Skip to content

Commit 568abf3

Browse files
paulsavoiepaulsavoie
authored
Merge pull request #35 from SignPath/download-links
adds download links for CryptoProviders
2 parents 1e4bf28 + d41312f commit 568abf3

10 files changed

Lines changed: 168 additions & 50 deletions

File tree

‎docs/_data/changelog.yml‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,23 @@
1+
- date: '2026-02-19'
2+
updates:
3+
crypto_providers:
4+
version: 6.0.1
5+
breaking_changes:
6+
- text: |
7+
The Windows CSP component for the deprecated [Windows CAPI](https://docs.microsoft.com/en-us/windows/win32/seccrypto/cryptographic-service-providers) (Crypto API) is not longer supported.
8+
- text: |
9+
The following configuration settings have been removed: `Timeouts.HttpRequest`, `Timeouts.FirstRetryDelay` and `Timeouts.RetryCount`.
10+
11+
Instead, use the new settings `ServiceUnavailableTimeoutInSeconds` and `HttpRequestTimeoutInSeconds`.
12+
13+
See [timeout settings](/crypto-providers#timeout-settings) for details.
14+
- text: |
15+
The Cryptoki library for Windows is now provided as a separate download and not part of the Windows installer any more (see [download section](/crypto-providers#download)).
16+
- text: |
17+
Logging: new file naming scheme; now a single log file gets written instead of one per process (see [logging settings](/crypto-providers#crypto-provider-config-values-logging)).
18+
new_features:
19+
- text: The Crypto Providers are now available via stable links on our download share. See the [download section](/crypto-providers#download) for details.
20+
issues: [SIGN-8265]
121
- date: '2026-02-17'
222
updates:
323
powershell_module:
@@ -940,7 +960,7 @@
940960
- date: '2024-10-21'
941961
updates:
942962
macos_cryptotokenkit:
943-
version: '2.0'
963+
version: '2.0.0'
944964
breaking_changes:
945965
- text: 'Renamed the command-line parameters to align with the other client tools.'
946966
issues: [3]

‎docs/_data/download_links.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
cryptoproviders:
2+
v1:
3+
- id: cryptoki
4+
name: 'Cryptoki'
5+
links:
6+
- text: 'Linux x64 (.tgz)'
7+
link: 'https://download.signpath.io/cryptoproviders/cryptoki/$VERSION/linux/x64/libSignPath.Cryptoki.tgz'
8+
- text: 'Windows x64 (.zip)'
9+
link: 'https://download.signpath.io/cryptoproviders/cryptoki/$VERSION/windows/x64/SignPath.Cryptoki.zip'
10+
- id: windows_ksp
11+
name: 'Windows KSP'
12+
links:
13+
- text: 'Installer (.msi)'
14+
link: 'https://download.signpath.io/cryptoproviders/windows-ksp/$VERSION/x64/SignPath.Windows.KSP.msi'
15+
- text: 'SBOM (CycloneDX .xml)'
16+
link: 'https://download.signpath.io/cryptoproviders/windows-ksp/$VERSION/x64/SignPath.Windows.KSP.bom.xml'
17+
- id: macos_cryptotokenkit
18+
name: 'macOS CryptoTokenKit'
19+
links:
20+
- text: 'Installer (.dmg)'
21+
link: 'https://download.signpath.io/cryptoproviders/macos-cryptotokenkit/$VERSION/SignPathCryptoTokenKit.dmg'
22+
- id: notation_plugin
23+
name: 'Notation Plugin'
24+
links:
25+
- text: 'Linux x64 (.tgz)'
26+
link: 'https://download.signpath.io/cryptoproviders/notation-plugin/$VERSION/linux/x64/notation-signpath.tgz'
27+
- text: 'Windows x64 (.zip)'
28+
link: 'https://download.signpath.io/cryptoproviders/notation-plugin/$VERSION/windows/x64/notation-signpath.zip'

‎docs/_data/menus/documentation.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@
8080
- text: Crypto Providers
8181
path: crypto-providers
8282
items:
83-
- text: Windows CSP and KSP
83+
- text: Windows KSP
8484
path: windows
8585

8686
- text: Cryptoki/PKCS#11

‎docs/_includes/download-cryptoproviders-panel.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{% comment %}
2+
Parameter `major` or `version` must be specified
3+
Parameter `components` must be specified
4+
Parameter `title_details` may be specified
5+
{% endcomment %}
6+
<blockquote class="panel download">
7+
<p><strong>Download Crypto Providers {%- if include.title_details != nil %} ({{ include.title_details }}) {%- endif -%}</strong></p>
8+
{%- assign components_arr = include.components | split: "," -%}
9+
{%- if include.version == nil -%}
10+
<p>
11+
These download links refer to the latest available {{ include.major }}.x version. This is recommended for automated downloads from build scripts. See <a href="/changelog/">Product changes</a> for stable links to a specific version. SignPath Crypto Providers use <a href="https://semver.org/">semantic versioning</a>.
12+
13+
</p>
14+
{%- assign major_version = include.major -%}
15+
{%- else -%}
16+
{%- assign major_version = include.version | split: "." | first -%}
17+
{%- endif --%}
18+
{%- assign latest_version = major_version | append: "-latest" -%}
19+
<table>
20+
{%- if include.version != nil -%}
21+
<tr>
22+
<th></th>
23+
<th>{{ latest_version}} (recommended)</th>
24+
<th>{{ include.version }}</th>
25+
</tr>
26+
{%- endif -%}
27+
{%- for cp in site.data.download_links.cryptoproviders.v1 -%}
28+
{%- if components_arr contains cp.id -%}
29+
<tr>
30+
<td data-label="Type">{{ cp.name }}</td>
31+
<td data-label="{{ latest_version }}">
32+
{%- for link in cp.links -%}
33+
<a href="{{ link.link | replace: '$VERSION', latest_version }}">{{ link.text }}</a>{%- if forloop.last != true -%}&nbsp;&nbsp;|&nbsp;&nbsp;{%- endif -%}
34+
{%- endfor -%}
35+
</td>
36+
{%- if include.version != nil -%}
37+
<td data-label="{{ include.version }}">
38+
{%- for link in cp.links -%}
39+
<a href="{{ link.link | replace: '$VERSION', include.version }}">{{ link.text }}</a>{%- if forloop.last != true -%}&nbsp;&nbsp;|&nbsp;&nbsp;{%- endif -%}
40+
{%- endfor -%}
41+
</td>
42+
{%- endif -%}
43+
</tr>
44+
{%- endif -%}
45+
{%- endfor -%}
46+
</table>
47+
</blockquote>

‎docs/_sass/resources.scss‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@ main > section.resources-section {
205205
display: inline-block;
206206
}
207207

208-
&.info, &.warning, &.tip {
208+
&.info, &.warning, &.tip, &.download {
209209
& > p:first-child::before,
210210
& > h6:first-child::before {
211211
font-family: "Line Awesome Free";
@@ -220,6 +220,15 @@ main > section.resources-section {
220220
content: "\f05a";
221221
}
222222
}
223+
224+
&.download {
225+
background-color: $light-grey-background-color;
226+
& > p:first-child::before,
227+
& > h6:first-child::before {
228+
content: "\f381";
229+
}
230+
}
231+
223232
&.tip {
224233
background-color: $light-grey-background-color;
225234
& > p:first-child::before,

‎docs/changelog/index.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ redirect_from:
7575
{% comment %} extract component id (e.g. application, crypto_providers, etc.) and release {% endcomment %}
7676
{% assign componentid = update[0] %}
7777
{% assign release = update[1] %}
78+
{% assign major_version = release.version | split: '.' | first | times: 1 %}
7879
7980
{% assign component_change_type_class_list = 'component' %}
8081
{% for changes_per_type in release %}
@@ -109,7 +110,22 @@ redirect_from:
109110
</div> <!-- change_type -->
110111
{% endif %}
111112
{% endfor %}
112-
</div>
113+
{% assign include_cryptoproviders_download_panel = false %}
114+
{%- if componentid == 'macos_cryptotokenkit' and major_version >= 2 -%}
115+
{% assign include_cryptoproviders_download_panel = true %}
116+
{%- endif -%}
117+
{%- if componentid == 'crypto_providers' and major_version >= 6 -%}
118+
{% assign include_cryptoproviders_download_panel = true %}
119+
{%- endif -%}
120+
{%- if include_cryptoproviders_download_panel -%}
121+
{% if componentid == 'crypto_providers' %}
122+
{% assign crypto_provider_components = "cryptoki,windows_ksp" %}
123+
{% else %}
124+
{% assign crypto_provider_components = "macos_cryptotokenkit" %}
125+
{% endif %}
126+
{% include download-cryptoproviders-panel.md version=release.version components=crypto_provider_components %}
127+
{%- endif -%}
128+
</div> <!-- component -->
113129
{% endfor %}
114130
{% else %}
115131
<p class='no-updates'>No customer facing changes in this release.</p>

‎docs/crypto-providers/cryptoki.md‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,13 @@ This section provides general information about using the SignPath Cryptoki libr
3434
| RedHat | 8 (latest minor) |
3535
| RedHat | 9 (latest minor) |
3636

37+
<!-- TODO: this panel (and the next?) is not needed any more - right -->
3738
{:.panel.info}
3839
> **Dependency on OpenSSL and `ca-certificates`**
3940
>
4041
> The Crypto Providers use OpenSSL internally to perform HTTPS requests. So the packages `openssl` and `ca-certificates` (which contains the HTTPS/TLS root certificates) must be present on your system.
4142
>
42-
> If you see log messages like `Error in SSL handshake`, these dependencies may be missing. You can test connectivity via the following command:
43+
> If you see log messages like `Error in SSL handshake` or `The SSL connection could not be established`, these dependencies may be missing. You can test connectivity via the following command:
4344
>
4445
> ```bash
4546
> curl https://app.signpath.io/Api/healthz
@@ -58,15 +59,11 @@ This section provides general information about using the SignPath Cryptoki libr
5859
5960
#### Windows
6061
61-
The Cryptoki library is installed to `%ProgramFiles%\SignPath\CryptoProviders\SignPath.Cryptoki.dll` by the [MSI installer](/crypto-providers/windows#installation).
62-
63-
Alternatively, you can copy-deploy `Windows\SignPath.Cryptoki.dll` from the Crypto Providers ZIP archive to your target system.
62+
You can copy-deploy `SignPath.Cryptoki.dll` from the Crypto Providers `.zip` archive to your target system.
6463
6564
#### Linux
6665
67-
Copy-deploy the Cryptoki library `Linux/libSignPath.Cryptoki/$OpenSslVersion/libSignPath.Cryptoki.so` from the Crypto Providers ZIP archive to your target system.
68-
69-
Check the output of `openssl version` on your target system to select the correct OpenSSL version.
66+
Copy-deploy the Cryptoki library `libSignPath.Cryptoki.so` from the Crypto Providers `.tar.gz` archive to your target system.
7067
7168
### Configuration
7269

‎docs/crypto-providers/gpg.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ For `gnupg-pkcs11-scd`, `stdout` console output must be disabled. Use the log fi
6868

6969
The [`InitializeSignPathCryptoProviderGpgSigning` helper function](/crypto-providers/gpg#configure-gnupg) uses the following logging directories:
7070

71-
* SignPath Cryptoki logs: `/tmp/SignPathLogs/<timestamp>.log`
71+
* SignPath Cryptoki logs: `/tmp/SignPathLogs/SignPath.CryptoProviders.Cryptoki.txt`
7272
* `gnupg-pkcs11-scd` logs: `/tmp/SignPathLogs/gnupg-pkcs11-scd.log`
7373
* GPG logs: `/tmp/SignPathLogs/gpg-agent.log`
7474

‎docs/crypto-providers/index.md‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ header: Crypto Providers
33
layout: resources
44
toc: true
55
show_toc: 3
6-
description: SignPath Crypto Providers (Cryptoki, KSP, CSP, CryptoTokenKit)
6+
description: SignPath Crypto Providers (Cryptoki, KSP, CryptoTokenKit)
77
---
88

99
{% include editions.md feature="hash_based_signing.rest_api" %}
@@ -12,14 +12,14 @@ description: SignPath Crypto Providers (Cryptoki, KSP, CSP, CryptoTokenKit)
1212

1313
The SignPath Crypto Providers allow signing tools such as [SignTool.exe](/crypto-providers/windows#signtool), [OpenSSL](/crypto-providers/cryptoki#openssl) or [jarsigner](/crypto-providers/cryptoki#jarsigner) to sign files locally using keys or certificates stored and managed by SignPath.
1414

15-
Crypto Providers are generally used to provide a device-independent API for using secure key storage devices such as USB key tokens or Hardware Security Modules (HSMs). You may think of them as device drivers for crypto hardware. Most software tools used for code signing support one Crypto Provider technology, such as Microsoft KSP/CSP or PKCS #11 Cryptoki.
15+
Crypto Providers are generally used to provide a device-independent API for using secure key storage devices such as USB key tokens or Hardware Security Modules (HSMs). You may think of them as device drivers for crypto hardware. Most software tools used for code signing support one Crypto Provider technology, such as Microsoft KSP or PKCS #11 Cryptoki.
1616

1717
The SignPath Crypto Providers do not access the crypto hardware directly. Instead, they implement these interfaces to provide access to SignPath _Projects_ and _Signing Policies_. During the entire operation, the private key will remain on the HSM.
1818

1919
{:.panel.info}
2020
> **Version info**
2121
>
22-
> This documentation contains information about the latest version of the CryptoProviders. See the [CryptoProvider changelog](/changelog?component=crypto_providers) or the [macOS CryptoTokenKit changelog](/changelog?component=macos_cryptotokenkit) for updates.
22+
> This documentation contains information about the latest version of the Crypto Providers. See the [Crypto Provider changelog](/changelog?component=crypto_providers) or the [macOS CryptoTokenKit changelog](/changelog?component=macos_cryptotokenkit) for updates.
2323
2424
### Crypto Providers
2525

@@ -29,7 +29,6 @@ The following Crypto Providers are available for SignPath:
2929
|-----------------------------------------------|-----------------------------------------------|---------------------|--------------
3030
| **Cryptoki** (Cryptographic Token Interface) | [PKCS #11] version 2.40 | Windows, Linux
3131
| **KSP** (Key Storage Provider) | [CNG] (Cryptographic API: Next Generation) | Windows
32-
| **CSP** (Cryptographic Service Provider) | [CAPI] (CryptoAPI) | Windows | This API is deprecated, most tools now use KSP/CNG
3332
| **CTK** (CryptoTokenKit) | [CTK extension] | macOS
3433

3534
[PKCS #11]: https://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html
@@ -68,15 +67,21 @@ With small platform-specific variations, the general flow of a signing operation
6867

6968
As always, the private key does not leave the boundaries of the HSM.
7069

71-
## Installation and usage
70+
## Download and installation {#download}
7271

73-
Depending on the signing tool you're using, the corresponding Crypto Provider needs to be installed (on all build nodes). See the respective pages:
72+
Choose the correct package and install it on all build agents:
7473

75-
* [SignPath KSP and CSP](/crypto-providers/windows) for _SignTool.exe_ and most native Windows tools
76-
* [SignPath Cryptoki](/crypto-providers/cryptoki) for _OpenSSL_, _jarsigner_, and many other Open Source tools
77-
* [GPG-based tools](/crypto-providers/gpg), such as _gpg_, _rpm_, or _dkpg-sig_ use the [SignPath Cryptoki Crypto Provider](/crypto-providers/cryptoki) but require additional configuration steps
74+
* [SignPath Windows KSP](/crypto-providers/windows) for _SignTool.exe_ and most native Windows tools
75+
* [SignPath Cryptoki library](/crypto-providers/cryptoki) for _OpenSSL_, _jarsigner_, and many other Open Source tools
76+
* [GPG-based tools](/crypto-providers/gpg), such as _gpg_, _rpm_, or _dkpg-sig_ use the [SignPath Cryptoki library](/crypto-providers/cryptoki) but require additional configuration steps
7877
* [SignPath CryptoTokenKit](/crypto-providers/macos) for macOS _codesign_
79-
* Instead of using a CryptoProvider, it is also possible to [sign hashes directly using the REST API](/crypto-providers/rest-api)
78+
79+
<!-- should really include notation_plugin here also and merge other PR -->
80+
{% include download-cryptoproviders-panel.md major="6" components="cryptoki,windows_ksp" %}
81+
82+
{% include download-cryptoproviders-panel.md major="2" components="macos_cryptotokenkit" title_details="MacOS CryptoTokenKit" %}
83+
84+
Instead of using a CryptoProvider, it is also possible to [sign hashes directly using the REST API](/crypto-providers/rest-api)
8085

8186
## Configuration {#crypto-provider-configuration}
8287

@@ -107,7 +112,7 @@ The [MSI installer](/crypto-providers/windows#installation) for Windows creates
107112
You will usually specifiy the Project and Signing Policy and let SignPath select the matching certificate.
108113

109114
The following values
110-
* should be provieded for other [PKCS #11/Cryptoki](cryptoki) signing tools that don't accept a _key ID_ parameter
115+
* should be provided for other [PKCS #11/Cryptoki](cryptoki) signing tools that don't accept a _key ID_ parameter
111116
* are internally used for GPG signing via PKCS #11 (see [GPG](gpg#configure-gnupg))
112117
* can be provided for macOS CryptoTokenKit as default values (see [macOS](macos#usage-project-signing-policy))
113118

@@ -127,13 +132,15 @@ The following values
127132

128133
Supported log levels: `none`, `fatal`, `error`, `warning`, `info`, `debug`, `verbose`.
129134

135+
Within `Log.File.Directory`/`SIGNPATH_LOG_FILE_DIRECTORY` the log file is named `SignPath.CryptoProviders.<Interface>.txt` (e.g. `SignPath.CryptoProviders.KSP.txt`). In case the log file would exceed 10 MB, the log file gets rotated (up to five "old" log file copies).
136+
137+
130138
#### Timeout settings
131139

132-
| JSON setting | Environment variable | Default Value | Description
133-
|-----------------------------|---------------------------------------|-------------------|-------------------------
134-
| `Timeouts.HttpRequest` | `SIGNPATH_TIMEOUTS_HTTP_REQUEST` | `30` | Timeout for HTTP calls in seconds per attempt
135-
| `Timeouts.FirstRetryDelay` | `SIGNPATH_TIMEOUTS_FIRST_RETRY_DELAY` | `1.16` | Initial delay in seconds in case of failed API HTTP requests
136-
| `Timeouts.RetryCount` | `SIGNPATH_TIMEOUTS_RETRY_COUNT` | `10` | Maximum number of retries in case of failed API HTTP requests
140+
| JSON setting | Environment variable | Default Value | Description
141+
|--------------------------------------|----------------------------------------------------|---------------|-------------------------
142+
| `ServiceUnavailableTimeoutInSeconds` | `SIGNPATH_SERVICE_UNAVAILABLE_TIMEOUT_IN_SECONDS ` | `600` | Total time in seconds that the command will wait for a single service call to succeed (across several retries).
143+
| `HttpRequestTimeoutInSeconds` | `SIGNPATH_HTTP_REQUEST_TIMEOUT_IN_SECONDS` | `30` | Timeout for HTTP calls in seconds per attempt
137144
{: .break-column-2}
138145

139146
HTTP timeouts and 5xx server errors (e.g. 503 Service Unavailable errors) are treated as failed requests.
@@ -224,7 +231,7 @@ In order to perform hash-based signing with the Crypto Providers, perform the fo
224231

225232
### Linux samples {#linux-docker-samples}
226233

227-
The Crypto Provider package contains Linux sample scripts that demonstrate the use of different signing tools, their configuration, and the required dependencies in the `Scenarios` directory. See the `README.md` for the full list.
234+
The Cryptoki package for Linux contains sample scripts that demonstrate the use of different signing tools, their configuration, and the required dependencies in the `Scenarios` directory. See the `README.md` for the full list.
228235

229236
For supported Linux distributions, you can execute the samples using the provided Docker container configurations. See the `Linux/Samples` directory in the Crypto Provider package. See `README.md` for further information and details how to use the `RunScenario.sh` and `RunScenario.ps1` entry point scripts to invoke samples.
230237

0 commit comments

Comments
 (0)