Guide for setting up code signing using Azure keyvalue

[dksander]

Hi,
I am trying to setup signing of Appsource app using a code signing certificate, but currently it seams that the documentation is a mix of previous version of AL-Go and there is not straight foreward guide.

I will try to open a issue to find what is wrong, but it would be nice to have to documentation updated at some point :-)

[spetersenms]

Hi @dksander,
I have just tried setting up a new repo with signing, and while the documentation is not per se outdated for older AL-Go versions, it is messy and not super well structured. Especially for the signing setup.

We do need to get around to updating the documentation, but until then I can try help you here if you have specific questions on how to setup signing.

Here is a quick step-by-step guide using managed identity (I assume you already have a KeyVault with a certificate):

1. Create a new user assigned managed identity in Azure.
2. Assign the identity the following permissions:
   2.a Using RBAC: Key Vault Secrets User + Key Vault Crypto User + Key Vault Certificate User
   2.b Using Access Policy: Secret permissions: Get, List & Cryptographic Operations: Sign & Certificate permissions: Get
3. Go to the federated credentials tab of your managed identity and add a new credential.
   3.a Select the Github actions deploying Azure resources scenario. This still works for signing, even though the same suggests otherwise.
   3.b Fill out your org and repo name. For entity select branch and fill out the branch name. I used main in my setup.
4. In your GitHub repo, create a new repo secret called AZURE_CREDENTIALS and give it the following single-line value: {"keyVaultName":"{keyVaultName}","clientId":"{clientId}","tenantId":"{tenantId}"} - replace with your KeyVault name, identity client id and tenant id.
5. Add this setting: "keyVaultCodesignCertificateName": "{certName}" - replace with your cert name.

Next time you run CICD on the main branch, this should run the signing task after the build.

[dksander]

@spetersenms
Thank you for the quick step-by-step guide I have successfully set up signing of the app now 😊
I am glad I am not the only once that kinda found the documentation a bit messy :-)