Cm 70024 cli update certificates - #515
Closed
omer-roth wants to merge 6 commits into
Closed
Conversation
DigiCert issued a new Cycode Ltd code signing cert (valid 2026-06-05 to 2027-08-22). Point signtool at its thumbprint via the temporary SM_CODE_SIGNING_CERT_SHA1_HASH_NEW secret so the old value stays intact as a fallback until a CI run confirms the new cert signs successfully. Also drop --keypair-alias from certsync. The previous attempt failed with "Certificate for keypair alias: *** not found", which synced zero certs and left signtool with no candidates. Syncing every cert in the account and letting /sha1 pick removes an extra value to keep in sync on renewal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
certsync without an alias only synced the first keypair the account returns (the old cert), so signtool still had no match for the new thumbprint. Restore --keypair-alias, sourced from SM_KEYPAIR_ALIAS_NEW. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The keypair is visible in the KSP but smctl reports its certificate as not found. List keypairs and certificates in CI to see the association and status. To be removed before merge. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Drop the probe steps now that the new cert signs. Point the client cert, its password and the API key at _NEW secrets so a service account can be verified in CI without disturbing main, and keep a temporary healthcheck to confirm which identity actually signs. Also record why certsync failed for the new cert: it only syncs keypairs the calling identity may sign with, so the credential owner must be a signer on the certificate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The cert rotation itself lives entirely in DigiCert One and the repo secrets, so all _NEW indirection is gone. What is worth keeping in the workflow is why certsync reported the new certificate as missing: it only syncs keypairs the calling identity may sign with. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.
Tip: disable this comment in your organization's Code Review settings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.