From dae283f96020186a2defddcb82b503bd88b2ecd5 Mon Sep 17 00:00:00 2001 From: Jay Wu Date: Fri, 30 Oct 2026 09:03:48 +0800 Subject: [PATCH] ci(release): verify the wrapper signature right after signing Check that the wrapper Insomnia.exe has a valid signature before the installer steps run. If signing failed, the job stops before the six installer signatures are spent. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/release-build.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml index d9782b64bc..94ca01e8f4 100644 --- a/.github/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -210,6 +210,19 @@ jobs: SM_API_KEY: ${{ secrets.DIGICERT_SM_API_KEY }} SM_CLIENT_CERT_PASSWORD: ${{ secrets.DIGICERT_SM_CLIENT_CERT_PASSWORD }} + # Fails the job now, before the installer signing steps spend more tokens, if signing did not work. + - name: Verify wrapper signature (Windows only) + if: runner.os == 'Windows' + shell: pwsh + run: | + $signature = Get-AuthenticodeSignature -LiteralPath "packages/insomnia/dist/win-unpacked/tosign/Insomnia.exe" + Write-Host "Status: $($signature.Status)" + Write-Host "Signer: $($signature.SignerCertificate.Subject)" + if ($signature.Status -ne 'Valid') { + Write-Error "Insomnia.exe is not validly signed" + exit 1 + } + - name: Move .dll and .exe files back to win-unpacked and delete /tosign if: runner.os == 'Windows' shell: pwsh