chore(ci): migrate to Garasign from notary MONGOSH-1655 #1876
Conversation
mcasimir
changed the title
| authToken: config.notaryAuthToken || '', | ||
| signingComment: 'Evergreen Automatic Signing (mongosh)', | ||
| }); | ||
| } |
There was a problem hiding this comment.
iirc we gave the MSI special handling because it was fairly unusable without the signing – should we keep this? should we apply all signing to the "create package" phase rather than the "draft release" phase?
There was a problem hiding this comment.
I dropped this because I noticed that it was being re-signed in runDraft. We couldn't find any special reason just the MSI needed to be signed in the packaging step (e.g. for testing), and none of the Windows-specific tests seemed to fail because of this. The reason to drop it is that it'd require the whole host-create + ssh dance as things are written now because packaging happens on particular operating systems instead of just Ubuntu like runDraftdoes. I think a better solution in the future would move signing to something that happens before/after packaging as appropriate for the artifact in question, and ideally this would run on a Linux distro only. But that felt like a bigger refactor than I was prepared to do at this time!
There was a problem hiding this comment.
Yeah, makes sense – let's leave it like this then :)
No description provided.