['WINDOWS_SIGNING_CERT'] && ENV['WINDOWS_SIGNING_CONFIG']
arr << "--cert" << ENV['WINDOWS_SIGNING_CERT']
arr << "--config" << ENV['WINDOWS_SIGNING_CONFIG']
arr << "--key-info" << ENV['WINDOWS_SIGNING_CONFIG']
end
arr << "\"#{file}\""
end.join(" ")
Expand All @@ -145,7 +145,7 @@ def ddwcssign(file)
if status.exitstatus != 0
log.warn(self.class.name) do
<<-EOH.strip
Failed to sign with dd-wcs (Attempt #{attempts} of #{max_retries})
Failed to sign with windows-code-signer.exe (Attempt #{attempts} of #{max_retries})

STDOUT
------
Expand All @@ -156,9 +156,9 @@ def ddwcssign(file)
#{status.stderr}
EOH
end
raise "Failed to sign with dd-wcs"
raise "Failed to sign with windows-code-signer.exe"
else
log.info(self.class.name) { "Successfully signed #{file} after #{attempts} attempt(s)" }
log.info(self.class.name) { "Successfully signed #{file} using windows-code-signer.exe after #{attempts} attempt(s)" }
end
rescue => e
# Retry logic: raise error after 3 attempts
Expand All @@ -167,7 +167,7 @@ def ddwcssign(file)
sleep(delay)
retry
end
raise "Failed to sign with dd-wcs: #{e.message}"
raise "Failed to sign with windows-code-signer.exe: #{e.message}"
end
end

Expand Down
4 changes: 2 additions & 2 deletions tasks/libs/common/omnibus.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,8 +69,8 @@
'PROGRAMFILES(X86)': 'Standard Windows installation location',
'PROGRAMFILESW6432': 'Standard Windows installation location',
'SIGN_WINDOWS_DD_WCS': 'Determines whether to sign Windows artifacts',
'WINDOWS_SIGNING_CERT': 'S3 URL of the signing certificate to use with dd-wcs',
'WINDOWS_SIGNING_CONFIG': 'S3 URL of the signing config to use with dd-wcs',
'WINDOWS_SIGNING_CERT': 'S3 URL of the signing certificate to use with windows-code-signer.exe',
'WINDOWS_SIGNING_CONFIG': 'S3 URL of the signing config to use with windows-code-signer.exe',
Comment on lines +72 to +73

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Forward the new signer credentials through Omnibus

The Omnibus Windows build runs signing from the Ruby process built by get_omnibus_env, which only preserves variables listed here; after switching that signer to windows-code-signer.exe, the CI-provided CI_IDENTITIES_GITLAB_ID_TOKEN and AWS_SHARED_CREDENTIALS_FILE are still filtered out even though the direct signing job forwards them for this tool. In the Windows package jobs I checked, CI_IDENTITIES_GITLAB_ID_TOKEN is passed into the container, but Omnibus drops it before shellout, so package signing runs without the credentials the new signer needs.

Useful? React with 👍 / 👎.

'SSL_CERT_FILE': 'Used to point Ruby at the certificate for OpenSSL',
'SYSTEMDRIVE': "goes with SYSTEMROOT",
'SYSTEMROOT': 'Solves git: fatal: getaddrinfo() thread failed to start',
Expand Down
5 changes: 3 additions & 2 deletions tasks/msi.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,8 +111,9 @@ def sign_file(ctx, path, force=False):
if dd_wcs_enabled or force:
cert = os.environ.get('WINDOWS_SIGNING_CERT')
config = os.environ.get('WINDOWS_SIGNING_CONFIG')
cert_args = f'--cert {cert} --config {config} ' if cert and config else ''
return ctx.run(f'dd-wcs sign {cert_args}"{path}"')
cert_args = f'--cert {cert} --key-info {config} ' if cert and config else ''
print("signing with windows-code-signer.exe")
return ctx.run(f'C:/devtools/windows-code-signer.exe sign {cert_args} "{path}"')


def _ensure_wix_tools(ctx):
Expand Down
Loading