IJHack / QtPass / 38087374618
93%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 117
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 92.891%. Remained the same
38087374618

push

github

web-flow 
Sign the Windows release through the SignPath Foundation (#1977)

* Sign the Windows release through the SignPath Foundation

SignPath Foundation accepted QtPass for free Authenticode signing (#1643).
The Release installers workflow now, on tag pushes and manual runs, hands
qtpass.exe to SignPath, builds the Inno Setup installer around the signed
exe, and hands that over too. Pull requests never sign; without the
SIGNPATH_API_TOKEN secret and the SIGNPATH_ORGANIZATION_ID variable the
build is unsigned as before. The unsigned inputs are uploaded as
unsigned-* artifacts and the publish job only takes qtpass-*, since the
unsigned installer has the same file name as the signed one.

Only qtpass.exe and the installer are signed; the Qt libraries
windeployqt copies in are Qt's, which the Foundation terms keep out of
the project certificate.

SignPath checks the product name and version of what it signs, and
qtpass.exe had no version resource at all (windows.rc held only the
icon). qmake now generates the resource from VERSION and
QMAKE_TARGET_*; the installer gets VersionInfo* lines, with a numeric
version for the -rcN tags. .signpath/artifact-configuration.xml is the
reviewed source of the configuration kept in SignPath.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

* CHANGELOG: Windows code signing through SignPath

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JuQsrHonihp1nARE7bzstc

* SignPath: token behind an environment, reject bad signatures

The Windows job enters the signpath environment on tag pushes and manual
runs; with the token as an environment secret and deployment rules for
v* tags and main, a manual run on another branch cannot read it. Pull
requests do not enter the environment.

A returned file must have a Valid signature. While SignPath signs with
its test certificate (repository variable SIGNPAT... (continued)

9081 of 9776 relevant lines covered (92.89%)

191.54 hits per line

Coverage Regressions

Lines Coverage ∆ File
9
0.0
0.0% src/qrc_qmake_qmake_qm_files.cpp
Jobs
ID Job ID Ran Files Coverage
1 38087374618.1 117
92.89
GitHub Action Run
Source Files on build 38087374618