Documentation  ❯  Trusted Build Systems   ❯   Jenkins

Prerequisites

• The Jenkins plugin has been installed on the respective Jenkins instance (Jenkins 2.359 or higher are supported).
• The plugin has been registered as a custom Trusted Build System within SignPath and linked to the respective project (see the configuration section).
• The following plugins are installed on the Jenkins server:
  • Credentials binding
  • Git
  • Pipeline (Workflow aggregator)

Performed checks

The plugin ensures that

• A build was actually performed by a specific Jenkins CI instance, not by some other entity in possession of the API token
• Origin metadata is provided by Jenkins CI, not the build script, and can therefore not be forged
• The artifact is stored as an immutable Jenkins artifact before it is submitted for signing

Installation

See the official plugin page on how the plugin can be installed.

Configuration

• The Trusted Build System Token needs to be stored in a System Credential (Under Manage Jenkins / Manage Credentials)
• The Api Token of a SignPath user with submitter permissions needs to be available to the build pipelines of the respective projects.
• The default credential ID for the Trusted Build System Token, the default organization ID and the SignPath API endpoint can be configured in the plugin configuration (under System in the Code Signing with SignPath section).

Usage

In your Jenkinsfile, make sure the artifacts to be signed are pushed to the master node by adding a stage e.g.

    stage('Archive') {
      steps {
        archiveArtifacts artifacts: "build-output/**", fingerprint: true
      }
    }

Provided steps

Include the submitSigningRequest and optionally, the getSignedArtifact steps in your build pipeline.

General parameters

Parameters for the submitSigningRequest step

Parameters for the getSignedArtifact step

Examples

Example: Submit a synchronous signing request

    stage('Sign with SignPath') {
      steps {
        submitSigningRequest(
          projectSlug: "${PROJECT_SLUG}",
          signingPolicySlug: "${SIGNING_POLICY_SLUG}",
          artifactConfigurationSlug: "${ARTIFACT_CONFIGURATION_SLUG}",
          inputArtifactPath: "build-output/my-artifact.exe",
          outputArtifactPath: "build-output/my-artifact.signed.exe",
          waitForCompletion: true
        )
      }
    }

Example: Submit an asynchronous signing request with parameters

    stage('Sign with SignPath') {
      steps {
        script {
          signingRequestId = submitSigningRequest(
            projectSlug: "${PROJECT_SLUG}",
            signingPolicySlug: "${SIGNING_POLICY_SLUG}",
            artifactConfigurationSlug: "${ARTIFACT_CONFIGURATION_SLUG}",
            inputArtifactPath: "build-output/my-artifact.exe",
            outputArtifactPath: "build-output/my-artifact.signed.exe",
            waitForCompletion: false,
            parameters: [
              "version": "1.0",
              "my-param": "another param"
            ]
          )
        }
      }
    }
    stage('Download Signed Artifact') {
      input {
        id "WaitForSigningRequestCompleted"
        message "Has the signing request completed?"
      }
      steps{
        getSignedArtifact( 
          signingRequestId: "${signingRequestId}",
          outputArtifactPath: "build-output/my-artifact.exe"
        )
      }
    }