mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-10-28 23:50:04 -05:00
Dave Page
b6ed164952
The signing host is about to become the only machine in the release pipeline that cannot be rebuilt from something. Everything else either disappears or becomes an ephemeral runner described entirely by a workflow file; this one is configured by hand and holds a certificate on a hardware card that cannot be copied or exported. What documentation existed lived in the buildfarm repository, which is being retired, and was written for the Jenkins arrangement. It also opened by saying it was "preserved for reference only" because the configuration was "now managed by Ansible roles", which was never true of this machine. So this consolidates both notes into one document next to the build they serve, rewritten for the GitHub Actions arrangement: the runner in an interactive session rather than as a service, the Startup folder shortcut, the PIN helper, the prerequisites the workflow checks for, and the PGADMIN_WINDOWS_CSC repository variable. The Certum material is preserved largely as it was, because it is hard-won and none of it changes: CSP mode rather than Minidriver, importing to the machine store, and above all the certificate-to-key repair via keyprov.inf, which the card's own registration does not do correctly and without which signing either fails or quietly degrades to SHA1. The troubleshooting section is kept for the same reason, particularly that NTE_KEYSET_NOT_DEF almost always means someone is on Remote Desktop. Everything specific to an individual, a machine or a certificate stays out: subject names, thumbprints, container IDs and passwords are placeholders, as they were in the originals.