Updated dependencies. The action now requires NodeJS in version 24.
Greatly improved signing request list UI:
Added support for Android package (APK) signing via <apk-sign>.
The trusted build system details page now shows in which projects/signing policies the trusted build system is used.
Switched HSM interface for nShield HSMs, which requires a manual key conversion step. Ask SignPath support for further details.
Requires Jenkins version 2.426.3 or higher.
The archiveArtifact step is not required any more for signing. Instead of the actual artifact, a digest file is now automatically published to the Jenkins server.
Added the inputArtifactRetrievalUrl and inputArtifactRetrievalHttpHeaders parameters to allow retrieving an unsigned artifact from a HTTPS URL.
Various performance improvements.
Added support for S/MIME signing via <smime-sign>.
Fixed: occasional JAR signing processing errors during high system load.
Renamed Helm charts:
signpath-signservice-sw to signpath-signservice-software-chartREST API: new route for cancelling signing requests: POST /v1/{organizationId}/SigningRequests/{id}/Cancel
signpath-application chart, appSettings.shared.forwardedHeadersOptions: renamed knownNetworks to knownIPNetworks
signpath-application chart: moved openIdConnectOptions from appSecrets.shared to appSecrets.webClient
OIDC client secrets are now mandatory for the web client configuration, because the authentication flow now uses OAuth Pushed Authorization Requests (PAR).
ECDSA key management now supported for nShield.
Added “cancel” buttons to create/edit screens.
Fixed: missing output-file-name parameters in artifact configurations were reported as system errors.
Fixed in REST API: requests with missing or invalid Content-Type request headers were not properly handled.
Due to changed behavior in the current AWS S3 SDK, content store uploads will fail when using older MinIO versions.
If you cannot update immediately, you may temporarily append the following option to the appSecrets.shared.contentStore connection string: ;RequestChecksumCalculation=WHEN_REQUIRED.
The default ingress annotations in the signpath-application-ingress chart are now disabled because the Kubernetes NGINX Ingress Controller became obsolete.
chartSettings.ingressAnnotations.nginx.enabled.The javasigningmethodservice deployment now requires a Linux container. If you use it, ensure that your cluster has available resources to host its replicas.
The Windows CSP component for the deprecated Windows CAPI (Crypto API) is not longer supported.
The following configuration settings have been removed: Timeouts.HttpRequest, Timeouts.FirstRetryDelay and Timeouts.RetryCount.
Instead, use the new settings ServiceUnavailableTimeoutInSeconds and HttpRequestTimeoutInSeconds.
See timeout settings for details.
The Cryptoki library for Windows is now provided as a separate download and not part of the Windows installer any more (see download section).
Logging: new file naming scheme; now a single log file gets written instead of one per process (see logging settings).
The Crypto Providers are now available via stable links on our download share. See the download section for details.
TeamCity agents now connect to the SignPath TeamCity connector only. (Agents used to download artifacts from SignPath directly.)
Added support for SLSA Build Level 2 attestations.
Increased default HTTP client timeout.
Improved logging messages.
Increased default HTTP client timeout.
Improved logging messages.
Increased default HTTP client timeout.
Improved logging messages.
Improved error message when an incorrect ApiUrl is specified.
Fixed: signing request submission errors when user-defined parameters ended on the term “file”.
Added support for file-based Debian package (.deb) signing via <debsigs-sign>.
Improved the artifact configuration selection in the project creation UI.
REST API: added webLink response property, pointing to the Signing Request UI detail page, in the following routes:
GET /v1/{organizationId}/SigningRequests/{id}POST /v1/{organizationId}/SigningRequests/Submit*POST /v1/{organizationId}/SigningRequests/SignHashImproved authorization error messages.
REST API: specific cause of HTTP 403 (Forbidden) errors is now included in the body.
Changed recommended Kubernetes version to 1.33.x and signpathio/kubectl image tag to 1.33.
Improved performance.
Reduced number of required network routes for Azure DevOps Server deployments.
Improved performance.
Reduced number of required network routes for GitHub Enterprise Server deployments.
Fixes wrong values in the repository field for SLSA attestations.
Improved performance.
In case of failed artifact uploads, the integration now aborts immediately instead of running into timeouts.
Fixes broken documentation links.
Deep signing with long file paths (> 260 characters) is now supported.
SignService charts: moved Application Insights connection string from appSecrets.signService.applicationInsights.connectionString to appSecrets.shared.applicationInsights.connectionString.
REST API: improved naming of “verify origin policy” on signing policy objects.
verifyOrigin to verifyOriginPolicy and originVerification to originPolicyVerification in the following API routes:
POST /v1/{organizationId}/Projects/{projectSlug}/SigningPoliciesPOST /v1/{organizationId}/Projects/{projectSlug}/SigningPolicies/{signingPolicySlug}verifiesOrigin to verifiesOriginPolicy in the following API routes:
GET /v1/{organizationId}/Projects/{slug}GET /v1/{organizationId}/Projects/{projectSlug}/SigningPolicies/{signingPolicySlug}Added support for file-based RPM Package Manager (.rpm) signing via <rpm-sign>.
Artifact download permissions based on global roles: only some global roles are now eligible (used to be all explicit global roles). See documentation.
Improved the history view on the organization details page (missing fields added).
All Windows containers switched from Windows Server 2019 to Server 2022 base images. Before starting the upgrade, ensure that your Kubernetes cluster has Windows Server 2022 worker nodes available and ready.
Added support for DSSE (Dead Simple Signing Envelope) signatures via <dsse-sign>.
Fixed in UI: Error handling for “resubmit” action when the new signing policy doesn’t allow the original signing requests’ branch name.
Improved SignService reliability during temporary database outages.
Improved Linux Cryptoki samples:
debsigs Debian package formatAdded Debian 13 (“trixie”) to the supported Linux distros
Cryptoki on Linux: updated OpenSSL dependency to 3.4.2
Quotas are now calculated, displayed and limited annually:
GET /v1/{organizationId}/Organization
yearlyMaxSizeOfArtifactsInBytes, yearlyMaxNumberOfIndividualSignatures, quotaPeriodStart, quotaPeriodEndmonthlyMaxSizeOfArtifactsInBytes and maxNumberOfIndividualSignaturesREST API: new route GET /v1/{organizationId}/SigningRequests/{id}/Status for signing request status polling.
GET /v1/{organizationId}/SigningRequests/{id} for status polling. This route may become rate-limited in the future.Added automatic cleanup of temporary signing request metadata in ApplicationShared DB which reduces the overall database size.
REST API: new route POST /v1/{organizationId}/Projects/{projectSlug}/TrustedBuildSystemLinks for linking trusted build systems in projects. See API definition for details.
Minor improvements in the quota display on the organization details page.
Fixed: hash signing requests for ECDSA keys with invalid input hash lengths resulted in internal errors (now responds with status 400).
Changed recommended Kubernetes version to 1.32 and signpathio/kubectl image tag to 1.32.
Improved logging to aid problem analysis.
<create-raw-signature>: dropped the legacy file-name attribute (has been renamed to output-file-name in version 1.179).
REST API: new route POST /v1/{organizationId}/TrustedBuildSystems/AddPredefined for adding predefined trusted build systems. See API definition for details.
Fixed: trying to sign Authenticode or Office Macro files with very long paths resulted in a generic “processing error” message.
Fixed in REST API: multipart/form-data requests with invalid field names resulted in status 500 responses (e.g. user-defined parameters in signing request submission).
Dropped the fourth part (internal build number) from container image version numbers (e.g. image tag for this release is now simply 1.198.1). In case you perform image mirroring you may need to update your mirroring scripts.
Improved self-healing/error recovery on temporary SQL connection outages in SignService.
All requests including signed artifact download are now performed via the connector service. The build agent no longer needs direct network access to SignPath.
The signpath-api-url output parameter has been removed.
All requests including signed artifact download are now performed via the connector service. The build agent no longer needs direct network access to SignPath.
Cleaned up log levels
Cleaned up log levels
Signing requests from personal builds are now rejected.
Improved error messages for operational errors.
Cleaned up log levels
Improved error logging
Improved error display on signing request details page for failed custom signer invocations.
Fixed: re-upload of X.509 certificates didn’t work if they contained an ECDSA key.
Fixed: missing output-file-name attributes on <create-gpg-signature> or <create-raw-signature> directives led to internal errors (improved error handling).
New mandatory configuration value in signpath-application chart: appSettings.shared.apiUrlOptions.apiBaseUrl.
Operator API: changed POST /Api/v1-pre/Organizations to create an initial CI user, which then can be used for additional setup steps via the REST API.
REST API: POST SigningRequest route split for more specific contracts
POST /v1/{organizationId}/SigningRequestsPOST /v1/{organizationId}/SigningRequests/SubmitWithArtifact route
POST SigningRequests for isFastSigningRequest=falsePOST /v1/{organizationId}/SigningRequests/SignHash route
POST SigningRequests for isFastSigningRequest=trueREST API: improvements and fixes in the API definition for better OpenAPI client code generation
{organizationId})format=uuid annotation for {organizationId} segmentsrequired and some missing nullable:false annotationsGET /v1/{organizationId}/Cryptoki/MySigningPolicies route (used for hash signing)Changed the links in the cmdlet descriptions to point to the new docs.signpath.io website.
REST API: All status 4xx error response bodies now conform to the RFC9457 “problem details” JSON format.
Fixed in REST API: the GET /v1/{organizationId}/Organization route contained a typo (renamed maxNumberOfIndiviudualSignatures property to maxNumberOfIndividualSignatures).
An internal delay for deleting/archiving artifacts has been reduced from 24 hours to 1 hour.
Fixed: response was not stored for webhook calls that returned an error, display link failed.
Fixed: GitHub workflow jobs that do not execute any steps caused violations of runner group policies. (Cause: these jobs do not have a runner agent assigned.)
Fixed: signing requests submitted from a Trusted Build System, but without origin information, were rendered incorrectly.
Fixed: certificate import for by OpenSSL-generated PFX files didn’t work.
Improved the performance and logging.
Fixed a bug that prevented the use of API tokens of interactive users.
Fixed a bug that prevented the use of API tokens of interactive users.
Fixed a bug that prevented the use of API tokens of interactive users.
Improved performance and logging.
REST API: New signing request submission APIs, which allow to separate metadata submission from artifact upload:
POST /v1/{organizationId}/SigningRequests/SubmitWithoutArtifact creates a signing request in a “waiting for artifact upload” status.POST /v1/{organizationId}/SigningRequests/{id}/UploadUnsignedArtifact (afterwards) uploads the artifact.Added subject and author <msi-file> metadata restrictions.
Improved performance for the signing policy-filtered signing request list as well as the “waiting for your approval” list on the dashboard UI.
Fixed a bug that considered skipped GitHub jobs as violations of the allowed runner groups policy.
Cryptoki/PKCS#11: project and signing policy can now be specified via environment variables or config file.
InitializeSignPathCryptoProviderGpgSigning helper function now fully configures GPG; no more need to run ImportSignPathGpgPublicKey.Improved the default logging locations for GPG signing, see GPG docs.
Added a dedicated Verifications panel on the signing request page to provide a comprehensive overview of all the checks that were performed by SignPath.
signpath-application chart: moved smtpServerOptions section from appSecrets/appSettings.notificationsProcessorService to appSecrets/appSettings.shared.
Improved general database query performance when using multiple organizations with uneven signing request data distribution.
Fixed Fortanix HSM SignService connections to Fortanix DSM clusters with in-house PKI TLS certificates.
Changed the GET /v1/{organizationId}/SigningRequests/{id} REST API to always return a signedArtifactLink. Note that the returned URL will respond with status 400 while the signing request is being processed.
Fixed processing errors for specific MSI files when performing deep signing.
Fixed that “Resubmit with current settings” button was visible for users without submission privileges (which later led to an “not allowed” error message).
Fixed error handling of invalid input of POST /v1/{organizationId}/TrustedBuildSystems/AddCustom REST API (now the correct status code 400 instead of 500 is returned).
Additional migration steps happen in final application migration phase. Expect longer downtime than usual (exact downtime depends on number of total signing requests and database performance; contact support for details).
signpath-application chart: renamed appSecrets.setupDb.connectionStrings.reportModelDatabaseDdl to signingRequestDatabaseDdl and appSecrets.shared.connectionStrings.reportModelDatabase to signingRequestDatabase. Note: only the values’ paths have changed; keep the values as they are.
Added support for subscriptions without the origin verification feature.’
Improved the matching algorithm of users during the initial synchronization
Fixed a potential inconsistent state bug for group synchronization (not relevant for supported scenarios).
Processing now aborts immediately when client aborts HTTP connection.
Processing now aborts immediately when client aborts HTTP connection.
Fixed incorrect group name evaluation for GitHub runners due to unannounced GitHub API change.
Processing now aborts immediately when client aborts HTTP connection.
Fixed a bug where the root cause of certain error cases was not properly displayed.
Support user-defined parameters for hash-algorithm attribute of <create-raw-signature>.
Removed the “user feedback” button (rationale: was mainly used for support requests).
Changed recommended Kubernetes version to 1.31 and signpathio/kubectl image tag to 1.31.
Certificate chains are now always embedded in Authenticode, ClickOnce, CMS and XML signatures. (Previously only chains from public CAs were embedeed.)
Improved the user experience by removing unused Trusted Build System Link details.
Email notifications for accepted invitations now state whether a SSO or personal user account was used.
Changes of the purpose property of certificates and signing policies are now included in the history view.
Proper error messages are now displayed when invalid certificate files are uploaded.
The following REST APIs now return the correct error codes when no artifact is available:
GET /SigningRequests/{signingRequestId}/UnsignedArtifactGET /SigningRequests/{signingRequestId}/SignedArtifactMinimum required version to upgrade from is 1.140. In case you have an older version, you first need to upgrade to a previous version (e.g. 1.186, contact support). [Updated 2025-05-19]
All configuration settings of each container instance are now dumped into a file at startup for easier troubleshooting (except secrets).
The output-artifact-directory path now also supports absolute paths.
X.509 certificate chains:
GET /v1/{organizationId}/Certificates/{slug} REST API contains a new x509CertificateChain property (contains the available full chain).PFX import now also supports uploading X.509 certificate chains.
REST API additions:
POST /v1/{organizationId}/Projects/{projectSlug}/ArtifactConfigurations/{artifactConfigurationSlug}/EditXml route.GET /v1/Meta/SystemInfo route to retrieve the application version and UI base URL.Fixed caching issue that prevented project configurators from editing recently created artifact configurations.
Fixed a bug in branch ruleset policy evaluation (potential skipping of rules; evaluation of system logs confirmed that this codepath was not executed in production)
Initial release: TeamCity Plugin is now supported as a Trusted Build System.
Initial release: TeamCity Plugin is now supported as a Trusted Build System.
Azure DevOps (dev.azure.com) is now supported as a Trusted Build System (In Preview).
Personal API tokens of interactive users can now be used in combination with trusted build systems/origin verification.
Performance improvement for group membership changes (especially for groups with frequent changes).
Custom notification email styling: changed _MailLayout.cshtml. In case you have overridden the template, compare your customized file with the Helm chart’s version. [Updated 2025-06-03]
Certificate chains are now automatically resolved. See the documentation.
Uploaded X.509 certificate chains are now embedded in the signature when using the <authenticode-sign> directive.
Performance improvements.
Added support for storing and retrieving X.509 certificate chains (for e.g. certificates issued by in-house PKIs).
Added support for file-version, company-name, copyright, and original-filename to <pe-file> metadata restrictions.
The rsa-padding attribute in create-cms-signature or create-raw-signature doesn’t lead to validation errors when signing with an ECDSA certificate (it will be just ignored).
Fixed a memory leak in SignService with enabled HSM watchdog.
ECDSA keys can now be created on custom HSMs with the “Exportable” flag turned on, which allows those keys to be synchronized to a self-hosted backup HSM.
Certificate signing requests (CSRs) and self-signed X.509 certificates now set the key usage Code Signing as critical to align with the CA/Browser forum requirements.
Improved performance when dealing with large user groups or many artifact configurations.
Fixed a bug that did not allow saving artifact configurations containing detached signature (Raw, CMS or GPG) directives within <file-set> elements.
Reduced image size of the signpathio/signservice-lunahsm container image and startup time of the SignService migration jobs.
The SignPath GitHub App is only required if source code and build policy verification is used.
Fixed bug for workflow runs with skipped jobs.
The SignPath Api URL must now be configured globally in the Jenkins system settings. The parameter in the Pipeline step has been marked as deprecated. (It is ignored if it matches the global setting.)
This fix removes a risk of introducing insecure configurations through individual Jenkins projects. All potentially affected customers have previously been informed.
A default Trusted Build System Token Credential ID and a default Organization ID can now be configured globally in the Jenkins system settings.
Improved Linux container samples:
-GpgKeyId parameter of the scenario scripts has been replaced with -ProjectSlug and -SigningPolicySlug.Samples/Scenarios/temp to Samples/Scenarios/Work and logs directory to Samples/Scenarios/Work/Logs.GPG Key Creation: fixed a rounding error, which led to expiry dates which were 1 sec off and an overflow error for expiry dates later than year 2161
Signing Request CSV Report: fixed failed report download when querying large time spans
Added support for detached GPG file signing.
The signing request details page now displays details of detected malware including threat names and the exact file location in container files like ZIP archives.
<create-raw-signature>: renamed file-name attribute to output-file-name. (file-name is still supported for backwards compatibility.)
<create-cms-signature>: hash-algorithm attribute is now optional.
REST API: Fixed error in signing request approve/deny APIs when providing empty request body. (Used to fail unless passing a dummy {} body.)
Changed recommended Kubernetes version to 1.30 and signpathio/kubectl image tag to 1.30.
Reduced image size of the signpathio/signservice-software container image and startup time.
Added support for Cryptographic Message Syntax (CMS) signatures.
Policy checks for branch rulesets, build and build runner are supported. See the documentation.
Fixed a bug that prevented signing requests from being submitted when the “re-run failed jobs” feature of workflows was used for workflows with multiple jobs.
Fixed an integer overflow bug caused by large artifact IDs.
Added GPG key management:
create-raw-signature.REST API additions and improvements regarding certificates and signing policies:
GET /v1/{organizationId}/Projects/{projectSlug}/SigningPolicies/{signingPolicySlug}GET /v1/{organizationId}/Projects/{projectSlug}/SigningPolicies/{signingPolicySlug}/CertificateGET /v1/{organizationId}/Projects/{projectSlug}/SigningPolicies/{signingPolicySlug}/Certificate/X509CertificateGET /v1/{organizationId}/Projects/{projectSlug}/SigningPolicies/{signingPolicySlug}/Certificate/GpgPublicKeyx509CertificateData property instead of x509Certificate:
GET /v1/{organizationId}/CertificatesGET /v1/{organizationId}/Certificates/{slug}x509Certificate property is included returned for backwards compatibility, but marked as “deprecated”.Improved error reporting for projects with manual approval enabled (not available for hash-signing) for SignPath Crypto Providers.
Fixed a concurrency issue which potentially caused signing request processing to stop for the affected organization.
(SaaS only)JAR signing is now disabled by default because it requires dedicated service instances. To enable it, you need to deploy the new javasigningmethodservice component via the chartSettings.javaSigningMethodService.replicaCount value and set up authentication configuration.
Improved basic authentication configuration (basicAuthenticationOptions sections):
passwordHash value).Generate-Secret tool to generate the new format (see “Generate basic authentication passwords and hashes” in the installation guide).previousPasswordHash value to allow zero-downtime rotation.This change is backwards-compatible. The legacy passwordSalt can be still used.
Added support for using GPG keys generated by SignPath certificate management:
Linux PKCS#11 CryptoProvider: Added support for Debian 12 “bookworm” and Ubuntu 24.04 distros.
JAR signing: Added a workaround for Java code signing using recent GlobalSign code signing certificates. (The default root certificate is not in the Java root trust list, so a special cross-signed certificate must be applied.)
Improved display of validation errors in the user invitation UI.
Azure Blob Storage and SQL Server connections: added support for Azure Workload Identity authentication. See “Azure Workload Identity” in the installation guide for details.
Reduced image size of the signpathio/signservice-setup-db container image and startup time of the SignService migration jobs.
Improved performance of event audit log REST API (GET /v1-pre/{organizationId}/AuditLog/Events) for organizations with high signing request volume.
Improved error handling for invalid paths in archive files.
In the signpath-application chart, the appSettings/appSecrets.shared.fastSigningRequestProcessorServiceClientOptions configuration section has been renamed to fastSigningServiceClientOptions (value unchanged).
Fixed a bug that prevented signing of artifactsf from GitHub.com. (GitHub’s global ID values crossed the max-int threshold on Nov. 5, 2024.)
Improved certificate list UI: added new “type” and key store information columns, dropped “valid from” column.
Added support for user-defined parameters.
The API Token Credential can now be stored either in th System or a Global (recommended) scope.
Improved error messages.
Renamed the command-line parameters to align with the other client tools.
Added support for sha1 signatures required for productsign.
Added support for HTTP timeout and retry configuration.
Improved logging and logging configuration.
Fixed a bug that prevented multiple certificates from being loaded at once.
Fixed a bug where the application failed when provided with an invalid configuration file.
Renamed the X.509 certificate creation/upload REST API routes:
POST /v1/{organizationId}/Certificates/CreateSelfSigned → CreateSelfSignedX509POST /v1/{organizationId}/Certificates/CreateCsrBased → CreateCsrBasedX509POST /v1/{organizationId}/Certificates/{slug}/UploadCertificate → UploadX509CertificateOld routes are still available but deprecated. No changes in request bodies.
Breaking change in v1 response properties.
Affected routes:
GET /v1/{organizationId}/CertificatesGET /v1/{organizationId}/Certificates/{slug}Changes:
type (top-level) now represents the certificate type (currently only X509).type is now in x509Certificate.creationMethod (SelfSigned, Csr, PfxImport, ImportedWithExistingKeyPair).(Rationale: we expect no external dependencies on the current value of type.)
ECDSA hash signing: added support for signature block format “RFC 3279 ASN.1 sequence”. See artifact format for signing hash digests.
Signing request details page now shows HTTP response status code for failed artifact retrievals.
Fixed broken base URL in Swagger UI (affected version 1.172).
Added origin information to the signing request list (verified origin or trusted build system name).
Improved quota display on the organization page.
(SaaS only)Artifact configuration visualization: multiple signing directives now displayed separately.
Signing request processing history now displayed indefinitely (was not displayed for “archived” signing requests, i.e. 31 days after completion in SaaS).
Fixed disabled “Resubmit with current settings” button for archived signing requests (completion older than 31 days).
Fixed interactive user invitation flow for newly registered users.
(SaaS only)Changed recommended Kubernetes version to 1.29 and signpathio/kubectl image tag to 1.29.
Graceful container shutdown: termination of Pods is now delayed (default of 30 secs). This allows for request drain-out and safe shutdown (e.g. flushing Application Insights data).
Fixed missing response models and response status codes in the API definition for the following REST API routes:
/v1/{organizationId}/CIUsers/{id}/RegenerateApiToken/v1/{organizationId}/InteractiveUsers/{id}/RegenerateApiToken/v1/{organizationId}/TrustedBuildSystems/{slug}/RegenerateTrustedBuildSystemToken/v1/{organizationId}/SigningRequests/Resubmit (only status code was wrong)All signpath-application Pods now correctly report application_Version to Application Insights (if enabled).
Initial release: GitHub.com is now available as a Trusted Build System.
All v1-pre REST API routes except audit log routes are now available as JSON APIs in v1.
Changes in v1:
PATCH to POST:
/v1/{organizationId}/InteractiveUsers/{id}/Edit/v1/{organizationId}/InteractiveUsers/{id}/SetDirectorySynchronized/v1/{organizationId}/CIUsers/{id}/Edit/v1/{organizationId}/UserGroups/{id}/Edit/v1/{organizationId}/UserGroups/{id}/SetDirectorySynchronized/v1/{organizationId}/Certificates/{slug}/Edit/v1/{organizationId}/Projects/{slug}/Edit/v1/{organizationId}/Projects/{projectSlug}/ArtifactConfigurations/{artifactConfigurationSlug}/Edit/v1/{organizationId}/Projects/{projectSlug}/SigningPolicies/{signingPolicySlug}/Edit/v1/{organizationId}/TrustedBuildSystems/{slug}/Editurl response properties have been renamed to link:
GET /v1/{organizationId}/InteractiveUsersGET /v1/{organizationId}/CIUsersGET /v1/{organizationId}/UserGroupsGET /v1/{organizationId}/Projects/{slug} (artifactConfigurationXmlUrl and certificateUrl)POST /v1/{organizationId}/ProjectsPOST /v1/{organizationId}/Projects/{projectSlug}/ArtifactConfigurationsname, slug and description properties are now in the request or response root object.
"metadata" object has been dropped in all JSON requests and responses.metadata. prefix has been dropped in all multipart/form-data requests.See the API definition for more details.
The v1-pre routes are unchanged but deprecated. They are no longer included in the API definition and will be removed in a future version.
Note that these routes still use multipart/form-data:
POST /v1/{organizationId}/Certificates/{slug}/UploadCertificatePOST /v1/{organizationId}/SigningRequestsPOST /v1/{organizationId}/SigningRequests/SubmitWithArtifactRetrievalLinkFor all other v1 APIs, multipart/form-data is no longer available.
Authenticode signing now supports the following optional attributes:
description and description-urlhash-algorithmFixed failed JAR signing operations for JAR files with >20,000 items.
Fixed error during rendering of old failed signing requests with specific errors (e.g. artifact retrieval).
Added missing response body definition for GET /v1/{organizationId}/Projects/{projectSlug}/TrustedBuildSystemLink in the API definition.
Improve error reporting for authentication errors in Operator Client.
Fixed missing error detection in pairing restore startup script in HSM SignService.
Added support for JSON request bodies in the REST API.
multipart/form-data is still accepted in all changed APIs (but not exposed to the API definition).Internal SignService API breaking change: when upgrading from a version below 1.165, follow the SignService breaking changes steps in the installation guide, section “Version compatibility”.
Details: All file-based signing operations have been removed from the SignService API. Since version 1.165, all file-based signing operations have been executed by signing-processor-service.
Improved warning and error logging for HTTP call errors: log message now includes details about the error incl. HTTP status and response body if available.
Fixed unnecessary retries for non-recoverable errors like authentication errors or invalid artifact configurations (anything but hash-signing) in the SignPath project.
Added support for appending Authenticode signatures.
Improved approval notification emails: added project, signing policy and artifact file name to email body.
Fixed a display error if browser’s language is configured to Chinese (zh-CHS).
Auto-restart detection mechanism extended to include a specific Luna Client startup error in signpath-signservice-lunahsm.
Added to organization page the number of “applied individual signatures” of the current month.
(SaaS only)Reduced memory overhead in all Pods deployed by the signpath-signservice-<type> charts by switching the entry point from PowerShell to CMD.
Signing requests are new automatically cancelled after WaitForCompletionTimeoutInSeconds. This can be overridden with the new -CancellationTimeoutInSeconds parameter.
Added an optional cancellationTimeoutInSeconds parameter to the signing request submission REST APIs to automatically cancel signing requests after the provided timeout.
Reduced memory overhead in all Pods deployed by the signpath-application chart by switching the entry point from PowerShell to CMD.
Changed default logging behavior:
info level) is now enabled by default
%TEMP%\SignPathLogs, on Linux /tmp/SignPathLogs.SIGNPATH_LOG_CONSOLE_LEVEL=none to opt-out from file logging.SIGNPATH_LOG_CONSOLE_OUTPUT_STREAM configuration to switch back to stdout.The Windows Crypto Providers (incl. KSP, CSP and Cryptoki library) now are delivered with a Windows MSI installer.
InstallCspKsp.ps1 installation:
SIGNPATH_CONFIG_FILE JSON file: copy its content to %ProgramFiles%\SignPath\CryptoProviders\CryptoProvidersConfig.jsonLinux container samples improvements:
run_scenario.sh) next to the existing PowerShell version (RunScenario.ps1).GenerateGpgKey scenario now allows to specify all key parameters like full name, email or expiration directly to the entry point script.SignRpm) now allow to specify the key’s ID (email) directly to the entry point script.The CryptoProvider package now includes SBOM files.
Linux container samples: fixed incompatibility with recent RedHat 8 and 9 repository changes concerning openssl and gnupg-pkcs11-scd.
Allow import of certificates that exceed RFC length limits in Distinguished Name components such as Common Name. Applies to Certificate Signing Request (CSR) certificate upload and PFX import.
Improve error reporting for PFX files with missing common name field in the contained certificate.
Fixed error handling for invalid ClickOnce files with missing “deployment manifest” files.
Added ECDSA certificate support for Authenticode.
Fixed minor UI glitch for edit signing policy (approval deactivated when removing all approvers).
Changed the recommended Kubernetes version to 1.28 and the signpathio/kubectl image tag to 1.28.
Reduced the compressed signing-processor-service image size by 350 MB.
Fixed false-positive exceptions for hash/fast signing operations when the client aborts the HTTP call.
Fixed failing hash/fast signing operations when malware scanning is disabled in the corresponding signing policy.
Fixed issue which can cause occasional failing signing requests under very high load. (Introduced in 1.154)
Authenticode files can now be signature validated with the new <authenticode-verify /> artifact configuration directive.
Use to ensure that third-party components are properly signed in deep signing configurations.
Office macro signing now supports ECDSA certificates.
Improved error reporting when a macro-enabled Office file contains no macros instead of generic “processing error”.
Malformed hash signing requests now result in a specific 400 validation error (invalid hash encoding or length, was a 500 response since version 1.160).
Fixed a rare concurrency issue on high Office macro signing load.
Replaced the “readiness probes” in all K8s deployments with startup + liveness probes to improve startup perf and stability.
Improved history UI: table column alignment, use of screen estate.
Improved performance of ModifyMembers, ChangeMembers user group REST APIs.
HSM SignServices now provides “readonly” mode for operational/maintenance purposes, which disables key management while still allowing signing operations.
K8s readiness probe for signingprocessorservice switched from “readyfile” command probe to HTTP “healthz” probe to improve stability.
When applying changes via helm upgrade, now all signpath-application deployments restart automatically (via rollout restart).
Added a safeguard mechanism for signpath-application pods which prevents startup on inactive colors due to deployment or configuration errors.
Artifact configuration: <create-raw-signature> supports input filename substitution via ${file.name}.
“Resubmit with current settings” now also works for signing requests which fail due to an artifact retrieval error.
Hash signing operations are now performed by signingprocessorservice.
You need to configure basic authentication configuration:
signingProcessorService.basicAuthenticationOptionsfastSigningRequestProcessorServiceClientOptions.basicAuthenticationPasswordSee “Generate basic authentication passwords and hashes” in the installation guide for more information.
The HSM SignServices watchdog doesn’t require a TSA URL anymore. The previously mandatory SignService values
config entry appSettings.signService.cspWatchdogOptions.timestampingServerUrl can be removed.
Initial release
Provided dedicated REST APIs for modifying group memberships:
/ChangeMembers sets a new list of members/ModifyMembers allows to add/remove membersSee the API definition for more details.
Added a new API route GET /v1-pre/<org-id>/SiginingRequests that allows listing Signing Requests. See the API definition for more details.
Improved the reliability of processing signing requests in case of temporary network errors.
Added additional custom dimensions to AppInsights events.
The AdministrationUtility tool can now also log to AppInsights.
Added an additional safeguard mechanism that prevents the inactive color deployment from processing signing requests.
Fixed the mechanism that restarts the SignService components when the connection to a Luna/Thales DPoD HSM becomes corrupt.
Added missing ActivityId entries to the log output to ensure a consistent logging experience.
Fixed a bug that prevented the underlying error messages from being shown.
Fixed a bug that prevented retries from being executed properly in certain situations.
Fixed a bug in the Linux container samples for GPG signing.
New “Operator REST API” (part of the Operator Client deployment) including organization list queries and organization creation APIs. Can be activated via appSettings.shared.globalFeatureToggleOptions.isOperatorApiEnabled configuration.
Added Generate-Secret tool to simplify secure encryption key, basic authentication secret and API token generation.
For failed signing requests, the “Retry with current settings” feature was replaced with “Resubmit with current settings”. This feature creates a new signing request (linking back to the “original signing request”) instead of retrying the same signing request.
Stricter validation of email address input.
Introduced file size limits for XML files (2 MB) and OPC files (40 MB) to improve operational stability.
Fixed path validation issue for encoded paths in OPC, MSIX and APPX files.
Renamed the Hangfire dashboard application component K8s Deployment to “Operator Client”:
signpathio/hangfire-dashboard Docker image to signpathio/operator-client (you may need to update your Docker image mirroring)appSettings/appSecrets.hangfireDashboard values section with appSettings/appSecrets.operatorClientchartSettings.hangfireDashboard section with chartSettings.operatorClientoperatorClient authentication settings from basic auth to API token-based (see operatorClientOptions.operatorUsers section)Added the possibility to expose the Operator Client via the Ingress (see “Enable Operator Client Ingress” installation guide).
Application Insights: greatly reduced the amount of “pulled empty batch” events in the CustomEvents telemetry to reduce log volume.
Increased default signingProcessorService.dotNetGCHeapHardLimit from 450 to 700 MB to avoid out of memory situations for XML and OPC signing.
Fixed a migration job issue which left the old color Application Pods running in case of an Kubernetes API server outage.
REST API: Added new routes for creating, querying and modifying Trusted Build Systems.
Improved error reporting of internal errors during Authenticode signing operations.
Fixed a bug where changing the certificate before approving a signing request caused a processing error in certain situations.
Fixed a bug that hid the detailed error message in the user interface when an artifact fails to be scanned for malware.
Changed the recommended Kubernetes version to 1.27 and the signpathio/kubectl image tag to 1.27.
Application Insights: The custom dimension name has been renamed from LoggerName to CategoryName to comply with Microsoft standards.
Application Insights: Now the Trace (application logs) and Request (Incoming HTTP requests) telemetry types aren’t sampled anymore on high load (i.e. Application Insights receives a gapless log stream) by default. The default configuration can be overridden in signpath-application or Sign Service values in the additionalApplicationInsightsOptions section.
Container/Application Insights logs: Removed specific high volume, but unimportant log emitters to reduce log volume.
Fixed a bug that prevented read-only files from being submitted for signing.
REST API: Added new routes for (de)activating certificates, projects, signing policies and artifact configurations, and a new route for the “delete private key” certificate operation.
REST API: Added GET /v1-pre/{organizationId}/InteractiveUsers/Me route.
REST API: Added the ID of the created entity to the response body in various POST routes.
Improved the title line on the signing request detail page for long project/signing policy names.
In signpath-application values chartSettings section: removed malwareScanning.timeout configuration value, and instead introduced scanner-type specific values:
malwareScanning.signPathMalwareScanningService.scanningTimeout and .httpRequestTimeoutmalwareScanning.customMalwareScanningScript.scriptTimeoutAdded logging of the “User Agent” header to Application Insights requests.
Removed the signpathmalwarescanningservice config map resource (unused since 1.144).
Fixed broken Application Insights sampling configuration for signservice Pods.
Trusted build systems: Fixed validation error for Git repository SSH URLs.
Improved GPG initialization and shadow key fetching in Linux container sample scripts (which also fixed a compatibility issue with GnuPG 2.3+).
Linux PKCS#11 CryptoProvider: Added support for Debian 11 and RedHat 9 distros incl. updated Linux container samples.
Added CryptoProvider version info to the user agent header for backend REST calls.
KSP CryptoProvider: Fixed a compatibility issue with ECDSA certificates.
Added support for creating raw detached signature files.
Added additionalApplicationInsightsOptions section to signpath-application values which allows to configure Application Insights sampling options.
Renamed CIUserToken to ApiToken.
Added configurable timeouts for HTTP requests and signing request processing.
Improved error messages.
Restricted user role assignment for OSS subscriptions.
Granular read-access authorization for signing requests. (Work in progress, available on request.)
Signing requests with artifact retrieval links: added support for HTTP content compression.
Improved reliability of HSM key store (additional retry conditions).
(SaaS only)Improved performance of ClickOnce signing operations.
Improved error messages for Office files without macros.
Fixed PFX certificate import into certain HSM key stores (including SaaS HSM).
Fixed a bug that prevented signing with Crypto Providers using the new API token feature for interactive users.
Changed the recommended Kubernetes version to 1.26 and the signpathio/kubectl image tag to 1.26.
Added a Helm chart check which fails the installation in case the pod disruption budget’s minAvailable count is larger or equal to replicaCount.
Renamed the CIUserToken configuration file property to ApiToken and SIGNPATH_CI_USER_TOKEN environment variable to SIGNPATH_API_TOKEN). Please adapt your configurations (you can use the same value for ApiToken). Note that the old names are still accepted, but will be removed in a future version.
Added documentation and Linux integration tests for the osslsigncode tool.
Implemented the Windows KSP EnumKeys function, which enables hash based Mage / ClickOnce signing.
New REST API route: download the X509 certificate of a signing request GET /v1-pre/{organizationId}/SigningRequests/{id}/X509Certificate.
Improved error messages for AppX and MSIX files when the publisher name does not match the certificate subject.
Timestamping now falls back to alternative timestamping servers when primary server is unavailable.
(SaaS only)Project administrators can now configure Docker repositories.
User page shows date and time when an API token was generated.
Fixed a bug that prevented importing PFX files generated by Microsoft CNG.
Fixed a bug that prevented adding CI users to the project configurators of a project.
Dropped the JCE key “retargeting” when creating certificates on nShield HSMs (previously required for JAR signing).
Fixed a problem that caused the sandbox.vhdx files of the Docker Mirantis runtime to grow continuously in Docker Compose installations.
Renamed certificate field “Thumbprint” to “SHA-1 Thumbprint” in the user interface and pre-release API.
Added improved error messages for analyzing SSO-related configuration issues.
Improved logging login/logout errors by providing more details on OIDC related errors.
Fixed issue of unnecessarily delay of automatic artifact deletion or archiving in content store of 23 days (affected versions 1.148 and 1.149).
Fixed incorrect logging of PathBase in HTTP request logging.
Added limited administrator roles: User Administrator, Project Administrator and _Certificate Administrator. For more details, see the user roles documentation.
Select multiple files is now generally available.
Added support for deep signing of APPX and MSIX files. Read more about deep signing.
Fixes incorrect display of malware scanning status for old signing requests.
(SaaS only)Fixed a race condition that caused multiple signing requests to be created when uploading multiple files instead of bundling them correctly into a single artifact.
Fixed a bug that led to failed signing requests for artifact configurations with a <zip-file> containing a path attribute as a root file element.
Fixed a bug that prevented signing with the Crypto Providers for interactive users and users that were added as submitters through group membership.
Configuration setting appSettings.shared.signingOptions.timestampingServerUrl has been renamed to timestampingServerUrlTemplate in signpath-application values.
The SignPath.Application.AdministrationUtility.exe tool in the Administration Utility pod has been renamed to SignPath.Application.Clients.AdministrationUtility.exe.
Improved the inline documentation
Added installation/uninstallation PowerShell script for Windows CSP and KSP. Note that the old installation method (involving System32 file copying, sp-register-ksp, regsvr32) still works, but it’s recommended to switch to the installation script. For details and usage see the “CSP/KSP installation (Windows)” section in the CryptoProviders documentation.
Added support for personal API tokens for interactive users. See authentication.
Renamed “CI user token” to “Api token” in the user interface and one pre-release API (RegenerateApiToken).
Renamed artifact configuration XML attributes productName and productVersion to product-name and product-version, respectively. (Existing spelling is still valid for the current schema version.)
The zip archive created when uploading multiple files for signing is now named bundle.zip. See ui-multifile-upload.
Renamed “Initial Login Email Address” of interactive users to “Account email address” in the user interface and InteractiveUser pre-release APIs.
Added support for “nginx.org” Ingress Controller distribution (see ingressAnnotations.nginx.ingressControllerDistribution configuration value).
Improved memory consumption of the Signing Processor Service pod (see signingProcessorService.dotNetGCHeapHardLimit configuration value).
Updated the default Ingress controller annotations to support 4 GB file uploads.
Removed unnecessary values in signpath-application-ingress.
Reduced logging noise in webclient and api containers.
Fixed disk space leak which affected signpath-application containers with large logging volume.
Renamed -CIUserToken parameter to -ApiToken. The old name is still valid for this major version (4.x).
Replaced Timeouts.ServiceUnavailable (and SIGNPATH_TIMEOUTS_SERVICE_UNAVAILABLE) configuration value with Timeouts.FirstRetryDelay and Timeouts.RetryCount (See “Setting configuration values” section in the CryptoProviders documentation for details).
Changed the HTTP call error retry strategy to use an exponential back-off mechanism.
Added a warning logging for failed HTTP calls before retrying.
Improved error return values codes for KSP/CSP/Cryptoki functions for HTTP call errors to better express the underlying problem. (See the corresponding “Error return values” sections in the CryptoProviders documentation).
Improved the debug logging output for Cryptoki function calls.
Improved the error message for HTTP(S) errors on Linux.
Added a “My profile” link in the user menu.
Fixed incorrect handling of special characters in artifact file path during malware scanning and during OPC deep signing processing.
Added confirmation prompts in the administration utility for all commands and a -y argument.
Added recommendation of master database SQL user creation to “Database logins and permissions” section in documentation.
Added ui-multifile-upload feature to upload multiple files in signing request web client UI (preview).
Added “Multiple Office files with macros” default artifact configuration which allows to upload multiple Office files in the user interface.
Improved resilience of system against temporary database outages.
Limit number of maximum events per stored entity to avoid performance bottlenecks.
Added chartSettings.signingProcessorService.dotNetGCHeapHardLimit to reduce memory consumption of signingprocessorservice pods.
Fixed possible timeouts for long running malware scanning runs via malwareScannerType: signPathMalwareScanningService.
Improved /v1-pre/{organizationId}/AuditLog/SigningRequestEvents responses:
originalSigningRequestId for resubmit events.Improved the performance of the /v1-pre/{organizationId}/AuditLog/Events REST API
Changed the recommended Kubernetes version to 1.25 (note that 1.24 will go EOL on 2023-07-28) and the signpathio/kubectl image tag to 1.25.
Changed the Web Client authentication ticket lifetime from 14 days to 12 hours. This means that after 12 hours without any request, the Web Client will re-authenticate via OIDC.
Allowed using multi-line PEM certificates in chartSettings.trustedRootCertificates/.intermediateCertificates in all Helm Charts.
Dropped the supportOptions and signingRequestQueueThrottlingOptions sections (both not relevant for self-hosted installations) in signpath-application values.
Removed mandatory SMTP server username/password overrides in the signpath-application values.
Reduced the log noise in all web server based containers.
Added SigningRequestProcessing-IndividualSignature Application Insights events for hash signing requests.
New REST API route: reinvite interactive users /v1-pre/{organizationId}/InteractiveUsers/{id}/Reinvite.
New REST API route: /v1-pre/{organizationId}/Projects/{slug}/SetDefaultArtifactConfiguration.
Improved performance of REST API and UI HTTP responses.
Improved performance and reduced memory consumption of the signPathMalwareScanningService malware scanning client.
Fixed duplicate MalwareScannerOptions__MalwareScannerType config map entries.
Event Audit Log API (preview): The TrustedBuildSystem.Added event has been renamed to TrustedBuildSystem.CustomAdded.
Reduced memory consumption when signing JAR files.
Fixed aborted SignService deployments in cases using descheduler for Kubernetes with RemovePodsViolatingTopologySpreadConstraint.
Added support for optionally moving contents to the Azure Blob store archive tier instead of deleting them.
Reduced amount of application logging for Azure Blob content store accesses.
Fixed error when accessing Hangfire dashboard in special cases.
Malformed hash values in hash signing are now gracefully reported to the API caller.
Fixed a problem that caused some signing requests to be stuck in the Queued state.
Fixed a problem where some signing request reports were truncated.
Added support for client-mediated HA Group Pairing for Luna Network HSMs.
Added the “Signing Request Accepted” event to the reported “custom events” in Application Insights.
Various performance fixes regarding signing request archive database access.
Added support for signing Cyclone DX SBOMs.
Added support for XML file signing based on the W3C XMLDSig standard.
Fixed timeouts that occurred during the creation of signing request reports.
Fixed timeouts in the Audit Log API.
Support for using mutual TLS client certificates specified by a Microsoft template ID.
After the upgrade the report model database will be automatically built up from scratch. This means that for a while (depending on the number of signing requests) the signing request list in the UI and the CSV report may be incomplete until the report model building reached the latest signing requests.
Fixed a bug that allowed users to be created via the API even though the quota limit has been met.
Fixed timeouts in the signing request Audit Log API.
Fixed the alignment of the buttons in the artifact configuration panel on the project page.
Improved performance in UI when showing long history lists.
Fixed potential issue that allowed very long running background tasks to run in parallel.
SignPath now explicitly drops any secrets exposed in the build settings by AppVeyor. All affected parties were informed.
Fixed the issue that not all application logging entries reached Application Insights.
Fixed missing error reporting details for failed malware scanning service calls.
New REST API route /v1-pre/{organizationId}/SigningRequests/{id}/ArtifactDescriptionXml allows to retrieve the artifact description XML content for signing requests including file details for all contained signed files.
Added a “Sign artifact” button in the artifact configuration list in the project page.
Added “Sign artifact” and “Show signing requests” buttons on the artifact configuration details page.
Improved error messages when a wrong URL is provided.
Cryptoki: Added Cryptoki.DoNotFailOnReadWriteSessions configuration flag to enable compatibility with Cryptoki / PKCS #11 clients which always open the session with the read/write option (e.g. pkcs11-tool in version lower than 0.23).
Added documentation for pkcs11-tool usage and Linux Docker container sample scenario.
The following configuration values have been moved from appSettings to appSecrets:
signpath-application value appSettings.shared.applicationInsights.connectionStringsignpath-signservice-<variant> value appSettings.signService.applicationInsights.connectionStringAdded support for automatic artifact deletion after a configurable retention time (disabled by default).
The operator user name stored alongside all operations triggered by the administration utility can now be set via an environment variable.
Various malware scanning script performance fixes.
Added support for ECDSA X.509 (key type ecdsa-x509) certificates for Docker Signing.
Added new REST API for listing all projects as well as modifying projects, signing policies, and artifact configurations.
Improved dashboard loading performance.
Added suppport for using a HTTP web proxy (Linux and Windows).
Improved the error reporting for the sp-register-ksp command (Windows).
For Luna and DPoD HSMs it’s now possible to delete certificate keys on the HSM storage 60 days after the “Delete private key” action (Note: By default, deleted keys are only recorded for manual deletion.)
The configuration parameters for NGINX proxy settings in the signpath-application-ingress chart have a new location.
Custom malware scanning scripts must now be able to handle two new parameters: -OriginalFileName and -ExecutionTimeout.
Added support in the Ingress chart to configure additional annotations on the Ingress resource and to opt-out from the NGINX default annotations.
Changed recommended Kubernetes version from 1.23 to 1.24.
Updated the signpathio/kubectl container image to include kubectl 1.24.10 (the image is tagged with both 1.24 and 1.24.10).
Dropped NGINX session affinity annotations (Note: reverse proxy session affinity has not been a requirement since release 1.133.).
Improved signing request triggering latency.
Changed the default replica count for hangfireDashboard to 1.
Cleaned up the Ingress chart (removed the tests section).
Cleaned the SignService Kubernetes Helm Charts (dropped unused sections).
The commands in the administration utility were cleaned up.
Artifact configurations can now be deactivated.
New REST API /v1-pre/{organizationId}/Certificates allows to list all certificates.
Added REST APIs to modify, activate and deactivate CI Users.
HTTP requests where the TCP connection is dropped by the client are now automatically canceled.
Added new mandatory database connection strings for the application: DataProtectionDatabase and DataProtectionDatabaseDdl.
ReportModel database to ApplicationShared and use this database in the connections strings ReportModelDatabase, ReportModelDatabaseDdl and the two new connection strings.DataProtection can be created and used.Cleaned up and improved the default values in values.yaml in the Kubernetes Helm Charts.
Improved the log format for multi-line log messages.
Changed the Kubernetes topologySpreadConstraints.maxSkew to 1 to advise K8s to preferably spawn pod replicas on different nodes.
Fixed a bug that set maximum number of certificates quota to zero when changing subscriptions in certain cases.
Removed PowerShell dependency.
Fixed a bug that allowed a potential attacker to submit files other than the build artifacts.
Within the AuditLog API (preview) response, the metadata.user property has been renamed to metadata.actor.
Changed web hooks to be triggered for all final signing request statuses, not only Complete.
Improved error reporting when deep-signing MSI files with missing external files.
Fixed artifact configuration generation for file names containing special characters like square brackets.
Fixed an HTML (non-XSS) injection vulnerability in the UI.
Uploaded artifact files can now be exempt from Windows Defender realtime scanning on Kubernetes hosts.
Temporary files during HTTP uploads are now stored in an emptyDir volume, which can improve performance and fix disk usage issues (Kubernetes).
The Audit Log REST API (preview) /v1-pre/{organizationId}/AuditLog/Events doesn’t include signing request events anymore, instead they can be retrieved via the the new /v1-pre/{organizationId}/AuditLog/SigningRequestEvents route.
Added support for additional, organization-specific key stores.
Signing requests with more than one signing policy are now properly returned in the REST API.
Enabled Swagger UI for the REST API at /Api/swagger.
Fixed bug in elliptic curve certificate generation for the software key store.
Renamed signServiceOptions to keyStoreOptions in the following places:
appSecrets/appSettings.shared.signServiceOptions (also changed the structure)appSettings.deletionProcessorServiceappSettings.signingProcessorServiceConfiguration value appSettings.notificationsProcessorService.smtpServerOptions.useSsl has been renamed to .secureSocketMode. Change false to 'None' and true to 'Ssl'.
Added support for SMTP StartTLS protocol.
New AppInsights customEvents for individual signing operations.
Added possibility to disable malware scanning for individual signing policies.
Performance improvement for signing requests using the HSM key store.
New REST API routes (preview) to list all CI Users and regenerate CI User tokens.
Artifact Retrieval: Instead of uploading the artifact file, a HTTPS retrieval link including authentication headers can now be passed to SignPath.
Linux: Added Debian package signing via dpkg-sig to signing scenarios.
Linux: Added Maven GPG signing Docker container sample scenario.
New Administration Utility ChangeMultipleSubscriptions command to (partially) update multiple organizations with new subscription options.
Added support for including images files in custom notification email styling.
The versioning scheme of the Kubernetes Helm Charts has been changed to match the application version.
The signService.lunaHsmKeyStoreOptions.slotIndex configuration value is not necessary anymore and can be dropped.
Verifying that a signing request was submitted from a trusted build system (TBS) is now possible without requiring the TBS to provide origin information.
The certificate view now also lists the X509 Issuer, Serial Number, Thumbprint, Key Usage and Extended Key Usage flags for each certificate.
Changed the name of the initial artifact configuration when creating projects to “Initial version”.
New mandatory chartSettings.malwareScanning.malwareScannerType configuration for signpath-application (Kubernetes only).
New mandatory signService.cspWatchdogOptions.keyId app setting for Luna HSM SignService.
Possibility to configure a custom malware scanning service (via PowerShell adapter script).
Luna HSM watchdog key IDs can now be configured.
Fixed a bug where multiple Luna HSM watchdog keys were created on first startup (only relevant for Kubernetes installations with multiple replicas).
Added support for MSIX (Windows app package) signing.
Added UI support for Re-submission of signing requests.
Added new API routes to change a user’s NotificationEmailAddress and Identity fields.
Added a proper return message when an operation is not allowed.
Cleaned up the documentation.
To continue using the REST API to resubmit signing requests (preview), a feature toggle needs to be enabled for every organization.
Interactive users can now be created via the REST API.
Various small UI/UX improvements:
Linux: Updated the statically linked dependencies to Boost 1.79.0, OpenSSL 1.1.1n/3.0.5, plog 1.1.8 and zlib 1.2.12
Fixed a segmentation fault when using Cryptoki on Linux.
Fixed Cryptoki loading error on RedHat Linux v8.
Fixed missing CI User token redaction when passed on command line instead by configuration.
Improved pairing experience with nShield HSMs.
The “HashPassword” functionality doesn’t require a Windows container anymore.
Fixed nShield HSM startup error in Kubernetes.
Compatibility with Internet Explorer 11 has been dropped.
The artifact description in signing requests now contains the full path of files inside container artifacts.
The certificate’s key store ID is now also shown on the certificate details page (needs to be enabled per organization).
Modernization of the HTML UI framework including fixes of minor UI glitches.
Projects can now be configured to use multiple repository URLs for origin verification.
Fixed broken signing request notifications for denied signing requests in special scenarios.
Fixed Cryptoki loading errors on RedHat Linux 8.6.
Collecting information about the invoking process (command line call and user account) is now also supported on Linux.
Fixed missing support for libp11 (OpenSSL engine) version 0.4.12.
Fixed missing reporting of specific configuration errors (e.g. invalid CI user token registry location).
The SIGNPATH_LOG_LEVEL configuration was split into SIGNPATH_LOG_CONSOLE_LEVEL and SIGNPATH_LOG_FILE_LEVEL.
The console logging was disabled by default (SIGNPATH_LOG_CONSOLE_LEVEL=none).
Cryptoki: Added compatibility with gnupg-pkcs11-scd to support GnuPG PGP signing.
Improved error reporting for wrong configurations.
Added missing error reporting in the Administration Utility.
Fixed interopability problems with the Azure Container Registry.
Added support for Windows Script Signing.
Improved error handling for invalid archives.
Fixed bug that prevented project configurators from setting the default artifact configuration.
Added references to the online documentation.
Improved the pairing process for Thales Luna and DPoD Cloud HSMs.
Added support for Azure Application Insights logging.
Added the possibility to provide a reason when denying a signing request.
Improved error messages when submitting invalid NuGet packages.
Fixed a bug that allowed deleting an unsigned artifact that was still referenced by a resubmitted signing request.
Fixed a bug that that required self-hosted installations to configure a timestamping server URL for FreeTrial subscriptions.
Fixed a potential argument injection vulnerability in the jarsigner call.
Fixed a bug that prevented notification email changes from being shown in the history.
New REST API route (preview): /v1-pre/{organizationId}/CIUsers/Me returns information about the authenticated CI user.
In Kubernetes installations, an improved migration mode ensures that all container images are ready before to the new version starts, ensuring a minimum downtime.
Fixed Content-Security-Policy rules that prevented some SVG icons from being loaded.
A new ReportModel database needs to be created. See the installation guide for more details.
Administrators are now prevented from deploying to the wrong color.
Added a new /healthzd route to the API that checks the health of the SignServices.
Calling SetupDBs.ps1 now prints out a usage message when no parameters are supplied in the Docker Compose setup.
Improved default values in configuration files.
Fixed a bug that prevented Docker Signing to work when using the Azure Container Registry.
An error message is shown when an artifact is no longer available for download.
Artifacts can now be deleted using the administration utility.
The database connection strings used in the initial setup and during the migration are now read from the configuration files.
New REST API route (preview): /v1-pre/{organizationId}/Organization to query organization and quota information.
Support for DPAPI-encrypted CI User tokens.
Dedicated support for signing of Microsoft Office macros.
Separate versions for 32- and 64-bit architectures.
NShield HSM keys are automatically retargeted to be used for Java signing.
Fixed Malware Scanner warnings on startup on Windows Server machines using Docker Compose.
Limited the maximum file size for artifact retrieval to 4GB in SaaS.
(SaaS only)Configuration and parameter names changed. All Crypto Providers now use a common naming schema. Environment variables have precedence over the configuration file. Command line parameters have precedence over environment variables.
All Crypto Providers can now gracefully handle application downtimes and will retry HTTP requests if the application is temporarily unavailable.
Introduced a configurable file size limit for the artifact retrieval feature (defaults to 4GB).
Introduced the option to re-download a Certificate Signing Request (CSR) and to re-upload certificates.
Updated Java Runtime to JDK 12.
Fixed a bug that prevented the Audit Log API from handling Webhook.Deleted events.
Introduced option to change the log4net configuration used in SignPath.
Audit Log REST API is now available in preview.
Expiration emails for already expired certificates are no longer sent out.
Windows only: Information about the invoking process (command line call and user account) is collected.
Windows only: Mutual TLS (mTLS) client certificates can be specified.
Only for nShield HSMs: Move the kneti-hardserver file from the NShieldHardserverPath directory to a subdirectory hardserver in the NShieldPairingDataPath directory. (Note: The NShieldHardserverPath configuration value has been removed.)
The API now returns concrete error messages in the body of HTTP 401 Unauthorized responses.
The signing request ID is now included in the HTTP response body of the submit API routes.
Extended the build system integration for Appveyor to allow private projects for non-OSS subscriptions.
For Hash Signing, the metadata is now included in the signed artifact payload file.
Fixed a bug that caused expiration notifications to be sent out even if a new certificate was re-imported.
The Submit-SigningRequestResubmit command has been removed. Resubmit is now possible using the -Resubmit flag of the regular Submit-SigningRequest command.
The Configuration.yml file does not contain settings for the connection strings any more. Connection strings are now handled as secrets by default. However, for migration purposes, the connection strings can still be added to the Configuration.yml and referencing secret files is still supported.
The secret handling has been unified between the Docker Compose and K8s deployment targets.
Signing request filters: The signing request list can be filtered by status and artifact configuration (when viewing signing requests for a specific project or signing policy).
User roles can also be configured for CI Users. Permissions will be applied to API calls accordingly.
Fixed a bug that prevented artifact names of signing requests submitted via the artifact retrieval workflow from being included in the signing request report.
Fixed a bug that hid an error message when the configuration file could not be properly read.
Security-hardened handling of tokens and artifacts within the plugin.
Fixed a bug that caused Jenkins to run into timeouts when uploading large artifacts for signing.
The content of signing request lists has been cleaned up and only includes the artifact name once.
Fixed a UI glitch in the webhook body editor.
The correct HTTP response code (403) is now returned for requesting unknown resources.
Fixed a bug that prevented an error message from being shown when a parameter is missing.
Special characters are now handled correctly during the creation of the ENV-file.
Added global reader and project reader roles.
Signing requests can now be resubmitted via the PowerShell module or via the API.
An additional certificate expiration notification is sent 10 days prior to the certificate expiration date.
Errors that are caused by an unexpected timestamping algorithm are now handled properly again.
Support for Thales DPoD cloud HSMs are in pre-release status.
The signing request status values have been reduced. Multiple status are now combined as “In Progress”.
Artifact sizes are now displayed in a human readable format.
Fixed a bug that prevented the artifact configuration XML from being downloaded if there were special characters in the configuration’s name.
In the Docker.LunaPairingDataPath or Docker.NShieldPairingDataPath directory respectively, replace all characters in the filenames that do not fall in the following patterns with underscores (_): ^[-._a-zA-Z0-9]+$.
Dropped support for file-based content stores. Use content stores compatible with the Amazon S3 interface instead.
The pairing data files have been renamed to only contain a reduced set of characters (for the upcoming Kubernetes support).
Loosened the restrictions on the timestamping server protocol to allow the use of more timestamping servers.
Fixed a bug that caused exception stack traces during startup.
Project configurators: Configurator permissions can be granted to users that allow them to edit the artifact configurations and webhooks for specific projects only.
The signing request report now includes a link to the web page of the respective signing request.
Support for the (AWS) S3 content store backend. (Note: The file-based content-store will be dropped in the next version.)
The health check route of the Hangfire Dashboard works again.
Hardenend the content-security-policy settings.
Improved logging during the database setup phase.
Fixed order of elements in Configuration.yml for easier comparison between versions.
Notification Levels: Users can now select a notification level for each signing policy separately. By default, administrators will stop receiving notifications for signing requests unless they are configured as submitters or approvers.
Improved performance when processing artifacts.
Removed the invalid required marker for Docker repositories on the create projects page.
Fixed a UI glitch: The “View documentation” links are right-aligned again.
Improved migration times
Unified replaceme placeholders in configuration files.
Disabled free trial organizations by default.
Patched version for Thales DPoD support.
Better error reporting for archives that contain multiple files with the same name.
Performance improvements when loading signing request lists.
The “resubmit” functionality that allows a failed signing request to be executed again was renamed to “retry”.
Cleaned up the code.
Changed the default isolation mode from Hyper-V to Process.
Removed necessity to set Multiple Active Result Set (MARS) in the connection strings explictly when upgrading.
Improved performance for hash-signing operations.
Docker images are now pulled from DockerHub instead of being included in the installation package.
The default key size was increased to 4096 bits when creating keys via the user interface. This change was necessary to meet the new baseline requirements for code signing certificates as published by the CA/Browser forum. Existing certificates are not affected by this change.
Authenticode signatures may contain a description field that is displayed by Windows User Account Controls (UAC) and possibly other mechanisms. If present, SignPath will now use the FileDescription value of the PE file VERSIONINFO resource (VER_FILEDESCRIPTION_STR). Otherwise the file name will be used as before.
The malware scanning step is now displayed as a separate entry in the processing log of each new signing request.
Improved migration performance by reducing the number of events.
Fixed wrong metadata type entry in content store for signed/unsigned artifacts.
Various small UX improvements:
In the SaaS deployment, the login process has been improved and handles correlation errors more gracefully.
(SaaS only)Fixed a bug where certain directory structures in clickonce application bundles resulted in unusable artifact configurations when created from a sample upload.
Added support for user-defined parameters.
Move all configuration values from the .env file to the respective section in the Configuration.yml file.
Added possibility to configure an external malware scanner.
Switched to a YAML-based hierarchical configuration system.
The performance of the Administration Utility has been improved.
Changed webhook URLs to only allow HTTPS.
Group memberships are also shown for user groups.
The repository URL is also shown on the signing policy detail page (if origin verification is enabled).
Added more explicit error messages when a Trusted Build System Link is missing in the Project configuration.
Move all secrets from the .env file to the respective secret files.
Switched to using Docker-Compose secrets.
SQL connection strings for the SignService databases are also encrypted by default.
Improved error messages in case of missing configuration values.
Cleaned up the Docker images.
Signing request reports now also include the user IDs of all submitters and approvers.
Added -Verbose flag for better debugging experience.
The -ClientCertificate parameter is now also supported in the Get-SignedArtifact command.
File handles are now closed correctly even if an error occurs.
Reverse proxies are now supported, recommended and enabled by default.
Artifact configurations now support user-defined parameters.
Fixed a bug that did not show the organization name on the invitation page.