It's unclear how to use this GitHub Action

[CurtT-OCC]

Neither the ReadMe content or the provided help link show an example of how to use this action.

What are the inputs? What does it do?

The examples provided in the link do not utilize digicert/ssm-code-signing at all!

[CurtT-OCC]

To any others that find this, I ended up finding the yaml for a 3rd party action that utilizes this action, and that served well as a primer for this. If you're so inclined, you could just use the 3rd party action as is, but I prefer not to let 3rd party actions handle potentially sensitive data.

https://github.com/cognitedata/code-sign-action/blob/main/action.yaml

Here's the meat:

- name: Configure Digicert Secure Software Manager
      uses: digicert/ssm-code-signing@v0.0.2
      env:
        SM_API_KEY: ${{ env.SM_API_KEY }}
        SM_CLIENT_CERT_PASSWORD: ${{ env.SM_CLIENT_CERT_PASSWORD }}
        SM_CLIENT_CERT_FILE: ${{ env.SM_CLIENT_CERT_FILE }}

This sets up the dependencies and command line utilities you need. You still need to securely provide the cert file and actually sign the file(s) you need.

To the DigiCert devs:
Just that snippet with a description of the required "env" setup and a description of what part of the cert process this actually does would go a long way to improving this action.

[cderv]

Thanks for sharing this example. That is helpful.

The doc can also get clearer on this: https://docs.digicert.com/de/software-trust-manager/ci-cd-integrations/plugins/github-custom-action-for-keypair-signing.html

From this doc, it seemed that the action can be used once. Possibly because it leverage tool cache which is kept between run on self hosted runner.This could also be more clearly documented.

[duaneking]

Just wanted to add My support for better docs.

When I look at this and I see the documentation is so lacking, I worry that this may not be a legitimate company, or it might be an illegitimate account pretending to be a legitimate company, and so if I look and I don't see any of that expected documentation... that is a red flag.

Think about it from the different layers of any given org:

• As a CTO or CISO I want my team to be able to get as much done as possible, and I want our foundational business partners to assist in our goals and make that easier to do.. so if they are not, then I would then reevaluate the use of those partners.

• As a SDE I want my team to be able to get as much done as possible, and I want our 3rd party dependencies to assist in our goals and make that easier to do.. so if they are not, then I would then reevaluate the use of those dependencies.

At the end of the day I don't think that Digicert fully understands how petty people can be about things like this that get in their way and actively make their job harder, I would like to respectfully request that the docs be updated and completed because the current docs look like they were done by somebody who doesn't communicate a developers needs well.

[duaneking]

@anshuman-mor ?

[duaneking]

I don't think it's a docs issue; it is like digicert doesn't even care about its own company or its own obligations under the agreements that allow them to even have a root cert. They are simply not maintaining this to a standard that keeps it functional and useful. This makes me worried about using Digicert.

[duaneking]

It should be noted that the above actually doesn't do anything except install a bunch of tools that still can't pass a healthcheck after, Because it's not configured correctly, as the installer does not work to do so correctly.

[duaneking]

As of the most recent new version, it does not correctly detect or install on a mac m4, either, in our tests.

[vishalshanbhag-digicert]

The concerned issues have been resolved in v1.1.0 (digicert/ssm-code-signing@v1.1.0). Please update to this version.

For more details on this version, please refer Here

[Crease29]

@vishalshanbhag-digicert you guys should update your docs as well with the new version: https://docs.digicert.com/de/software-trust-manager/ci-cd-integrations/plugins/github/install-client-tools-for-standard-keypair-signing-on-github.html

[vishalshanbhag-digicert]

@Crease29 - Thank you for bringing it to our attention. The document is already updated, but it looks like the link was pointing to the old document. Please refer to the link below for the latest document; the same has already been updated in our README file.

https://docs.digicert.com/en/software-trust-manager/ci-cd-integrations-and-deployment-pipelines/plugins/github/install-client-tools-for-standard-keypair-signing-on-github.html