Class AzureSignTool

constructor/signing.py:132–227

class AzureSignTool(SigningTool):
    def __init__(self):
        super().__init__(os.environ.get("AZURE_SIGNTOOL_PATH", "AzureSignTool"))

    def get_signing_command(self) -> str:
        required_env_vars = (
            "AZURE_SIGNTOOL_KEY_VAULT_URL",
            "AZURE_SIGNTOOL_KEY_VAULT_CERTIFICATE",
        )
        check_required_env_vars(required_env_vars)
        timestamp_server = os.environ.get(
            "AZURE_SIGNTOOL_TIMESTAMP_SERVER_URL", "http://timestamp.sectigo.com"
        )
        timestamp_digest = os.environ.get("AZURE_SIGNTOOL_TIMESTAMP_DIGEST", "sha256")
        file_digest = os.environ.get("AZURE_SIGNTOOL_FILE_DIGEST", "sha256")

        command = (
            f"{win_str_esc(self.executable)} sign -v"
            ' -kvu "%AZURE_SIGNTOOL_KEY_VAULT_URL%"'
            ' -kvc "%AZURE_SIGNTOOL_KEY_VAULT_CERTIFICATE%"'
            f' -tr "{timestamp_server}"'
            f" -td {timestamp_digest}"
            f" -fd {file_digest}"
        )
        # There are three ways to sign:
        #   1. Access token
        #   2. Secret (requires tenant ID)
        #   3. Managed identity (requires prior login to Azure)
        if "AZURE_SIGNTOOL_KEY_VAULT_ACCESSTOKEN" in os.environ:
            logger.info("AzureSignTool: signing binary using access token.")
            command += ' -kva "%AZURE_SIGNTOOL_KEY_VAULT_ACCESSTOKEN%"'
        elif "AZURE_SIGNTOOL_KEY_VAULT_SECRET" in os.environ:
            # Authentication via secret required client and tenant ID
            logger.info("AzureSignTool: signing binary using secret.")
            required_env_vars = (
                "AZURE_SIGNTOOL_KEY_VAULT_CLIENT_ID",
                "AZURE_SIGNTOOL_KEY_VAULT_TENANT_ID",
            )
            check_required_env_vars(required_env_vars)
            command += (
                ' -kvi "%AZURE_SIGNTOOL_KEY_VAULT_CLIENT_ID%"'
                ' -kvt "%AZURE_SIGNTOOL_KEY_VAULT_TENANT_ID%"'
                ' -kvs "%AZURE_SIGNTOOL_KEY_VAULT_SECRET%"'
            )
        else:
            # No token or secret found, assume managed identity
            logger.info("AzureSignTool: signing binary using managed identity.")
            command += " -kvm"
        return command

    def verify_signing_tool(self):
        self._verify_tool_is_available()
        check_call([self.executable, "--help"], stdout=PIPE, stderr=PIPE)

    def verify_signature(self, installer_file: str | Path):
        """Use Powershell to verify signature.

        For available statuses, see the Microsoft documentation: