Azure Artifact Signing integration

[Sytten]

We are planning to move to Azure Artifact Signing (new name for Trusted Publishing) as our certificate is expiring and all new certificated are HSM based and super expensive.

Ideally we would like to continue using osslsigncode, but I am a bit at a loss if it is possible. I think we are many in that situation of switching to this service since it's the cheapest option right now to get a valid cert.

Any pointer would be appreciated!

[mtrojnar]

I'm not sure what your budget is, but see this: https://shop.certum.eu/code-signing.html

This is the service I use for stunnel and recommend for open source projects: https://shop.certum.eu/open-source-code-signing-code.html

[mtrojnar]

Could be in budget, we are trying Azure first since it also reduces the false positive of Windows Defender and it's 120USD/year. IDK if someone wrote a PCKS#11 provider for Azure Artifact Signing.

The price is very attractive indeed. Sadly, there seems to be no standard interface to Artifact Signing, such as a PKCS#11 module, only a plug-in dll for signtool. I guess vendor lock-in is the purpose of providing such a competitively priced service.

[Sytten]

I know JSign supports it but it is not standard indeed (https://github.com/ebourg/jsign/blob/a82a0b6403ab89d14adf1437772bcf10863727f3/jsign-crypto/src/main/java/net/jsign/jca/AzureTrustedSigningService.java). I asked an AI to see if it would be possible to write an adapter, but it seemed no really possible?

[ebourg]

The Azure Trusted Signing API doesn't fit well with PKCS#11, because the certificate is short lived (3 days) and generated when the hash is signed. This means that you can't load the certificate before signing in the read_token() function:

osslsigncode/osslsigncode.c

Lines 4253 to 4267 in d0ef178

	if (options->p11cert) {
	struct {
	const char *id;
	X509 *cert;
	} params;
	params.id = options->p11cert;
	params.cert = NULL;
	ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, &params, NULL, 1);
	if (!params.cert) {
	fprintf(stderr, "Failed to load certificate %s\n", options->p11cert);
	ENGINE_finish(engine);
	return 0; /* FAILED */
	} else
	sk_X509_push(options->certs, params.cert);

[mtrojnar]

The Azure Trusted Signing API doesn't fit well with PKCS#11

Do you mean a private API, or is there a public API I'm not aware of?

[ebourg]

I mean the PKCS#11 model of a keystore holding private keys and certificates. An Azure Trusted Signing keystore doesn't contain any certificate until the key is used.

AFAIK the Azure Trusted Signing API isn't documented.

[mtrojnar]

@ebourg I'm not sure there's much value in speculating about the private API. I assume it's private by design to enforce vendor lock-in.

If you have the budget to reverse-engineer Azure Artifact Signing and integrate it with osslsigncode, we'd be happy to help.