P2: Code signing for exe + installer (CI integration) #24

Activity

1. Kinin-Code-Offical

   added

   Priority: P2

   Type: enhancement

   Area: security

   P2

   security

   release

   enhancementNew feature or requestNew feature or request

   on Dec 21, 2025
2. Kinin-Code-Offical

   added this to the P2 – Enterprise Distribution & Signing milestone on Dec 21, 2025
3. Kinin-Code-Offical commented on Dec 22, 2025

   

   Kinin-Code-Offical

   on Dec 22, 2025

   OwnerAuthor

   More actions

   Plan:

   • Add optional signing support to release workflow using base64 PFX secret.
   • Sign both cloudsqlctl.exe and cloudsqlctl-setup.exe after build/installer when cert is present.
   • Keep workflow no-op when signing secrets are not provided.

   Risks:

   • Incorrect secret configuration will cause signing to fail; ensure clear skip behavior.

   Tests:

   • npm ci
   • npm run lint
   • npm test
   • npm run build
   • npm run package
   • npm run smoke:exe
   • npm run installer
   • npm run stage
4. Kinin-Code-Offical

   closed this as completedin #43on Dec 22, 2025
5. Kinin-Code-Offical commented on Dec 22, 2025

   

   Kinin-Code-Offical

   on Dec 22, 2025

   OwnerAuthor

   More actions

   Merged via #43
   Merge commit: 20f5888

   Notes:

   • Signing is optional: if repo secrets CLOUDSQLCTL_SIGN_CERT_B64 / CLOUDSQLCTL_SIGN_PWD are not set, the release workflow will skip signing.
   • CI/docs gate fixed by regenerating docs/commands.md.