Azure Artifact Signing integration

[Sytten]

We are planning to move to Azure Artifact Signing (new name for Trusted Publishing) as our certificate is expiring and all new certificated are HSM based and super expensive.

Ideally we would like to continue using osslsigncode, but I am a bit at a loss if it is possible. I think we are many in that situation of switching to this service since it's the cheapest option right now to get a valid cert.

Any pointer would be appreciated!

[mtrojnar]

I'm not sure what your budget is, but see this: https://shop.certum.eu/code-signing.html

This is the service I use for stunnel and recommend for open source projects: https://shop.certum.eu/open-source-code-signing-code.html

[Sytten]

Could be in budget, we are trying Azure first since it also reduces the false positive of Windows Defender and it's 120USD/year.
IDK if someone wrote a PCKS#11 provider for Azure Artifact Signing.

[mtrojnar]

Could be in budget, we are trying Azure first since it also reduces the false positive of Windows Defender and it's 120USD/year. IDK if someone wrote a PCKS#11 provider for Azure Artifact Signing.

The price is very attractive indeed. Sadly, there seems to be no standard interface to Artifact Signing, such as a PKCS#11 module, only a plug-in dll for signtool. I guess vendor lock-in is the purpose of providing such a competitively priced service.

[Sytten]

I know JSign supports it but it is not standard indeed (https://github.com/ebourg/jsign/blob/a82a0b6403ab89d14adf1437772bcf10863727f3/jsign-crypto/src/main/java/net/jsign/jca/AzureTrustedSigningService.java). I asked an AI to see if it would be possible to write an adapter, but it seemed no really possible?