github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-03-09 11:42:54 -05:00
Code Issues 250 Packages Projects Releases 53 Wiki Activity

[PR #1209] [CLOSED] RFC: Codesigning windows builds #3594

New Issue
Closed
opened 2026-02-28 20:43:57 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-02-28 20:43:57 -06:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/actualbudget/actual/pull/1209
Author: @Shazib
Created: 6/27/2023
Status: ❌ Closed

Base: master ← Head: codesigning-windows

📝 Commits (7)

  • 7d9cbd8 Attempt to add codesigning to windows electron
  • 53e3877 Merge branch 'actualbudget:master' into master
  • 5efbe3c Bump electron package version to match
  • 6893e4f Add Release Notes
  • 669b41c Merge branch 'actualbudget:master' into master
  • 6d3c6b5 Merge branch 'actualbudget:master' into master3
  • 9e2459f Rename 1191.md to 1209.md

📊 Changes

3 files changed (+25 additions, -3 deletions)

View changed files

📝 .github/workflows/build.yml (+18 -2)
📝 packages/desktop-electron/package.json (+1 -1)
➕ upcoming-release-notes/1209.md (+6 -0)

📄 Description

Sorry I accidentally closed the PR so opening again.

Changes Made

Adding code-signing to windows builds.

This is all handled by electron-builder so all we need to do is supply it with the certificate details. There are two new github org secrets that need to be set before it will work. I am just using a locally generated certificate for now.

The new secrets are WIN_CERT_BASE64 and WIN_CERT_PASS

I will remove the workflow_dispatch: before this PR is merged, its just there for testing atm.

Slightly related, the version number in desktop-electron/package.json is out of sync, so whatever process updates this perhaps needs a review.

Getting a Certificate

Option 1: Generate our own certificate.

  • Free adn easy but won't be recognised by windows

Option 2: Purchase a Certificate

  • Will be recognised by windows
  • More complicated

Steps:

  1. We need to set up a cloud based HSM (hardware security module) to store the cert. This requirement came into force May of this year as far as I can tell and cert authorities will only send youa cert on a hardware token or add it to your HSM.
  2. Buy a cert. There are lots of websites that sell codesigning certs, the cheapest i've seen is here for $149/year.
  • We can use a cloud based HSM, for example Azure Key Vault
  • Azure offers $200 in free credit. I'm not sure how long this would last. Presumably we can use an unverified cert for dev builds and only fetch the offical one for release builds.
  • You upload and store the certificate in azure and its accessed via this github action

One thing i'm a little unclear about is how we would tranfer the certificate from the seller to the HSM, given they won't just send you the file. I have seen this but I can't test it without actually buying a cert. Azure is partnered with digicert etc for eliminating this issue but the certificates from them are much more expensive.

I am currently deploying an azure keyvault to try it out and will report back...There is also an AWS HSM.

In terms of financing this, I have not seen any links for donating etc, but would be happy to contribute.

Windows Store

I think none of the above is needed if we publish directly to the microsoft store, as they re-sign things with a microsoft certificate, we just have to sign with a cert, that we upload to our MS Developer account so they can verify who submitted the app.

I can't test this thoroughly because whilst I have a MS Dev account you need to provide a url to a website, a url to the exe, a privacy policy, etc, so I dont have a good 'test' app to run through the process.

I can try actually deploying the current actualbudget there if people want.

This does have the caveat that people downloading directly from the github release won't get the 'officially' signed version.

image

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/actualbudget/actual/pull/1209 **Author:** [@Shazib](https://github.com/Shazib) **Created:** 6/27/2023 **Status:** ❌ Closed **Base:** `master` ← **Head:** `codesigning-windows` --- ### 📝 Commits (7) - [`7d9cbd8`](https://github.com/actualbudget/actual/commit/7d9cbd88320d66a4f6e0d29a283350e22bbcb3ba) Attempt to add codesigning to windows electron - [`53e3877`](https://github.com/actualbudget/actual/commit/53e38770253f4e39f851fe291d377f5d8b9e4602) Merge branch 'actualbudget:master' into master - [`5efbe3c`](https://github.com/actualbudget/actual/commit/5efbe3c1e3df34c07542270081139a74d3975c70) Bump electron package version to match - [`6893e4f`](https://github.com/actualbudget/actual/commit/6893e4f49783c7e99dddcde8a3e392725a36cc8c) Add Release Notes - [`669b41c`](https://github.com/actualbudget/actual/commit/669b41cfceddbcb9f72b7b8fdeb2b6a545dd9470) Merge branch 'actualbudget:master' into master - [`6d3c6b5`](https://github.com/actualbudget/actual/commit/6d3c6b55dc50e3ee22917e8677e0ed82910ece95) Merge branch 'actualbudget:master' into master3 - [`9e2459f`](https://github.com/actualbudget/actual/commit/9e2459f5cfb82c59e8c3eedb7dc14fffb326d685) Rename 1191.md to 1209.md ### 📊 Changes **3 files changed** (+25 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/build.yml` (+18 -2) 📝 `packages/desktop-electron/package.json` (+1 -1) ➕ `upcoming-release-notes/1209.md` (+6 -0) </details> ### 📄 Description Sorry I accidentally closed the PR so opening again. ### Changes Made Adding code-signing to windows builds. This is all handled by [electron-builder](https://www.electron.build/code-signing.html) so all we need to do is supply it with the certificate details. There are two new github org secrets that need to be set before it will work. I am just using a locally generated certificate for now. The new secrets are WIN_CERT_BASE64 and WIN_CERT_PASS I will remove the `workflow_dispatch:` before this PR is merged, its just there for testing atm. Slightly related, the version number in `desktop-electron/package.json` is out of sync, so whatever process updates this perhaps needs a review. ### Getting a Certificate Option 1: Generate our own certificate. - Free adn easy but won't be recognised by windows Option 2: Purchase a Certificate - Will be recognised by windows - More complicated Steps: 1. We need to set up a cloud based HSM (hardware security module) to store the cert. This requirement came into force May of this year as far as I can tell and cert authorities will only send youa cert on a hardware token or add it to your HSM. 2. Buy a cert. There are lots of websites that sell codesigning certs, the cheapest i've seen is [here](https://cheapsslsecurity.com/fastssl/code-signing-certificate.html?gad=1) for $149/year. - We can use a cloud based HSM, for example [Azure Key Vault](https://azure.microsoft.com/en-gb/products/key-vault) - Azure offers $200 in free credit. I'm not sure how long this would last. Presumably we can use an unverified cert for dev builds and only fetch the offical one for release builds. - You upload and store the certificate in azure and its accessed via this [github action](https://github.com/Azure/cli) One thing i'm a little unclear about is how we would tranfer the certificate from the seller to the HSM, given they won't just send you the file. I have seen [this](https://learn.microsoft.com/en-us/azure/key-vault/certificates/certificate-scenarios#creating-a-certificate-with-a-ca-not-partnered-with-key-vault) but I can't test it without actually buying a cert. Azure is partnered with digicert etc for eliminating this issue but the certificates from them are much more expensive. I am currently deploying an azure keyvault to try it out and will report back...There is also an AWS HSM. In terms of financing this, I have not seen any links for donating etc, but would be happy to contribute. ### Windows Store I _think_ none of the above is needed if we publish directly to the microsoft store, as they re-sign things with a microsoft certificate, we just have to sign with _a_ cert, that we upload to our MS Developer account so they can verify who submitted the app. I can't test this thoroughly because whilst I have a MS Dev account you need to provide a url to a website, a url to the exe, a privacy policy, etc, so I dont have a good 'test' app to run through the process. I can try actually deploying the current actualbudget there if people want. This does have the caveat that people downloading directly from the github release won't get the 'officially' signed version. ![image](https://github.com/actualbudget/actual/assets/4405777/d576da6e-dc0f-4e26-a076-a2be12b32705) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-02-28 20:43:57 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#3594
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?