Linux binaries again?

[Sytten]

We used to have linux binaries in the release but we don't anymore.

Would be nice to have them again so we don't have to rely on very outdated apt.

Thanks!

[mtrojnar]

Have you contacted building osslsigncode from source for your particular hardware architecture and OpenSSL version? With OpenSSL 3.x, we reduced the number of build dependencies to cmake, OpenSSL headers and zlib headers, so building osslsigncode from source became trivial. We still provide binaries for less developer-friendly operating systems.

[Sytten]

Yeah I did end up building our own binary for the CICD. It was easy enough, its mostly that you need to store it somewhere so I forked the project and created my own release. I then use mise with the GitHub backend to download the binary.
A static build could be interesting to provide.

[mtrojnar]

Yes, it could. Unfortunately, this feature depends on openssl/openssl#24944.

[Sytten]

Ha make sense!

Anyway for reference if other folks are facing the same issue:

1. Build it on a linux box / nix flake similar to your CI machine
2. Create a release on a fork or somewhere else (similar to https://github.com/caido/action-osslsigncode/releases/tag/2.11)
3. Create a mise config like:

[tools]
"github:caido/action-osslsigncode" = { version = "2.11", asset_pattern = "osslsigncode-2.11-linux-amd64.tar.gz" }
"github:GoogleCloudPlatform/kms-integrations" = { version = "pkcs11-v1.9", asset_pattern = "libkmsp11-1.9-linux-amd64.tar.gz" }

[tasks.setup]
description = "Install all signing dependencies"
run = """
#!/usr/bin/env bash
if ! dpkg -s libengine-pkcs11-openssl >/dev/null 2>&1; then
  echo "Installing system PKCS11 engine..."
  sudo apt-get update && sudo apt-get install -y libengine-pkcs11-openssl
fi
mise install
echo "✅ All dependencies ready."
"""

[olszomal]

@Sytten You can build osslsigncode from source quite easily.
The README includes a short step-by-step build guide.
With OpenSSL 3.x, the build only requires CMake, OpenSSL headers, and zlib headers.

[Sytten]

Its more that you dont want to do that every time when you build in CICD :)

[mtrojnar]

@Sytten: If your goal is to use the most recent software packages for your CI/CD then maybe dealing with each individual package is not the most efficient approach. Have you considered using a rolling release distribution for the job? Maybe you could deploy it as a container on your current CI/CD machine. What about Fedora Rawhide?

[Sytten]

We are moving to a nix flake for this exact reason, but it's not a huge priority