Intermittent failure when downloading tools MSI

[wyattcdavis]

Occasionally (and consistently this morning) this action fails to download the tools needed to run:

Tool to be downloaded and used smtools-windows-x64.msi and url is signingmanager/api-ui/v1/releases/noauth/smtools-windows-x64.msi/download
Error fetching file from the API: AxiosError: Request failed with status code 403

This then breaks our builds.

[mattjcly]

Also experiencing this

[wwwillchen]

Same here. When I go to https://demo.one.digicert.com/signingmanager/api-ui/v1/releases/noauth/smtools-windows-x64.msi/download

I see this error message:

{
	"message": "Get \"http://extauth.demo:8085/extauth/signingmanager/api-ui/v1/releases/noauth/smtools-windows-x64.msi/download\": context deadline exceeded",
	"status_code": 403
}

Seems like digicert has some kind of server issue?

[tigunia-dave]

Also experiencing this issue, exact same behavior as those above.

[pirog]

Experiencing the same.

{
	"message": "Get \"http://extauth.demo:8085/extauth/signingmanager/api-ui/v1/releases/noauth/smtools-windows-x64.msi/download\": context deadline exceeded",
	"status_code": 403
}

This seems to happen on the older v0.0.2 and also v1.1.0. If you set force-download-tools: true you get a 503 which im guessing is the actual underlying issue and suggests something is up on the digicert side.

[duaneking]

I just pointed this issue out to DigiCert support

[duaneking]

... and today they claim its fixed but the release doesn't pass full QA as of the time of this post.

[anshuman-mor]

We addressed this issue on August 26, 2025 by changing our endpoint URL for Code signing with Software Trust Manager on GitHub marketplace from demo.one.digicert.com to one.digicert.com to ensure improvement in High Availability and monitoring by the DigiCert support team (#50).

[duaneking]

Yes, but only after I spent weeks escalating through multiple DigiCert executives and internal managers to force action.

These bugs were reported publicly by myself and others for months, yet your engineering team failed to respond despite having clear, actionable information. Support channels were effectively unusable, with even your own staff acknowledging how disengaged and obstructive the process had become. I’ve already raised concerns with your executive team about the excessive friction in your support workflows, including potential ADA compliance issues.

Let’s be clear: these issues were not resolved due to any initiative from DigiCert’s engineering team. They were fixed because I had to intervene and push relentlessly for action in the absence of basic ownership and accountability.

[duaneking]

Also: If this issue has been fixed, why is it still open?

Leaving resolved issues open highlights how inactive this repository has become. It also suggests a lack of basic oversight from your engineering leadership.

Since no one else seems to be maintaining this properly, I’ll ask the obvious: please close this issue if it’s indeed resolved.