Configure the Code Signing Pipeline

base64 -i pki.p12 | tr -d '\n' > pki.p12.b64

stages:
  - build
  - sign

# ---- Build a Windows EXE with MinGW -----------------------------------------
build_exe:
  image: openturns/archlinux-mingw
  tags: [mingw]
  stage: build
  script:
    - x86_64-w64-mingw32-gcc main.c -o example.exe
  artifacts:
    paths:
      - example.exe

# ---- Submit for code signing + poll by request status -----------------------
sign_exe:
  image:
    name: docker-registry.futurex.com/futurex/fxcl/kmes-cli:1.9.2-2
  tags: [codesign]
  stage: sign
  timeout: 3d                 # also raise project-wide timeout in Settings → CI/CD → General pipelines
  variables:
    FXCL_SESSION: "./fxcl.kmes.session.$CI_JOB_ID"
    POLL_INTERVAL: "10"       # seconds between status checks
    MAX_ATTEMPTS: "0"         # 0 = infinite; else set e.g. 25920 for ~3 days at 10s
    CH_HOSTNAME: "integrations.uscentral1-cryptohub-uat.virtucrypt.com"
    CH_PORT: "2001"
  script:

    # Pull the client TLS certificate from the Gitlab instance project variables and save to encrypted file
    - mkdir -p .secure_files
    - echo "$PKI_P12_B64" | base64 -d > .secure_files/pki.p12
    - fxcli.kmes tls pki --file .secure_files/pki.p12 --password "$PKI_PASS"
    - fxcli.kmes connect -c "$CH_HOSTNAME":"$CH_PORT"

    # Submit request with unique name and capture REQUEST_ID
    - |
      set -eo pipefail
      DATETIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
      REQ_NAME="Gitlab-Codesign-demo-$DATETIME"
      echo "Submitting signing request with name: ${REQ_NAME}"
      REQUEST_ID=$(fxcli.kmes code-sign-req submit \
        -a code-signing \
        -t sha256 \
        -f example.exe \
        --name "${REQ_NAME}" | yq -r '.request.id')
      echo "Submitted signing request. REQUEST_ID=${REQUEST_ID}"

    # Poll request STATUS via `code-sign-req get` (no --json flags)
    #   - if output indicates the request was deleted/unknown -> fail (exit 3)
    #   - denied  -> fail (exit 2)
    #   - pending -> sleep & retry
    #   - signed  -> download & finish
    - |
      set -eo pipefail
      ATTEMPTS=0
      while true; do
        ATTEMPTS=$((ATTEMPTS+1))

        # Capture stdout+stderr
        OUT_TEXT="$(fxcli.kmes code-sign-req get -i "$REQUEST_ID" 2>&1 || true)"

        # Deleted/unknown edge case detection
        if printf '%s' "$OUT_TEXT" | grep -qiE 'UNKNOWN PROFILE-BASED REQUEST|Failed to download request'; then
          echo "Request $REQUEST_ID no longer exists (deleted/unknown). Failing the job."
          printf '%s\n' "$OUT_TEXT"
          exit 3
        fi

        # Try to parse status with yq from YAML-like text
        STATUS="$(printf '%s' "$OUT_TEXT" \
          | yq -r '.request.status // .requests[0].status // ""' 2>/dev/null \
        )"

        # If yq path didn't work, fallback to regex "status: <value>"
        if [ -z "$STATUS" ] || [ "$STATUS" = "null" ]; then
          STATUS="$(printf '%s' "$OUT_TEXT" \
            | sed -n 's/^[[:space:]]*status:[[:space:]]*"\?\([^"]*\)"\?/\1/p' \
          )"

        echo "$(date -Iseconds) Request $REQUEST_ID status: $STATUS (attempt ${ATTEMPTS})"

        case "$STATUS" in
          denied)
            echo "Request was DENIED by approvers. Failing the job."
            exit 2
            ;;
          pending)
            if [ "$MAX_ATTEMPTS" != "0" ] && [ "$ATTEMPTS" -ge "$MAX_ATTEMPTS" ]; then
              echo "Reached MAX_ATTEMPTS (${MAX_ATTEMPTS}) while still pending. Failing the job."
              exit 124
            fi
            sleep "${POLL_INTERVAL}"
            ;;
          signed)
            echo "Request is SIGNED. Downloading signed artifact..."
            if fxcli.kmes code-sign-req download -i "$REQUEST_ID" -f example.exe; then
              echo "Signed artifact downloaded."
              break
            else
              echo "Download failed unexpectedly after status=signed. Retrying in ${POLL_INTERVAL}s..."
              sleep "${POLL_INTERVAL}"
            fi
            ;;*)
            echo "Unexpected status '$STATUS'. Treating as transient; retrying in ${POLL_INTERVAL}s..."
            sleep "${POLL_INTERVAL}"
            ;;
        esac
      done

  artifacts:
    paths:
      - example.exe
    when: always

build_exe:
  image: openturns/archlinux-mingw
  tags: [mingw]
  stage: build
  script:
    - x86_64-w64-mingw32-gcc main.c -o example.exe
  artifacts:
    paths:
      - example.exe