chore: migrate digicert signing action to Node.js 24 successor - BED-8168

.github/workflows/publish.yml

@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - v*.*.*
+  workflow_dispatch:
 env:
   AZUREHOUND_VERSION: ${{ github.ref_name }}
 jobs:
@@ -59,6 +60,7 @@ jobs:
         run: sha256sum ${{ env.FILE_NAME }}.zip > ${{ env.FILE_NAME }}.zip.sha256
 
       - name: Upload Release
+        if: github.event_name != 'workflow_dispatch'
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # ratchet:softprops/action-gh-release@v3
         with:
           files: |
@@ -91,56 +93,38 @@ jobs:
           name: azurehound-bin-${{ matrix.os }}-${{ matrix.arch }}
           path: unsigned/azurehound-bin-${{ matrix.os }}-${{ matrix.arch }}
 
-      - name: Install osslsigncode & pkcs11 engine
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y osslsigncode libengine-pkcs11-openssl
-
-      - name: Install DigiCert Client Tools
-        id: digicert
-        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # ratchet:digicert/ssm-code-signing@v1.2.1
-
-      - name: Set PKCS#11 Paths
-        id: pkcs11
-        run: |
-          SM_TOOLS_DIR=$(dirname "$(realpath '${{ steps.digicert.outputs.PKCS11_CONFIG }}')")
-          echo "module=${SM_TOOLS_DIR}/smpkcs11.so" >> "$GITHUB_OUTPUT"
-          LIB_PKCS11="$(dpkg -L libengine-pkcs11-openssl | grep "libpkcs11.so")"
-          echo "engine=$LIB_PKCS11" >> "$GITHUB_OUTPUT"
-
-      - name: Sign Artifacts via DigiCert Signing Manager
+      - name: Setup SM_CLIENT_CERT_FILE
+        shell: bash
         env:
-          SM_HOST: ${{ secrets.SM_HOST }}
-          SM_API_KEY: ${{ secrets.SM_API_KEY }}
           SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
-          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
-        shell: bash
         run: |
-          export SM_CLIENT_CERT_FILE=$(mktemp)
+          SM_CLIENT_CERT_FILE="${RUNNER_TEMP}/Certificate_pkcs12.p12"
           printenv SM_CLIENT_CERT_FILE_B64 | base64 --decode > "$SM_CLIENT_CERT_FILE"
-          trap 'rm $SM_CLIENT_CERT_FILE' EXIT
+          echo "SM_CLIENT_CERT_FILE=${SM_CLIENT_CERT_FILE}" >> "$GITHUB_ENV"
 
-          mkdir signed
-          artifact=unsigned/azurehound-bin-${{ matrix.os }}-${{ matrix.arch }}/azurehound.exe
-          smctl sign --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --input "$artifact" --openssl-pkcs11-engine "${{ steps.pkcs11.outputs.engine }}" --pkcs11-module "${{ steps.pkcs11.outputs.module }}" --tool osslsigncode --verbose
-          mv "$artifact" "signed/azurehound.exe"
-
-      - name: Verify Signed Artifacts
+      - name: Setup Software Trust Manager & Sign
+        id: digicert
+        uses: digicert/code-signing-software-trust-action@fae23a455ba4bde62b64fd7cb2f81ade788f5a95 # ratchet:digicert/code-signing-software-trust-action@v1.2.1
+        with:
+          simple-signing-mode: true
+          input: unsigned/azurehound-bin-${{ matrix.os }}-${{ matrix.arch }}/azurehound.exe
+          keypair-alias: ${{ secrets.SM_KEYPAIR_ALIAS }}
         env:
           SM_HOST: ${{ secrets.SM_HOST }}
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
-          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_CLIENT_CERT_FILE: ${{ env.SM_CLIENT_CERT_FILE}}
           SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+
+      - name: Cleanup cert file
+        if: always()
         shell: bash
-        run: |
-          export SM_CLIENT_CERT_FILE=$(mktemp)
-          printenv SM_CLIENT_CERT_FILE_B64 | base64 --decode > "$SM_CLIENT_CERT_FILE"
-          smctl certificate download --keypair-alias "${{ secrets.SM_KEYPAIR_ALIAS }}" --format pem --chain --name cert-chain.pem
-          trap 'rm $SM_CLIENT_CERT_FILE cert-chain.pem' EXIT
+        run: rm -f "${{ env.SM_CLIENT_CERT_FILE }}"
 
-          for artifact in signed/*; do
-            osslsigncode verify -CAfile cert-chain.pem "$artifact"
-          done
+      - name: Move Signed Artifacts
+        shell: bash
+        run: |
+          mkdir signed
+          mv unsigned/azurehound-bin-${{ matrix.os }}-${{ matrix.arch }}/azurehound.exe signed/azurehound.exe
 
       - name: Zip Signed Executables
         run: |
@@ -152,10 +136,12 @@ jobs:
           sha256sum zipped/${{ env.FILE_NAME }}.zip > zipped/${{ env.FILE_NAME }}.zip.sha256
 
       - name: Upload Artifacts to S3
+        if: github.event_name != 'workflow_dispatch'
         run: |
           aws s3 cp --recursive zipped/ s3://${{ secrets.BHE_AWS_BUCKET }}
 
   containerize:
+    if: github.event_name != 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       packages: write