SpacetimeDB

mirror of https://github.com/clockworklabs/SpacetimeDB.git synced 2026-05-06 15:49:35 -04:00

Files

T

History

Ryan 8b8a42fa35 Windows Binary Signing through DigiCert (#4906 )

# Description of Changes

Add EV code signing for Windows CLI binaries using DigiCert KeyLocker.
The workflow now signs `spacetimedb-update.exe`, `spacetimedb-cli.exe`,
and `spacetimedb-standalone.exe` on tag pushes using `smctl sign` with a
cloud HSM-backed certificate.

These changes reflect the updated DigiCert guidance for code signing
through GitHub found here:
https://github.com/marketplace/actions/digicert-binary-signing

# API and ABI breaking changes

No API or ABI changes. This change only affects the CI/CD packaging
workflow.

# Expected complexity level and risk

1 - This PR only adds code signing to existing CI packaging. Risk is
limited to the Windows packaging step failing on tags; Linux and macOS
builds are unaffected.

# Testing

- [X] Tested via workflow dispatch on tag `test-signing-v0.0.1`
- [X] All three executables signed and verified successfully
- [X] Signature verification confirms certificate chain
- [X] Signed artifacts uploaded successfully

2026-04-30 15:43:59 +00:00

attach-artifacts.yml

Use VM-based github runners (#4045 )

2026-02-01 09:03:54 +00:00

benchmarks.yml

Bump Rust to 1.93.0 (#4180 )

2026-02-06 19:51:53 +00:00

check-merge-labels.yml

CI - Label check runs on synchronize events (#4602 )

2026-03-10 18:07:23 +00:00

check-pr-base.yml

Fix #1180 : Add PR status check that fails unless based on master (#1213 )