Add optional Artifact Signing for Windows builds by mokagio · Pull Request #2995 · Automattic/studio

mokagio · 2026-04-07T05:19:46Z

Related issues

How AI was used in this PR

Implementation planned and written with Claude Code (Opus 4.6).
All code reviewed by @mokagio before committing.

Proposed Changes

Takes the work from #2709 and puts it behind a toggle env var.
The idea being that we can switch back to the previous signing implementation if something turns out to be wrong once released in the wild.

Add Azure Trusted Signing utilities (azure-signing.cjs, azure-sign-hook.js) for SHA256-only signing via signtool
Add windowsSign.ts module gated on USE_AZURE_TRUSTED_SIGNING env var — returns Azure hook config when set, undefined (PFX fallback) otherwise
Wire windowsSign into forge.config.ts for both packagerConfig and MakerSquirrel
Add conditional signing setup in build-for-windows.ps1 (Azure or PFX based on toggle)
Add conditional signing in package-appx.mjs for sideload AppX
Update CI toolkit version to include setup_azure_trusted_signing.ps1
Set USE_AZURE_TRUSTED_SIGNING=1 in both dev and release Windows build jobs in the pipeline

To revert to PFX signing, remove the USE_AZURE_TRUSTED_SIGNING env var from the pipeline YAML files.

Testing Instructions

I created #2996 to test the changes here and verify that both build paths work.

Pre-merge Checklist

Have you checked for TypeScript, React or other console errors? - N.A.

Posted by Claude Code (Opus 4.6) on behalf of @mokagio with approval.

wpmobilebot · 2026-04-07T05:57:55Z

📊 Performance Test Results

Comparing 6b940af vs trunk

app-size

Metric	trunk	`6b940af`	Diff	Change
App Size (Mac)	1252.23 MB	1252.23 MB	+0.00 MB	⚪ 0.0%

site-editor

Metric	trunk	`6b940af`	Diff	Change
load	1724 ms	1879 ms	+155 ms	🔴 9.0%

site-startup

Metric	trunk	`6b940af`	Diff	Change
siteCreation	8175 ms	8178 ms	+3 ms	⚪ 0.0%
siteStartup	4840 ms	4837 ms	3 ms	⚪ 0.0%

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)

mokagio · 2026-04-07T06:49:11Z

.buildkite/shared-pipeline-vars

 # The ~> modifier is not currently used, but we check for it just in case
 XCODE_VERSION=$(sed -E -n 's/^(~> )?(.*)/xcode-\2/p' .xcode-version)
-CI_TOOLKIT_VERSION='6.0.1'
+CI_TOOLKIT_VERSION='4411dd924c08dea251702db5760e741c9d81eff2'


Waiting for confirmation on the tooling from a few more clients before shipping a new version of the plugin. A commit sha doesn't look as neat as a tag, but the pinning result is the same.

scripts/package-appx.mjs

mokagio · 2026-04-07T07:49:59Z

Mmm... I just noticed that the signed artifact in CI is called unsigned, which is confusing

Reverting to draft to address.

Shared config and signing hook for Azure Trusted Signing, ported from the `test-artifact-signing` branch. `azure-signing.cjs` builds signtool args and validates env vars. `azure-sign-hook.js` is the custom `@electron/windows-sign` hook that calls signtool with SHA256-only params (Azure doesn't support the default SHA1+SHA256 dual-sign). --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

Returns Azure signing hook config when `USE_AZURE_TRUSTED_SIGNING` is set, `undefined` otherwise so Forge falls back to PFX certs. Throws if the toggle is on but Azure env vars are missing. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

Adds `windowsSign` to `packagerConfig` and `MakerSquirrel`. When defined (Azure mode), uses the signing hook. When undefined (PFX mode), uses `certificateFile`/`certificatePassword`. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

Conditionally calls `setup_azure_trusted_signing.ps1` or `setup_windows_code_signing.ps1` based on `USE_AZURE_TRUSTED_SIGNING`. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

When `USE_AZURE_TRUSTED_SIGNING` is set, builds an unsigned sideload AppX then signs it with Azure signtool. Otherwise uses the existing PFX certificate path. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

Points to the `add-azure-trusted-signing` branch which includes `setup_azure_trusted_signing.ps1`. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

The `add-azure-trusted-signing` branch no longer exists. Use the commit SHA directly. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

Co-authored-by: Gio Lodi <giovanni.lodi42@gmail.com>

Set `USE_AZURE_TRUSTED_SIGNING=1` in both dev and release Windows build jobs so Azure signing is active by default. The toggle in `build-for-windows.ps1` still allows falling back to PFX by unsetting the env var. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

`electron2appx` names the file "unsigned" when `devCert: 'nil'` is passed. The Azure signing path builds unsigned then signs externally, so the file kept the misleading name. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

mokagio · 2026-04-08T01:43:53Z

scripts/package-appx.mjs

+			const renamedPath = path.join( appxOutputPathSigned, renamedFile );
+			await fs.rename( appxPath, renamedPath );
+			console.log( `Renamed to ${ renamedFile }` );
+		}


Given the signed AppX is not used by any of our distribution automation, no other update was needed.

mokagio · 2026-04-08T03:31:54Z

apps/studio/forge.config.ts

+				// Azure mode: use the custom signing hook that calls signtool
+				// with Azure Trusted Signing parameters.
+				// PFX mode: use the local certificate file and password.
+				...( windowsSign
+					? { windowsSign }
+					: {
+							certificateFile: path.join( repoRoot, 'certificate.pfx' ),
+							certificatePassword: process.env.WINDOWS_CODE_SIGNING_CERT_PASSWORD,
+					  }
+				),


Once we'll have established that the new code signing is good, we'll be able to merge the checks done inside windowsSign.ts in this file, before defining this ForgeConfig instance.

As it stands, this code looks a bit ugly, but it's a temporary compromise.

Copilot

Pull request overview

This PR adds an opt-in Azure Trusted Signing path for Windows artifacts (Forge packaging, Squirrel installer, and sideload AppX), while retaining the existing PFX-based signing as a fallback controlled by USE_AZURE_TRUSTED_SIGNING.

Changes:

Introduces Azure Trusted Signing helpers (azure-signing.cjs, azure-sign-hook.js) and a windowsSign Forge config helper gated by USE_AZURE_TRUSTED_SIGNING.
Updates Windows AppX packaging to support Azure signing for the sideload (local testing) AppX path.
Updates Buildkite pipelines and Windows build script to set up Azure signing when the toggle is enabled and bumps CI toolkit ref.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/package-appx.mjs	Adds Azure-vs-PFX branching for env validation and sideload AppX signing via `signtool`.
scripts/azure-signing.cjs	Adds shared Azure signing config/env validation and `signtool` arg builder.
scripts/azure-sign-hook.js	Adds a custom `@electron/windows-sign` hook to do SHA256-only signing via Azure.
apps/studio/windowsSign.ts	Adds an env-gated Forge `windowsSign` hook configuration for Azure signing.
apps/studio/forge.config.ts	Wires `windowsSign` into packager config and conditionally into MakerSquirrel config.
.buildkite/shared-pipeline-vars	Updates CI toolkit ref to include Azure signing setup script.
.buildkite/release-build-and-distribute.yml	Enables Azure signing for Windows release builds via `USE_AZURE_TRUSTED_SIGNING=1`.
.buildkite/pipeline.yml	Enables Azure signing for Windows dev builds via `USE_AZURE_TRUSTED_SIGNING=1`.
.buildkite/commands/build-for-windows.ps1	Conditionally runs Azure or PFX signing setup based on `USE_AZURE_TRUSTED_SIGNING`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-08T03:32:53Z

apps/studio/windowsSign.ts

+	if ( ! process.env.AZURE_CODE_SIGNING_DLIB || ! process.env.AZURE_METADATA_JSON ) {
+		throw new Error(
+			'USE_AZURE_TRUSTED_SIGNING is set but Azure signing env vars ' +
+				'(AZURE_CODE_SIGNING_DLIB, AZURE_METADATA_JSON) are missing. ' +


getWindowsSign() validates AZURE_CODE_SIGNING_DLIB and AZURE_METADATA_JSON but not SIGNTOOL_PATH, even though the Azure signing hook requires it. This can lead to a later failure during signing rather than failing fast when loading Forge config; consider validating SIGNTOOL_PATH here and including it in the error message to keep the required env var list consistent.

Suggested change

if ( ! process.env.AZURE_CODE_SIGNING_DLIB || ! process.env.AZURE_METADATA_JSON ) {

throw new Error(

'USE_AZURE_TRUSTED_SIGNING is set but Azure signing env vars ' +

'(AZURE_CODE_SIGNING_DLIB, AZURE_METADATA_JSON) are missing. ' +

if ( ! process.env.AZURE_CODE_SIGNING_DLIB || ! process.env.AZURE_METADATA_JSON || ! process.env.SIGNTOOL_PATH ) {

throw new Error(

'USE_AZURE_TRUSTED_SIGNING is set but Azure signing env vars ' +

'(AZURE_CODE_SIGNING_DLIB, AZURE_METADATA_JSON, SIGNTOOL_PATH) are missing. ' +

scripts/package-appx.mjs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

mokagio · 2026-04-08T03:38:04Z

@p-jackson @wojtekn can I ask you to take the artifacts from the Windows test build, in particular the Artifacts Signing ones for a spin to verify they work as expected?

Thanks!

wojtekn · 2026-04-08T14:12:59Z

@mokagio both Azure and PFX build artifacts install fine, and show as properly signed on my test machine.

I noticed one difference, though - the PFX doesn't show dates.

Azure	PFX

mokagio · 2026-04-08T22:34:28Z

Thanks @wojtekn !

I don't know why the PFX doesn't show the date in the signature. Guess: Artifact Signing requires a more precise system.

Anyway, given Artifacts Signing is the way we want to go forward, I think it's okay to leave the question unanswered for the PFX in the interest of moving ahead.

p-jackson · 2026-04-09T00:51:05Z

@mokagio I saw the same things as Wojtek, but it makes sense that if we have to move forward with PFX then the dates can be figured out later.
The installer worked as expected, updating Studio without any warnings about the certificate.

The usual stuff (installing, installing on top of existing installation, uninstalling) all work as expected.

mokagio · 2026-04-09T06:09:02Z

Thanks @p-jackson

mokagio self-assigned this Apr 7, 2026

mokagio mentioned this pull request Apr 7, 2026

Test: Run PFX and Azure signing in parallel #2996

Closed

mokagio changed the title ~~Add Azure Trusted Signing toggle for Windows~~ Add optional Artifact Signing for Windows builds Apr 7, 2026

mokagio commented Apr 7, 2026

View reviewed changes

scripts/package-appx.mjs Outdated Show resolved Hide resolved

mokagio commented Apr 7, 2026

View reviewed changes

scripts/package-appx.mjs Outdated Show resolved Hide resolved

mokagio marked this pull request as draft April 7, 2026 07:50

mokagio and others added 10 commits April 8, 2026 10:52

Update CI toolkit for Azure signing

f0cf79a

Points to the `add-azure-trusted-signing` branch which includes `setup_azure_trusted_signing.ps1`. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

Pin CI toolkit to commit SHA

0700241

The `add-azure-trusted-signing` branch no longer exists. Use the commit SHA directly. --- Generated with the help of Claude Code, https://claude.ai/code Co-Authored-By: Claude Code Opus 4.6 <noreply@anthropic.com>

Clarify the purpose of signing the local AppX

08dc82c

Co-authored-by: Gio Lodi <giovanni.lodi42@gmail.com>

mokagio force-pushed the ainfra-2233-integrate-artifacts-signing-in-ci-for-studio-windows branch from f1360a5 to 82cf136 Compare April 8, 2026 00:52

mokagio commented Apr 8, 2026

View reviewed changes

mokagio requested review from Copilot and iangmaia April 8, 2026 03:29

Copilot started reviewing on behalf of mokagio April 8, 2026 03:30 View session

mokagio commented Apr 8, 2026

View reviewed changes

mokagio requested review from p-jackson and wojtekn April 8, 2026 03:32

mokagio marked this pull request as ready for review April 8, 2026 03:32

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Constrain Boolean parsing from env var

6b940af

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

mokagio enabled auto-merge (squash) April 8, 2026 03:38

Conversation

mokagio commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related issues

How AI was used in this PR

Proposed Changes

Testing Instructions

Pre-merge Checklist

Uh oh!

wpmobilebot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Performance Test Results

app-size

site-editor

site-startup

Uh oh!

mokagio Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mokagio commented Apr 7, 2026

Uh oh!

mokagio Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

mokagio Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mokagio commented Apr 8, 2026

Uh oh!

wojtekn commented Apr 8, 2026

Uh oh!

mokagio commented Apr 8, 2026

Uh oh!

p-jackson commented Apr 9, 2026

Uh oh!

mokagio commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

mokagio commented Apr 7, 2026 •

edited

Loading

wpmobilebot commented Apr 7, 2026 •

edited

Loading