UPX stanza is run after build hooks. That breaks code signing.

[levinalex-samedi]

We're using pust-build hooks to codesign windows binaries we build with goreleaser (discussed here)

When we also enable upx packing (https://goreleaser.com/customization/upx/) what breaks the code signing because UPX is run after the post build hooks.

We can work around that by calling UPX from a hook again. But maybe the UPX action should run before the hooks?

[caarlos0]

The thing is that signing from the build hook is probably not the right place... it should be on the last step possible, when you won't change it anymore.

maybe you could sign in the new msi before hook?

[levinalex-samedi]

Signing the executables does belong in the build step imo. The binaries should always be signed, also for non-msi uses like archives, docker images etc. Putting signing into msi hooks would not help with that.
Also we're sometimes building multiple executables. In the MSI hooks it wouldn't be obvious which ones we're signing.

I think our workaround will be to move upx packing (back) into build hooks. (or just to not use upx)

[caarlos0]

yes in that case it might be better to run upx directly as a build hook as well, yes.

there's also the sign feature, but it is usually involved in creating a signature file (not replacing the binary itself).

can you share how you do sign your windows binaries? maybe its something we could add native support for at the right place

[levinalex-samedi]

After some back and forth, we now use azure code signing for this, with the azure cli to log in and jsign to do the actual signing.
(we're not using osslsigncode any more because the world is moving to using short-lived certificates for code signing as well)

az login --service-principal -u "$AZURE_CLIENT_ID" -p "$AZURE_CLIENT_SECRET" --tenant "$AZURE_TENANT_ID" --allow-no-subscriptions
AZURE_TOKEN=$(az account get-access-token --resource https://codesigning.azure.net --query accessToken -o tsv)

jsign \
  --storetype "TRUSTEDSIGNING" \
  --keystore "weu.codesigning.azure.net" \
  --storepass "$AZURE_TOKEN" \
  --alias "organisation/name" \
  --name "$CODESIGN_APPLICATION_NAME \
  --url "$CODESIGN_APPLICATION_URL" \
  "$tmp_outfile"

We build and package the azure cli, jsign, and goreleaser into an alpine docker image and use that in our CI pipelines.

jsign is java, this is probably not appropriate to build into goreleaser. I don't know how much our signing process generalises otherwise.