Transition from Digicert keylocker to Azure Trusted Signing

[ryanaslett]

Our digicert keylocker certificates have a limited number of signatures available (598 as of this issue).

We'll need to ensure continuity in signing windows releases (nightly/canary/full releases).

Azure trusted signing is a more cost effective mechanism for signing code going forward.

The OpenJS foundation has established a Trusted Signing account as per: https://learn.microsoft.com/en-us/azure/trusted-signing/quickstart?tabs=registerrp-portal%2Caccount-portal%2Corgvalidation%2Ccertificateprofile-portal%2Cdeleteresources-portal to allow OpenJS projects to use our Identity to sign windows binaries.

The rough estimate is that we have a couple of months worth of signatures before we run out, (worst case 75 days).

So the next steps to get this addressed:

• Set up a nodejs signing account in azure that uses the trusted signing account, and has access to the appropriate secrets that we can inject into our release pipeline
• Set up the release machines/install trusted signing
• Modify the release pipelines to sign the code with the new mechanism

[felixrieseberg]

Here's how I think we'll solve this problem:

1. Ensure that build machines have the required binaries, namely:

nuget install Microsoft.Windows.SDK.BuildTools -Version 10.0.26100.1742 -x
nuget install Microsoft.Trusted.Signing.Client -Version 1.0.60 -x

2. Ensure that build machines have a trusted_code_signing.json in a well-defined path

{
	"Endpoint": "https://wus2.codesigning.azure.net/",
	"CodeSigningAccountName": "TBD",
	"CertificateProfileName": "tbd"
}

3. Ensure that build machines have AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID set. We also need to know the path to Azure.CodeSigning.Dlib.dll and to bin\10.0.26100.0\x64\signtool.exe (it needs to be that version or newer).

4. Then, we replace https://github.com/nodejs/node/blob/main/tools/sign.bat with:

@echo off

@REM From March 2024, we use Azure Trusted Signing for code signing.
@REM Release CI machines are configured to have it in the PATH so this can be used safely.
path/to/signtool.exe sign /tr "http://timestamp.acs.microsoft.com" /td sha256 /fd sha256 /v /dlib %AZURE_CODE_SIGNING_DLIB% /dmdf %AZURE_METADATA_JSON% %1
if not ERRORLEVEL 1 (
    echo Successfully signed %1 using signtool
    exit /b 0
)
echo Could not sign %1 using signtool
exit /b 1